JP2000259521A - System and device for managing network security rule - Google Patents

Abstract

PROBLEM TO BE SOLVED: To appropriately set rule information in a short time. SOLUTION: Firewall devices 3-1 and 3-2 and a network security rule managing device 2 are respectively provided with common rule information storage parts 4, 6-1 and 6-2 for storing common rule information common for all the firewall devices 3-1 and 3-2 and individual rule information storage parts 5, 7-1 and 7-2 for storing individual rule information peculiar to the respective firewall devices 3-1 and 3-1. Then, the network security rule managing device 2 transfers the common rule information stored in the common rule information storage part 4 provided thereon to the common rule information storage parts 6-1 and 6-2 and transfers the individual rule information stored in the individual rule information storage part 5 provided thereon to the relevant firewall devices 3-1 and 3-2 on the other hand.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a network security rule management system and a network security rule management device for realizing security in a network.

[0002]

2. Description of the Related Art Conventionally, a security device has been introduced in a network for the purpose of preventing leakage or destruction of information. As this security device, a firewall device is known, and the firewall device is installed at a connection point of a network site in a network. Here, the network site is a group of computers, such as a server computer and a client computer, which are installed corresponding to the head office and each branch office of the company.

[0003] The above-mentioned firewall device controls passing / non-passing of information to be transmitted according to characteristics such as whether a network site at a connection point to be installed is a head office or a branch office. In this case, it is necessary to set network security rule information (hereinafter, rule information) for determining which information is passed or not passed.

[0004]

Conventionally, a maintenance person or the like goes to a place where the firewall device is installed and sets the above rule information. For this reason, there has been a problem that appropriate rule information cannot be set due to an input error at the time of setting, or a large amount of time is required for setting.

[0005] The present invention has been made in view of the above-described problems of the conventional network security, and has as its object to appropriately set rule information.
An object of the present invention is to provide a network security rule management system and a network security rule management device capable of reducing the time required for setting.

[0006]

A network security rule management system according to the present invention is provided in a network, and controls a passage / non-passage of information transmitted through the network. A network security rule management apparatus for providing network security rule information for determining whether information is passed or not passed through the network, wherein the security apparatus and the network security rule management apparatus are provided. Includes a common rule information storage unit that stores common rule information common to all security devices, and an individual rule information storage unit that stores individual rule information unique to each security device. Said The network security rule management device transfers the common rule information stored in the common rule information storage unit provided in the own device to the common rule information storage units provided in all the security devices, while the The individual rule information stored in the stored individual rule information storage unit is transferred to the individual rule information storage unit provided in the corresponding security device. As a result, the rule information can be created and edited by dividing it into common rule information and individual rule information, and can be distributed by transfer, so that it is not necessary to go to the place where each individual security device is installed.

A network security rule management device according to the present invention provides a security device that is provided in a network and controls the passage / non-passage of information transmitted through the network, and determines whether the information is passed or non-passed. A network security rule management device for providing network security rule information for determining, wherein the network security rule management device includes a common rule information storage unit that stores common rule information common to all security devices, An individual rule information storage unit for storing individual rule information unique to the device, and the common rule information stored in the common rule information storage unit provided in the own device is transferred to all the security devices, and provided in the own device. Stored in the individual rule information storage unit Characterized by comprising a means for transferring individual rule information corresponding to the security device. As a result, the rule information can be created and edited by dividing the rule information into the common rule information and the individual rule information, can be distributed by transfer, and it is not necessary to go to the place where each individual security device is installed.

In the network security rule management device, when each rule information is updated, update time information indicating the time is set, and when each rule information is transferred, transfer time information indicating the time is set. The transfer means detects the rule information to be transferred based on the update information and the transfer information and performs the transfer. As a result, only the untransferred rule information that has been updated is transferred and distributed, and unnecessary distribution is not performed.

Further, the network security rule management device is provided with an update rule information storage section for storing each rule information when the rule information is updated, and means for transferring the updated rule information in the update rule information storage section. The transfer is performed by detecting the storage. Thereby, only the updated rule information is transferred and distributed, and no unnecessary distribution is performed.

