JP2004355285A - Security policy setting method, device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To set the security policy of a user and the security policy of an Internet service provider in a firewall set in a user network in order to prevent any unauthorized access to the user network, and to prevent an unauthorized access to the Internet service provider network by the user network, and to prevent the traffic increase of the unauthorized access. <P>SOLUTION: Separation information to discriminate a security policy shown by ISP priority order 1 and 2 set by an Internet service provider from a security policy shown by user priority order 1, 2 and 3 set by a user is set before and after each security policy such as the beginning and tail of the security policy of the Internet service provider and the beginning and tail of the security policy of the user, and the security policy of the Internet service provider and the security policy of the user are made to coexist in the firewall of the user network. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a security policy setting method, apparatus, and program for setting a security policy in a firewall, which is a network security apparatus for protecting a computer network from unauthorized access, and more particularly, to security of a user's network and an Internet service provider's network. The present invention relates to a security policy setting method, an apparatus, and a program for setting a security policy, which is an operation rule for restricting unauthorized access to both networks, in a firewall provided in a user network in order to ensure security.
[0002]
[Prior art]
2. Description of the Related Art In recent years, the use of brod bands has become widespread, and the number of users who constantly connect a computer to the Internet is rapidly increasing. On the other hand, unauthorized access to computers connected to the Internet is also increasing, and firewalls are becoming widespread as means for preventing unauthorized access to user networks.
[0003]
The firewall is installed at the connection point between the user network and the Internet, and discards packets that the user does not want as unauthorized access. This firewall may be installed in a user network or an Internet service provider's network. Note that broadband routers installed in user networks are increasingly provided with a firewall function due to high performance and low price of the broadband routers installed in user networks.
[0004]
FIG. 11 is a diagram showing an Internet connection configuration when a firewall is installed in the user network 10 as indicated by reference numeral 11, but in this figure, the firewall 11 is provided in a broadband router. As shown in the figure, the client 15 of the user network 10 is connected to the Internet service provider network 50 and the Internet 3 from the firewall 11 via the router 51, and within the Internet service provider network 50 from the router 51 via the firewall 53. The server 3 is connected to the server 55 via the firewall 31 in the Internet 3.
[0005]
FIG. 12 is a diagram showing an Internet connection configuration when a firewall is installed in the network 50a of the Internet service provider as indicated by reference numeral 14. As shown in the figure, a client 15 of a user network 10a is connected from a broadband router 12 to an Internet service provider network 50a and the Internet 3 via a router 51 from a firewall 14 provided in the Internet service provider network 50a. In the provider network 50a, the router 51 connects to the server 55 via the firewall 53, and in the Internet 3, connects to the server 33 via the firewall 31.
[0006]
As shown in FIG. 11, when the firewall 11 is installed in the user network 10, the user sets the security policy of the firewall 11, but the user needs to have advanced knowledge of network security.
[0007]
On the other hand, as shown in FIG. 12, when the firewall 14 is installed in the Internet service provider network 50a, in order to change the setting in accordance with the change of the user's network configuration or the necessary communication, the user needs to use the firewall 14 It is necessary to ask the Internet service provider to change the security policy, and it lacks flexibility and speed. As a service of this system, there is Secure OCN ADSL by NTT Communications (for example, see Non-Patent Document 1).
[0008]
In recent years, Internet service providers increasingly provide mail services, network news services, video distribution services, and the like using servers installed in Internet service provider networks, but these services are protected from unauthorized access by users. As a method, an Internet service provider generally sets a security policy in a firewall provided in the Internet service provider network.
[0009]
[Non-patent document 1]
"FW / ISD service specification", [online], 2003/5/16, [2003/5/16 search], Internet <URL: http: // www. ocn. ne. jp / securecn / acca spec 02. html # a06>
[0010]
[Problems to be solved by the invention]
In order to protect the server of the Internet service provider from unauthorized access from the user, discarding the unauthorized access packet at the firewall closest to the source of the unauthorized access can prevent an increase in network traffic due to the unauthorized access. Therefore, it is desirable to implement a security policy that protects the Internet service provider from unauthorized access to the service by a user network firewall. However, since the security policy of the user network firewall is managed by the user, the It is difficult to set both security policies of the Internet service provider, and the security policy of the Internet service provider is set in the firewall of the Internet service provider network. It is desired to simultaneously set the security policy of the user and the security policy of the Internet service provider in the firewall installed in the user network.
[0011]
The present invention has been made in view of the above, and an object of the present invention is to set a security policy of both a user and an Internet service provider to coexist on a firewall provided in a user network so that unauthorized use of the user network can be prevented. It is an object of the present invention to provide a security policy setting method, apparatus, and program that can prevent unauthorized access to an Internet service provider network while protecting access, while also preventing unauthorized access traffic from increasing.
