JP2002328897A - Computer network security system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To permit access only for pseudo data when a server connected to a network is illegally intruded, to specify an illegally intruding terminal or user on the basis of accessed contents during the time and to contribute to the development of a means coping with illegal access by storing illegality data as a library. SOLUTION: A normal service server 3 and a pseudo service server 4 are provided. At the time of detecting illegal intrusion, the access is possible only for safe or pseudo data without immediately disconnecting the connection of the intrusion and access contents at the time are recorded.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security system for a computer network, and more particularly to a security system in which an intruder other than a legitimate user leaves a large trace of an intrusion when an intruder performs an unauthorized intrusion.

[0002]

2. Description of the Related Art Conventionally, as a network security system, for example, one described in Japanese Patent Application Laid-Open No. 7-264178 is known. FIG. 4 shows a configuration diagram of a network system in which this conventional security system is implemented. In FIG. 4, 11, 1
2, 13, 14, and 15 are LANs, 21, 22, 23,
And 24 are relay devices, 51, 52, 53, 54, and 5
5 is a terminal device, and 56 is a management device.

[0003] The operation of the conventional security system having the above configuration will be described below. First, the LA connected from any of the terminal devices 51, 52, 53, 54, 55 via the relay devices 21, 22, 23, 24
Terminal devices 51, 52, 5 on N11, 12, 13, 14
In the case where unauthorized access has been made to 3, 54, 55, the relay devices 21, 22, 23, 24 notify the alarm information, and the management device 56 displays the contents when receiving the alarm information. And each relay device 21 to
The access history information held by the terminal device 24 narrows down to which port of each of the relay devices 21 to 24 the terminal device that has performed the unauthorized access is connected,
Specify which LAN is connected to.

[0004] As a result, it is possible to identify a terminal device that has made unauthorized access to a certain terminal device, and it is possible to stop data tampering or erasure, and intrusion of unauthorized data.

[0005]

However, in the above-mentioned conventional network security system,
When an unauthorized intrusion occurs, it is required that the connection from the unauthorized intruder be cut off and access to the data thereafter be prohibited, and then the unauthorized intruder and the access route be specified. However, in such a security system, only a trace of intrusion remains, and therefore, there is a problem that it is difficult to identify an unauthorized intruder or an access route thereof. In addition, when illegal data such as a virus invades and the terminal device or the entire network goes down, there is also a problem that it is difficult to analyze and clarify the source.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems of the prior art, and it is easy to identify an intruder, illegal data, and an access route thereof by leaving many traces of an intruder. The purpose of the present invention is to provide a security system.

[0007]

According to a first aspect of the present invention, there is provided a computer network security system in which a plurality of user terminal devices are connected to various servers. In a computer network, a legitimate service server that provides a service for legitimate access, a pseudo service server that permits access to illegal access, and, when an illegal access is found, connects the fraudulent access to the pseudo service server. Server switching means for accessing only secure data or pseudo data; and unauthorized access content recording means for recording an access log of the unauthorized access and data handled by the unauthorized access. It is assumed that.

According to a second aspect of the present invention, there is provided the computer network security system according to the first aspect of the present invention, wherein a user who attempts to access is authenticated to determine whether the access is authorized or unauthorized. An authentication server is provided.

[0009]

DESCRIPTION OF THE PREFERRED EMBODIMENTS (Embodiment 1) This embodiment prohibits unauthorized users from accessing data that must be protected by security, and at the same time permits access to pseudo-data, thereby preventing intrusion. By manipulating the pseudo data, a large number of traces are left behind to make it easier to identify unauthorized intruders and their access routes.

Hereinafter, a first embodiment of the present invention will be described with reference to FIGS. FIG. 1 shows the first embodiment.
1 is a configuration diagram of a computer network security system according to the present invention.

In FIG. 1, 1 is a user, 2 is an authentication server (server switching means), 3 is a regular service server, and 4 is a pseudo service server. Also, 4b in the pseudo service server 4 is a user pseudo data storage area that makes an unauthorized user think that the service is a legitimate service server, and 4a is a large pseudo data that is stored in the user pseudo data storage area 4b. An original pseudo data storage area, 4c is a user difference data storage area, 4d is a data library storage area, and 4e is a log storage area.

Each of these regions 4a, 4b, 4c, 4d,
Reference numeral 4e is allocated as a separate partition to a storage medium such as a hard disk drive in the pseudo service server 4, and changes the size of the storage medium of the pseudo service server according to the number of users who request authentication to the authentication server 2. You can also.