[0010] The network security rule management device is provided with an update rule information storage section for storing when each rule information is updated, and when each rule information is updated, update time information indicating the time is set. When the transfer of each rule information is performed, transfer time information indicating the time is set, and the transfer means detects the rule information to be transferred based on the update time information and the transfer time information, and detects the update rule information. The transfer of the corresponding rule information stored in the storage unit is performed. Thereby, only the updated rule information is transferred and distributed, and no unnecessary distribution is performed.

Further, in the network security rule management device, the network security rule management device is provided with a backup storage unit for storing the transferred rule information when each rule information is transferred, and the transferring means includes a transfer rule. Information is stored in the backup storage unit. As a result, the transferred rule information is backed up, and it is possible to prepare for a transfer failure or the like.

[0012]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A network security rule management system and a network security rule management device according to an embodiment of the present invention will be described below with reference to the accompanying drawings. In each drawing, the same components are denoted by the same reference numerals, and redundant description will be omitted. FIG. 1 shows a network security rule management system and a network security rule management device according to an embodiment of the present invention. In FIG. 1, an NSR management device (network security rule management device) 2 is connected to a network 1, and firewall devices 3-1 and 3-2 as security devices are connected.

The NSR management device 2 has a common rule information storage unit 4 for storing common rule information common to all firewall devices, and an individual rule information storage unit 5 for storing individual rule information unique to each firewall device. Provided. In addition, the firewall devices 3-1 and 3
-2, common rule information storage units 6-1 and 6-2 for storing common rule information common to all firewall devices, and individual rule information storage for storing individual rule information unique to the firewall device. Part 7-
1, 7-2 are provided. Firewall equipment 3
-1 and 3-2 are set at the connection points between the network 1 and the network sites 8-1 and 8-2 as described above, and the network 1 and the network sites 8-1 and 8-2 are set.
-2, passing / non-passing is controlled for information transmitted between -2. This control includes a common rule information storage unit 6-1,
6-2 and the rule information stored in the individual rule information storage units 7-1 and 7-2 are used. The common rule information storage units and the individual rule information storage units do not necessarily need to be physically separated.

The common rule information common to all the firewall devices includes “file transfer protocol (ft)
p) does not pass "," passes packets for a specific common server ", and the like, and individual rule information unique to each firewall device includes network sites 8-1, 8-2. , The network address of the server computer group and the client computer group included in the server, or rule information such as regulation of outgoing and incoming calls to a specific computer.

The NSR management device 2 has an editing / storage means 2
a, management information storage means 2b, and distribution means 2c. The editing / storage means 2a edits the rule information and stores it as a file in the common rule information storage unit 4 and the individual rule information storage unit 5. The management information storage unit 2b is a table that stores information such as the location (storage address, directory, etc.) of rule information, the last update date and time of rule information, and the last distribution date and time of rule information. The distribution means 2c extracts the rule information from the common rule information storage unit 4 and the individual rule information storage unit 5 when necessary, distributes the rule information to the firewall devices 3-1 and 3-2, and outputs the rule information to the firewall devices 3-1 and 3-2. -2 provided to the common rule information storage units 6-1 and 6-2 and the individual rule information storage units 7-1 and 7-2.

The NSR management device 2 including the common rule information storage unit 4 and the individual rule information storage unit 5 does not necessarily need to include all components, but is configured as shown in FIG. 2, for example. That is, the configuration is such that the CPU 10 controls each unit using the programs and data stored in the main memory 11 and performs data processing.

The CPU 10 has a keyboard control unit 13, a display control unit 14, a mouse control unit 15,
The printer controller 16, the magnetic disk controller 17, and the communication interface 18 are connected. A keyboard input device 19 is connected to the keyboard control unit 13, and an operator of each node can input information using the keyboard input device 19. A CRT display device 20 having, for example, a CRT is connected to the display control unit 14 so that necessary information is displayed. A mouse 21 as a pointing device is connected to the mouse control unit 15 so that position information can be input when necessary.

The printer controller 16 includes a printer 22
Is connected, and information can be printed out. A magnetic disk device 23 is connected to the magnetic disk control unit 17, and programs and data are stored in the magnetic disk device 23, and read and written by the CPU 10 as needed. A communication processing unit 24 is connected to the communication interface 18 so that data can be transmitted / received to / from the network 1.