[0012]
[Means for Solving the Problems]
In order to achieve the above object, according to the present invention, there is provided a security policy setting method for setting a security policy for ensuring security of a user's network and an Internet service provider's network in a firewall provided in a user network. The gist is that delimiter information for distinguishing between a security policy set by a user and a security policy set by an Internet service provider is set between both security policies or before or after each security policy.
[0013]
According to the first aspect of the present invention, delimiter information for distinguishing a security policy set by a user from a security policy set by an Internet service provider is set between both security policies or before or after each security policy. Therefore, the security policy of both the user and the Internet service provider can be set to coexist with the firewall of the user network, thereby preventing unauthorized access to the user network and preventing unauthorized access to the Internet service provider network at the user network. It is possible to protect and prevent an increase in network traffic due to unauthorized access.
[0014]
According to a second aspect of the present invention, in the first aspect of the invention, the Internet service provider management terminal calculates and stores a hash value of a security policy created by the Internet service provider by using a hash function, Encrypting the hash value using a secret key of the Internet service provider, and transmitting the encrypted hash value and the security policy created by the Internet service provider to a firewall provided in a user network to an Internet service provider management terminal; In the user management terminal, the hash value of the security policy created by the user is calculated and stored by a hash function, and the hash value is encrypted using the user's private key. The encrypted hash value And user created The security policy is transmitted from the user management terminal to the firewall provided in the user network, and the firewall of the user network acquires a public key corresponding to the secret key of the Internet service provider, and uses the acquired public key. Decrypting the encrypted hash value received from the Internet service provider management terminal to obtain a hash value, and converting the hash value of the security policy of the Internet service provider received from the Internet service provider management terminal by a hash function. The calculated hash value is compared with the hash value obtained by the decryption, and as a result of the comparison, if the two hash values do not match, it is not a true security policy from a legitimate Internet service provider. Then, the security policy is discarded, and if both hash values match, it is confirmed that the security policy is a true security policy from a legitimate Internet service provider, and the security policy of the user network is determined as the security policy of the Internet service provider. Set in the firewall, in the firewall of the user network, obtain a public key corresponding to the private key of the user, using the obtained public key, decrypt the encrypted hash value received from the user management terminal A hash value of the security policy of the user received from the user management terminal by a hash function, and compares the calculated hash value with the hash value obtained by the decryption. , If the hash values do not match, It is determined that the security policy is not a true security policy from a valid user, the security policy is discarded, and if both hash values match, it is confirmed that the security policy is a true security policy from a valid user, and the security policy of the user is determined. The gist is to set in the firewall of the user network.
[0015]
According to the second aspect of the present invention, the hash value of the security policy of the Internet service provider is calculated and stored, and the hash value is encrypted using the secret key of the Internet service provider. Sending the hash value and the security policy of the Internet service provider to the firewall of the user network, calculating and storing the hash value of the user's security policy, encrypting the hash value using the user's private key, and encrypting the hash value; The Internet service provider sends the encrypted hash value and the user's security policy to the user network firewall, decrypts the encrypted hash value with the Internet service provider's public key to obtain the hash value, and receives the received hash value. No Calculates the hash value of the security policy, compares the two hash values and confirms that it is a true security policy from a legitimate Internet service provider, sets it on the firewall of the user network, and encrypts it with the user's public key. Decrypts the hash value to obtain the hash value, calculates the hash value of the security policy of the received user, compares the two hash values, and confirms that the security policy is a true security policy from a valid user. The Internet service provider and the user security policy set in the user network firewall to be set in the network firewall are the true security policies created by the legitimate user and the Internet service provider, respectively. It is possible to confirm whether or not to accurately.
[0016]
Further, according to a third aspect of the present invention, in the second aspect, the Internet service provider management terminal receives a security policy of the Internet service provider from a firewall of the user network, and hashes the received security policy. The value is calculated by a hash function and compared with the stored hash value in the Internet service provider management terminal. If the two hash values do not match as a result of the comparison, the Internet service set in the firewall of the user network is set. It is determined that the security policy of the provider has been tampered with. If the hash values match, the security policy of the Internet service provider set in the firewall of the user network is tampered. The user management terminal receives the security policy of the user from the firewall of the user network, calculates a hash value of the received security policy by a hash function, and compares the hash value with the stored hash value in the user management terminal. If the two hash values do not match as a result of the comparison, it is determined that the security policy of the user set in the firewall of the user network has been tampered with. The gist is to confirm that the security policy of the user set in the network firewall has not been tampered with.
[0017]
According to the third aspect of the present invention, the Internet service provider management terminal receives the security policy of the Internet service provider from the firewall of the user network, calculates a hash value of the security policy, and stores the hash value of the security policy with the stored hash value. Based on the result of the comparison, confirm whether the security policy of the Internet service provider set in the firewall of the user network has been tampered with, and receive the user security policy from the firewall of the user network at the user management terminal. Then, the hash value of this security policy is calculated and compared with the stored hash value. Based on the result of this comparison, the security policy of the user set in the firewall of the user network is falsified. In order to confirm whether or not the security policy of the Internet service provider and the user set in the firewall of the user network has been tampered with, from the Internet service provider management terminal and the user management terminal, respectively. Can be.
