JP4748487B2 - Server management system and method thereof - Google Patents

Description

  The present invention relates to a server management system and method for monitoring changes made to an application of an information system, etc., detecting irregular changes and release mistakes reliably and promptly, and supporting subsequent confirmation.

When releasing an application program to an important system such as a core system or changing an infrastructure setting, the following procedures are generally performed.
(1) The system development department develops the program to be changed (2) The system development department issues a release request form and obtains the approval of the system development department head (3) The system development department requests the program and release (4) The system operation management department tests the operation of the program in a test environment, and if there is no problem, submit a release application to the system operation management department manager for approval (5) There is a problem (6) The system operation management department releases the program to the production environment according to the release request and checks the operation. If there is no problem, the release history is updated. Unauthorized release by comparing the attributes of the program released to the system server with the previous time and this time Patent Document 1 discloses an apparatus, a method, and a check program for discovering.

  Referring to FIG. 8, the apparatus, method, and check program of Patent Document 1 are a basic system server 1 in which a monitoring target program 71 and a monitoring system 10 coexist, and a party terminal 3 that performs program release and management of the basic system server. And the mail distribution server 2 for notifying the person terminal 3 of the attribute comparison result by mail and the network 40 connecting them.

  When a program is released from the party terminal 3 to the backbone system server 1, the check program installed in the backbone system server 1 compares the attributes of the monitoring target program 71 before and after the release, and whether there is an irregular change. Check. If there is an irregular change, the mail delivery server 2 notifies the related person terminal 3 by mail.

  In Patent Documents 2 to 5, identification information such as a hash value corresponding to the configuration or content of a content such as a home page is generated at the time of registration or update of the content, and thereafter, the current configuration or content of the content is handled. A method of generating identification information such as a hash value and comparing the past and current identification information to detect and notify falsification of content is disclosed.

Patent Document 6 discloses a network monitoring system including a user client, a monitoring server, and a monitoring target system.
JP 2005-267341 A JP 2001-282619 A JP 2007-257348 A JP-A-2005-208814 JP 2003-140969 A Japanese Patent Application Laid-Open No. 2004-058033

  However, in the inventions described in Patent Documents 1 to 6 described above, simply by following the above procedure, changes made without following the normal procedure, so-called irregular changes, do not leave a release request form or release history. , It was difficult to recognize its existence, the discovery was delayed, and the subsequent confirmation was difficult.

  In the invention disclosed in Patent Document 1 and the like, in an environment in which the program can be changed via a plurality of networks, it is not known which network is changed, so an emergency release of the program is performed particularly when a failure occurs in the system. Sometimes problems are likely to arise.

  For example, even if it is a release by a system administrator, it is unclear whether the release is via a predetermined terminal and network, and it has been difficult to detect unauthorized changes to the program by a malicious person.

  Further, since the attribute information of the program is stored in plain text, there is a risk of information leakage, which may also lead to unauthorized modification of the program by a malicious person.

  The present invention has been made in view of the above, and even if an unauthorized release that does not leave a release request document or release history is made, the unauthorized release can be found and information can be prevented from leaking. It is an object of the present invention to provide a server management system and method capable of confirming after which network a change has been made when an unauthorized release is found by displaying network monitoring information.

  A server management system according to the present invention includes a monitoring target system having a plurality of servers, a monitoring system that monitors the presence or absence of an unauthorized release to the monitoring target program via a network, with the server program as a monitoring target program, and A server management system having a release management system that releases the management target program to the monitoring target system via the network, wherein the server locks the monitoring target program, and Attribute information is acquired, the attribute information is hashed / encrypted, network monitoring information including the IP address of the access source to the server is acquired, and the hash / encrypted attribute information and the network monitoring information are acquired An agent for transmitting the message to the monitoring system The monitoring system stores the hash / encrypted attribute information in a time series of the current acquisition and the previous acquisition, and stores the hash / encryption attribute information at the current time and the previous time. Determining whether the release is appropriate by comparing in series and outputting it as an attribute information comparison result, and storing the network monitoring information; receiving the attribute information comparison result and the network monitoring information from the manager; A view to be displayed, wherein the manager instructs the agent to release the lock of the monitored program when the release is appropriate.