The large-scale pseudo data storage area 4a, user difference data storage area 4c, data library storage area 4d, and log storage area 4e are made inaccessible to intruders. This is FTP (File Transfer Protocol)
l) or using a file system that does not allow external data to be referenced by a communication protocol such as HTTP (HyperText Transfer Protocol). in this way,
By limiting the access authority of all executable data in the pseudo service server 4 to the user pseudo data storage area 4b, the operation of the pseudo service server 4 itself is not affected. .

The computer network security system shown in FIG. 1 has a plurality of LANs as shown in FIG.
In this case, it is assumed that the user 1 in FIG. 1 uses the terminal device 5 in FIG.
1 to 54, and the system including the authentication server 2, the regular service server 3, and the pseudo service server 4 in FIG. 1 corresponds to the management device 56 in FIG. 4, respectively. It goes without saying that it can be applied.

FIG. 2 is a configuration diagram of the pseudo service server 4 of FIG. In FIG. 2, reference numeral 40 denotes a file storage unit for storing a file, which is constituted by a hard disk drive or the like. Reference numeral 41 denotes a CPU. A log means (illegal access recording means) 41a for recording an access of an unauthorized user in the log storage area 4e of FIG. 1 by a program running on the CPU 41, and a pseudo data storage for the user of FIG. Area 4
b, and a difference extracting unit 41b for extracting a difference between the large original pseudo data storage area 4a, a data library registration unit 41c for detecting new illegal data and storing it in the data library storage area 4d of FIG. ,
A storage area management unit 41d for dividing the storage area (partition) and protecting data is realized. Reference numeral 42 denotes communication means for exchanging data between the inside and the outside of the pseudo service server 4.

Next, the operation of the computer network security system having the above configuration will be described with reference to FIGS. FIG. 3 is a diagram showing an operation flow of the computer network security system according to the first embodiment.

First, in the pseudo service server 4, the storage area management means 41d secures the large-size pseudo-data storage area 4a and secure data, that is, leaks to the outside in the large-size pseudo data storage area 4a of the file storage means 40. Data that can be falsified or falsified, or pseudo data, that is, data that is completely random, is stored.

Then, the storage area management means 41d of the pseudo service server 4 prepares the user pseudo data storage area 4b for the unauthorized user to access in preparation for access from the unauthorized user, and accesses the pseudo data storage area 4b by the unauthorized user. User difference data storage area 4 for recording the contents of changes at the time
c is secured as an area in the storage medium of the file storage means 40 (step S1).

The storage area management means 41d includes:
The pseudo data is copied from the original pseudo data storage area 4a to the user pseudo data storage area 4b, and the user difference data storage area 4c is initialized to have no data (step S2).

Next, the user 1 accesses the authentication server 2 to perform user authentication. The authentication server 2 authenticates a user who tries to access, and determines whether the access is authorized access or unauthorized access. The authentication server 2 determines general unauthorized access. Examples of this determination method include password mismatch and use of an unregistered IP address.

The authentication server 2 connects the user to the authorized service server 3 when the access of the user 1 is determined to be an authorized access, and connects the unauthorized user to the pseudo service server 4 when determined to be an unauthorized access ( Step S3).
Here, the reason that the authorized user and the unauthorized user are connected to different service servers is that the unauthorized user increases the processing load of the server on the authorized service server to bring down the system, or to perform root authority (management). This is to prevent unauthorized access to all functions of the server and falsification of data.

Thus, the user connected to the authorized service server 3 can access as usual (step S4). On the other hand, when the user 1 is authenticated as an unauthorized intruder, the user 1 is connected to the pseudo service server 4 (step S5).

When the pseudo service server 4 receives the connection of the user 1 from the authentication server 2, the pseudo service server 4 gives the user 1 an access right only to the user pseudo data storage area 4b previously secured for the user 1 so that the user 1 1, the pseudo data storage area 4b for the user in the storage medium is made to look like an original space opened by the service server 3. The user 1 accesses the user pseudo data storage area 4b and falsifies or deletes the data. The log means 41a of the pseudo service server 4 records an access log in the log storage area 4e from the time of starting the access (Step S).
6). The administrator starts specifying the user 1 and the access route based on the contents of the log storage area 4e.

