JP2005293007A - Security check system and security check method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To limit a client terminal from performing access to a business server before completing security check. <P>SOLUTION: A client 100 includes a policy A104 for permitting the transmission of a packet to a clean room realizing server 200 and a policy B105 for permitting the transmission of a packet to a business server 300. When the client 100 is connected to a network, a policy switching tool 103 sets a policy to be used by the client fire wall 101 to a policy A104. When a security check tool 102 completes the security check of the client 100, the policy switching tool 103 switches the selected policy from the policy A104 to the policy B105. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a security check system and a security check method using a client firewall.

  When a client terminal that can access the business server via the network connects to the network, a security check of the client terminal is performed. For example, Non-Patent Document 1 describes a security check system using a client firewall. FIG. 5 is a block diagram illustrating a configuration example of a conventional security check system described in Non-Patent Document 1. As shown in FIG. 5, the conventional security check system includes a client firewall management server 600 and a client firewall 700 installed in the client terminal.

  As shown in FIG. 5, the client firewall management server 600 includes an anti-virus version check unit 601. In addition, the client firewall 700 includes an anti-virus version check unit 701 and a network disconnection unit 702. The anti-virus version check unit 601 and the anti-virus version check unit 701 check the version of the virus definition file held by the client terminal, and determine whether or not the client terminal holds an appropriate virus definition file. If it is determined that the appropriate virus definition file is not held, the network disconnecting unit 702 disconnects the client terminal from the network.

  Patent Document 1 describes a computer system that provides a firewall service. In the computer system described in Patent Document 1, the degree of freedom of access rules is increased by using dynamic rules added to access rules for processing packets.

Japanese Patent No. 3443529 (pages 4-6 and 9, FIGS. 1-3) “RealSecure Agent Advanced Administration Guide Version 7.0”, Internet Security Systems, p. 12-13

  In the security check system described in Non-Patent Document 1, the security check of the client terminal is performed by determining whether or not the version of the virus definition file held by the client terminal is appropriate. If it is determined that the security check condition is not met, the network disconnecting means 702 disconnects the client terminal from the network.

  However, since the security check is performed after the client terminal is once connected to the network, there is a possibility that the client terminal can access the business server even though the security check has not been completed. For this reason, it is difficult to ensure the security of the computer network. For example, a business server may be infected with a computer virus while performing a security check on a client terminal already infected with a computer virus.

  In the security check system described in Non-Patent Document 1, when it is determined that the security check condition is not met, the client terminal is disconnected from the network and cannot access the business server. . Further, since the security check means (antivirus version check means 701) is implemented as a function of the client firewall, the security check cannot be performed in cooperation with other security tools. For example, in the security check system described in Non-Patent Document 1, security checks other than the virus definition file version check cannot be performed in cooperation.

  Further, the computer system described in Patent Document 1 only increases the degree of freedom of access rules used for the client firewall by using dynamic rules.

  Therefore, an object of the present invention is to provide a security check system and a security check method that can restrict a client terminal from accessing a business server before the client terminal completes a security check.

  A security check system according to the present invention includes a client terminal that accesses a business server via a network, and the client terminal determines whether or not the security state of the client terminal matches a predetermined condition; And an access permission unit that permits the client terminal to access the business server when the security determining unit determines that the security state of the client terminal meets a predetermined condition. The security status of the client terminal is, for example, whether or not a security patch is installed on the client terminal and the update status of the virus definition file on the client terminal.

  The client terminal also stores condition data for storing condition data indicating conditions for filtering data when the client terminal performs communication, and performs filtering of data when the client terminal performs communication according to the condition data. Filtering means for performing access, and when the security judging means judges that the security status of the client terminal matches a predetermined condition, the access permitting means includes data to the business server among the condition data stored in the condition storing means. The condition data permitting the communication may be selected, and the filtering unit may perform filtering of data when the client terminal performs communication according to the condition data selected by the access permission unit. According to such a configuration, it is possible to easily permit the client terminal to access the business server by selecting the condition data.

