JP2003330802A - Confidential information access monitoring control method, confidential information access monitoring control system, and record medium storing the confidential information access monitoring control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a confidential information access monitoring control method for limiting an access right to a maintenance company at normal times and making the maintenance company quickly perform maintenance in case of emergency. <P>SOLUTION: An access control parameter definition information database 71 stores data or access right corresponding to application stored in monitored server computers 21 to 24 at every access. A monitoring control agent program 40 monitors and manages the access status for customer confidential information based on the access right stored in the database 71. A monitoring control log database 72 records the result of monitoring and limiting access according to the program 40. The monitored server computers 21 to 24 monitors and manages the access states to the customer confidential information based on the access right stored in the access control parameter definition information database 71 under the control of a monitoring control agent program 60 using the above database 71, the program 4 and the database 72, and records the result of monitoring and limiting access in the monitoring control log database 72. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a confidential information access monitoring control method in a client / server system for remotely operating and monitoring a system in a customer site via a network, and a confidential information access monitoring control system using the access monitoring control method. And a recording medium storing the confidential information access monitoring and controlling method, in particular, a confidential information access monitoring and controlling method capable of protecting the confidential information of the customer according to the customer's request, and confidential information using the access monitoring and controlling method The present invention relates to an access monitoring control system and a recording medium storing the confidential information access monitoring control program.

[0002]

2. Description of the Related Art In recent years, while business systems compatible with the Internet or Intranet have grown exponentially, many threats such as illegal invasion and virus attack against these systems have been reported, and users' anxiety about system safety. Is also increasing. In particular, the business system in a company stores a lot of confidential information including personal information, which cannot be leaked or illegally used.
For corporate management, leakage of such confidential information will result in a great deal of damage such as loss of credibility, customer abandonment, and criminal lawsuits. However, due to the recent opening of the system and the progress of Internet or intranet connection, there is an increasing possibility of being exposed to threats of leakage and unauthorized use.

For example, in local governments, etc. in recent years,
While it is hoped that the system will be open for various services to residents (for example, registration / change of resident card, issuance of seal stamp certification, provision of minutes information of parliament, etc.), residents will be invaded by malicious third parties. Personal information such as ledgers and resident assets / taxes may be leaked or used illegally,
There are conflicting needs for openness and confidentiality.

Under such a background, the maintenance company (data center) that undertakes the operation management and failure management of the customer system not only provides immediate and flexible construction and operation of the system, but also the safety and robustness of the system. They have come to recognize that guarantees also need to be provided as a service. And, as a service example, in order to prevent unauthorized intrusion of the system from outside the company, measures such as installation and management of firewall, introduction and management of intrusion detection system,
Measures to prevent information leakage within a company include digital authentication of important documents and user access control.

As a document in which the above-mentioned confidentiality protection technology according to the prior art is described, for example, the access reliability of a person who may have an access request from the outside and the corporate confidentiality level in advance for a plurality of data are preliminarily set. If set, and if there is an access request through the external network in the corporate system, JP-A-2002-84324 or JP-A-2002-84324 which describes that the access target is restricted according to the access reliability and secrecy, Monitor addresses accessed from outside,
Japanese Patent Laid-Open No. Hei 9- 9 describes a technique for permitting access only to an address for which a preset security permission has been obtained.
319715 publication is mentioned.

[0006]

In the above-mentioned prior art confidentiality protection technology, a company sets a confidentiality level in advance, and sets access to an authorized confidentiality level to an authorized access target person. However, if there is a computer system of a certain company and a maintenance company that manages the maintenance of the computer system,
If the maintenance company is granted unconditional access to perform maintenance, it means that the maintenance company can access confidential information inside the company even when maintenance is not required. It is possible to hesitate to introduce a maintenance company. Conversely, if access rights to the maintenance company are restricted, it will not be possible to respond promptly if a failure occurs in the company's computer system. There was a problem that the reliability of the system decreased.

In particular, when the above-mentioned company is a public institution such as a local government, a resident register or resident assets /
Personal information such as taxes is stored, and in recent years, with the enactment of the Personal Information Security Law, it is not preferable for local governments to have an environment in which personal information can be easily accessed from maintenance companies, and hesitates to introduce maintenance companies. there were.

