JPH09319715A - Security control system for computer network - Google Patents

Abstract

PROBLEM TO BE SOLVED: To permit a part of users outside of a protection objective network to access to a server computer. SOLUTION: In a computer network composed the server computer and a client computer 2, a server process 1 and a security information file 4 are provided within the server computer. When an access request occurs from a client computer 2, then, an access monitoring means 3 obtains the address of the client computer 2, an access discriminating means 5 discriminates the propriety of the access based on this address and the file 4, and an access execution means 6 permits or rejects access from the client computer 2 based on this discriminating result.

Description

Detailed Description of the Invention

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer network security control system, and in particular, in a computer network system typified by the Internet or the like, client computers access resources and information of server computers distributed over the network. In the case of a computer network security control system.

[0001]

2. Description of the Related Art In a computer network system typified by the Internet or the like, a first conventional security control system when a client computer accesses information on server computers distributed on a network is constructed by a firewall or the like. By doing so, all access from outside the protected network was restricted.

A second conventional system is disclosed in Japanese Patent Laid-Open No.
As described in JP-A-214863, the access from the outside to the protected network is restricted by using the user information.

[0003]

However, the first security control system described above has a problem that access to the server computers of all users outside the protected network is unconditionally restricted.

The second security control system allows some users to access the server computer, but cannot be applied to a system that does not manage user information. was there.

Further, when this second security control system is applied to a large-scale computer network, the number of user information to be managed becomes enormous and the management becomes complicated.

An object of the present invention is to simplify the process of deciding whether or not to allow access to a server computer when a user outside the protected network is allowed to access the server computer.

Another object of the present invention is to allow access to the server computer to some users outside the protected network even in a computer network that does not manage user information. To do.

Still another object of the present invention is to enable or disable the access to the server computer based on the network address of the computer outside the protected network.

[0009]

According to a first aspect of the present invention, there is provided a computer network security control system, wherein when an access request is made from a client computer, the access permission is determined based on the identification information of the client computer. It has a server computer.

A second computer network security control system of the present invention is a computer network security control system for determining whether or not a client computer, to which a server computer belongs, does not have access to the server computer. Then, the server computer, when there is a request for access to the data from the client computer and a security information file storing security information indicating whether or not the client computer can access the data in the server computer, Obtaining the identification information of the client computer and reading the security information from the security information file, the identification information and the security And an access determination means for determining whether access from said client computer based on the information.

A third computer network security control system of the present invention is a computer network security control system for deciding whether or not a client computer, to which a server computer belongs, can access the server computer. Then, the server computer stores the security information that stores the server process means for providing the client computer with its own data and the security information indicating whether the data can be accessed from the client computer via the server process means. When there is a request for access to the file and the data from the client computer via the server process means, the client computer Reading the security information from the security information file with obtaining the identity of the over data, and an access judging means for judging whether the access from the client computer based on the identification information and the security information.

A fourth computer network security control system of the present invention is a computer network security control system for deciding whether or not a client computer, to which a server computer belongs, does not have access to the server computer. Then, the server computer stores the security information that stores the server process means for providing the client computer with its own data and the security information indicating whether the data can be accessed from the client computer via the server process means. When there is a request for access to the file and the data from the client computer via the server process means, the client computer Access monitoring means for obtaining identification information of the client computer, and when the identification information of the client computer is notified from the access monitoring means, the security information is read from the security information file and based on the identification information and the security information. When an access determination unit that determines whether access from the client computer is possible and a determination result of the access availability is notified from the access determination unit, the client computer transmits the determination result based on the determination result through the server process unit. And an access execution means for permitting or denying access to the data.

A fifth computer network security control system of the present invention is the fourth computer network security control system, wherein the security information in the security information file is a client computer which permits access to the server process means. Identification information of the client computer obtained by the access monitoring means includes the network address of the client computer, and the access determining means determines that the network address notified from the access monitoring means is the security information file. The access from the client computer is permitted only when the information is registered as security information in.

A sixth computer network security control system according to the present invention is the fourth computer network security control system, wherein the security information in the security information file is a client computer which refuses access to the server process means. Identification information of the client computer obtained by the access monitoring means includes the network address of the client computer, and the access determining means determines that the network address notified from the access monitoring means is the security information file. It is characterized in that the access from the client computer is permitted only when the client computer is not registered as security information.