  In the server management method according to the present invention, in the monitoring target system having a plurality of servers, the program of the server is set as the monitoring target program, and the monitoring system monitors whether there is an unauthorized release to the monitoring target program via the network. A server management method in which the release management system releases the management target program to the monitoring target system via the network, the procedure for locking the monitoring target program, and the attribute information of the monitoring target program , The procedure for hashing / encrypting the attribute information, the procedure for acquiring network monitoring information including the IP address of the access source to the server, the hash / encrypted attribute information and the network A procedure for transmitting monitoring information to the monitoring system; and A procedure in which the system stores the hash / encrypted attribute information in the time series of the current acquired and previous acquired information, and the monitoring system stores the hash / encrypted attribute information in the current time Comparing the time series with the previous time to determine whether the release is appropriate and outputting the attribute information comparison result, the procedure for the monitoring system to store the network monitoring information, and the monitoring system, Release of the lock of the monitoring target program when the release is determined to be appropriate in the procedure of displaying the attribute information comparison result and the network monitoring information, and the procedure in which the monitoring system outputs the attribute information comparison result And a procedure for instructing.

  As described above, according to the server management system and the method thereof according to the present invention, the attribute information is stored in the time series of the attribute information acquired this time and the previously acquired attribute information, and the hash / encrypted attribute information is stored. By comparing the chronological order of this time and the previous time, even if an unauthorized release that does not have a release request or release history is made, the unauthorized release can be found and the attribute information is hashed / encrypted By processing, it is possible to prevent information leakage, and by displaying network monitoring information, if an unauthorized release is found, it can be confirmed after which network the change was made There is an effect.

  Next, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a configuration diagram of a server management system according to the present embodiment. Referring to FIG. 1, the server management system according to the present embodiment changes a monitoring system 10 that monitors an unauthorized release, a monitored system 20 that is monitored for unauthorized changes, and a monitored program 71. The release management system 30 releases the program to the monitoring target system 20 and the network 40 connecting them.

  The monitoring target system 20 includes a plurality of servers 70, and a monitoring target program 71 whose attributes are monitored is included in the servers 70.

  The monitoring system 10 includes an agent 80 installed on each server 70 of the monitoring target system 20, a manager 50 on the network 40, and a view 60 connected to the manager 50.

  FIG. 2 is a configuration diagram describing the correspondence among the agent 80, the manager 50, and the view 60 provided in the server 70 in more detail.

  Referring to FIG. 2, the agent 80 includes an attribute information acquisition unit 82 that acquires attribute information of the monitoring target program 71, a hash / encryption processing unit 83 that performs hash / encryption processing of attribute information, and attribute information and access. An attribute information transmitting unit 84 that transmits network monitoring information including the original IP address to the manager 50, a monitoring target program lock / unlocking unit 81 that locks or unlocks the operation of the monitoring target program 71, and the network 40 And a network monitoring unit 85 that acquires network monitoring information.

  The manager 50 stores the attribute information of the monitored program 71 that has been hashed / encrypted in a time series of the current acquisition and the previous acquisition, and compares the attribute information in the time series between the current acquisition and the previous acquisition. It judges the suitability of release and outputs it as an attribute information comparison result.

  Specifically, the manager 50 receives the attribute information of the monitoring target program 71 from the agent 80 and records it in the current attribute information recording unit 55 and the previous attribute information recording unit 56 (described later), Attribute information comparison unit 53 that takes out attribute information recorded in attribute information recording unit 55 and previous attribute information recording unit 56, compares them to determine whether release is appropriate, and outputs the attribute information comparison result, and attribute information An attribute information comparison result output unit 54 that outputs the comparison result of the comparison unit 53 to the view 60, a network monitoring information reception unit 51 that receives network monitoring information from the agent 80 and records it in the network monitoring information recording unit 57, and an agent This time attribute information recording unit 55 for recording the latest attribute information acquired and transmitted by the agent 80 and the agent 8 It includes the previous attribute information recording unit 56 for recording the last attribute information but has been obtained and transmitted, and the network monitoring information recording unit 57 for recording the network monitoring information which the agent 80 has transmitted, the.

  The view 60 receives attribute information comparison results and network monitoring information from the manager and displays them. Specifically, the view 60 includes an attribute information comparison result receiving unit 61 that receives an attribute information comparison result that is information from the attribute information comparison result output unit 54 of the manager 50, and the system administrator knows the attribute information comparison result. An attribute information comparison result display unit 62 for easy display.

