JP2002366525A - Security policy maintenance system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To newly develop a system for maintaining the security policy of a network. SOLUTION: When a client 6 logs in a network, resource information of the client is acquired by a security agent client 7, transmitted to a security agent server 5, an information data base 2 intrinsic to the client is compared with a security policy data base 3 in a security policy server 1 and permission or nonpermission of network log in by the client 6 is determined. In addition, the security agent client 7 always monitors an operating state of the client 6, transmits it to the security agent server 5 and when breach of the security policy is caused, disconnects network connection by the client 6.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to the by the client security level to participate in the network in the use of computer networks, it relates to media for recording it and network security level management controller or an application.

[0002]

2. Description of the Related Art Conventionally, if you continue to operate to build a computer network, in advance to create the operational manuals, etc., to set the item for the security maintained in that,
Done to improve the user's moral, it has been to maintain the security level.

[0003] In addition, the network participants distinction, because you were allowed to participate in check only network login ID and password, some clients do not maintain a private personal computers and security level arrangements,
He had participated in easy to network.

[0004] In addition, by lower security level the network administrator does not know the client to participate in the numerous network, if the security level of the network is reduced, serious problems such as infection and leakage of information to the virus occurs was there.

[0005]

The present invention is to challenge you try to provide a process, in order to solve the above-mentioned problems, to perform a denial and limit the participation to the network was set to be by the client of the security level information acquisition and the acquired security level It intended, characterized by the following apparatus and method.

An object of the present invention is to provide a management method for limiting the network participation of the client that does not lead to a reference security level network administrator defined.

[0007]

To reside a security check agent to the server and the client SUMMARY In order to achieve the above, turn on the client, security agent starts from the time you start. The security agent, the network administrator has set on the client,
The acquisition of the operating status and version information of all times normal operation is necessary applications do. In addition, it makes the acquisition of other operation in the application information and transmits it to the server along with the log-in process the acquired information.

[0008] The server-side, client security information is transmitted and, the specific data such as MAC address, CPU and HDD size of the client compared to the contents of the security policy configuration database, to determine the propriety of network participation.

[0009] If the network participation is permitted, but becomes as it is possible to use the network resources, in the case of non-permit, deny network login.

[0010] In addition, when the security agent of the login process on a network server from a non client running is performed, by the security agent that resides on the server side, was forced to interrupt the network login process, network refuse to participate.

[0011]

DETAILED DESCRIPTION OF THE INVENTION network users, start the client of 6 that is self-management of, by entering the start-up after the ID and password, to log in to the network.

[0012] The client, if the client of the regular permission, by 7 security agent client, hardware resource information of the software operating status and 9 of 8 is acquired, the security agent from 5 to 7 security agent client along with the log-in process It is sent to the server, 6 security agent servers, on one of the security policy server, the second client-specific information based on the database and security policy database information of 3, to determine the propriety of the login.

[0013] has reached the security level is standard, 5 of security agent server, to the 7 security agent client, to allow login.

[0014] However, if the security level of the reference below, 5 is the security agent server, to the 7 security agent client, rejects the login, to send a reason for rejection of login 7 of the security agent client. 7 security agent client will display the reason for rejection was received. The user action according to the instructions, and the login process again.

[0015] In addition, if not a client of the regular permission of the privately owned, 7 security agent client country running or client-specific information of the operation and even if the MAC address and the CPU and the HDD size, and the like, is, 2 because of no registration in the client-specific information database, by 5 security agent server, network participation is denied.

[0016] In addition, 7 security agent client of, while connected to the network, detects a change to 6 clients of software and hardware resources, and notifies the 5 security agent server, 5 of security agent server, notification content is compared with the security policy database, if there is a violation of the security policy, to forcibly disconnected from the network 6 of the client.

[0017] In addition, 5 of the security agent server, monitors the operation of the always-7 security agent client, if you cut off the signal from the 7 security agent client, determined that the abnormality has occurred in the security level of 6 of the client and forcibly disconnected from the network.

[0018]

According to the present invention can be achieved by taking advantage of the security policy maintenance system of the present invention, it is possible to prevent the client's connection to violate the security policy, it is possible to maintain the security level of the network. In addition, by managing to record the resource status of each client to the database, even if the MO and the RAS environment expansion maliciously, because it is automatically disconnected from the network, confidential information and personal information leaks and virus it can be prevented from entering.

BRIEF DESCRIPTION OF THE DRAWINGS

Is a diagram for explaining the flow of basic processing of the present invention; FIG

DESCRIPTION OF SYMBOLS

1 - Security policy server 2 - client-specific information database 3 - security policy database 4 - Server 5 - Security agent server 6 - Client 7 - security agent client 8 - Soft relationship 9 - Hard relationship

[Procedure amendment]

[Filing date] 2001 July 23 (2001.7.2
3)

[Amendment 1]

[Correction target document name] specification

[Correction target item name] claim 2

[Correction method] change

[Correction contents]

[Amendment 2]

[Correction target document name] specification

[Correction target item name] Field of the Invention

[Correction method] change

[Correction contents]

The present invention relates is, by the client security level to participate in the network in the use of the computer network, the network participation
And restrict device or application relates medium for recording it.

Claims (3)

[The claims]
1. By 1. A client security level to join the network, a permission and reject means clients network participation from the server side, acquires the security level information, the security level of the check means between the client and the server When, characterized by comprising a medium for recording it and the security policy maintenance device or application
2. 2. A client is participating in the network,
   Even while continuing treatment, means to monitor the security level information of the client, to limit the use of network resources if it becomes impossible to get or if security level information security level is lower than the network participation possible level characterized by comprising a preparative,
   E-mail management system and applications and media to record it
3. Wherein further comprising a client determination means of the network administrator legitimate clients and unauthorized you allow characterized, security policy maintenance device or application and the medium for recording it