JP2001148715A - Network system and terminal device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve the problem that an internal terminal of a conventional communication system can not detect communication packets between a regular external terminal and a terminal in an organization if an illegal user forges the IP address of the sender. SOLUTION: When the regular terminal 6 connected to an external network sends a communication IP packet 12 to an internal terminal 1 connected to an internal network through a gateway 5, an authentication code 13 calculated by using a specific function is embedded in the communication IP packet 12 and the gateway 5 having the same function authenticates the authentication code 13 to prevent an illegal communication IP packet 12 from passing through.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network system for monitoring unauthorized access in order to secure the security of computer systems connected via a network, and a terminal device configured to prevent unauthorized use. It is.

[0002]

2. Description of the Related Art With the spread of personal computers,
Most of daily tasks are performed using terminal devices such as personal computers and workstations connected to networks in organizations such as companies and servers providing various services. Such an intra-organizational network is usually used in connection with the Internet connected all over the world for the convenience of exchanging information with the outside of the organization. On the other hand, such a situation is exposed to various threats of unauthorized access to the internal network from external users, and a technology for stopping such unauthorized access at the shore is becoming important.

Conventionally, an internal network has been accessed from an external network as follows. (1) For communication that attempts to invade the in-house network from the external network, pass-through registration is made in advance based on the communication packet information (source IP address, destination IP address, source port number, destination port number). It is checked against the communication packet information that has been passed, and whether or not passage is permitted is implemented. (2) When an unauthorized user attempts to invade an in-house network from an external network, it is often the case that information about the in-house network is first obtained. However, in the past, such inquiries were often answered due to insufficient network management settings and the like. (3) For the communication source terminal and the destination terminal, communication is performed by embedding only the IP addresses of the mutual terminals that perform communication in the communication packet.

[0004]

According to the above prior art, there are the following problems. The above (1)
In the related art, the exchange of a communication packet between a legitimate external terminal and a terminal and a server (hereinafter, an internal terminal) within the organization is taken over by an unauthorized user on the way (eavesdropping the communication packet and changing the source IP address). In the case of forgery, the communication is changed to the communication between the internal terminal and the unauthorized terminal.) In this case, there is a problem that the internal terminal cannot detect this at all.
Further, when the IP address of the internal terminal is leaked to the outside, it identifies spoofing from an external unauthorized access user (forging the source IP address into the IP address of the internal terminal and sending a communication packet to the internal network), There was also a problem that it could not be removed.

In the case of the prior art (2), TC
Since it responds to an inquiry such as a P / IP route search or a user information acquisition command, it inadvertently responds to a network route path or user information to an internal terminal. Therefore, there is a problem that information for an internal terminal attack is given to the user who made the inquiry.

[0006] In the prior art of the above (3), unauthorized access that is accessed using a regular port number (TCP / IP command) with a regular user name via a regular external terminal or router is used. On the other hand, there was a problem that it could not be detected.

Further, conventionally, when the terminal is started up and used, or when the terminal is resumed after the terminal has been used for a while, the user is required to input the user name and password to make the terminal usable. If the user name and the password are leaked, there is a problem that an unauthorized user can use the terminal without any trouble.

SUMMARY OF THE INVENTION The present invention has been made to solve these problems, and separates unauthorized access to an internal terminal from impersonation from an external network to prevent unauthorized access to the internal network. It is a primary object to obtain a network system that can perform such operations. In addition, a network system that prevents unauthorized access by preventing the provision of useful information for unauthorized access to external networks and tracks information inquiries to prevent unauthorized access before it occurs. The second purpose is to obtain.

It is a third object of the present invention to provide a terminal device capable of preventing physical unauthorized use.

[0010]

In a network system according to the present invention, a first terminal device connected to an internal network for transmitting and receiving communication packets and a first terminal device connected to an external network and communicating with the first terminal device are provided. A second terminal device authorized to send and receive packets,
The communication packet transmitted from the second terminal device to the first terminal device includes a gateway that connects the internal network and the external network, and includes the authentication code calculated by the second terminal device. is there.

The authentication code calculated by the second terminal device is calculated using a predetermined function held by the gateway, and the authentication of the authentication code is performed by the gateway. The authentication code calculated by the second terminal device is calculated using a predetermined function held in the first terminal device, and authentication of the authentication code is performed by the first terminal device.