Actually, a third party (maintenance company) who undertakes the development and operation / maintenance work of the customer business system has an opportunity to obtain confidential information of the customer and use it for testing the system or troubleshooting and remote monitoring / operating. May have. Generally, in order to perform these tasks, it is necessary to access the system with administrator authority, so the system administrator authority is given to this third party. Therefore, in system operation monitoring work by a third party, it is not necessary to browse confidential information such as application logs necessary for countermeasures in the event of an emergency such as a failure during regular operation. Regardless, since it has been given system administrator authority, it is always left in a state in which it can be viewed in a regular way. Third parties not only have free access to customer confidential information, but also perform important operations such as changing the settings of the computer on which the customer business system is operating in a remote operating environment without any special prior confirmation. There was a problem that I could do it.

An object of the present invention is to eliminate the above-mentioned problems caused by the prior art. A customer side company having a computer system, a local government or the like restricts an access right to a maintenance company in a normal time, Further, there are provided a confidential information access monitoring control method capable of promptly performing maintenance by a maintenance company in an emergency, a confidential information access monitoring control system using the access monitoring control method, and a recording medium storing the confidential information access monitoring control program. It is to be.

[0010]

In order to achieve the above-mentioned object, the present invention provides a method for accessing a plurality of monitored server computers from a monitored server computer via a network, so that In a confidential information access monitoring control method for monitoring access status to applications and data, an access control parameter definition information database storing access rights corresponding to data or applications stored in a monitored server computer for each access, and the access control parameters The monitoring control agent program that monitors and manages the access status to the customer confidential information based on the access right stored in the definition information database, and the results of the access monitoring and restriction performed by the monitoring control agent program. The monitored server computer monitors and manages the access status to the confidential information based on the access right stored in the access control parameter definition information database under the control of the monitoring control agent program by using the monitoring control log database for recording. The first feature is that the result of access monitoring and restriction is recorded in the monitoring control log database.

Further, according to the present invention, the confidential information access for monitoring the access status to the application and data in the monitored server computer by accessing the plurality of monitored server computers from the monitoring server computer via the network. In the monitoring control system, the monitored server computer stores at least an access right corresponding to data stored in the monitored server computer of an access unit or an application, and the access control parameter definition information database. A monitoring control agent program that monitors and manages the access status to confidential information based on the access rights stored in The second comprising the results and monitoring control log database that records the.

Further, according to the present invention, the confidential information access for monitoring the access status to the application and data in the monitored server computer by accessing the plurality of monitored server computers from the monitoring server computer via the network. An access control parameter definition information database, which is a recording medium storing a program for performing monitoring control, stores access rights corresponding to data or applications stored in a monitored server computer for each access, and the access control parameter definition information database A monitor control agent program that monitors and manages the access status to customer confidential information based on the access right stored in, and the result of access monitoring and restriction by the monitor control agent program. Using a supervisory control log database, the computer, the monitored server computer, the control of the monitor control agent program,
A program that functions as a procedure for monitoring and managing the access status to confidential information based on the access rights stored in the access control parameter definition information database, and a procedure for recording the results of access monitoring and restriction in the monitoring control log database. The third characteristic is that the computer can read the recorded data.

[0013]

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, a confidential information access monitoring control method according to an embodiment of the present invention, a confidential information access monitoring control system using the access monitoring control method, and a recording medium storing the confidential information access monitoring control program. Will be described in detail with reference to the drawings. FIG. 1 is a conceptual diagram of a confidential information access monitoring control system according to this embodiment,
2 is a system configuration diagram according to an embodiment of the confidential information access monitoring control system according to the present embodiment, FIG. 3 is a functional configuration diagram showing a specific configuration of the confidential information access monitoring control system, and FIG. 4 is an access control shown in FIG. 5 is a block diagram of the processing function of the unit 62, and FIG. 5 is an access control condition setting unit 6 of FIG.
21 is an operation flowchart showing the processing procedure of FIG.
7 is an operation flowchart of the processing procedure of the access control determination unit 622, and FIG. 7 is an operation flowchart of the processing procedure of the access control condition updating unit 624 of FIG.