Further, the user 1 writes illegal data such as a virus into the user pseudo data storage area 4b,
And so on, the difference extracting means 41 of the pseudo service server 4
b stores the difference between the pseudo data in the large source pseudo data storage area 4a and the user pseudo data storage area 4b in the user difference data storage area 4c (step S7), and stores the difference data in the data library registration means. 41c inquires a database of existing illegal data in the data library storage area 4d (step S8), and determines whether the data is new illegal data (step S9). If the data is new fraudulent data, the data library registration unit 41c registers the data in the data library storage area 4d in accordance with an instruction of the administrator (step S10), and furthermore, based on the contents of the log storage area 4e, the user 1 and its user. Start identifying access routes.

Thereafter, the user 1 sets the pseudo service server 4
When the connection to the pseudo data storage area 4 is disconnected (step S11), the storage area management unit 41 d
b and the user difference data storage area 4c are initialized to no data to prepare for the appearance of the next unauthorized user (step S1).
2).

The storage area management means 41d prepares a plurality of user pseudo data storage areas 4b and user difference data storage areas 4c in advance, and stores the accessed user pseudo data storage area and the user difference data storage area 4c. By sequentially initializing the data storage areas, it is also possible to avoid a situation in which the initialization cannot be performed in time when illicit use frequently occurs.

As described above, in the computer network security system according to the first embodiment, the pseudo service server is provided and the unauthorized user is connected to the pseudo service server. By prohibiting access rights to data that must be protected and allowing only safe or pseudo data to be accessed, access by an intruder can be continued and many traces of the intruder can be left. This makes it possible to characterize the intruder from the trace. In addition, for example, when the illegal data is a new type of virus, analysis of the virus can be useful for creating a vaccine or finding the source of the vaccine.

[0028]

As described above, according to the computer network security system according to the first aspect of the present invention, a legitimate service server that provides services for legitimate access, and a pseudo service server that permits access for unauthorized access. A server switching unit that, when an unauthorized access is found, connects the unauthorized access to a pseudo service server and accesses only secure data or pseudo data; An access log and an unauthorized access recording means for recording data handled by the unauthorized access are provided, so that the unauthorized access can be connected to a pseudo service server having no actual harm, and the unauthorized user can be connected as if the authorized server Access logs left on the pseudo server, Be able to be collected over data, it is possible to unauthorized user identification and sampling of unauthorized data from its contents, the advantageous effect is obtained that it is possible to the development of counter-how to identify and unauthorized access of unauthorized user.

According to a second aspect of the present invention, in the computer network security system according to the first aspect, the server switching means authenticates a user who attempts to access, An authentication server that discriminates between legitimate access and unauthorized access based on the authentication result can be distinguished from legitimate users and unauthorized users at an early stage, preventing access to the legitimate server and preventing damage. There is an effect that a security system having an advantage that can be obtained is obtained.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a computer network security system according to a first embodiment of the present invention.

FIG. 2 is a block diagram showing an internal configuration of a pseudo service server in the computer network security system according to the first embodiment of the present invention.

FIG. 3 is an operation flowchart of the computer network security system according to the first embodiment of the present invention;

FIG. 4 is a configuration diagram of a network system in which a conventional security system is implemented.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 User 2 Authentication server 3 Regular service server 4 Pseudo service server 4a Large source pseudo data storage area 4b User pseudo data storage area 4c User difference data storage area 4d Data library storage area 4e Log storage area 40 File storage means 41 CPU 41a Log means 41b Difference extraction means 41c Data library registration means 41d Storage area management means 51-55 Terminal device 11-15 LAN 21-24 Relay device 56 Management device

Continued on the front page (51) Int.Cl. ⁷ Identification code FI Theme coat II (Reference) H04L 9/32 H04L 9/00 675D F-term (Reference) 5B076 FB05 5B082 DD08 EA11 HA08 5B085 AC14 AE00 BA07 BC01 BG07 5B089 GA11 JA33 KA17 KB04 KB13 KC47 KC58 KE03 KG05 MC03 MC08 5J104 AA07 KA02 NA05 PA07

Claims (2)

[Claims] 1. In a computer network connecting a plurality of user terminal devices and various servers, a legitimate service server for providing services for legitimate access, and a pseudo for permitting access for unauthorized access A service server, a server switching means for connecting the unauthorized access to a pseudo service server when the unauthorized access is found, and accessing only secure data or pseudo data, an access log of the unauthorized access, A computer network security system, comprising: unauthorized access recording means for recording data handled by unauthorized access. 2. The computer network security system according to claim 1, wherein the server switching unit authenticates a user who attempts to access, and discriminates between an authorized access and an unauthorized access based on the authentication result. A computer network security system comprising an authentication server that performs authentication.