  The view 60 can display the network monitoring information recorded in the network monitoring information recording unit 57 when the system administrator investigates the monitoring target program 71 and the network monitoring information.

  The monitoring target program 71 may be a single program or a program composed of a plurality of programs. Alternatively, it may be a directory including a plurality of files.

  Here, the attribute information is information necessary for identifying each program and file, and specifically, the name, size, and update date (time stamp) of the file related to the monitoring target program 71. FIG. 3 is a diagram showing a specific example of the attribute information.

  The network monitoring information is information for identifying the network through which the monitoring target program 71 is changed. Specifically, the IP address of the access source and the server 70 are connected to the network 40 by a plurality of cables. When connected, the IP address of the server 70, and when using a VLAN (Virtual Local Area Network), a VLAN tag is included.

  Next, referring to the flowcharts of FIG. 4, FIG. 5 and FIG. 6, as the first embodiment according to the present invention, the operation when periodically acquiring the attribute information of the monitoring target program 71 will be described in detail. explain.

  In FIG. 4, when a change is made to the monitoring target program 71 by the release management system 30 (step A1), first, the network monitoring unit 85 of the agent 80 acquires network monitoring information and transmits it to the manager 50 (step A2). . The network monitoring information receiving unit 51 of the manager 50 records the network monitoring information received from the agent 80 in the network monitoring information recording unit 57 (step A3).

  On the other hand, in FIG. 5, the monitoring target program lock / unlock unit 81 of the agent 80 locks the monitoring target program 71 at a preset timing (periodic) (step B1), and the attribute information acquisition unit 82 sets the monitoring target program. 71 is acquired (step B2), is hashed / encrypted by the hash / encryption processing unit 83 (step B3), and is transmitted to the manager 50 through the attribute information transmission unit 84 (step B4).

When the attribute information receiving unit 52 of the manager 50 receives the hashed and encrypted program attribute information from the agent 80 (steps B5 and C1), the program attribute information is recorded in the following procedure shown in FIG. FIG. 6 is a flowchart when no release is performed between the previous comparison work and the current comparison work.
(1) When the attribute information receiving unit 52 newly receives attribute information that has been hashed / encrypted, the previous attribute information recording unit 56 deletes the information recorded in itself (step C2).
(2) The information recorded in the current attribute information recording unit 55 is moved to the previous attribute information recording unit 56 (step C3).
(3) The hashed / encrypted attribute information received from the agent 80 is recorded in the current attribute information recording unit 55 (step C4).

  The attribute information comparison unit 53 of the manager 50 extracts and compares the hashed attribute information from the current attribute information recording unit 55 and the previous attribute information recording unit 56 (step C5).

  If the two match, an attribute information comparison result of “no unauthorized release” is output (step C6).

  On the other hand, if the two do not match, the attribute information comparison result of “with irregular release” is output (step C8).

  If the output of the attribute information comparison result is “no unauthorized release”, the attribute information receiving unit 52 of the manager 50 determines that the release of the monitoring target program 71 is in the lock / unlock unit 81 of the agent 80, assuming that the release is appropriate. The lock release is instructed (step C7).

  If the output of the attribute information comparison result is “There is an irregular release”, the agent 80 keeps locking the monitoring target program 71 to preserve the environment. The system administrator checks the monitoring target program 71 and the network monitoring information, and if there is no problem, manually instructs the lock / unlock unit 81 of the agent 80 to release the lock via the manager 50.

  FIG. 7 is a flowchart when a release is performed between the previous comparison work and the current comparison work. In FIG. 7, the process up to step C4 is the same as the case where no release is performed between the previous comparison work and the current comparison work in FIG.

  In step C5 of FIG. 7, the attribute information hashed from the current attribute information recording unit 55 and the previous attribute information recording unit 56 are extracted and compared to extract the difference between them.

  If the difference between the two matches the release request document, the attribute information comparison result of “successful release” is output (step D6).

  If the difference between the two does not match the release request, the attribute information comparison result of “release failure” is output (step D8).