  In addition, the security check system includes a condition management server that manages a security condition indicating a condition of the security status required for the client terminal, and the security judgment means includes a security status of the client terminal in the security condition managed by the condition management server. The access permission means determines whether the security conditions of the client terminal match the security conditions, the access permission means determines whether the condition storage means stores the condition data stored in the condition storage means to the business server. It is also possible to select condition data that permits data communication. The security condition is a condition indicating, for example, a security patch to be installed on the client terminal or a virus definition file to be held by the client terminal.

  In addition, the condition storage means permits both conditional data with restrictions that allow only data communication to the condition management server and data communication to the condition management server and data to the business server as condition data. When the client terminal connects to the network, the access permission means selects the restricted condition data from the condition data stored by the condition storage means, and the security judgment means sets the client as a security condition. If it is determined that the security status of the terminal matches, the condition data to be selected may be switched from restricted condition data to unlimited condition data. According to such a configuration, the access destinations of client terminals that have not completed the security check can be limited to the condition management server.

  Further, the condition management server includes a specific information storage unit that stores condition specifying information for specifying a security condition, and a condition information transmission unit that transmits the condition specifying information stored in the specific information storage unit to the client terminal, The security determination means may determine whether or not the security status of the client terminal matches the security condition based on the condition specifying information received from the condition management server.

  Further, the specific information storage means stores condition specifying information including information for specifying a security patch to be installed in the client terminal, and the security judging means installs the security patch in the client terminal based on the condition specifying information. If it is determined whether the security patch is installed in the client terminal, it may be determined that the security status of the client terminal matches the security condition. According to such a configuration, it is possible to prevent a client terminal not installed with a security patch from accessing the business server.

  Further, the condition management server includes a patch storage unit that stores a security patch to be installed in the client terminal, and a patch transmission unit that transmits the security patch stored in the patch storage unit to the client terminal according to a request from the client terminal. It may be included. According to such a configuration, even if it is determined that the security condition is not met, the client terminal can access the business server by downloading and executing the security patch.

  The specific information storage means stores condition specifying information including information for specifying the virus definition file to be held by the client terminal, and the security judging means holds the virus definition file based on the condition specifying information. If the client terminal determines that the client terminal holds the virus definition file, it may be determined that the security status of the client terminal matches the security condition. According to such a configuration, it is possible to prevent a client terminal that does not hold a virus definition file and may be infected with a computer virus from accessing the business server.

  The condition management server also stores virus definition storage means for storing the virus definition file to be held by the client terminal, and virus definition for transmitting the virus definition file stored by the virus definition storage means to the client terminal in accordance with a request from the client terminal. And a transmission means. According to such a configuration, even if it is determined that the security condition is not met, the client terminal can access the business server by downloading the virus definition file and executing the virus check. Can do.

  The security check method according to the present invention includes a security determination step for determining whether or not a security status of a client terminal accessing a business server via a network matches a predetermined condition, and a security status of the client terminal is a predetermined condition. And an access permission step for permitting the client terminal to access the business server when it is determined that they match.

In addition, the security check method includes a condition storage step for storing condition data indicating a condition for filtering data when the client terminal performs communication, and data filtering when the client terminal performs communication according to the condition data. A filtering step for performing the processing, and the access permission step is a condition data that permits communication of data to the business server among the stored condition data when it is determined that the security state of the client terminal matches a predetermined condition. The filtering step may perform filtering of data when the client terminal performs communication according to the condition data selected in the access permission step. According to such a configuration, it is possible to easily permit the client terminal to access the business server by selecting the condition data.

  According to the present invention, when it is determined that the security state of the client terminal matches a predetermined condition, the client terminal is permitted to access the business server. Therefore, only client terminals that have completed the security check can access the business server. Therefore, the client terminal can be restricted from accessing the business server before the client terminal completes the security check.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing an example of a configuration of a computer network to which a security check system according to the present invention is applied. As shown in FIG. 1, the computer network includes a client 100, a clean room realization server 200, and a business server 300.

  In this embodiment, the security check system is applied to a computer network using an intranet, a virtual private network (VPN), or the like. In the present embodiment, the security check system performs a security check of the client 100 when the client 100 connects to the network.