<Description of Positioning of Confidential Information Access Monitoring and Control System According to this Embodiment> First, the positioning of the confidential information access monitoring and control system according to this embodiment is shown in FIG.
Will be described with reference to. Generally, the method of accessing the customer confidential information from the outside is as shown in FIG.
And access means 3 for the access user 2 to access and access control 4 for controlling the access means 3. The access user 2 can access the access means 3 under the control of the access control 4. Can be represented as accessing the customer confidential information 100.

For example, the external user of the access user 2 cannot access the customer confidential information 100 due to the access control such as the firewall of the access control 4 and the intrusion detection system. On the other hand, the general authorized user has an opportunity to access the customer confidential information 100 through the business application, and access control is performed by the security implemented in the business application, such as input of user ID and password. On the other hand, in the confidential information access monitoring and control system of this embodiment, conventionally, the customer system administrator and the operation / maintenance staff use the system administrator authority to relatively freely access the management / operation application including the operation system command. In the present embodiment, by disposing the confidential information access monitoring control system between the access means 3 and the customer confidential information 100, the confidential information access monitoring control system is Access control is performed based on access conditions.

<Description of Overall System Overview> FIG. 2 is a block diagram showing an overall overview of a computer system including the confidential information access monitoring control system according to the present embodiment.
As shown in FIG. 2, this system has a management operation screen 11, a monitoring control agent management program related to the management part of the confidential information access monitoring control system, and stores a data by installing a monitoring control agent management program on the side of a maintenance company. And a management operation screen 20, a confidential information access monitoring control agent program is installed, and the monitored server computer 21 to 21 of the above-mentioned company that stores data is stored.
24, a network 3 which is a public communication line connecting the monitoring server computer 1 and the monitored server computers 21 to 24, and an information recording medium storing a program and a file for realizing the confidential information access monitoring control system. CD-ROM 4 and the CD-RO
Like the M4, it includes a flexible disk 5 which is an information recording medium storing a program and a file for realizing the confidential information access monitoring control system. The programs and files stored in the CD-ROM 4 or the flexible disk 5 are the monitoring server computer 1 and the monitored server computers 21 to 21 as necessary.
It shall be installed in 24 and executed.

<Explanation of each monitoring server system> Now,
The specific configuration of the confidential information access monitoring control system according to the present embodiment is, for example, as shown in FIG. 3, the monitored server computers 21 to 24 on the company side, and the monitoring server computer 1 corresponding to the maintenance company, for example. Are interconnected by a network 3.

The monitored server computers 21 to 2
4 is a user operation screen 20, a supervisory control agent program 6 installed to implement the confidential information access supervisory control system of the present invention in the monitored server computers 21-24, and the supervisory control agent program 6. The information storage unit 70 includes a parameter definition information database 71 and a monitoring control log information database 72 to be used.

The supervisory control agent program 6
Is a communication control unit 61 that controls communication with the outside, an access control unit 62 that controls access from the access user shown in FIG. 1, and a resource management unit 63 that manages communication record (log) data described later. A data protection unit 64 that controls encryption and the like, and an event control unit 65 that manages events that occur in each function in the monitored control agent program.

The parameter definition information database 71 of the information storage unit 70 stores access rights for each access user or each data confidentiality level as parameters according to conditions such as a normal state or a failure occurrence level, and monitors the parameters. The control log database 72 is the monitoring server computer 1
The access status from the access user including is stored as a communication log.

The access control unit 62 has a hierarchical structure and, as shown in FIG. 4, includes an access control condition setting unit 621 for setting conditions for access monitoring and restriction of customer confidential information, and an access control condition setting unit 621. An access control determination unit 622 that determines whether access to customer confidential information is possible or not, and whether recording is necessary or not, and a monitoring control log information database 7 that monitors access contents to customer confidential information.
2 and an access control condition updating unit 624 that specifies the determination when changing the access monitoring and restriction conditions set for the customer confidential information and the operation after the change. .