Further, the predetermined function uses the data part of the communication packet as a parameter. The communication packet transmitted from the second terminal device to the first terminal device includes the source MAC address.

Further, the gateway refers to the MAC address database in which the MAC address of the second terminal device is stored in advance, and refers to the source M included in the communication packet.
It authenticates the AC address. Furthermore, the gateway has an internal interface connected to the internal network and an external interface connected to the external network, and the source IP address of the communication packet captured from the external interface is not that of the first terminal device. Is to authenticate.

A first terminal device connected to the internal network for transmitting and receiving communication packets and a first terminal device connected to the external network connected to the router are permitted to transmit and receive communication packets to and from the first terminal device. A second terminal device, and a gateway connecting the internal network to the external network, wherein a communication packet transmitted from the second terminal device via a router includes an IP address of the second terminal device and a login user name. Is included. Also, a first terminal device connected to the internal network, which transmits and receives communication packets, and a second terminal device connected to the external network, which is permitted to transmit and receive communication packets with the first terminal device, A gateway for connecting the internal network and the external network, wherein the gateway transmits a communication packet for inquiring about internal network information from a third terminal device not permitted to transmit / receive a communication packet to / from the first terminal device via the external network. And an access recording unit that records the rejected communication packet in a logging file when the communication packet is transmitted.

In addition, the gateway has an access inquiry unit for inquiring the source of a communication packet inquiring about internal network information about user information. Further, the terminal device according to the present invention includes a keyboard fingerprint matching unit for matching the fingerprint of the keyboard user, and a mouse fingerprint matching unit for matching the fingerprint of the mouse user. Is used to perform use start permission authentication.

[0016]

Embodiments of the present invention will be described below with reference to the drawings. Embodiment 1 FIG. FIG. 1 is a block diagram showing a configuration of a network system according to Embodiment 1 of the present invention.
In the figure, 1 is an internal terminal which is a first terminal device having an IP address C, and 2 is an internal terminal having an IP address D, which is connected to the internal network 3 together with the internal terminal 1. 4 is an external network, 5 is a gateway connecting the internal network 3 and the external network 4,
It has a P address B. Reference numeral 6 denotes a legitimate terminal which is connected to the external network 4 and communicates with the internal terminals 1 and 2 and has an IP address A. Reference numeral 7 denotes an unauthorized terminal, which is a third terminal device that is connected to the external network 4 and performs unauthorized access to the internal terminals 1 and 2, and has an IP address X. Reference numeral 8 denotes an internal interface of the gateway 5 connected to the internal network 3, 9 denotes an external interface of the gateway 5 connected to the external network 4, and 10 denotes an MA holding a MAC address of a regular terminal.
The C address database is connected to the gateway 5. Reference numeral 11 denotes an authentication code generation unit provided in the authorized terminal 6, for each communication packet to be communicated (all communication packets or each communication intermittently) by an arbitrary function using a parameter as shown in Expression (1) described later. Packet) to generate an authentication code. Reference numeral 12 denotes a communication IP packet,
It is composed of a P address, a destination IP address, an authentication code 13, a source MAC address 14 which is a physical address of a source, and a data part which is communication contents. Reference numeral 15 denotes an authentication code collation unit provided in the gateway 5, which holds the same function as the authentication code generation unit 11, calculates an authentication code from a communication IP packet using the function, and generates the The verification is performed by comparing with the authentication code. The MAC address database 1
0 and the source MAC address 14 will be described in the second embodiment. In the first embodiment, the authorized terminal 6 and the gateway 5
Have the same function, respectively, and embed the authentication code 13 calculated by the function for each communication IP packet transmitted from the authorized terminal 6, and use the same function in the gateway 5 to authenticate the authentication code 13 from the communication IP packet. Is calculated, and the calculated authentication code and the embedded authentication code are compared to authenticate the communication packet so that the communication IP packet from the unauthorized terminal 7 is not passed.

Next, the operation of the network system configured as described above will be described. The unauthorized terminal 7 connected to the external network 4 eavesdrops on the communication IP packet between the authorized terminal 6 and the internal terminal 1 and forges the source IP address transmitted from the authorized terminal 6 to make the communication illegal. It is assumed that the takeover of communication which is changed to the communication between the terminal 7 and the internal terminal 1 is performed. Communication IP packet 12 flowing on the network
Then, the authentication code 13 calculated by the following equation (1) is embedded therein. Authentication code ID = F (source IP address, destination IP address, user ID, date, time, packet serial number) (1) where F is an arbitrary function using each parameter in parentheses () as a variable Then, a data portion may be added to the parameter to make it more difficult for wiretapping.

