JP2000293493A - Distributed processing system for security check and its device and information storage medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To quickly attain security check by distributing the security check processing to plural processing, to continue a system service, and to attain rule change without stopping the security check processing. SOLUTION: This system is provided with a constitution ranging from a reception controlling part 10 to a rule changing part 40. When the security check of a waiting registration data packet operated based on a preliminarily set rule base in dead security check processing during rule base non-changing and non-processing retrieved in plural security check processing is allowable, the data packet is transmitted. Also, when the security check is unallowable, the data packet is abandoned. Also, normal processing which receives and changes a change rule base in security check processing during non-processing in the plural security check processing retrieved based on a rule change request is communicated to a data package waiting registration side. Also, the abnormal processing contents at the time of abnormal end are communicated to the origin of the change request.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a distributed security check processing method and apparatus for protecting servers and small general-purpose computers constituting a communication system from unauthorized access from an external communication network. Regarding recording media, in particular, a security check distributed processing method and apparatus for speeding up a security check by dispersing processing by a plurality of security checks, continuing system services, and changing rules without stopping the security check processing And an information recording medium.

[0002]

2. Description of the Related Art Conventionally, in a communication system, a server and a small general-purpose computer constituting the communication system are configured as follows.
Security checks have been implemented to protect against unauthorized access from external communication networks. In such a conventional security check, one security check database is used, and the security check is performed based on data stored in this database.

In the security check based on such a database, the following problems (1), (2) and (3) have been pointed out. (1) A security check is performed based on data stored in one security check database. This security check is made up of a plurality of rule base data, and is configured to check each rule base in order.

In such a configuration, in recent security checks, various types of data packets are received, and the more detailed the security check, the more the rule base. If the rule is earlier in the rule base, the security check ends immediately,
The later the rule base is, the longer the check processing time becomes. As described above, when the number of rule bases increases, the time required for the security check becomes longer or shorter.

[0005] For this reason, if the security check is executed in the rule base in the last check order, the processing time becomes long, and the security check cannot be executed on the received data packet until the security check is completed. In other words, as the line speed increases, the security check process also needs to be speeded up. When a large number of data packets are checked at a high speed, a delay in the check occurs. To perform waiting registration of a large number of data packets, it is necessary to increase the capacity of the reception buffer.

(2) Since only one security check is performed, if a failure occurs in the security check unit, service processing of the entire system is stopped.

(3) Since there is only one security check database, when changing it, the security check processing during this change period is interrupted, and the security check is restarted after the change is completed. Therefore, as described above, when performing a security check on a large number of data packets at high speed, if the security check process cannot be performed during the change period, the check may be delayed or a reception buffer may be required to perform waiting registration of a large number of data packets. Needs to be expanded.

There have been many proposals for such security checks as conventional examples.
Japanese Patent Application Laid-Open No. 798826/179927 discloses a "method and apparatus for providing password synchronization". In the conventional example, regarding resource sharing between data synchronization systems by password synchronization, general-purpose resources for a plurality of local resources for each user in a client / server system are used. Password synchronization is provided between repositories. In this case, the external registry maintains local password synchronization with the password maintained by the security server in the main registry.

Japanese Patent Application Laid-Open No. 9-185584 discloses a "method and apparatus for checking a password mechanism". In a conventional example, regarding a resource sharing between data synchronization systems by password synchronization, a general-purpose repository in a client / server system and a plurality of resources are shared. Password synchronization is provided with the user. In this case, the password can be propagated to the new registry until a change to the user's password occurs.

Japanese Patent Application Laid-Open No. 10-229418 discloses a system and method for providing peer-level access control in a network. In the conventional example, access control between one set of automatic information systems and another set is performed. In particular, to provide a flexible and inexpensive peer-level security without the need for system administrator intervention, to efficiently implement a local rule base on a network where security news is constantly changing. I have. In other words, while maintaining the function of the filter, it provides a new security function for each user based on the filter and firewall, and responds to the changing news of individual users by dynamically adjusting the local rule base that can be adjusted dynamically. I have.