  A client (client terminal) 100 is a terminal used by a user, and specifically, an information processing terminal such as a personal computer. As shown in FIG. 1, the client 100 includes a client firewall 101, a security check tool 102, a policy switching tool 103, a policy A 104, and a policy B 105. Although one client 100 is shown in FIG. 1, the computer network includes a plurality of clients 100.

  Specifically, the client firewall 101 is software installed in the client 100. The client firewall 101 has a packet filtering function for filtering packets transmitted and received by the client 100. For example, the client firewall 101 determines whether a packet in a direction (outbound) transmitted from the client 100 to the outside is allowed to pass. Further, the client firewall 101 determines whether or not to allow a packet in a direction (inbound) received by the client 100 from the outside to pass the packet.

  In this embodiment, expressions such as “the client firewall 101 determines” are used, but actually, the CPU of the client 100 executes processing according to the client firewall 101. The same applies to other software installed in the client 100. The client firewall 101 filters packets according to setting information called policy (condition data).

  Specifically, the security check tool 102 is software installed in the client 100. The security check tool 102 has a function of performing security check of the client 100 by communicating with security check means 201 of the clean room realizing server 200 described later. In the present embodiment, the security check tool 102 determines whether or not the security status of the client 100 matches the security conditions managed by the security check unit 201. In the present embodiment, the security check tool 102 determining that the security state of the client 100 matches the security condition is also expressed as passing the security check.

  In this embodiment, the security check tool 102 determines whether or not a security patch for repairing a security hole in the operating system (OS) is installed and executed, so that the security status of the client 100 is a security condition. It is determined whether or not it matches. In this embodiment, installing and executing a security patch is expressed as applying a security patch.

  Further, the security check tool 102 determines whether or not the security status of the client 100 matches the security condition by determining the update status of the virus definition file of the client 100. For example, the security check tool 102 determines whether or not the client 100 holds the latest virus definition file.

  Specifically, the policy switching tool 103 is software installed in the client 100. The policy switching tool 103 has a function of setting a policy used by the client firewall 101 for packet filtering. In the present embodiment, policy switching tool 103 selects either policy A 104 or policy B 105 as the policy used for packet filtering.

  Policy A (restricted condition data) 104 and policy B (all permission condition data) 105 are tables including conditions for performing packet filtering. Policy A 104 and policy B 105 are not limited to tables, and may be XML data including conditions for packet filtering, for example. Policy A 104 and policy B 105 are specifically stored in a storage device (not shown) of client 100. In the present embodiment, the client 100 stores two types of policies 104 and 105 in a storage device.

  The client 100 stores, as the policy A 104, a table including a condition for allowing only a packet whose destination is the clean room realizing server 200 to pass. Further, the client 100 stores a table including a condition for allowing both a packet whose destination is the clean room realizing server 200 and a packet whose destination is the business server 300 to pass as the policy B 105. In this embodiment, the policy switching tool 103 selects the policy A 104 until the client 100 passes the security check. When the client 100 passes the security check, the policy switching tool 103 switches the policy to be selected from the policy A 104 to the policy B 105.

  FIG. 2 is an explanatory diagram showing an example of the contents of the policy A104. As shown in FIG. 2, policy A 104 includes a type of communication direction, a communication target, and permission / non-permission associated with each other. In FIG. 2, “type” is information indicating whether the direction of packet communication is outbound or inbound. The “target” is a destination of a packet that the client 100 transmits / receives. “Permitted / Not Permitted” is information indicating whether or not to permit passage of a packet.

  In this embodiment, as shown in FIG. 2, when performing packet filtering according to policy A 104, client firewall 101 permits only transmission of packets from client 100 to clean room realization server 200.

  FIG. 3 is an explanatory diagram showing an example of the contents of the policy B 105. As illustrated in FIG. 3, the policy B 105 includes “type”, “target”, and “permitted / denied” in association with each other in the same manner as the policy A 104. In the present embodiment, as shown in FIG. 3, when performing packet filtering according to policy B 105, the client firewall 101 transmits a packet from the client 100 to the clean room realization server 200 and transmits data from the client 100 to the business server 300. Allow both sending packets.