Like the computer 21 and the like, the monitoring server computer 1 has a user operation screen 11 and a monitoring control agent management program 40 installed to implement the confidential information access monitoring control system.
And an information storage unit 50 including a parameter definition information database 51 and a monitoring control log information database 52 used by the monitoring control agent management program 40. The supervisory control agent management program 40 is
Like the agent program 6, the communication control unit 4
1, an access control unit 42, a resource management unit 43, a data protection unit 44, an event control unit 47, as well as a report generation unit 4 that supports the creation of reports such as monitoring conditions and monitoring history logs.
5. A monitoring control agent control unit 46 for monitoring the operating status of the monitoring control agent program 60 in each monitored server / computer 21 and the like. Further, the access control unit 42 in the supervisory control agent management program 40 is also provided with the same function hierarchy as the access control unit 62, which enables access control in the supervisory server / computer.

<Procedure for setting access control conditions> In the confidential information access monitoring and control system configured as described above, when the access control conditions are set, the administrator calls the access control information setting screen as shown in FIG. 5 (step 62
101), on this screen, designation of applications and data files subject to access monitoring, designation of user information that is accessible or inaccessible, designation of access methods such as browsing and updating, routine work, trouble resolution, and configuration change work Set access control conditions consisting of type (621
02)

At this time, the administrator can set a plurality of access control conditions for one access monitoring target or access monitoring target group at the same time, and specify which of the access control conditions is valid. To do. The setting of the administrator who can change the access control condition is also defined as a parameter of the access control condition.

This setting allows the monitoring server computer 1 to access the monitored server computers 21 to 24 during normal operation when the operation mode is normal / when a low level failure occurs / when a high level failure occurs. As for the range, the data can only be indirectly accessed through the application for operation and maintenance, the contents of the log file and the database table cannot be directly read, and the application outputs when a low-level failure occurs. Make settings so that only logs and event log files (part of the contents may contain resident information itself or information necessary to access the resident information system) can be referenced only on the monitored server computer. When a high-level failure occurs, the log output by the application for failure analysis and the Set to enable external take-out of the database files themselves vents log file or resident information (transfer to an external recording copying and monitoring server computer 1 to the medium) can be considered.

As the setting, the system installed on the monitored server computer 21 or the like
Since it is possible to control access to files and applications related to each (application) unit, if it is known in advance which system in the monitored server has a failure, it is set for that system. Make settings to relax only access control conditions.

More specifically, for example, there is a resident information data file as an access control target of the resident information system, and a map information database file as an access control target of the area / map information system. Only when a failure occurs, If it is set so that the contents of each database file can be referenced, and if it is known that some kind of failure has occurred in the resident information system, only the access control conditions of the resident information system are mitigated for troubleshooting. The area / map information system database file can be set to be inaccessible. However, when there are files or applications that are access control targets common to a plurality of systems, it is necessary to set the priority order so that the respective access control conditions do not conflict.

Further, as the setting, designated hard disk / designated folder / monthly (last day) processing can be set. In addition, for these settings, the monitoring side and the monitored side should create a manual at the time of failure occurrence according to the possible failure in advance, and the monitored side administrator should refer to the manual when some kind of failure occurs. The operation mode can be changed as described later.

Access control condition setting unit 621 (FIG. 4)
Stores these access control conditions as parameter information of the monitoring control agent in the parameter definition information database 71 (step 62103), and at the same time, transfers the parameter information to the monitoring control agent management program 40, and the parameter definition information database 5
1 as backup information (step 621)
04).

<Access Control Setting Procedure> In this confidential information access monitoring control system, the access control determining unit 622 causes the parameter definition information database 71 when the monitoring control agent program 6 is activated in response to an external access to customer confidential information. The access control condition parameter information is read from (step 62201), the access status to the application or data file that is the access monitoring target set in the access control condition parameter is monitored (step 62202), and the access monitoring target is accessed. If it is determined that access recording is necessary, it is determined whether or not access recording is required based on the access monitoring condition that specifies whether or not to perform monitoring recording (step 62203).
Records the access status in the monitoring control log information database 72 (step 62204).

Therefore, the present system can always monitor and judge the access situation from the outside during normal times to the time of occurrence of a failure, and by keeping a monitoring record if necessary, it is possible to evaluate the external access if necessary. That is, if unauthorized intrusion from the outside is expected, the source of the intrusion and the contents of the accessed file can be known.
It can be used as a countermeasure.