[0011]

In the above conventional example, when a large number of data packets are security-checked at a high speed, a delay occurs and the capacity of a reception buffer needs to be increased. Further, when a failure occurs, service processing of the entire system is stopped. Furthermore, when performing a high-speed and large-volume data packet security check, if the security check process cannot be performed during the change period, the check will be delayed or the reception buffer capacity will be increased due to waiting registration of a large number of data packets. Expansion is needed. In other words, there is a drawback that the processing capacity of the security check is reduced, and the device scale and the processing scale are increased.

The present invention solves the above-mentioned problems in the prior art. The check processing can be distributed by a plurality of security checks, and the waiting check (waiting Q) is prevented from remaining. In addition to speeding up processing, even if one security check process fails, another security check process is performed, so that system services can be continued, and rules can be maintained without stopping security check process It is an object of the present invention to provide a security check distributed processing method, an apparatus, and an information recording medium that can be changed, improve the security check processing capability, and reduce the apparatus scale and processing scale.

[0013]

In order to achieve the above object, a security check distributed processing method according to the present invention comprises:
Executes the procedure of the distributed security check operation against unauthorized access from the outside, and performs multiple security check processes including the process of waiting and registering received data and the security check process while rule base is not being changed and not being processed And a process of checking waiting registration data in the searched security check process based on a preset rule base, and determining whether to permit or non-permit the data. And transmitting and discarding the data when it is not permitted.

Further, the distributed security check processing method of the present invention executes a procedure of a rule change operation in a distributed security check against an unauthorized access from the outside, and performs a plurality of security checks based on a rule change request. A process of searching for a security check process that is not being processed in the process, a process of determining whether the change by the change rule base received by the security check process that is not being processed in this search is normal or abnormal, and a process of ending the rule change normally. Notifying the data waiting registration side of the security check processing and notifying the change request source of the abnormal processing content at the time of abnormal termination.

The distributed processing apparatus for unauthorized access security check according to the present invention executes a distributed security check operation procedure for an unauthorized access from the outside. In the security check process of the empty space in the security check process, the data that is registered in the queue based on the rule base set in advance is transmitted if it is permitted, and the data is discarded if it is not permitted. The configuration includes a check operation processing unit.

An apparatus for distributed processing of unauthorized access security check of the present invention executes a procedure of a rule change operation in a distributed security check for an unauthorized access from the outside. In the security check processing of non-processed free space in the security check processing, the normal processing changed by receiving the change rule base is notified to the data waiting registration side, and the abnormal processing content at the time of abnormal termination is sent to the change request source The configuration is provided with a rule change operation processing means for notifying.

An unauthorized access security check distributed processing device according to the present invention executes a distributed security check operation and a rule change operation processing procedure for an unauthorized access from the outside. In the security check process of the vacant security check process, the check performed based on the rule base set for the data of the waiting registration based on the preset rule base sends the data when it is allowed and the data when it is not allowed. Security check operation processing means for discarding the data, and normal processing changed by receiving the change rule base in the non-processed empty security check processing in the plurality of security check processings searched based on the rule change request. Side to notify the It is constituted and a rule changing operation processing means for notifying a contents change requester.

As the security check operation processing means and the rule change operation processing means, a reception control unit for performing control for registering received data in a waiting Q, and receiving data registered in the waiting Q by a search in the reception control unit. Receiving a plurality of security check units for performing a security check on this data based on a preset rule base, and receiving data determined as a result of checking the plurality of security check units based on the rule base. And a rule change unit that receives a rule change request event and issues a rule change request to the reception control unit in order to search for a security check unit that does not operate.

Further, the reception control unit and the security check unit are configured to start or end the processing by adding or deleting a flag. Also, the data is
IP packet, source IP address, destination IP
This is data including address and packet service contents, and security check is performed on the data in an order based on a preset rule base. Further, the above configuration is applied to a communication network including at least a server and a small general-purpose computer, and executes a distributed security check for protecting against unauthorized access from an external communication network.