  As shown in FIG. 1, the clean room realization server (condition management server) 200 includes a security check unit 201, a patch distribution unit 202, and a patch 203.

  Specifically, the security check unit 201 is realized by a CPU, a storage device, and a network interface unit (not shown) that operate according to the program of the clean room realization server 200. The security check unit 201 has a function of managing security conditions required for the client 100. In other words, in the present embodiment, the clean room realization server 200 functions as a security check server that manages security conditions by including the security check unit 201.

  The security check unit 201 manages the security condition by storing server management information (condition specifying information) for specifying the security condition in the storage device and updating it as necessary. In the present embodiment, the security check unit 201 stores server management information including information for specifying a security patch to be applied to the client 100 (hereinafter referred to as security patch management information). Further, the security check unit 201 stores server management information including information for specifying the latest virus definition file (hereinafter referred to as virus management information).

  The security check unit 201 has a function of communicating with the security check tool 102 of the client 100 and transmitting server management information to the client 100.

  Specifically, the patch distribution unit 202 is realized by a CPU, a storage device, and a network interface unit that operate according to the program of the clean room realization server 200. The patch distribution unit 202 has a function of distributing the patch 203 to the client 100. That is, in this embodiment, the clean room realization server 200 functions as a patch distribution server that distributes the patch 203 by including the patch distribution unit 202.

  In the present embodiment, the patch distribution unit 202 extracts the patch 203 from the storage device and transmits it to the client 100 in response to a request from the security check tool 102.

  The patch 203 is a security patch or a virus definition file. Specifically, the patch 203 is stored in the storage device of the clean room realization server 200.

  In the present embodiment, the client 100 executes the security check process using the server management information managed by the clean room realization server 200, thereby preventing the computer virus from entering the business server 300 area of the computer network. To prevent. In the present embodiment, an area in a computer network in which prevention of computer virus intrusion is realized is called a clean room. That is, the clean room realization server 200 plays a part of the role of realizing a clean room by supplying server management information to the client 100.

  The business server 300 is a server that performs each business process such as accounting management and inventory management. The business server 300 executes each business process in response to a request from the client 100. Although one business server 300 is shown in FIG. 1, the computer network includes a plurality of business servers 300.

  In the present embodiment, the condition storage means is realized by a storage device of the client 100. The security determination means is realized by the security check tool 102. The access permission means is realized by the policy switching tool 103. The filtering means is realized by the client firewall 101. The specific information storage unit and the specific information transmission unit are realized by the security check unit 201. The patch storage means and virus definition storage means are realized by the storage device of the clean room realization server 200. The patch transmission unit and the virus definition transmission unit are realized by the patch distribution unit 202.

  Next, the operation will be described. FIG. 4 is a flowchart illustrating an example of processing for performing a security check of the client 100 and setting a policy used by the client firewall 101. When the client 100 is activated according to the user's activation operation, the client 100 starts processing according to the policy switching tool 103. The policy switching tool 103 sets the policy used by the client firewall 101 in the policy A 104 (step S11). By selecting the policy A 104, the client 100 can only transmit a packet to the clean room realization server 200. That is, the client 100 is prohibited from transmitting a packet to the business server 300.

  When the policy is set, the policy switching tool 103 activates the security check tool 102 (step S12). When the security check tool 102 is activated, the policy switching tool 103 waits until a security check result is received from the security check tool 102.

  The security check tool 102 acquires server management information from the security check unit 201 (step S13). In step S <b> 13, the client 100 requests the security check unit 201 to transmit server management information according to the security check tool 102. Then, the security check unit 201 transmits server management information to the client 100.

  The security check tool 102 performs a security check of the client 100 based on the server management information (step S14), and determines whether or not the security state of the client 100 matches the security conditions (step S15).

  In step S15, the security check tool 102 determines whether or not the client 100 has a security patch applied based on the security patch management information included in the server management information. If it is determined that a security patch has not been applied, the security check tool 102 determines that the security status of the client 100 does not match the security conditions.