[0018]
According to a fourth aspect of the present invention, there is provided a security policy setting apparatus for setting a security policy for ensuring security of a user's network and an Internet service provider's network in a firewall provided in the user network, wherein the user network Provided in the firewall of the user, to distinguish between the security policy of the user set by the user, the security policy of the Internet service provider set by the Internet service provider, and the security policy of the user and the security policy of the Internet service provider And a storage means for storing delimiter information set between both security policies or before and after each security policy.
[0019]
According to the present invention, delimiter information for distinguishing between a security policy set by a user and a security policy set by an Internet service provider is set between both security policies or before or after each security policy. Therefore, the security policy of both the user and the Internet service provider can be set to coexist with the firewall of the user network, thereby preventing unauthorized access to the user network and preventing unauthorized access to the Internet service provider network at the user network. It is possible to protect and prevent an increase in network traffic due to unauthorized access.
[0020]
According to a fifth aspect of the present invention, in the fourth aspect, the internet service provider management terminal provided in the internet service provider network and operated by the internet service provider includes: Calculation and storage means for calculating and storing a hash value of the created security policy by a hash function, encryption means for encrypting the hash value using a secret key of an Internet service provider, and the encrypted hash value Transmitting means for transmitting the security policy created by the Internet service provider from the Internet service provider management terminal to a firewall provided in the user network, the user being provided in the user network and operated by the user A calculation terminal for calculating and storing a hash value of a security policy created by a user using a hash function, an encryption unit for encrypting the hash value using a secret key of the user, Transmitting means for transmitting the security value created by the user and the security policy created by the user from a user management terminal to a firewall provided in a user network, wherein the firewall provided in the user network is provided with the secret key of an Internet service provider. Internet service provider-side decryption means for obtaining a public key corresponding to the Internet service, using the public key to decode an encrypted hash value received from the Internet service provider management terminal to obtain a hash value, The interface received from the service provider management terminal An internet service provider-side hash value calculation unit that calculates a hash value of a security policy of the net service provider by a hash function, and compares the calculated hash value with the hash value obtained by the decryption. As a result of the comparison, If the two hash values do not match, it is determined that the security policy is not a true security policy from a valid Internet service provider, and the security policy is discarded. If the two hash values match, a valid Internet service provider is provided. The Internet service provider confirms that the security policy is a genuine security policy from a user and stores the Internet service provider in the storage means provided in the user network firewall in order to set the security policy in the user network firewall as the security policy of the Internet service provider. A provider that obtains a public key corresponding to the private key of the user and decrypts the encrypted hash value received from the user management terminal to obtain a hash value using the public key. Side decryption means, user side hash value calculation means for calculating a hash value of a security policy of a user received from the user management terminal by a hash function, and compares the calculated hash value with the hash value obtained by the decryption. As a result of this comparison, if the two hash values do not match, it is determined that the security policy is not a true security policy from a valid user, the security policy is discarded, and if the two hash values match, a valid security policy is determined. Confirm that this is the true security policy from the user, and use the firewall of the user network as the user's security policy. And summarized in that and a user-side comparison means for storing in said storage means provided on the firewall of the user network in order to set Le.
[0021]
According to the fifth aspect of the present invention, the security value of the security policy of the Internet service provider is calculated and stored by the Internet service provider management terminal, and the hash value is calculated using the secret key of the Internet service provider. And transmits the encrypted hash value and the security policy of the Internet service provider to the firewall of the user network, calculates and stores the hash value of the user's security policy by the user management terminal, and uses the user's private key. Transmitting the encrypted hash value and the security policy of the user to the firewall of the user network. The firewall of the user network decrypts the encrypted hash value with the public key of the Internet service provider. After obtaining the hash value, calculating the hash value of the received security policy of the Internet service provider, comparing the two hash values, and confirming that the security policy is a true security policy from a legitimate Internet service provider, the user network Of the user, obtain the hash value by decrypting the encrypted hash value with the user's public key, calculate the hash value of the received user's security policy, compare the two hash values, If it is confirmed that the security policy is a true security policy from the user, the security policy of the Internet service provider and the user set in the firewall of the user network is set to the firewall of the user network, so that the security policy of the legitimate user and the Internet is set. Whether or not it is true of the security policy that was created by the door the service provider can be confirmed in accurately.