  When the output of the attribute information comparison result is “release successful”, the attribute information receiving unit 52 of the manager 50 determines that the release is appropriate, and the lock / unlock unit 81 of the agent 80 unlocks the monitoring target program 71. (Step C7).

  When the output of the attribute information comparison result is “release failure”, the agent 80 keeps locking the monitoring target program 71 to save the environment. The system administrator checks the monitoring target program 71 and the network monitoring information, and if there is no problem, manually instructs the lock / unlock unit 81 of the agent 80 to release the lock via the manager 50.

[Second Embodiment]
Next, a second embodiment according to the present invention will be described in detail with reference to the drawings. The configuration of the second embodiment according to the present invention is the same as that of the first embodiment described above. Hereinafter, referring to the flowcharts of FIGS. 4, 5, 6, and 7, as the second embodiment of the present invention, the operation when the attribute information of the monitoring target program 71 is acquired immediately before and immediately after the release. This will be described in detail.

  First, when the attribute information of the monitoring target program 71 is acquired immediately before the release, in FIG. 5, the lock / unlock unit 81 of the agent 80 locks the monitoring target program 71 (step B1), and the attribute information acquisition unit 82 Program attribute information of the monitoring target program 71 is acquired (step B2), hashed / encrypted by the hash / encryption processing unit 83 (step B3), and transmitted to the manager 50 through the attribute information transmitting unit 84 (step B4).

When the attribute information receiving unit 52 of the manager 50 receives the hashed and encrypted program attribute information from the agent 80 (steps B5 and C1), the program attribute information is recorded in the following procedure shown in FIG.
(1) When the attribute information receiving unit 52 newly receives attribute information that has been hashed / encrypted, the previous attribute information recording unit 56 deletes the information recorded in itself (step C2).
(2) The information recorded in the current attribute information recording unit 55 is moved to the previous attribute information recording unit 56 (step C3).
(3) The hashed / encrypted attribute information received from the agent 80 is recorded in the current attribute information recording unit 55 (step C4).

  The attribute information comparison unit 53 of the manager 50 extracts and compares the hashed attribute information from the current attribute information recording unit 55 and the previous attribute information recording unit 56 (step C5).

  If the attribute information matches, the attribute information comparison result of “no unauthorized release” is output (step C6). In this case, the attribute information receiving unit 52 of the manager 50 instructs the lock / unlock unit 81 of the agent 80 to unlock the monitoring target program 71 (step C7).

  On the other hand, if the attribute information does not match, the attribute information comparison result of “with irregular release” is output (step C8). In this case, the agent 80 keeps locking the monitoring target program 71 for environmental preservation. The system administrator checks the monitoring target program 71 and the network monitoring information, and if there is no problem, manually instructs the lock / unlock unit 81 of the agent 80 to release the lock via the manager 50.

  Further, when the attribute information of the monitoring target program 71 is acquired immediately after the release, when the monitoring target program 71 is changed by the release management system 30 in FIG. 4 (step A1), first, the network monitoring unit of the agent 80 85 acquires the network monitoring information and transmits it to the manager 50 (step A2). The network monitoring information receiving unit 51 of the manager 50 records the network monitoring information received from the agent 80 in the network monitoring information recording unit 57 (step A3).

  On the other hand, in FIG. 5, the monitoring target program lock / unlock unit 81 of the agent 80 locks the monitoring target program 71 (step B1), and the attribute information acquisition unit 82 acquires the program attribute information of the monitoring target program 71 (step B1). B2), the hash / encryption processing unit 83 performs hashing / encryption (step B3), and transmits it to the manager 50 through the attribute information transmission unit 84 (step B4).

When receiving the hashed and encrypted program attribute information from the agent 80 (steps B5 and C1), the attribute information receiving unit 52 of the manager 50 records the program attribute information according to the following procedure shown in FIG.
(1) The information recorded in the previous attribute information recording unit 56 is deleted (step C2).
(2) The information recorded in the current attribute information recording unit 55 is moved to the previous attribute information recording unit 56 (step C3).
(3) The hashed / encrypted attribute information received from the agent 80 is recorded in the current attribute information recording unit 55 (step C4).

  The attribute information comparison unit 53 of the manager 50 extracts and compares the hashed attribute information from the current attribute information recording unit 55 and the previous attribute information recording unit 56 (step C5).