  Further, the security check tool 102 determines whether the client 100 holds the latest virus definition file based on the virus management information included in the server management information. If it is determined that the client 100 does not hold the virus definition file, the security check tool 102 determines that the security status of the client 100 does not match the security conditions. If the security check tool 102 determines that the version of the virus definition file held by the client 100 is older than the latest version, the security check tool 102 determines that the security status of the client 100 does not match the security conditions.

  If it is determined that a security patch has been applied and the latest virus definition file is held, the security check tool 102 determines that the security status of the client 100 matches the security conditions.

  If it is determined in step S15 that the security conditions are not met, the client 100 downloads and executes the patch 203 from the patch distribution unit 202 in accordance with the security check tool 102 (step S16).

  For example, when it is determined that a security patch has not been applied, the client 100 requests the patch distribution unit 202 to transmit a security patch according to the security check tool 102. Then, the patch distribution unit 202 extracts a security patch as the patch 203 from the storage device of the clean room realization server 200, and transmits the extracted security patch to the client 100. Then, the client 100 executes the received security patch.

  For example, when it is determined that the latest virus definition file is not held, the client 100 requests the patch distribution unit 202 to transmit the latest virus definition file according to the security check tool 102. Then, the patch distribution unit 202 extracts the latest virus definition file as the patch 203 from the storage device of the clean room realization server 200 and transmits the extracted virus definition file to the client 100. Then, the client 100 performs a virus check using the received virus definition file.

  When the patch 203 is downloaded and executed, the security check tool 102 passes a check result indicating that the security check has been completed without any problem to the policy switching tool 103. Then, the policy switching tool 103 sets the policy used by the client firewall 101 in the policy B 105 (step S17). That is, the policy switching tool 103 switches the policy to be selected from the policy A 104 to the policy B 105. By switching to the policy B 105, the client 100 can transmit packets to both the clean room realization server 200 and the business server 300.

  If it is determined in step S15 that the security status of the client 100 matches the security condition, the security check tool 102 passes the security check result to the policy switching tool 103 as it is without executing step S16. Then, the policy switching tool 103 executes the process of step S17 to switch the policy to be selected from the policy A 104 to the policy B 105.

  As described above, according to the present embodiment, when the client 100 connects to the network, the policy switching tool 103 selects the policy A 104 that permits only transmission of packets to the clean room realization server 200. Therefore, the access destination of the client 100 that has not completed the security check can be limited to the clean room realization server 200. Further, when the security check of the client 100 is completed, the policy switching tool 103 switches the policy to be selected to the policy B 105 that permits transmission of packets to both the clean room realization server 200 and the business server 300. Therefore, only the client 100 that has completed the security check can access the business server 300. Therefore, the client 100 can be restricted from accessing the business server 300 before the client 100 completes the security check.

  Further, according to the present embodiment, it is possible to prevent the client 100 to which no security patch has been applied from accessing the business server 300. Further, according to the present embodiment, it is possible to prevent a client 100 that does not hold the latest virus definition file and may be infected with a computer virus from accessing the business server 300. Further, according to the present embodiment, the client 100 can easily download and execute the patch 203 from the patch distribution unit 202. Therefore, even if it is determined that the security conditions are not met, the client 100 can access the business server 300 by downloading and executing the patch 203. Further, according to the present embodiment, a plurality of security checks such as a security patch check and a virus definition file version check can be performed in cooperation.

  Further, according to the present embodiment, since the client 100 can be restricted from accessing the business server 300 until the security check is completed, it is ensured that the computer virus has entered the area of the business server 300 in the computer network. Can be prevented. That is, according to the present embodiment, the area of the business server 300 can be kept in a clean room state. Therefore, it is possible to ensure the security of the computer network.

  The present invention can be applied to a security check used when a client terminal connects to a network in a computer network using a client firewall. In particular, it can be applied to the purpose of strengthening security management, such as thorough security ensuring by security patches in a computer network using an intranet, or thorough updating to the latest version of virus definition files. It can also be applied to applications such as VPN for reducing risk in remote access.