[0022]
Further, in the present invention according to claim 6, in the invention according to claim 5, the internet service provider management terminal receives the security policy of the internet service provider from a firewall of the user network, and receives the security policy of the internet service provider. A hash value calculating means for calculating a hash value of the security policy by a hash function, and comparing the calculated hash value with the stored hash value in the Internet service provider management terminal. As a result of the comparison, the two hash values do not match. In this case, the security policy of the Internet service provider set in the firewall of the user network is determined to have been tampered with, and if the hash values match, the security policy set in the firewall of the user network is determined. A comparison means for confirming that the security policy of the Internet service provider has not been tampered with, wherein the user management terminal receives the security policy of the user from a firewall of the user network; A hash value calculating means for calculating a hash value of the security policy by a hash function, and comparing the calculated hash value with the stored hash value in the user management terminal. As a result of the comparison, if the two hash values do not match, The security policy of the user set in the firewall of the user network is determined to have been tampered with, and if the hash values match, the security policy of the user set in the firewall of the user network has been tampered. Not And summarized in that and a comparison verification means to verify.
[0023]
According to the present invention, the Internet service provider management terminal receives the security policy of the Internet service provider from the firewall of the user network, calculates a hash value of the security policy, and stores the hash value of the security policy with the stored hash value. Based on the result of the comparison, confirm whether the security policy of the Internet service provider set in the firewall of the user network has been tampered with, and receive the user security policy from the firewall of the user network at the user management terminal. Then, the hash value of this security policy is calculated and compared with the stored hash value. Based on the result of this comparison, the security policy of the user set in the firewall of the user network is falsified. In order to confirm whether or not the security policy of the Internet service provider and the user set in the firewall of the user network has been tampered with, from the Internet service provider management terminal and the user management terminal, respectively. Can be.
[0024]
According to a seventh aspect of the present invention, since the security policy setting method according to any one of the first to third aspects is recorded on a recording medium as a computer-executable security policy setting program, the recording medium is used. Thus, its distribution can be improved.
[0025]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing an Internet connection configuration for implementing a security policy setting method according to an embodiment of the present invention.
[0026]
As shown in FIG. 1, the user network 1 is connected to the Internet service provider network 5 and the Internet 3 via a router 51 provided in the Internet service provider network 5. Further, a firewall 11 is provided in the broadband router in the user network 1 in order to protect the client 15 provided in the user network 1 from unauthorized access from the Internet 3. Further, a firewall 53 is provided in the Internet service provider network 5 in order to protect the server 55 provided in the Internet service provider network 5 from unauthorized access from the Internet 3 or the user network 1.
[0027]
In the embodiment shown in FIG. 1, the user management terminal 13 is connected to the firewall 11 in the user network 1, and the Internet service provider management terminal 57 is connected to the firewall 53 in the Internet service provider network 5. Sets the security policy of the user on the firewall 11 of the user network 1 by the user management terminal 13, and sets the security policy of the Internet service provider on the firewall 11 of the user network 1 by the internet service provider management terminal 57. This prevents unauthorized access to the user network 1 and also prevents unauthorized access to the Internet service provider network 5 with the user network 1. And your, so as to prevent an increase in the unauthorized access traffic. In FIG. 1, a certificate authority (CA) 61 is provided so as to be connected to the router 51 of the Internet service provider network 5.
[0028]
As described above, the security policy set in the firewall 11 of the user network 1 is stored in a security policy storage unit (not shown) provided in the firewall 11 of the user network 1 as shown in FIG.
[0029]
This security policy is composed of a plurality of operation rules for restricting unauthorized access to the user network 1 and the Internet service provider network 5 in order to secure the security of the user network 1 and the Internet service provider network 5. . In the present embodiment, in order to regulate unauthorized access to both the user network 1 and the Internet service provider network 5, both the security policy of the user and the security policy of the Internet service provider are set to the firewall of the user network 1. In order to coexist and store the security policies together, delimiter information for clearly distinguishing both security policies is used, and the security policy of the user and the security policy of the Internet service provider are distinguished by the delimiter information.
[0030]
As shown in FIG. 2, the security policy set in the firewall 11 of the user network 1 defines a plurality of operation rules or division information having contents indicated by items of priority / separation, contents / condition, and operation. It is composed of a plurality of lines, and whether each line is an operation rule or delimiter information is indicated by the contents of the priority / delimiter item.
[0031]
In FIG. 2, the first line 201 is a line that indicates the start of the security policy of the Internet service provider as described as "Internet service provider start" as described in the content / condition. This indicates that the security policy of the Internet service provider is stored from the line following this line.
[0032]
The second line 202 indicates that the Internet service provider (ISP) has an operation rule of priority 1 as described as "ISP priority 1", and the contents / conditions of the operation rule are as follows. As described as “from the user network to the server”, the contents of the operation restriction “access from the user network 1 to the server 55 of the Internet service provider network 5” are shown. The operation rule in the second line is that the access rule to the Internet service provider network 5 is changed from the user network 1 to the Internet service provider network 5 Pass the access of the packet to the server 55.
[0033]
Similarly, the third line indicated by 203 is an operation rule of the priority 2 of the Internet service provider, the content of which passes through the access of the packet from the Internet service provider management terminal 57 to the firewall 11 of the user network 1. It is to do.