  If the difference between the two matches the release request, the attribute information comparison result of “successful release” is output (step D6), and the attribute information receiving unit 52 of the manager 50 monitors the lock / unlock unit 81 of the agent 80. An instruction to unlock the target program 71 is given (step C7).

  If the difference between the two does not match the release request form, the attribute information comparison result of “release failed” is output (step D8), and the agent 80 keeps locking the monitoring target program 71 for environmental preservation. The system administrator checks the monitoring target program 71 and the network monitoring information, and if there is no problem, manually instructs the lock / unlock unit 81 of the agent 80 to release the lock via the manager 50.

  The present invention is a core business system that often has a plurality of network connections such as data communication, other system cooperation, and operation management. It can be applied to applications such as stable system operation and improved security. In addition, if the monitoring target system 20 is an information system related to financial reporting, it can also be applied to uses such as “securing the total number of change operations (population)” that is noticed in the audit of internal control (IT general control).

It is a block diagram of the server management system which concerns on this Embodiment. It is a block diagram describing in more detail the correspondence between agents, managers, and views provided in a server. It is a figure which shows the specific example of attribute information. It is a flowchart which shows the operation | movement of this Embodiment. It is a flowchart which shows the operation | movement of this Embodiment. It is a flowchart which shows the operation | movement of this Embodiment. It is a flowchart which shows the operation | movement of this Embodiment. It is a block diagram of the server management system which concerns on a prior art.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Core system server 2 Mail delivery server 3 Party terminal 10 Monitoring system 20 Monitoring target system 30 Release management system 40 Network 50 Manager 51 Network monitoring information receiving part 52 Attribute information receiving part 53 Attribute information comparison part 54 Attribute information comparison result output part 55 Current attribute information recording unit 56 Previous attribute information recording unit 57 Network monitoring information recording unit 60 View 61 Attribute information comparison result receiving unit 62 Attribute information comparison result display unit 70 Server 71 Monitored program 80 Agent 81 Monitored program lock / unlock Unit 82 attribute information acquisition unit 83 hash / encryption processing unit 84 attribute information transmission unit 85 network monitoring unit

Claims (13)