The information recording medium of the present invention is an empty security check process in a plurality of security check processes in which the rule base is being changed and not being processed.
A security check operation process for transmitting data when the data of the waiting registration is performed based on a rule base set in advance and permitting the data and discarding the data when the data is not permitted, and / or a rule change request In the security check process of unprocessed empty in multiple security check processes searched based on, the normal process changed by receiving the change rule base is notified to the data waiting registration side, and the abnormal process content at the time of abnormal termination And a control program for executing a rule change operation process for notifying the change request source.

In the security check distributed processing method and apparatus of the present invention, check processing is distributed by a plurality of security checks, and the processing procedure of the security check operation and / or the rule change operation is performed. Running.

As a result, the speed of the security check process is increased, the rule can be changed without stopping the security check process, and the system service can be continued.

Therefore, in the case where the security check processing is speeded up each time the line speed is increased, in the present invention, the security check processing is dispersed by a plurality of security check processings, and the stagnation of waiting registration is eliminated. The security check can be speeded up easily.

That is, the security check processing in which the rule base in the plurality of security check processes (the plurality of security check units) is earlier is completed in a short time. As a result, due to the plurality of security check processes, the stagnation of the waiting Q is eliminated, and the security check process is sped up.

Also, since the check processing is distributed by a plurality of security check processes (a plurality of security check units), even if a failure occurs in one security check process, the other security check processes do not stop. System services continue.

Further, in the rule change of the security check, in the rule change processing (the rule change section) receiving the rule change request, the security check processing of the searched empty changes the rule base, and the security check processing during the processing is performed. After this processing, the rule is changed. As a result, the rules are changed without stopping the security check processing in the entire system.

According to the information recording medium of the present invention, a control program for the processing procedure of the security check operation and the processing procedure of the rule change operation is stored in a general-purpose package software, for example, a floppy (registered trademark) disk (F).
D) or a CD-ROM is provided as a medium.

As a result, the present invention (processing procedure for security check operation and processing procedure for rule changing operation) can be easily performed especially on a small general-purpose computer (terminal server).

[0029]

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a block diagram showing an embodiment of a security check distributed processing method and apparatus according to the present invention; FIG. 1 is a block diagram showing a configuration of a security check distributed processing method and apparatus and an information recording medium according to an embodiment of the present invention. In FIG. 1, in this example, a reception control unit 10 that performs control to register a data packet received from a line in a waiting Q (queue) and a search by the reception control unit A first method for receiving a registered data packet (IP packet) and performing a security check on a source IP address, a destination IP address and a service content of the data packet in an order based on a preset rule base.
A security check unit 20 and a second security check unit 21 are provided.

In this example, as a result of checking based on the rule base by the first security check unit 20 and the second security check unit 21, the data packets determined to be acceptable (the source IP address, the destination IP address) And a transmission control unit 30 for performing control for receiving and transmitting packet and service contents), and a non-processed (empty) first security check unit 2 not receiving a rule change request event and performing a processing operation.
And a rule change unit 40 that issues a rule change request to the reception control unit 10 to search for the zero or the second security check unit 21.

The reception control unit 10, the first security check unit 20, and the second security check unit 2
1. The transmission control unit 30 and the rule changing unit 40 can be provided in a small general-purpose computer. In the following security check operation procedure and rule change operation procedure, the application can be provided by general-purpose package software, for example, a floppy disk (FD) or a CD-ROM.

Next, the operation of this embodiment will be described. FIG. 2 is a flowchart showing a processing procedure of the security check operation. 1 and 2, in step S21, the data packet received from the line is registered in the waiting Q (queue) by the reception control unit 10.