The management information storage means 2b shown in FIG. 1 is provided in the main memory 11 as a memory table, for example.
The common rule information storage unit 4 and the individual rule information storage unit 5
This corresponds to the magnetic disk device 23. The editing / storage means 2a and the distribution means 2c shown in FIG. 1 are realized by the CPU 10 executing a program in the main memory 11. In addition, the firewall devices 3-1 and 3-2
For example, in the configuration shown in FIG. A configuration for performing control is provided.

The management information storage means 2b shown in FIG.
Memory tables M1 and M2 as shown in FIG. 3 are included. The memory table M1 is a table in which the location (path name) of a file of the common rule information (common rule file) is stored. The memory table M2 is a file of the individual rule information for each of the firewall devices 3-1 and 3-2. 6 is a table in which the locations (path names) of (individual rule files) are stored. Here, the security system names of the firewall devices 3-1 and 3-2 are respectively referred to as security system A and security system B.
There is.

In the system configured as described above, as described above, the CPU 10 executes the program as shown in FIG. Since the means 2c is realized, a description will be given below. The CPU 10 monitors whether an instruction to update the common rule file has been input (S1). The input of the update instruction is performed using, for example, the keyboard input device 19.

In the above, when an update instruction is input, a common rule file is read from the common rule information storage unit 4 onto the main memory 11 with reference to the information in the memory table M1 (S2). Of course, initially, the common rule file does not include the common rule information. Then, it is accepted that the operator edits (including new creation) the common rule file using the keyboard input device 19 (S
3) When the editing is completed, the resulting file is stored in the original location of the common rule information storage unit 4 (S4).

The CPU 10 monitors whether an instruction to update the individual rule file has been input (S5). Here, when an update instruction is input, the memory table M
The location of the specified individual rule file is obtained by referring to the information of item 2, and the relevant individual rule file is read from the individual rule information storage unit 5 onto the main memory 11 (S6).
Of course, initially, the individual rule file does not include the individual rule information. Then, it is accepted that the individual rule file is edited (including new creation) by the operator using the keyboard input device 19 (S7), and when the editing is completed, the resulting file is stored in the individual rule information storage unit 5 at the original location. (S8).

The CPU 10 monitors whether an instruction to distribute a rule file has been input (S9). This instruction is performed, for example, directly using the keyboard input device 19 or indirectly by setting a timer. Here, when a file distribution instruction is input, the location of the file is obtained by referring to the corresponding information in the memory tables M1 and M2, and the firewall device 3
The file is transmitted to the corresponding device of 1, 3-2 (S1
0).

The firewall devices 3-1 and 3-2 include:
When the common rule file is distributed, it is stored in the common rule information storage units 6-1 and 6-2, and when the individual rule file is distributed, the individual rule information storage unit 7-1 that stores this is stored. 7-2.

Since the common rule information and the individual rule information are separately managed as described above, it is only necessary to input the common rule information in the NSR management device 2, and the input work conventionally performed for each firewall device is performed. Input errors can be reduced. In addition, since the common rule information and the individual rule information are managed separately, it is possible to edit the necessary rule information,
It is efficient.

Next, a first modification of the system and apparatus shown in FIG. 1 will be described. In this modification, a management information storage unit 2b-1 shown in FIG. 5 is provided in place of the management information storage unit 2b provided in the NSR management device 2, and the management information storage unit 2b-1 has the configuration shown in FIG. As shown, memory tables M1-1, M2-1, and M3-1 are included. The memory table M1-1 stores the location (path name) of the common rule information file (common rule file).
In addition, the memory table M2-1 stores the last update date and time of the common rule file. The memory table M2-1 stores the location (path) of the file (individual rule file) of the individual rule information for each of the firewall devices 3-1 and 3-2. Is a table in which the last update date and time of each individual rule file are stored together with the name of the individual rule file. Further, the memory table M
3-1 is a table in which the last distribution date and time when the file was distributed is stored.

In this system, similarly to the system shown in FIG. 1, the CPU 10 executes a program corresponding to the flowchart shown in FIG. At this time, when updating including new creation of a rule file, the memory table M
1-1, the last update date and time is stored in a corresponding column of the memory table M2-1. Then, instead of the processing at the time of distribution in steps S9 and S10, the CPU 10 executes a program corresponding to the flowchart shown in FIG.