Next, in this process, it is judged whether or not access restriction is required based on the access restriction condition that specifies whether or not to restrict access (step 62205). By recording the access status in the monitoring control log information database 72 (step 62206) and restricting the access (step 62207), it is possible to prevent the intrusion of the access without the access authority and to keep the record.

Further, in this processing, it is determined whether the notification is necessary or not based on the notification condition that specifies whether or not to notify the access status (step 62208). If it is determined that the notification is necessary, the access control determination unit 622 causes the event control unit 622 to perform the notification. By performing the processing of transferring the notification content to the monitoring control agent management program 40 via 65 (step 62209), for example, an unauthorized access can be notified to the administrator.

<Access control condition updating procedure> In the confidential information access monitoring control system according to the present embodiment, when the monitored side changes the access control condition to the customer confidential information, for example, when a failure occurs, as shown in FIG. , The administrator logs in to the supervisory control agent program and calls the access control information setting screen (step 6240).
1) On the screen, request the access control condition update unit to update the corresponding access monitoring target (step 6240).
2) Then, at this time, it is determined whether or not the access control condition of the corresponding access target can be changed by referring to the user information logged in to the supervisory control agent program (step 62403). Is finished (step 62404), and if the user is logged in as a user whose access control condition can be changed, then the effective condition of the changed access control condition is set (step 62405).

The valid conditions of the changed access control conditions include, for example, setting of a period or time period during which the changed access control conditions are valid (for example, business days / business hours),
In addition to setting the upper limit of the number of valid accesses, you must issue a second password that is temporarily valid during such access, and enter this login second password in addition to the login ID for normal access. , Do not allow access to the customer confidential information. The access control condition updating unit 624 resets the operation under the changed access control condition so as to be valid (step 6240).
6) It is stored in the parameter definition information database 71 together with the effective condition of the changed access control condition as the parameter information of the monitoring control agent (step 6240).
7) At the same time, the parameter information is transferred to the supervisory control agent management program 40 and stored as backup information in the parameter definition information database 51 (step 62408).

After that, the access control condition determination unit 622
Monitors the access status to the customer confidential information based on the changed access control condition and the valid condition, and requests the access control condition updating unit 624 to reset the access control condition when it becomes invalid. . At this time, if the notification condition is satisfied, the event control unit 65 is requested to notify, and if the recording condition is satisfied, the access control recording unit is requested to record the log.

<Overall Operation and Effect of the Present Embodiment> In the confidential information access monitoring and control system configured as described above, the monitoring server computer 1 operates and maintains the monitored server computers 21 to 24 in normal times. Since only the access authority to indirectly access the data through the application for security is given, in normal times, the company on the monitored server / computer side does not have the risk of leaking confidential internal information to the outside, and a low-level failure occurs. Sometimes the administrator on the monitored server / computer side changes the operation mode to, for example, the low-level failure occurrence mode by referring to the manual at the time of the failure occurrence, so that the access right to the log or event log file output by the application Is given to the monitoring server computer side, If the low level failure mode cannot be maintained, the administrator changes to the high level failure mode and the log output by the application, event log file or resident information is used for failure analysis. By allowing the database file itself to be taken out, it is possible to deal with the failure.

Further, when it is known in advance which system in the monitored server computer 21 or the like has a failure, it is possible that the administrator has some kind of failure in the failure occurrence system, for example, the resident information system. If it is known, only the access control conditions of the resident information system are relaxed as measures against failures, so that necessary maintenance can be performed while limiting access to the database files of the regional / map information system. Also, by setting the above-mentioned temporarily valid second password by the administrator, unless the second password is input in addition to the normal ID and password, access to the customer confidential information is not permitted. By doing so, the monitored side can also set access with time restrictions.

[0039]

As described above, according to the present invention,
Not necessary for some jobs by setting multiple conditions for restricting access to confidential information by system administrators and system operators at various levels for each job, and monitoring or restricting access conditions based on this Access can be avoided, and confidential information of customers can be protected. In this way, the conditions of multiple access restrictions can be relaxed or strengthened by a limited number of users specified in advance, and confidential information in the customer business system that cannot be disclosed to the person in charge of operation at regular times In the event of an emergency such as a failure, the system administrator on the customer side can temporarily establish a system for protecting confidential information in the system, such as by relaxing access conditions so that the person in charge of operation can view it. It is possible to support the responsibility assurance business of the security of the client business system of the management company.