In step S22, the reception control unit 10 transmits the data packet registered in the waiting Q to the first security check unit 20 or the second security check unit 21. Is searched for a non-processed (empty) first security check unit 20 or a second security check unit 21 which has not been executed. Here, when the first security check unit 20 is processing, the second security check unit 21 is not processing, and the rule base is not changing, the reception control unit 10 transmits the data packet to the second security check unit 21. At the same time as sending, a flag indicating that processing is in progress is set.

In step S23, the second security check unit 21 determines the source IP address, the destination IP address of the data packet fetched from the reception control unit 10 and the service contents of the packet based on a preset rule base. Check in order.

In step S24, when the result of checking the data packet based on the rule base is determined to be acceptable, the data packet is transferred to the transmission control unit 30. When the security check is completed, the second security check unit 21 notifies the reception control unit 10 that the security check has been completed.
0 deletes the flag for the second security check unit 21.

In step S25, if the result of the check based on the rule base is determined to be non-permissible, the data packet is discarded. The first security check unit 20 and the second security check unit 21 notify the reception control unit 10 that the processing has been completed, and the reception control unit 10 deletes the flag based on the notification.

FIG. 3 is a flowchart showing a processing procedure of the rule changing operation. 1 and 3, in step S31, the rule changing unit 40 that has received the event of the rule change request is not performing a processing operation (non-processing /
In order to search the (free) first security check unit 20 or second security check unit 21, a rule change request is made to the reception control unit 10.

In step S32, the reception control unit 10 sets a flag to change all the rules in the first security check unit 20 and the second security check unit 21. The reception control unit 10 controls the first security check unit 20 and / or the second
The security check unit 21 is notified of the assigned number.

In step S33, the rule changing section 40 transfers the changed rule base to the second security check section 21 which is not being processed.

In step S34, when the change of the rule base is completed in the second security check unit 21, the second security check unit 21 notifies the rule change unit 40 of the completion.

In step S35, the rule changing unit 40
Notifies the reception control unit 10 of the number of the second security check unit 21 that has successfully completed the rule change. The reception control unit 10 deletes the corresponding flag during the rule change from the number of the second security check unit 21 received from the rule change unit 40.

In step S36, when the rule change is abnormally terminated by the first security check unit 20 and the second security check unit 21, the rule change unit 40 notifies the change request source of the contents of the abnormal processing.

In this embodiment, the description has been made using the two first security check units 20 and the second security check unit 21, but the same operation is performed when three or more security check units are arranged.

As a security check target, TCP / IP (Transmission Control Protocol / Int)
Although the source IP address and destination IP address of the IP packet and the service contents (for example, TOS / Type of Service) of the packet in the IP protocol are taken up, security check for other data is also possible. The present invention can be applied as it is to a security check for a packet such as an ATM communication network based on non-TCP / IP.

[0045]

As is apparent from the above description, according to the security check distributed processing method and apparatus of the present invention, a plurality of security check processes are distributed,
The processing procedure of the security check operation and / or the processing procedure of the rule change operation are executed.

As a result, the processing is distributed by a plurality of security checks, and the stagnation in waiting registration is eliminated.
The security check process can be speeded up, and even if a failure occurs in one security check process, another security check process is performed and the system service can be continued. Further, there is an effect that the rule can be changed without stopping the security check processing.

Further, the information recording medium of the present invention provides a control program for the processing procedure of the security check operation and the processing procedure of the rule changing operation as general-purpose package software. As a result, an effect is obtained that the present invention can be easily implemented particularly on a small general-purpose computer.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a security check distributed processing method and apparatus and an information recording medium according to an embodiment of the present invention.

FIG. 2 is a flowchart illustrating a processing procedure of a security check operation in the embodiment.