This function is performed by the gateway 5 and the regular terminal 6
In the communication IP packet transmitted from the authorized terminal 6, the authentication code calculated by the authentication code generation unit 11 using the function represented by the equation (1) using the source IP address and the like as a parameter is communicated. When the communication IP packet reaches the gateway 5, the authentication code matching unit 15 of the gateway 5 calculates the authentication code from the communication IP packet using the same function, and communicates with the calculated authentication code. The authentication code 13 is compared with the authentication code 13 included in the IP packet for collation. If they match, the packet is passed to the internal network 3 as a communication IP packet from the authorized terminal 6. If they do not match, the packet is not passed as a communication IP packet from the unauthorized terminal 7. By performing this process for each communication packet, a communication hijacked by the unauthorized terminal 7 whose source IP address is forged is created for each communication packet after a normal connection from the authorized terminal 6 to the internal network 3 at the start of communication. Since the authentication can be detected by the gateway 5 by the verification of the authentication code, unauthorized access from the unauthorized terminal 7 can be reliably prevented. Also, even if this authentication code itself is eavesdropped,
Since the authentication code is generated for each communication packet by the formula (1), unauthorized intrusion can be prevented. Note that by adding a data part to the parameter of this function, an authentication code unique to communication can be obtained, and unauthorized access can be more reliably prevented.

Embodiment 2 The network configuration of the second embodiment is the same as that of FIG. In addition to Embodiment 1,
In the communication IP packet 12, the E
The source MAC address 14 which is the MAC address of the OSI reference model physical layer such as THERNET is embedded, and this is collated with the MAC address database 10 of the legitimate terminal 6 previously held in the gateway 5 on the receiving side. After identifying that the packet is the communication IP packet 12, the packet is passed to the internal network 3.

As a result, it is possible to discriminate illegal communication packets sent from the illegal terminal 7 by falsifying the source IP address with the IP address of the regular terminal 6 and prevent unauthorized access.

Embodiment 3 The network configuration of the third embodiment is the same as that of FIG. In addition to the second embodiment, an unauthorized access that sends a communication IP packet whose source IP address is forged to that of the internal terminal 2 and that is used as a conventional means of invading the internal network 3 from the unauthorized terminal 7 is By discriminating whether the input of the communication IP packet 12 captured by the gateway 5 is from the external network interface 9 or the internal network interface 8, an unauthorized access is detected and the passage to the internal network 3 is rejected. I do. That is, the communication I fetched from the external network interface 9
In the P packet 12, the source IP address is
A packet in which a P address is set rejects passage to the internal network 3.

Embodiment 4 Although the network configuration of the fourth embodiment is the same as that of FIG. 1, in the fourth embodiment, the internal terminal 1 has an authentication code matching unit having the same function as the authentication code generation unit of the authorized terminal. In addition to the takeover in the middle of the communication described in the first embodiment, communication illegal rewriting interference in which all communication IP packets 12 of the authorized terminal 6 and the internal terminal 1 being transmitted on the external network 4 are intercepted and the data portion is falsified is prevented. It is assumed that the authentication code calculated by the following equation (2) in which the data part is added to the parameter is embedded in the communication IP packet 12 and the authentication code of the communication IP packet 12 received by the internal terminal 1 is also assumed. 13 is compared with the authentication code calculated from the communication IP packet 12 based on the above function by the authentication code matching unit, and if the matching does not match, it is detected that the data has been tampered with, and the tampering information can be rejected. . Authentication code ID = G (source IP address, destination IP address, user ID, date, time, packet serial number, data part) (2) where G is a parameter in parentheses (). Any function.