[0034]
The fourth line indicated by 204 is delimiter information and indicates the end of the security policy of the Internet service provider, and indicates that up to the line before this line is the security policy of the Internet service provider. .
[0035]
The fifth line denoted by 205 is delimiter information and is a line indicating the start of the user's security policy, and indicates that the user's security policy is stored from the line following this line.
[0036]
The sixth line indicated by 206 indicates that the operation rule has the user priority 1 as described in “user priority 1”, and the contents / conditions and operation of the operation rule are transmitted from the client 15 to the Internet. 3 through packet access.
[0037]
The seventh line indicated by reference numeral 207 indicates that the operation rule has the user priority 2 as described in “user priority 2”, and the contents / conditions and operation of the operation rule are transmitted from the client 15 to the Internet. This is to pass the packet access to the server 55 of the service provider network 5.
[0038]
The eighth line 208 indicates that the operation rule has the user priority 3 as described as “user priority 3”, and the contents / conditions and operation of this operation rule are described in the user management terminal 13. Through the access of the packet to the firewall 11 of the user network 1.
[0039]
A ninth line 209 is delimiter information and indicates the end of the security policy of the user, and indicates that the lines up to the line before this line are the security policies of the user provider. Also, the last tenth line indicated by 210 indicates an operation rule of discarding all accessed packets as a default and lowest priority operation rule.
[0040]
Note that the operation rules constituting the security policy shown in FIG. 2 are defined above in the table of FIG. 2 as shown by ISP priority 1, ISP priority 2, user priority 1, and user priority 2. The higher the operation rule, the higher the priority, and the lower the rule, the lower the priority. Then, in the firewall 11 of the user network 1, when judging the restriction on each access based on the security policy set in this way, the contents of each access are given a higher priority than the security policy shown in FIG. Are checked in order from the highest operation rule to determine the restriction or passage for each access. In the security policy shown in FIG. 2, the security policy of the Internet service provider is set at a higher priority than the security policy of the user, but this is determined in advance by the Internet service provider and the user. It shows the case where it was decided in consultation with.
[0041]
Note that the security policy of the Internet service provider and the user set in the firewall 11 of the user network 1 as shown in FIG. 2 is initially ISP priority 2 and user priority 2 as shown in FIG. There is no user priority 3; the condition of ISP priority 1 is “from the Internet service provider management terminal to the firewall of the user network”; and the condition of user priority 1 is “from the user management terminal to the firewall of the user network”. It has become.
[0042]
Next, referring to the flowchart shown in FIG. 3, the Internet service provider creates a security policy of the Internet service provider using the Internet service provider management terminal 57, and the security policy is applied to the firewall 11 of the user network 1. Will be described. In the following description, the security policy of the Internet service provider consisting of the operation rules defined in the second and third lines of FIG. 2 is described as security policy A, and is defined in the sixth to eighth lines. The security policy of the user consisting of the operation rules is described as security policy B.
[0043]
In FIG. 3, the Internet service provider creates its own security policy A to be set in the firewall 11 of the user network 1 (step S11), and stores the hash value h (A) of the created security policy A in the Internet service provider. The management terminal 57 calculates and stores the hash function h (step S13). Then, the Internet service provider encrypts the hash value h (A) at the Internet service provider management terminal 57 using the Internet service provider's own private key Kpri, and converts the encrypted hash value X (A). Calculation is performed (step S15).
[0044]
Next, the Internet service provider sends the encrypted hash value X (A) and the security policy A created by the Internet service provider from the Internet service provider management terminal 57 to the firewall 11 provided in the user network 1. It transmits (step S17). As a result, the firewall 11 of the user network 1 receives the encrypted hash value X (A) and the security policy A of the Internet service provider.
[0045]
Next, a process in which a user creates a security policy B of a user using the user management terminal 13 and transmits the security policy B to the firewall 11 of the user network 1 will be described with reference to a flowchart shown in FIG. .
[0046]
In FIG. 4, the user creates a security policy B to be set in the firewall 11 of the user network 1 (step S21), and uses the hash value h (B) of the created security policy B in the user management terminal 13 by the hash function h. Calculate and save (step S23). Then, the user encrypts the hash value h (B) at the user management terminal 13 using the user's own secret key K'pri, and calculates an encrypted hash value X '(B) (step S25). .
[0047]
Next, the user sends the encrypted hash value X ′ (B) and the security policy B created by the user from the user management terminal 13 to the firewall 11 of the user network 1 (Step S27). As a result, the firewall 11 of the user network 1 receives the encrypted hash value X ′ (B) and the security policy B of the user.
[0048]
Next, with reference to the configuration of the firewall 11 shown in FIG. 5 and the flowchart shown in FIG. 6, a process in which the firewall 11 of the user network 1 sets the security policy A received from the Internet service provider management terminal 57 will be described.