The CPU 10 compares the last update date and time stored in the memory table M1-1 relating to the common rule file with the last distribution date and time stored in the memory table M3-1 (S11). It is detected whether it is later (S12). Here, if it is detected that the last update date and time is later than the last distribution date and time, the updated file is not distributed, so the common rule file is taken out from the common rule information storage unit 4 and the firewall device 3 -1, 3-2 (S13). Next, the number N of the individual rule file (N = 1 is a file corresponding to the firewall device 3-1 and N = 2 is a file corresponding to the firewall device 3-2) is set to “1” (S14). The N
The last update date and time stored in the memory table M2-1 for the (= 1) individual rule file is compared with the last distribution date and time stored in the memory table M3-1 (S1).
5) It is detected whether the last update date is later than the last distribution date (S16).

Here, when it is detected that the last update date and time is later than the last distribution date and time, since the updated file has not been distributed, the individual rule information storage unit 5
Then, the individual rule file corresponding to the firewall device 3-1 is taken out from the server, and the file is transmitted to the firewall device 3-1 (S17). Next, N is increased by “1”, and the number N of the individual rule file is set to “2” (S
18), it is detected whether or not the N (= 2) individual rule files exist (S19). Because it exists here, N
The last update date and time stored in the memory table M2-1 for the (= 2) individual rule file is compared with the last distribution date and time stored in the memory table M3-1 (S1).
5) It is detected whether the last update date is later than the last distribution date (S16).

Here, when it is detected that the last update date and time is later than the last distribution date and time, since the updated file has not been distributed, the individual rule information storage unit 5
Then, the individual rule file corresponding to the firewall device 3-2 is taken out from the server, and the file is transmitted to the firewall device 3-2 (S17). Next, N is increased by “1”, and the number N of the individual rule file is set to “3” (S
18) It is detected whether or not the N (= 3) individual rule files exist (S19). Here, since the firewall device 3-3 does not exist and the corresponding individual rule file does not exist, the last distribution date and time of the memory table M3-1 is updated according to the current date and time (S20), and the process ends.

According to the first modification, only the file of the updated rule information is distributed, so that the data transfer can be performed without waste. In this modification, the file has one final distribution date and time in common. However, distribution management may be performed by giving the final distribution date and time of the file corresponding to the file.

Next, a second modification of the system and apparatus shown in FIG. 1 will be described. As shown in FIG. 8, the NSR management device 2 of this modified example is provided with an update rule information storage unit 9 that stores when each rule information is updated. The update rule information storage unit 9 does not need to be physically separated from other storage units. In the system according to this modification, a management information storage unit 2b-2 shown in FIG. 6 is provided instead of the management information storage unit 2b provided in the NSR management device 2, and the management information storage unit 2b
-2, as shown in FIG.
-2 and M2-2.

The memory table M1-2 stores the location (path name) of the common rule information file (common rule file).
In addition, the storage destination of the updated file of the common rule file (for example, the directory in the update rule information storage unit 9) is a table, and the memory table M2-2 is stored in each firewall device 3-
The location (path name) of the individual rule information file (individual rule file) for each of the individual rule files 1 and 3-2 and the storage location of the updated file of each individual rule file (for example,
This is a table in which a directory in the update rule information storage unit 9 is stored.

In this system, as in the system shown in FIG. 1, the CPU 10 executes a program corresponding to the flowchart shown in FIG. At this time, when updating including new creation of a rule file, the memory table M
1-2, the storage destination in the update rule information storage unit 9 is stored in a corresponding column of the memory table M2-2. And
Instead of the processing at the time of distribution in steps S9 and S10, the CPU 10 executes a program corresponding to the flowchart shown in FIG.