Embodiment 5 FIG. 2 is a block diagram showing a configuration of a network system according to Embodiment 5 of the present invention. In the drawing, 1, 3 to 7 are the same as those in FIG. Reference numeral 16 denotes an access control unit of the gateway 5 that rejects a response to an unauthorized inquiry, 1
Reference numeral 7 denotes an access recording unit of the gateway 5 for recording packet information for which an illegal inquiry has been made in the logging file 18. Reference numeral 19 denotes an access inquiry unit of the gateway 5 which inquires of user information in order to obtain the user information in response to an illegal inquiry. Reference numeral 20 denotes a network information acquisition command for inquiring internal network information from the unauthorized terminal 7, and reference numeral 20 denotes a user information acquisition command for inquiring the unauthorized terminal 7 for user information from the access inquiry unit 19. FIG. 2 shows a network information acquisition command 20 directed from the unauthorized terminal 7 of the external network 4 to the internal network 3 targeted for unauthorized access, an access control unit 16 rejecting the command by the gateway 5, and recording the command. An access recording unit 17 is provided.

In such a network configuration, the network-related information (tr) of the internal network 3 targeted for unauthorized access from the unauthorized terminal 7 of the external network 4
information about external and internal routing such as the "acquire" command and the "netstat"command;
The access control unit 16 of the gateway 5 rejects a response to the network information acquisition command 20 for making an inquiry about information about an internal user such as an r command, and sends packet information of the inquiry communication (source IP address). Address, destination IP address, source port number, destination port number, date, and time) are logged in the logging file 18. This prevents leakage of useful access information on the internal network 3 and does not provide information on unauthorized access to unauthorized users. The determination as to whether or not the network information acquisition command 20 is transmitted from the unauthorized terminal 7 is basically made based on the source IP address and the user ID. The authentication code indicating the authorized terminal as described in the first to third embodiments may be incorporated in the network information acquisition command 20, and the authentication may be performed by the gateway 5.

Embodiment 6 FIG. The network configuration of the sixth embodiment is the same as that of FIG. In addition to Embodiment 5,
In order to obtain the user information of the inquiring source from the inquiring external unauthorized terminal 7, based on the packet information logged in the fifth embodiment, an inquiry about the user information is made in reverse to the source IP address. The user information acquisition command 21 to be executed is transmitted from the access inquiry unit 19, and this information is also logged. As a result, an unauthorized preliminary user who has attempted to obtain network information or user information that leads to unauthorized access logs his or her own user information to the gateway 5 as an unauthorized access preliminary user at the same time as the inquiry communication.

Embodiment 7 FIG. 3 is a block diagram showing a configuration of a network system according to Embodiment 7 of the present invention. In the figure, 1, 3 to 5, and 7 are the same as those in FIG. 1, but the IP address of the unauthorized terminal 7 is TF. 23 is a regular terminal connected to the external network 4 and having an IP address T1, 24 is a regular terminal connected to the external network 4 and has an IP address T2, and 25 and 26 are IP addresses R1 and R2, respectively.
And a router connected to the external network 4.
Reference numeral 27 denotes a communication IP packet transmitted by the unauthorized terminal 7, and reference numeral 28 denotes a communication IP packet transmitted by the router 26, each of which includes a source IP address, a destination IP address, a local login terminal IP address, a local terminal login user name,
It consists of a data section.

As shown in FIG. 3, a plurality of authorized terminals 23, 24
Network 4 to which routers 25 and 26 are connected
And the unauthorized terminal 7 of the external network 4 accesses the gateway 5 through the authorized terminals 23 and 24 and the routers 25 and 26 in the system configured by the internal terminal 1 of the internal network 3 connected through the gateway 5. Suppose that it is coming. In the communication IP packet 27, the local login terminal of the transmission source (in this case, the unauthorized terminal 7)
The IP address of the local terminal and the login name of the local terminal are embedded, and in each communication IP packet 28 transmitted from each of the regular login terminals 23 and 24 and the remote login terminals of the routers 25 and 26, the IP address of the local login terminal of the transmission source described above is included. Inherit and transfer the local terminal login user name. As a result, a communication IP packet that accesses the internal network 3 by impersonating a legitimate user via a plurality of legitimate terminals is transmitted to the gateway 5 by a packet source IP address (in this case,
If there is a difference between the router 26) and the local login terminal IP address, if there is a difference, the communication is rejected as spoofing unauthorized access and packet information is logged. Further, the originating terminal of the unauthorized access and the name of the unauthorized user can be immediately grasped.