FIG. 3 is a flowchart illustrating a processing procedure of a rule changing operation in the embodiment.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 Reception control part 20 1st security check part 21 2nd security check part 30 Transmission control part 40 Rule change part

Claims (10)

[Claims] 1. A security check distributed processing method for executing a distributed security check operation processing procedure for an unauthorized external access, comprising: a process of waiting and registering received data; A process of searching for a security check process from among a plurality of security check processes, and a process of checking the data of a waiting registration in the searched security check process based on a preset rule base, and determining whether to permit or disallow the data. And a process of transmitting data when the determination is allowable and discarding the data when the determination is non-permission. 2. A distributed security check method for executing a procedure of a rule change operation in a distributed security check for an unauthorized access from outside, wherein a plurality of security check processes are not being executed based on a rule change request. The process of searching for the security check process of this search, the process of judging whether the change by the change rule base received by the security check process not being processed in this search is normal or abnormal, and the security check process of the rule change being completed normally,
A process of notifying the data waiting registration side and notifying the change request source of the abnormal processing content at the time of abnormal termination. 3. A security check distributed processing apparatus for executing a processing procedure of a distributed security check operation for an unauthorized access from the outside, wherein a plurality of security check processes which are searched during rule base non-change and non-process are empty. In the security check processing of the above, the security check operation processing means for transmitting the data when the waiting registration data is performed based on the rule base set in advance is permitted and discarding the data when the checking is not permitted. A security check distributed processing apparatus comprising: 4. A security check distributed processing apparatus for executing a processing procedure of a rule change operation in a distributed security check against an unauthorized access from the outside, wherein a plurality of security check processings searched based on a rule change request are performed. A rule change operation that receives the change rule base and notifies the normal process changed by receiving the change rule base to the data wait registration side, and notifies the change request source of the abnormal process at the time of abnormal termination. A security check distributed processing apparatus comprising processing means. 5. A security check distributed processing apparatus for executing a processing procedure of a distributed security check operation and a rule change operation against an unauthorized access from outside, wherein a plurality of security systems which search during rule base non-change and non-process are searched. In the security check processing of the empty space in the check processing, the check performed based on the rule base set in advance for the data of the waiting registration is a security check that sends data when allowed and discards data when not allowed In the operation processing means, and in the security check processing of an unprocessed empty in a plurality of security check processing searched based on the rule change request, the normal processing changed by receiving the change rule base is notified to the data waiting registration side, Notify the change request source of the details of the abnormal processing at the time of abnormal termination Security check distributed processing apparatus characterized by comprising: a rule changing operation processing means, that. 6. A reception control unit for controlling registration of received data in a waiting Q as the security check operation processing unit and the rule change operation processing unit, and a reception control unit registered in the waiting Q by a search in the reception control unit. A plurality of security check units for receiving the data and performing a security check on the data based on a preset rule base; and a result of checking the plurality of security check units based on a rule base is determined to be acceptable. A transmission control unit that performs control of receiving and transmitting the received data, and a rule change unit that receives a rule change request event and issues a rule change request to the reception control unit to search for the security check unit that is not processed. 6. The security check according to claim 5, comprising: Distributed processing apparatus. 7. The security check distributed processing apparatus according to claim 6, wherein the reception control unit and the security check unit start or end the processing by adding or deleting a flag. 8. The data is an IP packet, a source IP address, a destination IP
7. The security check distributed processing device according to claim 6, wherein the data is data including address and packet service contents, and the data is subjected to a security check in an order based on a preset rule base. 9. The configuration according to claim 6 is applied to a communication network including at least a server and a small general-purpose computer, and executes a distributed security check for protecting against unauthorized access from an external communication network. A security check distributed processing device. 10. An empty security check process in a plurality of security check processes in which the rule base is being changed and not being processed, the check performed based on a preset rule base for data of waiting registration is performed.
Security check operation processing for transmitting data when permitted and discarding data when not permitted; and / or
Alternatively, in a plurality of security check processes searched based on a rule change request, in a non-processed empty security check process, a change rule base is received, and the changed normal process is notified to the data wait registration side, and abnormal termination is performed. An information recording medium storing a control program for executing a rule change operation process for notifying a change request source of abnormal processing contents at the time of the change.