It is a block diagram which shows an example of a structure of the computer network to which the security check system by this invention is applied. It is explanatory drawing which shows the example of the content of policy A104. It is explanatory drawing which shows the example of the content of policy B105. 5 is a flowchart illustrating an example of processing for performing a security check of a client 100 and setting a policy used by a client firewall 101. It is a block diagram which shows the structural example of the conventional security check system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Client 101 Client firewall 102 Security check tool 103 Policy switching tool 104,105 Policy 200 Clean room realization server 201 Security check means 202 Patch distribution means 203 Patch 300 Business server

Claims (11)

It has a client terminal that accesses the business server via the network.
The client terminal is
Security judgment means for judging whether or not the security status of the client terminal meets a predetermined condition;
And a security check including: an access permission unit that permits the client terminal to access the business server when the security determination unit determines that the security state of the client terminal satisfies a predetermined condition. system. The client terminal
Condition storage means for storing condition data indicating conditions for filtering data when the client terminal performs communication;
Filtering means for filtering data when the client terminal performs communication according to the condition data,
The access permission means is a condition that permits communication of data to the business server among the condition data stored in the condition storage means when the security determination means determines that the security status of the client terminal meets a predetermined condition. Select the data
The security check system according to claim 1, wherein the filtering unit filters data when the client terminal performs communication according to the condition data selected by the access permission unit. A condition management server that manages security conditions indicating the security status conditions required for the client terminal is provided.
Security judging means judges whether or not the security status of the client terminal matches the security conditions managed by the condition management server;
The access permission means is a condition that permits communication of data to the business server among the condition data stored in the condition storage means when the security determination means determines that the security status of the client terminal matches the security condition. The security check system according to claim 2, wherein data is selected. The condition storage means, as condition data, is limited condition data that allows only data communication to the condition management server, and unlimited communication that permits both data communication to the condition management server and data communication to the business server. Memorize the condition data,
Access permission means
When the client terminal is connected to the network, the condition data stored in the condition storage means is selected from the limited condition data,
The security system according to claim 3, wherein when the security judgment means judges that the security status of the client terminal matches the security condition, the condition data to be selected is switched from restricted condition data to unrestricted condition data. Condition management server
Specific information storage means for storing condition specifying information for specifying security conditions;
Condition information transmitting means for transmitting the condition specifying information stored in the specific information storing means to the client terminal,
The security check system according to claim 3 or 4, wherein the security judgment means judges whether or not a security state of the client terminal matches a security condition based on the condition specifying information received from the condition management server. The specific information storage means stores condition specifying information including information for specifying a security patch to be installed in the client terminal,
Security judgment means
Based on the condition specifying information, determine whether a security patch is installed on the client terminal,
The security check system according to claim 5, wherein when it is determined that the security patch is installed on the client terminal, it is determined that the security status of the client terminal matches the security condition. Condition management server
Patch storage means for storing security patches to be installed on the client terminal;
The security check system according to claim 6, further comprising: a patch transmission unit that transmits a security patch stored in the patch storage unit to the client terminal in accordance with a request from the client terminal. The specific information storage means stores condition specifying information including information for specifying a virus definition file to be held by the client terminal,
Security judgment means
Based on the condition specifying information, it is determined whether the client terminal holds a virus definition file,
The security check system according to any one of claims 5 to 7, wherein when it is determined that the client terminal holds a virus definition file, the security status of the client terminal matches a security condition. . Condition management server
Virus definition storage means for storing virus definition files to be held by the client terminal;
The security check system according to claim 8, further comprising virus definition transmission means for transmitting a virus definition file stored in the virus definition storage means to the client terminal in accordance with a request from the client terminal. A security judgment step for judging whether or not the security status of the client terminal accessing the business server via the network meets a predetermined condition;
An access permission step for permitting the client terminal to access the business server when it is determined that the security status of the client terminal meets a predetermined condition. A condition storage step for storing condition data indicating conditions for filtering data when the client terminal performs communication;
Filtering step of filtering data when the client terminal performs communication according to the condition data,
The access permission step, when it is determined that the security status of the client terminal meets a predetermined condition, out of the stored condition data, selecting condition data that permits data communication to the business server,
The security check method according to claim 10, wherein the filtering step performs filtering of data when the client terminal performs communication according to the condition data selected in the access permission step.

Images