The CPU 10 detects whether the storage destination is stored in the memory table M1-2 relating to the common rule file (S21), and determines whether the storage destination is stored (S22). Here, when the storage destination is stored, the common rule file relating to the update is extracted from the update rule information storage unit 9 based on the storage destination, and the file is transmitted to the firewall devices 3-1 and 3-2. The common rule file related to the update is stored in the common rule information storage unit 4, and the storage destination stored in the memory table M1-2 is deleted (S23). Next, the number N of the individual rule file (N = 1 is a file corresponding to the firewall device 3-1 and N = 2 is a file corresponding to the firewall device 3-2) is set to “1” (S14). It is detected whether the storage destination is stored in the memory table M2-2 relating to the N (= 1) individual rule file (S
25), it is determined whether the information of the storage destination is stored (S26).

Here, when it is detected that the storage destination is stored, the corresponding individual rule file relating to the update is retrieved from the update rule information storage unit 9 based on the storage destination, and the file is transmitted to the firewall device 3-1. And stores the individual rule file relating to the update in the individual rule information storage unit 5.
And the storage destination stored in the memory table M2-2 is deleted (S27). Next, N is increased by “1”, and the number N of the individual rule file is set to “2” (S
28), it is detected whether or not the N (= 2) individual rule files exist (S29). Because it exists here, N
It is detected whether the storage destination is stored in the memory table M2-2 relating to the individual rule file of (= 2) (S2).
5), it is determined whether the storage destination is stored (S2)
6).

Here, when it is detected that the storage destination is stored, the relevant individual rule file relating to the update is retrieved from the update rule information storage unit 9 based on the storage destination, and the file is transmitted to the firewall apparatus 3-2. And stores the individual rule file relating to the update in the individual rule information storage unit 5.
And the storage destination stored in the memory table M2-2 is deleted (S27). Next, N is increased by “1”, and the number N of the individual rule file is set to “3” (S
28), it is detected whether or not the N (= 3) individual rule files exist (S29). Here, since the firewall device 3-3 does not exist and the corresponding individual rule file does not exist, the process ends. As described above, according to the second modified example, when the file of the rule information is updated, the storage destination is stored. Since the storage location is detected and the file is distributed, only the file is distributed. Thus, data transfer without waste can be performed.

Next, a third modification of the system and apparatus shown in FIG. 1 will be described. As shown in FIG. 8, the NSR management device 2 of this modification is provided with an update rule information storage unit 9 for storing each rule information when it is updated, in the same manner as the second modification. It has a configuration. The update rule information storage unit 9 does not need to be physically separated from other storage units. Further, in the system according to this modification, the management information storage means 2b shown in FIG.
-3, and the management information storage means 2b-3 includes
As shown in FIG. 10, the memory tables M1-3, M1
2-3 and M3-3 are included.

The memory table M1-3 stores the location (path name) of the common rule information file (common rule file).
In addition, it is a table storing the last update date and time of the common rule file and the storage location of the updated file of the common rule file (for example, a directory in the update rule information storage unit 9), and a memory table M2-3. Are the respective firewall devices 3-1, 3-2
Of the individual rule information file (individual rule file) (path name), the last update date and time of each individual rule file, and the storage location of the updated file of each individual rule file (for example, an update rule information storage unit). 9) is a table in which is stored. Further, the memory table M3-3 is a table in which the last distribution date and time when the file was distributed is stored.

In this system, as in the system shown in FIG. 1, the CPU 10 executes a program corresponding to the flowchart shown in FIG. At this time, at the time of the update process including the new creation of the rule file, the last update date and time and the storage destination in the update rule information storage unit 9 are stored in the corresponding columns of the memory tables M1-3 and M2-3. Then, instead of the processing at the time of distribution in steps S9 and S10, the CPU 10 executes a program corresponding to the flowchart shown in FIG.

The CPU 10 compares the last update date and time stored in the memory table M1-3 relating to the common rule file with the last distribution date and time stored in the memory table M3-3 (S11). It is detected whether it is later (S12). Here, if it is detected that the last update date and time is later than the last distribution date and time, since the updated file has not been distributed, the common rule file is stored in the update rule information storage unit 9 based on the update file name. Removal, firewall device 3-
1 and 3-2, and a common rule file relating to the update is stored in the common rule information storage unit 4,
The storage destination stored in the memory table M1-3 is deleted (S23). Next, the number N of the individual rule file
(N = 1 is a file corresponding to the firewall device 3-1 and N = 2 is a file corresponding to the firewall device 3-2.) Is set to “1” (S14), and the N (=
Memory table M2 for individual rule file of 1)
-3 and the last update date and time stored in the memory table M
The last distribution date and time stored in 3-3 are compared (S1).
5) It is detected whether the last update date is later than the last distribution date (S16).