[0049]
5 and 6, the firewall 11 of the user network 1 uses the encrypted hash value X (A) transmitted from the Internet service provider management terminal 57 and the Internet service provider's internet server as described in step S17 of FIG. Upon receiving the created security policy A, a public key Kpub corresponding to the private key Kpri of the Internet service provider is obtained from the certificate authority (CA) 61, and the encrypted hash value X (A ) Is decrypted by the decryption unit 21 to obtain a hash value h (A) (step S31).
[0050]
In addition, the firewall 11 calculates the hash value h (A) of the security policy A received from the Internet service provider management terminal 57 by the hash value calculation unit 23 using a hash function, and calculates the calculated hash value h (A) and the aforementioned hash value h (A). The hash value h (A) decrypted by the decryption unit 21 is compared by the comparison unit 25. As a result of the comparison, if the two hash values are different, it is not a true security policy A from a legitimate Internet service provider. The security policy A is discarded, and if both hash values are the same, it is determined that the security policy A is a true security policy A from a legitimate Internet service provider, and the security policy A is Security of firewall 11 as security policy A of service provider Storing set to Rishi storage unit 27 (step S33).
[0051]
Next, a process for setting the security policy B received from the user management terminal 13 by the firewall 11 of the user network 1 will be described with reference to a flowchart shown in FIG.
[0052]
7, when the firewall 11 of the user network 1 receives the encrypted hash value X ′ (B) sent from the user management terminal 13 and the security policy B created by the user as described in step S27 of FIG. Obtains a public key K'pub corresponding to the user's private key K'pri from a certificate authority (CA) 61, and decrypts the encrypted hash value X '(B) using the public key K'pub. , A hash value h (B) is obtained (step S41).
[0053]
The firewall 11 calculates a hash value h (B) of the security policy B received from the user management terminal 13 by a hash function, and calculates the calculated hash value h (B) and the decrypted hash value h (B). If the two hash values are different as a result of the comparison, it is determined that the security policy B is not a true security policy B from a valid user, and the security policy B is discarded. However, the two hash values are the same. In this case, the security policy B is determined to be a true security policy B from a legitimate user, and the security policy B is stored and set in the security policy storage unit 27 of the firewall 11 as the security policy B of the user (step S43).
[0054]
Next, referring to the configuration of the Internet service provider management terminal 57 shown in FIG. 8, the Internet service provider uses the Internet service provider management terminal 57 to set the Internet set in the firewall 11 of the user network 1. A process of confirming whether the security policy A of the service provider has been tampered will be described.
[0055]
The Internet service provider receives the security policy A for the Internet service provider stored in the security policy storage unit 27 from the firewall 11 of the user network 1 through the Internet service provider management terminal 57, and receives the received security policy A. Is calculated by the hash value calculation unit 43 using a hash function, and the calculated hash value h (A) is compared with the stored hash value h (A), that is, stored in step S13 described above. The obtained hash value h (A) is read from the hash value storage unit 41 and compared by the comparison unit 45.
[0056]
As a result of this comparison, if the two hash values do not match, it is determined that the security policy A of the Internet service provider set in the firewall 11 of the user network 1 has been tampered with. Then, it is confirmed that the security policy A for the Internet service provider set in the firewall 11 has not been tampered with.
[0057]
Next, a process in which the user uses the user management terminal 13 to confirm whether the user's security policy B set in the firewall 11 of the user network 1 has been tampered with will be described.
[0058]
The user receives the user's security policy B stored in the security policy storage unit from the firewall 11 of the user network 1 by the user management terminal 13, and converts the hash value h (B) of the received security policy B into a hash function h. And the calculated hash value h (B) is compared with the stored hash value h (B), that is, with the hash value h (B) stored in step S23 described above.
[0059]
As a result of this comparison, if the two hash values do not match, it is determined that the security policy B of the user set in the firewall 11 has been tampered with. It is confirmed that the security policy B of the user who has not been falsified.
[0060]
In the above embodiment, the security policy of the Internet service provider and the user is the same as that of the embodiment shown in FIG. 2, and generally, as shown in FIG. And before and after the security policy of the user, but the present invention is not limited to this, and as shown in FIG. Separation information is provided only with the user's security policy, and this information is defined as "the Internet service provider up to this point." Above this delimitation information is the security policy of the Internet service provider. It may be a user security policy.
[0061]
Note that the processing procedure of the security policy setting method of the above embodiment is recorded as a program on a recording medium such as a CD or FD, and this recording medium is incorporated in a computer system, or the program recorded on the recording medium is transmitted to a communication line. Of course, it is possible to function as a security policy setting method for implementing a security policy setting method by downloading to a computer system or installing from a recording medium via a computer, and operating the computer system with the program. By using such a recording medium, it is possible to enhance the circulation.
[0062]
【The invention's effect】
As described above, according to the present invention, delimiter information for distinguishing between a security policy set by a user and a security policy set by an Internet service provider is set between both security policies or before or after each security policy. Therefore, the security policy of both the user and the Internet service provider can be set to coexist with the firewall of the user network, thereby preventing unauthorized access to the user network and preventing unauthorized access to the Internet service provider network by the user network. It is possible to protect and prevent an increase in network traffic due to unauthorized access.