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of a computer network security control system according to the present invention.

The present invention is a server process (service providing function of a server computer) 1 for providing resources and information.
And the client computer 2 provided with the service
Security information describing an access monitoring unit 3 that monitors access to the server process 1 by the client computer 2, and a network address (or Internet address) of the client computer 2 that permits or denies access to the server process 1. The file 4 and the access monitoring means 3 notify the network address of the client computer 2, read the security information from the security information file 4, and determine the access permission / non-permission of the client computer 2, and the access determination means 5. It comprises an access execution means 6 which is notified of the discrimination result from the means 5 and permits or denies the access of the client computer 2.

FIG. 2 is a flowchart showing the processing operation of the embodiment of the computer network security control system according to the present invention. The processing operation of the embodiment of the present invention will be described below with reference to FIG.

First, when the client computer 2 comes to access the server process 1 while the server process (service providing function of the server computer) 1 is providing resources and information, the access monitoring means 3 And obtains the network address of the client computer 2 (step 11). Here, the process number of the server process 1 is managed by the system, and the access of the client computer 2 is performed through the network function or the communication control driver, so that it can be easily recognized by the access monitoring means 3. Then, the access monitoring means 3 notifies the access determining means 5 of the access of the client computer 2, and passes the network address of the client computer 2.

The access judging means 5 reads the security information about the network address of the client computer 2 which permits or denies access to the server process 1 from the security information file 4 (step 12). Then, based on the information and the network address passed from the access monitoring means 3, it is determined whether the client computer 2 is permitted to access or not, and the result is notified to the access execution means 6 (step 13).

The access execution means 6 recognizes the discrimination result notified from the access discrimination means 5 (step 14),
Based on the information, the client computer 2 is permitted access (step 15) or is denied access (step 16).

Next, a DNS having a function of mapping a domain name representing each node and an internet address
A case where the present invention is applied to (Domain Name System) will be described.

FIG. 3 is a block diagram showing an embodiment of the present invention in this example.

That is, in the DNS, the above server computer corresponds to a name server that executes mapping of domain names and Internet addresses, and the above client computer corresponds to a resolver that accesses the name server.

The present invention comprises a name server 21 which provides host information and IP address information, a resolver 22 which is provided with the information, and an access monitoring means 23 which monitors access of the resolver 22 to the name server 21. A security information file 24 in which the IP address of the resolver 22 that permits or denies access to the name server 21 is described (can be specified by using a wild card), and the resolver 22 from the access monitor 23
Of the IP address of the resolver 22, the security information is read from the security information file 24, and the access determination means 2 for determining permission / non-permission of access of the resolver 22
5, and the access determination means 25 notifies the determination result,
An access execution unit 26 that permits or denies access to the resolver 22.

FIG. 4 is a flow chart showing the processing operation of an embodiment of the computer network security control system of the present invention. The processing operation of one embodiment of the present invention will be described below with reference to FIG.

First, the name server 21 determines host information and I
When the resolver (client computer) 22 comes to access the name server 21 while the P address information is being provided, the access monitoring means 23 recognizes it and obtains the IP address of the resolver 22 (step 31). Here, the process number of the name server 21 is managed by the system, and the access of the resolver 22 is performed through the network daemon or the TCP / IP communication control driver, so that it can be easily recognized by the access monitoring means 23. And the access monitoring means 2
3 notifies the access discriminating means 25 of the access of the resolver 22 and passes the IP address of the resolver 22.

Next, the access discriminating means 25 reads the security information regarding the IP address of the resolver 22 which permits or denies access to the name server 21 from the security information file 24 (step 3).
2). Then, based on the information and the IP address passed from the access monitoring means 23, it is determined whether the access of the resolver 22 is permitted or not, and the result is notified to the access execution means 26 (step 33).

The access execution means 26 recognizes the discrimination result notified from the access discrimination means 25 (step 3
4) Based on the information, access to the resolver 22 is permitted (step 35) or access is denied (step 36).

As described above, the processing of the computer network security control system according to the embodiment of the present invention is completed.