Embodiment 8 FIG. 4 is a configuration diagram showing a terminal device according to Embodiment 8 of the present invention. In the figure, reference numeral 30 denotes a keyboard fingerprint collating unit 31 that incorporates a fingerprint identification device into a personal computer or a workstation and verifies a fingerprint of a user who uses a keyboard;
This is an unauthorized use monitoring terminal device having a mouse fingerprint matching unit 32 for checking a fingerprint of a user who uses a mouse to prevent unauthorized use. FIG. 5 is a processing flowchart for permitting a terminal device to start using a terminal device according to Embodiment 8 of the present invention. In the eighth embodiment, in using a personal computer or a workstation, in addition to the conventional use permission of only a user ID and a password, use permission authentication is performed by a fingerprint identification device incorporated in a keyboard and a mouse.

Referring now to FIG. 5, a description will be given of a processing flowchart for permitting the start of use of the terminal. Step S1
To authenticate the login name and password. Next, in step S2, it is determined whether or not the authentication has been successfully performed. If the authentication has been successfully performed, the process proceeds to step S3, where fingerprint collation authentication is performed. Next, in step S4, it is determined whether or not the authentication has succeeded. If the authentication has succeeded, the authentication is terminated.
Jump to 5. If the authentication fails in step S2, the process also skips to step S5. In step S5, it is determined whether or not authentication has failed three times in a row.
Return to 1 and perform new authentication. When the number of failures reaches three, the process proceeds to step S6, where authentication failure is logged, and the user is locked.

As a result, fingerprint identification is required for use start permission authentication at the time of terminal login and resumption of use after sitting in use, and unauthorized use of the terminal is refused even if the user ID and password are leaked. Can be.

[0031]

Since the present invention is configured as described above, it has the following effects. A first terminal device connected to the internal network for transmitting and receiving communication packets; a second terminal device connected to the external network and authorized to transmit and receive communication packets to and from the first terminal device; Since the communication packet transmitted from the second terminal device to the first terminal device includes the authentication code calculated by the second terminal device, the authentication code Can be used to authenticate the second terminal device, thereby preventing unauthorized access.

The authentication code calculated by the second terminal device is calculated by using a predetermined function held by the gateway, and the authentication code is authenticated by the gateway. Unauthorized access can be prevented by an authentication code based on a predetermined function known only. The authentication code calculated by the second terminal device is calculated using a predetermined function held in the first terminal device, and the authentication of the authentication code is performed by the first terminal device. Unauthorized access can be prevented by an authentication code based on a predetermined function known only to the terminal device and the second terminal device.

Further, since the predetermined function uses the data part, which is the communication content of the communication packet, as a parameter, it is possible to detect the modification of the data part due to unauthorized access. Further, since the communication packet transmitted from the second terminal device to the first terminal device includes the source MAC address, it is possible to prevent unauthorized access by forging the IP address.

Also, the gateway refers to the MAC address database in which the MAC address of the second terminal device is stored in advance, and refers to the source M included in the communication packet.
Since the AC address is authenticated, unauthorized access can be prevented by the MAC address. Furthermore, the gateway has an internal interface connected to the internal network and an external interface connected to the external network, and the source IP address of the communication packet captured from the external interface is not that of the first terminal device. Is authenticated, unauthorized access using the source IP address of the first terminal device can be prevented.

A first terminal device connected to the internal network for transmitting and receiving communication packets and a first terminal device connected to the external network connected to the router are permitted to transmit and receive communication packets to and from the first terminal device. A second terminal device, and a gateway connecting the internal network to the external network, wherein a communication packet transmitted from the second terminal device via a router includes an IP address of the second terminal device and a login user name. Therefore, unauthorized access via a router can be prevented.

A first terminal device connected to the internal network for transmitting and receiving communication packets, and a second terminal device connected to the external network and permitted to transmit and receive communication packets to and from the first terminal device. Device, and a gateway for connecting the internal network to the external network, wherein the gateway transmits a communication packet for inquiring about internal network information from a third terminal device that is not permitted to transmit and receive the communication packet to and from the first terminal device. When transmitted via a network, the communication device has an access control unit for rejecting the communication packet and an access recording unit for recording the rejected communication packet in a logging file, so that it does not respond to an inquiry leading to unauthorized access. Can be.

In addition, since the gateway has an access inquiry unit for inquiring the user information to the transmission source of the communication packet inquiring about the internal network information, the gateway can log the user information of the inquiry source.