[0063]
Further, according to the present invention, the encrypted hash value received together with the security policy from the Internet service provider and the user is decrypted at the firewall of the user network and compared with the hash value of the received security policy. It is possible to properly confirm whether or not the Internet service provider and the security policy of the user set in the firewall of the user network are the true security policies created by the legitimate user and the Internet service provider, respectively.
[0064]
Further, according to the present invention, the Internet service provider and the user compare the hash value of the security policy set in the firewall of the user network with the hash value of the previously stored security policy. It is possible to easily and accurately check whether or not the security policy of the Internet service provider and the user set in the firewall is falsified from the Internet service provider management terminal and the user management terminal, respectively.
[0065]
According to the present invention, the security policy setting method is recorded as a security policy setting program on, for example, a recording medium and executed by a computer, so that the distribution of the security policy can be improved by using the recording medium.
[Brief description of the drawings]
FIG. 1 is a diagram showing an Internet connection configuration for implementing a security policy setting method according to an embodiment of the present invention.
FIG. 2 is a diagram showing a security policy set by the security policy setting method of the embodiment shown in FIG.
In the embodiment shown in FIG. 1, a process in which an Internet service provider creates a security policy of an Internet service provider using an Internet service provider management terminal and transmits the security policy to a firewall of a user network. It is a flowchart which shows.
FIG. 4 is a flowchart showing a process in which a user creates a user security policy using a user management terminal and transmits the security policy to a firewall of a user network in the embodiment shown in FIG. 1;
FIG. 5 is a block diagram showing a configuration of the user network firewall when the firewall of the user network sets a security policy received from the Internet service provider management terminal in the embodiment shown in FIG. 1;
FIG. 6 is a flowchart showing a process in which a firewall of a user network sets and stores a security policy received from an Internet service provider management terminal in the embodiment shown in FIG.
FIG. 7 is a flowchart showing a process of setting and storing a security policy received from a user management terminal by a firewall of a user network in the embodiment shown in FIG. 1;
FIG. 8 is a diagram showing an embodiment in which the Internet service provider uses the Internet service provider management terminal to determine whether the security policy of the Internet service provider set in the firewall of the user network has been tampered with; FIG. 4 is a block diagram showing a configuration of an Internet service provider management terminal when confirming the following.
9 is a diagram showing an initial state of a security policy set by the security policy setting method of the embodiment shown in FIG. It is.
FIG. 10 is a diagram showing another method for setting security policies of an Internet service provider and a user separately by using delimiter information.
FIG. 11 is a diagram showing a conventional Internet connection configuration when a firewall is provided in a user network.
FIG. 12 is a diagram showing a conventional Internet connection configuration when a firewall is provided in an Internet service provider network.
[Explanation of symbols]
1 User network
3 Internet
5 Internet service provider network
11 Firewall
13 User management terminal
15 clients
21 Decoding unit
23, 43 Hash value calculation unit
25, 45 Comparison section
27 Security Policy Storage
33 server
41 Hash value storage unit
51 router
53 Firewall
55 servers
57 Internet service provider management terminal
61 Certification Authority (CA)

Claims (7)

A security policy setting method for setting a security policy for ensuring security of a user's network and an Internet service provider's network in a firewall provided in a user network,
A security policy setting method, characterized in that delimiter information for distinguishing between a security policy set by a user and a security policy set by an Internet service provider is set between both security policies or before or after each security policy. In the Internet service provider management terminal, the hash value of the security policy created by the Internet service provider is calculated and stored by a hash function,
Encrypting the hash value using a private key of an Internet service provider,
Transmitting the encrypted hash value and the security policy created by the Internet service provider from the Internet service provider management terminal to a firewall provided in the user network,
In the user management terminal, the hash value of the security policy created by the user is calculated and stored by a hash function,
Encrypting the hash value using a user's private key;
Transmitting the encrypted hash value and the security policy created by the user from a user management terminal to a firewall provided in a user network,
In the firewall of the user network, obtain a public key corresponding to the private key of the Internet service provider,
Using the obtained public key, decrypt the encrypted hash value received from the Internet service provider management terminal to obtain a hash value,
Calculating a hash value of the security policy of the Internet service provider received from the Internet service provider management terminal by a hash function,
Comparing the calculated hash value with the hash value obtained by the decryption,
As a result of this comparison, if both hash values do not match, it is determined that the security policy is not a true security policy from a valid Internet service provider, the security policy is discarded, and if both hash values match, Confirm that it is a true security policy from a legitimate Internet service provider, set it in the firewall of the user network as the security policy of the Internet service provider,
In the user network firewall, obtain a public key corresponding to the user's private key,
Using the obtained public key, decrypts the encrypted hash value received from the user management terminal to obtain a hash value,
The hash value of the security policy of the user received from the user management terminal is calculated by a hash function,
Comparing the calculated hash value with the hash value obtained by the decryption,