A monitoring target system having a plurality of servers, a monitoring system that monitors the presence or absence of an unauthorized release to the monitoring target program via a network, and a monitoring system that monitors the presence or absence of an unauthorized release to the monitoring target program via the network A server management system having a release management system that releases the managed program to the system,
The server locks the monitoring target program, acquires attribute information of the monitoring target program, performs hash / encryption processing on the attribute information, and acquires network monitoring information including an IP address of an access source to the server And an agent that transmits the hash / encrypted attribute information and the network monitoring information to the monitoring system,
The monitoring system includes:
Saving the hash / encrypted attribute information in the time series of the current and previous acquired attribute information, and comparing the hash / encrypted attribute information in the current and previous time series To determine whether the release is appropriate and to output as attribute information comparison results, and to store the network monitoring information,
A view for receiving and displaying the attribute information comparison result and the network monitoring information from the manager;
With
The manager instructs the agent to release the lock of the monitoring target program when the release is appropriate.   The server management system according to claim 1, wherein the attribute information includes a name, a size, and a time stamp of a file related to the monitoring target program.   The network monitoring information includes an IP address of the server when the server is connected to the network with a plurality of cables, and a VLAN tag when a VLAN (Virtual Local Area Network) is used. The server management system according to claim 1, comprising: a server management system according to claim 1. The agent
An attribute information acquisition unit for acquiring the attribute information;
A hash / encryption processing unit for performing hash / encryption processing of the attribute information;
An attribute information transmitting unit for transmitting the hash / encrypted attribute information and the network monitoring information to the manager;
A monitored program lock / unlock unit that locks or unlocks the operation of the monitored program; and
A network monitoring unit that monitors the network and obtains the network monitoring information;
The server management system according to any one of claims 1 to 3, further comprising: The manager
An attribute information receiving unit that receives the hash / encrypted attribute information from the agent;
A current attribute information recording unit for recording the currently acquired attribute information that has been hashed / encrypted;
A previous attribute information recording unit that records the previously acquired attribute information that has been hashed / encrypted;
A network monitoring information receiving unit for receiving the network monitoring information from the agent;
A network monitoring information recording unit for recording the network monitoring information received by the network monitoring information receiving unit;
Take out the hash / encrypted attribute information recorded in the current attribute information recording unit and the previous attribute information recording unit, determine the suitability of the release by comparing them, and output as the attribute information comparison result An attribute information comparison unit,
An attribute information comparison result output unit for outputting the attribute information comparison result to the view;
With
When the attribute information receiving unit newly receives the hash / encrypted attribute information, the previous attribute information recording unit deletes the information recorded in itself,
When the attribute information receiving unit newly receives the hash / encrypted attribute information, the current attribute information recording unit moves the information recorded in the attribute information recording unit to the previous attribute information recording unit, and the attribute 5. The server management system according to claim 1, wherein the information receiving unit records the hash / encrypted attribute information newly received by the information receiving unit. The attribute information comparison unit extracts the hash / encrypted attribute information recorded in the current attribute information recording unit and the previous attribute information recording unit, compares the both, and if both match, the release Output the attribute information comparison result of “No unauthorized release”
6. If the two are compared and the two do not match, the suitability of the release is determined by outputting the attribute information comparison result of “Unauthorized release”. The server management system described in the section. The attribute information comparison unit takes out the hash / encrypted attribute information recorded in the current attribute information recording unit and the previous attribute information recording unit, compares both, and extracts the difference between the two, When the difference and the content of the release request form match, the attribute information comparison result of “successful release” is output, assuming that the release is appropriate,
6. The determination as to whether the release is appropriate or not by outputting an attribute information comparison result of “release failure” when the difference does not match the content of the release request form. The server management system according to item 1. In the monitoring target system having a plurality of servers, the server program is set as a monitoring target program, the monitoring system monitors whether there is an unauthorized release to the monitoring target program via the network, and the release management system via the network A server management method for releasing the management target program to the monitoring target system,
A procedure for locking the monitored program;
A procedure for acquiring attribute information of the monitoring target program and hashing / encrypting the attribute information;
Obtaining network monitoring information including an IP address of an access source to the server;
Transmitting the hash / encrypted attribute information and the network monitoring information to the monitoring system;
A procedure in which the monitoring system stores the hash / encrypted attribute information in a time series of what has been acquired this time and what has been previously acquired;
The monitoring system determines the suitability of the release by comparing the hash / encrypted attribute information in this time series with the previous time series, and outputs an attribute information comparison result;
A procedure for the monitoring system to store the network monitoring information;
A procedure in which the monitoring system displays the attribute information comparison result and the network monitoring information;
A procedure for instructing release of the lock of the monitoring target program when the monitoring system determines that the release is appropriate in the procedure of outputting the attribute information comparison result;
A server management method comprising the steps of:   9. The server management method according to claim 8, wherein the attribute information includes a name, a size, and a time stamp of a file related to the monitoring target program.   The network monitoring information includes an IP address of the server when the server is connected to the network with a plurality of cables, and a VLAN tag when a VLAN (Virtual Local Area Network) is used. The server management method according to claim 8, further comprising: The procedure for storing the hash / encrypted attribute information in chronological order of the one acquired this time and the one acquired last time is as follows:
When the monitoring system newly receives the attribute information subjected to the hash / encryption processing, the information recorded as the previously acquired information is deleted, and the information recorded as the current acquired information is previously acquired. The server management method according to claim 8, wherein the server management method further records the newly received attribute information subjected to the hash / encryption processing as acquired this time. .   The procedure for outputting the attribute information comparison result is as follows. When the hash / encrypted attribute information is compared in time series between the current time and the previous time and the two match, the release is appropriate. When the attribute information comparison result of “no unauthorized release” is output and the two are compared, and the two do not match, the attribute information comparison result of “with irregular release” is output to determine whether the release is appropriate The server management method according to claim 8, wherein the server management method is a server management method. The procedure for outputting the attribute information comparison result includes comparing the hashed / encrypted attribute information in a time series between the current time and the previous time, and extracting the difference between the two and the contents of the release request document. If it matches, output the attribute information comparison result of “successful release”, assuming that the release is appropriate,
The determination as to whether the release is appropriate or not is made by outputting an attribute information comparison result of "release failure" when the difference does not match the content of the release request form. 2. The server management method according to item 1.