According to one embodiment of the present invention, whether or not to permit access to the server computer is determined based on the network address of the client computer in the security information file. When the user is allowed to access the server computer, the processing of determining whether or not the access can be performed can be simplified.

Further, instead of using the user information to determine whether to access the server computer, the determination is made based on the network address of the client computer in the security information file. Even in a computer network that does not manage the above, there is an effect that access to the server computer can be permitted to some users outside the protected network.

Further, by holding the network address of the client computer which permits or denies access to the server computer in the security information file, based on the network address of the computer outside the protected network,
This has an effect that it is possible to determine whether or not to access the server computer.

[0034]

As described above, the computer network security control system according to the present invention enables access to a server computer when a user outside the protected network is allowed to access the server computer. This has the effect of simplifying the process of determining the propriety.

Further, even in a computer network in which user information is not managed, it is possible to allow some users outside the protected network to access the server computer.

Further, there is an effect that it is possible to determine whether or not the server computer can be accessed based on the network address of the computer outside the protected network.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of one embodiment of the present invention.

FIG. 2 shows input data 1 in one embodiment of the present invention.
FIG. 2 is a diagram showing the relationship between a database file 20 and a data file 30;

FIG. 3 is a flowchart showing a process according to an embodiment of the present invention.

FIG. 4 shows input data 1 in one embodiment of the present invention.
FIG. 2 is a diagram showing the relationship among a database 0, a database 20, and a data file 30 by a specific example.

[Explanation of symbols]

 1 Server Process 2 Client Computer 3 Access Monitoring Means 4 Security Information File 5 Access Discrimination Means 6 Access Execution Means 21 Name Server 22 Resolver 23 Access Monitoring Means 24 Security Information File 25 Access Discrimination Means 26 Access Execution Means

Claims (6)

[Claims] 1. A security control system for a computer network, comprising a server computer that determines whether or not the access is possible based on the identification information of the client computer when the client computer requests the access. 2. A security control system for a computer network, which determines whether or not a client computer not belonging to a computer network to which the server computer belongs is allowed to access the server computer, wherein the server computer comprises the client computer A security information file storing security information indicating whether or not data in the server computer can be accessed, and the identification information of the client computer when the client computer requests access to the data and the security information file. Security information is read from the information file, and it is determined whether access from the client computer is possible based on the identification information and the security information. A security control system for a computer network, characterized in that the security control system further comprises separate access determining means. 3. A computer network security control system for deciding whether or not a client computer not belonging to a computer network to which the server computer belongs is permitted to access the server computer, wherein the server computer stores data owned by itself. Server process means provided to the client computer; a security information file storing security information indicating whether or not the client computer can access the data via the server process means; and the client computer from the server process means. When there is a request for access to the data via the above, the identification information of the client computer is obtained and Read security information, computer network security control system, characterized in that it comprises an access judging means for judging whether the access from the client computer based on the identification information and the security information. 4. A security control system of a computer network for deciding whether to permit access to a server computer to a client computer not belonging to the computer network to which the server computer belongs, wherein the server computer stores data owned by itself. Server process means provided to the client computer; a security information file storing security information indicating whether or not the client computer can access the data via the server process means; and the client computer from the server process means. Access monitoring means for obtaining identification information of the client computer when there is a request for access to the data via the access monitoring means, When the identification information of the client computer is notified from the security information file, the security information is read from the security information file, and the access determination unit determines whether or not the client computer can access the security information based on the identification information and the security information. And an access execution unit for permitting or denying access to the data from the client computer through the server process unit based on the determination result when the access determination unit notifies the access determination result. A computer network security control system characterized by the above. 5. The security information in the security information file includes a network address of a client computer permitted to access the server process means, and the identification information of the client computer acquired by the access monitoring means is the client computer. The access determination means permits access from the client computer only when the network address notified from the access monitoring means is registered as security information in the security information file. The computer network security control system according to claim 4. 6. The security information in the security information file includes a network address of a client computer that denies access to the server process means, and the identification information of the client computer obtained by the access monitoring means is the client computer. The access determining means permits the access from the client computer only when the network address notified from the access monitoring means is not registered as security information in the security information file. The computer network security control system according to claim 4.