Further, the terminal device according to the present invention includes a keyboard fingerprint collation unit for collating the fingerprint of the keyboard user and a mouse fingerprint collation unit for collating the fingerprint of the mouse user. Since use start permission authentication is performed using the collation unit, it is possible to prevent unauthorized use of the terminal device.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a network system according to Embodiments 1, 2, 3, and 4 of the present invention.

FIG. 2 is a block diagram showing a configuration of a network system according to Embodiments 5 and 6 of the present invention.

FIG. 3 is a block diagram showing a configuration of a network system according to a seventh embodiment of the present invention.

FIG. 4 is a configuration diagram showing a terminal device according to Embodiment 8 of the present invention.

FIG. 5 is a processing flowchart for permitting a terminal device to start using a terminal device according to Embodiment 8 of the present invention;

[Explanation of symbols]

1, 2 internal terminals, 3 internal networks, 4 external networks, 5 gateways, 6 regular terminals,
7 unauthorized terminal, 8 internal interface, 9 external interface, 10 MAC address database, 11 authentication code generation unit, 12, 27, 28 communication IP packet, 13 authentication code, 14 source M
AC address, 15 authentication code collating unit, 16 access control unit, 17 access recording unit, 18 logging file, 19 access inquiry unit, 20 network information acquisition command, 21 user information acquisition command, 23, 24 regular terminal, 25, 26 router , 3
0 unauthorized use monitoring terminal device, 31 keyboard fingerprint collation unit, 32 mouse fingerprint collation unit.

Continued on front page F-term (reference) 5B089 GA21 GA31 GB01 JB22 JB24 KA17 KB13 KC15 KC47 KH03 LB04 LB07 5K030 GA15 HA08 HD03 HD06 JT02 5K034 JJ21 KK27 LL01 SS02 9A001 BB04 CC06 CC07 DD10 EE03 LL03

Claims (11)

[Claims] 1. A first terminal connected to an internal network for transmitting and receiving communication packets, and a second terminal connected to an external network and permitted to transmit and receive communication packets to and from the first terminal. Device, a gateway that connects the internal network and the external network, and a communication packet transmitted from the second terminal device to the first terminal device includes an authentication code calculated by the second terminal device. A network system characterized by: 2. The authentication code calculated by the second terminal device is calculated by using a predetermined function held by the gateway, and the authentication of the authentication code is performed by the gateway. The described network system. 3. The authentication code calculated by the second terminal device is calculated by using a predetermined function held by the first terminal device, and the authentication of the authentication code is performed by the first terminal device. 2. The network system according to claim 1, wherein: 4. The network system according to claim 2, wherein the predetermined function uses a data part of the communication packet as a parameter. 5. The communication packet transmitted from the second terminal device to the first terminal device includes a source MAC address. A network system according to claim 1. 6. The gateway, the MA of the second terminal device
The source MAC included in the communication packet is referred to by referring to the MAC address database in which the C address is stored in advance.
The network system according to claim 5, wherein the address is authenticated. 7. The gateway has an internal interface connected to the internal network and an external interface connected to the external network, and the source IP address of a communication packet fetched from the external interface is that of the first terminal device. The network system according to any one of claims 1 to 6, wherein the network system authenticates that the communication is not performed. 8. A first terminal device connected to an internal network for transmitting / receiving a communication packet, and connected to an external network connected to a router, and permitted to transmit / receive a communication packet to / from the first terminal device. A second terminal device, a gateway for connecting the internal network and the external network, and a communication packet transmitted from the second terminal device via a router includes an IP address of the second terminal device and a login user. A network system comprising a name. 9. A first terminal connected to an internal network for transmitting and receiving communication packets, and a second terminal connected to an external network and authorized to transmit and receive communication packets to and from the first terminal. Device, comprising a gateway connecting the internal network and the external network, wherein the gateway is configured such that a communication packet inquiring about internal network information is transmitted from a third terminal device which is not permitted to transmit and receive a communication packet with the first terminal device. A network system, comprising: an access control unit that rejects the communication packet when transmitted via an external network; and an access recording unit that records the rejected communication packet in a logging file. 10. The network system according to claim 9, wherein the gateway has an access inquiry unit for inquiring user information to a source of a communication packet inquiring about internal network information. 11. A keyboard fingerprint collation unit for collating a fingerprint of a keyboard user, a mouse fingerprint collation unit for collating a fingerprint of a mouse user, and use start permission authentication using the keyboard fingerprint collation unit or the mouse fingerprint collation unit. Terminal device.