Here, if it is detected that the last update date is later than the last distribution date, the updated file is not distributed, so that the update rule information storage unit 9 sends the updated file to the firewall based on the update file name. Device 3-
1 and sends the file to the firewall device 3-1 and stores the updated individual rule file in the individual rule information storage unit 5, and stores the file in the memory table M2-3. The destination is deleted (S27). Next, N is increased by “1”, and the number N of the individual rule file is set to “2” (S1
8) It is detected whether or not the N (= 2) individual rule files exist (S19). Because it exists here, N
The last update date and time stored in the memory table M2-3 for the (= 2) individual rule file is compared with the last distribution date and time stored in the memory table M3-3 (S1).
5) It is detected whether the last update date is later than the last distribution date (S16).

If it is detected that the last update date and time is later than the last distribution date and time, the updated file has not been distributed. Device 3-
2 and sends the file to the firewall device 3-2, stores the updated individual rule file in the individual rule information storage unit 5, and stores it in the memory table M2-3. The destination is deleted (S27).

Next, N is incremented by "1", and the number N of the individual rule file is set to "3" (S18).
It is detected whether or not the (= 3) individual rule file exists (S19). Here, since the firewall device 3-3 does not exist and the corresponding individual rule file does not exist, the last distribution date and time of the memory table M3-3 is updated according to the current date and time (S20), and the process ends.

According to the third modification, only the file of the updated rule information is distributed, so that the data transfer can be performed without waste. In this modification, the file has one final distribution date and time in common. However, distribution management may be performed by giving the final distribution date and time of the file corresponding to the file.

Next, a fourth modification of the system and apparatus shown in FIG. 1 will be described. As shown in FIG. 13, the NSR management device 2 of this modification includes a backup storage unit 9A that stores a backup file when each rule information is distributed, in addition to the configuration shown in FIG. . In the system according to this modification, the NSR
Management information storage means 2b of FIG.
Management information storage means 2b shown in FIG.
4, the management information storage means 2b-3 has memory tables M1-3, M2 as shown in FIG.
-3 and M3-4. Memory table M1-
3. The storage contents in M2-3 are equal to those in the third modification. The memory table M3-4 stores the file name of the backup file together with the last distribution date and time when the file was distributed. In consideration of the nature of the backup file created each time the backup file is created, a serial number, a date, a distinction between a common rule file and an individual rule file, and the like are set as additional information (see FIG. 11). Things are numbered sequentially).

In this modified example, the operation corresponding to the flowchart shown in FIG. 14 which is substantially the same as that of the third modified example is basically executed. However, what is different from the third modification is that steps S23A and S27 are different from the flowchart of FIG.
A is that the backup file is stored in the backup storage unit 9A in A, and the file name of the backup file is stored in the memory table M3-4 together with the last distribution date and time when the file was distributed.

According to the fourth modified example, since a file related to distribution is backed up, if the distribution is not properly executed, the file name of the memory table M3-4 and its additional information are deleted. Based on this, processing after a lapse of time, such as retrieving the corresponding file from the backup storage unit 9A and distributing it again, is enabled. Note that the configuration of the modified example relating to the backup can be applied to the second modified example. Further, in each example including the embodiment shown in FIG. 1, the number of the firewall devices is two, but it goes without saying that the number of the firewall devices can be three or more depending on the system configuration.

[0050]

As described above, according to the network security rule management system and the network security rule management apparatus according to the present invention, the rule information is divided into common rule information and individual rule information, and is created, edited, and distributed by transfer. Since it is performed, it is not necessary to go to the place where each individual security device is installed, the rule information can be set appropriately, and the time required for setting can be reduced.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a network security rule management system and its device according to an embodiment of the present invention.

FIG. 2 is a block diagram of the network security rule management device according to the embodiment of the present invention.

FIG. 3 is a diagram showing the contents of a management information storage means employed in the network security rule management system and the device according to the embodiment of the present invention.

FIG. 4 is a flowchart showing the operation of the network security rule management system and its device according to the embodiment of the present invention.