In addition, the security measures that have been dealt with so far by improving the system management and operation system and educating the people involved in these operations can now be systematically handled, and system management / operation contractors are of various types. It is possible to manage various customer business system environments uniformly and efficiently.

Further, from the meaning of protecting personal information,
By applying the present invention to a customer business system that has restrictions on network connection and remote monitoring with the outside,
The reliability of the customer can be improved, and the understanding of the introduction of the remote monitoring environment can be deepened. For example, it is also possible to recommend measures against the fear of leakage of personal information in public organizations.

A plurality of protocols can be adopted for the communication between the supervisory control agent program 60 and the supervisory control agent management program 40, and in particular, a new security fall is opened by making the protocol corresponding to the Internet available. Can be prevented.

[Brief description of drawings]

FIG. 1 is a conceptual diagram of a confidential information access monitoring control system according to an embodiment of the present invention.

FIG. 2 is a system configuration diagram of an embodiment of a confidential information access monitoring and control system according to the present embodiment.

FIG. 3 is a functional configuration diagram showing a specific configuration of the confidential information access monitoring control system.

4 is a configuration diagram of processing functions included in the access control unit 62 of FIG.

5 is an operation flowchart showing a processing procedure of an access control condition setting unit 621 in FIG.

6 is an operation flowchart of a processing procedure of an access control determination unit 622 in FIG.

7 is an operation flowchart of a processing procedure of an access control condition updating unit 624 of FIG.

[Explanation of symbols]

1: Monitored server computer, 2: Access user, 3: Access means, 4: CD-ROM, 5: Flexible disk, 6: Monitoring control agent program, 62: Access control unit, 63: Resource management unit, 64:
Data protection unit, 65: event control unit, 61: communication control unit, 71: parameter definition information, 72: monitoring control log,
40: supervisory control agent program, 42: access control unit, 43: resource management unit, 44: data protection unit, 4
5: event control unit, 41: communication control unit, 41: parameter definition information, 42: monitoring control log.

Claims (3)

[Claims] 1. A confidential information access monitoring control method for monitoring access status to an application and data in a monitored server computer by accessing a plurality of monitored server computers from a monitoring server computer via a network. The access control parameter definition information database that stores the access right corresponding to the data or the application stored in the monitored server computer for each access, and the customer based on the access right stored in the access control parameter definition information database The monitoring control agent program that monitors and manages the access status to confidential information and the monitoring control log database that records the results of access monitoring and restriction by the monitoring control agent program are used to monitor the monitored information. The monitoring server computer monitors and manages the access status to the confidential information based on the access right stored in the access control parameter definition information database under the control of the monitoring control agent program, and monitors the result of access monitoring and restriction. A confidential information access monitoring control method characterized by recording in a control log database. 2. A confidential information access monitoring control system for monitoring a status of access to an application and data in a monitored server computer by accessing a plurality of monitored server computers from a monitoring server computer via a network. And
An access control parameter definition information database in which the monitored server computer stores at least data or access right corresponding to an application stored in the monitored server computer of an access unit, and an access stored in the access control parameter definition information database Monitor access status to confidential information based on authority
A confidential information access monitoring control system, comprising: a monitoring control agent program for managing; and a monitoring control log database for recording a result of access monitoring and restriction performed by the monitoring control agent program. 3. Confidential information access monitoring control for monitoring access status to applications and data in a monitored server computer by accessing a plurality of monitored server computers from a monitoring server computer via a network. A recording medium storing a program to be executed, which is stored in the access control parameter definition information database for storing access right corresponding to data or application stored in the monitored server computer for each access, and the access control parameter definition information database. A monitoring control agent program that monitors and manages the access status to confidential customer information based on the access right, and a monitoring control log that records the results of access monitoring and restriction by the monitoring control agent program. The monitored server computer monitors and manages the access status to the customer confidential information based on the access right stored in the access control parameter definition information database under the control of the monitor control agent program. A computer-readable recording medium in which a procedure and a program that functions as a procedure for recording a result of access monitoring and restriction in a monitoring control log database are recorded.