As a result of this comparison, if the two hash values do not match, it is determined that the security policy is not a true security policy from a valid user, and the security policy is discarded. 2. The security policy setting method according to claim 1, wherein the security policy is determined to be a true security policy from a user and set as a user security policy in a firewall of a user network. The Internet service provider management terminal receives the security policy of the Internet service provider from the firewall of the user network,
The hash value of the received security policy is calculated by a hash function and compared with the stored hash value in the Internet service provider management terminal,
As a result of this comparison, if the two hash values do not match, it is determined that the security policy of the Internet service provider set in the firewall of the user network has been tampered with. Confirm that the security policy of the Internet service provider set in the firewall of the user network has not been tampered with,
The user management terminal receives the user security policy from the user network firewall,
The hash value of the received security policy is calculated by a hash function and compared with the stored hash value in the user management terminal,
As a result of this comparison, if the hash values do not match, it is determined that the security policy of the user set in the firewall of the user network has been tampered with. 3. The security policy setting method according to claim 2, wherein it is confirmed that the security policy of the user set in the firewall is not falsified. A security policy setting device for setting a security policy for ensuring security of a user's network and an Internet service provider's network in a firewall provided in a user network,
The security policy of the user is provided in the firewall of the user network, the security policy of the user set by the user, the security policy of the Internet service provider set by the Internet service provider, the security policy of the user and the security policy of the Internet service provider. A security policy setting apparatus, comprising: storage means for storing delimiter information set between both security policies or before and after each security policy for discrimination. An Internet service provider management terminal provided in the Internet service provider network and operated by the Internet service provider,
Calculation storage means for calculating and storing the hash value of the security policy created by the Internet service provider using a hash function,
Encryption means for encrypting the hash value using a secret key of an Internet service provider;
Transmission means for transmitting the encrypted hash value and the security policy created by the Internet service provider to the firewall provided in the user network from the Internet service provider management terminal,
A user management terminal provided in the user network and operated by the user,
Calculation storage means for calculating and storing a hash value of a security policy created by a user by a hash function,
Encryption means for encrypting the hash value using a user's secret key;
Transmitting means for transmitting the encrypted hash value and the security policy created by the user from a user management terminal to a firewall provided in a user network,
The firewall provided in the user network
An Internet service provider that obtains a public key corresponding to the secret key of an Internet service provider, and decrypts an encrypted hash value received from the Internet service provider management terminal to obtain a hash value using the public key. User side decryption means,
Internet service provider side hash value calculation means for calculating a hash value of the security policy of the Internet service provider received from the Internet service provider management terminal by a hash function,
The calculated hash value is compared with the hash value obtained by the decryption, and as a result of the comparison, if the two hash values do not match, it is determined that the security policy is not a true security policy from a valid Internet service provider. The security policy is discarded, and if the hash values match, the security policy is confirmed to be a true security policy from a legitimate Internet service provider, and is set in the firewall of the user network as the security policy of the Internet service provider. Internet service provider side comparison means stored in the storage means provided in the firewall of the user network in order to
User-side decryption means for obtaining a public key corresponding to the user's secret key, and using the public key to decode the encrypted hash value received from the user management terminal to obtain a hash value;
User-side hash value calculation means for calculating a hash value of a user security policy received from the user management terminal by a hash function,
The calculated hash value is compared with the hash value obtained by the decryption, and as a result of the comparison, if the two hash values do not match, it is determined that the security policy is not a true security policy from a valid user, and the security The policy is discarded, and if the two hash values match, it is confirmed that the security policy is a true security policy from a legitimate user, and the policy is set in the firewall of the user network to set the security policy of the user in the firewall of the user network. 5. The security policy setting device according to claim 4, further comprising a user-side comparison unit that stores the information in the storage unit. The Internet service provider management terminal,
Receiving means for receiving the security policy of the Internet service provider from the firewall of the user network;
Hash value calculating means for calculating a hash value of the received security policy by a hash function;
The calculated hash value is compared with the stored hash value in the Internet service provider management terminal, and as a result of the comparison, if the hash values do not match, the Internet service provider set in the firewall of the user network Comparing the security policy of the Internet service provider set in the firewall of the user network to determine that the security policy has not been tampered with. And having
The user management terminal,
Receiving means for receiving a user security policy from a firewall of the user network;
Hash value calculating means for calculating a hash value of the received security policy by a hash function;
The calculated hash value is compared with the stored hash value in the user management terminal, and as a result of the comparison, if the two hash values do not match, the security policy of the user set in the firewall of the user network is falsified. Comparing means for determining that the security policy of the user set in the firewall of the user network has not been tampered with when the two hash values match. Item 6. The security policy setting device according to Item 5. 4. A computer-executable security policy setting method program for causing a computer to execute the security policy setting method according to claim 1.

Images