FIG. 5 is a diagram showing the contents of a management information storage unit employed in a network security rule management system and a first modification of the device according to the embodiment of the present invention;

FIG. 6 is a diagram showing the contents of a management information storage unit employed in a network security rule management system and a second modification of the device according to the embodiment of the present invention.

FIG. 7 is a flowchart showing the operation of a first modification of the network security rule management system and the network security rule management system according to the embodiment of the present invention.

FIG. 8 is a configuration diagram of a second modified example of the network security rule management system and its device according to the embodiment of the present invention.

FIG. 9 is a flowchart showing an operation of a second modification of the network security rule management system and the network security rule management system according to the embodiment of the present invention.

FIG. 10 is a diagram showing the contents of a management information storage means employed in a network security rule management system and a third modification of the device according to the embodiment of the present invention.

FIG. 11 is a diagram showing contents of a management information storage means employed in a network security rule management system and a fourth modification of the device according to the embodiment of the present invention.

FIG. 12 is a flowchart showing an operation of a third modification of the network security rule management system and the network security rule management system according to the embodiment of the present invention.

FIG. 13 is a configuration diagram of a fourth modified example of the network security rule management system and its device according to the embodiment of the present invention.

FIG. 14 is a flowchart showing an operation of a fourth modified example of the network security rule management system and the network security rule management system according to the embodiment of the present invention.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 Network 2 NSR management device 3-1, 3-2 Firewall device 4, 6-1, 6-2 Common rule information storage unit 5, 7-, 7-2 Individual rule information storage unit 8-1, 8-2 Network Site 9 Update rule information storage unit 9A Backup storage unit 2a Editing / storage unit 2b, 2b-1 to 4 Management information storage unit 2c Distribution unit

Claims (6)

[Claims] 1. A security device that is provided in a network and controls the passage / non-passage of information transmitted through the network, and determines whether information is passed or non-passed by the security device. A network security rule management system, comprising: a network security rule management device that provides network security rule information according to any one of claims 1 to 3, wherein the security device and the network security rule management device each have a common rule common to all security devices. A common rule information storage unit for storing information; and an individual rule information storage unit for storing individual rule information unique to each security device, wherein the network security rule management device has a common Rule information While transferring the common rule information stored in the storage unit to the common rule information storage unit provided in all the security devices, the individual rule information stored in the individual rule information storage unit provided in the own device corresponds to A network security rule management system wherein the information is transferred to an individual rule information storage unit provided in a security device. 2. A security device, which is provided in a network and controls passage / non-passage of information transmitted through the network, transmits network security rule information for determining whether the information is passed or not. A network security rule management device to be provided, wherein the network security rule management device stores a common rule information storage unit that stores common rule information common to all security devices, and stores individual rule information unique to each security device. The individual rule information storage unit and the common rule information stored in the common rule information storage unit provided in the own device are transferred to all security devices, and are stored in the individual rule information storage unit provided in the own device. Transferred individual rule information to the corresponding security device A network security rule management device comprising: In the network security rule management device, when each rule information is updated, update time information indicating the time is set, and when each rule information is transferred, transfer time information indicating the time is set. 3. The network security rule management device according to claim 2, wherein the transferring unit detects rule information to be transferred based on the update information and the transfer information and transfers the rule information. 4. The network security rule management device is provided with an update rule information storage unit for storing each rule information when the rule information is updated, and means for transferring the updated rule information in the update rule information storage unit. 3. The network security rule management device according to claim 2, wherein the transfer is performed by detecting the storage. 5. The network security rule management device is provided with an update rule information storage unit for storing each rule information when it is updated, and when each rule information is updated, update time information indicating the time is set. When the transfer of each rule information is performed, transfer time information indicating the time is set, and the transfer means detects the rule information to be transferred based on the update time information and the transfer time information and transmits the update rule information. 3. The network security rule management device according to claim 2, wherein the corresponding rule information stored in the storage unit is transferred. 6. The network security rule management device is provided with a backup storage unit that stores the transferred rule information when each rule information is transferred, and the transfer unit transfers the transferred rule information to the backup storage unit. The network security rule management device according to claim 5, wherein the network security rule management device stores the information.