JP2006018766A - Network connection management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To suppress an adverse influence exerted on a communication network system by a connected computer and to suppress an adverse influence exerted on the connected computer by the communication network system. <P>SOLUTION: When a new or existing computer terminal 10 is connected to a communication network system 100, it is automatically connected to a protected remote network 20 for maintenance, and fragility and safety such as whether it is infected by virus or not of the computer terminal 10 trying to connect to the communication network system 100, are inspected, and a correction program is applied to the computer terminal 10 in the case that the computer terminal 10 has a fragility or is infected with virus, and connection of the computer terminal 100 to the communication network system 100 is permitted when the safety is confirmed. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a network connection management system, and more particularly to a network connection management system that performs safety inspection by connecting a terminal connected to a network to an isolated network.

It is a well-known fact that there are a number of vulnerabilities in terminals in the initial shipment state as computer systems become more complex. In addition, it is difficult to maintain security consistently as new vulnerabilities are discovered one after another for terminals once security measures have been taken. In recent years, security patches are often distributed via a network.
In addition, the network administrator determines the security policy in the scope of management, registers it in the security policy management device, and the network administrator adds, modifies, or deletes this security policy as necessary. Accepts a communication request and sets it in a network device. In addition, the network layer includes a first layer including a logical closed network component management unit that receives a user request, a second layer including a network policy component management unit that manages a network policy, and a virtual closed network (VPN). Three layers of the third layer composed of the security protection tool component management unit for setting the apparatus are configured, and the security policy check function is collected in the second layer. As a result, there is one in which the time from when a network user requests a logically closed network to when it is created is shortened (see, for example, Patent Document 1).
Further, based on whether or not a program used for each node in the virtual target system defined by the object definition function unit matches a program such as a service or OS having a vulnerability defined in the vulnerability DB. The vulnerability assessment function unit inspects the target system for vulnerabilities. For this reason, unlike conventional systems, there is no need to assemble an actual machine, there is no need to define causal rules for the authentication process, there is no need to use an expert system, and there is no need to use an expert system, while reducing human labor and reducing costs. There is one in which vulnerability is evaluated faster than in the past (for example, see Patent Document 2).
JP 2001-358716 A JP 2003-108521 A

However, in recent years, computer viruses of the type that attack all terminals on the network indiscriminately have emerged, and even if a modification program is applied to the terminals, it is dangerous to connect to the network carelessly. is there. Therefore, a method of storing a physical medium in which a correction program is recorded can be considered, but there is a problem that its management and operation are more troublesome than distribution via a network.
Further, the inventions of Patent Document 1 and Patent Document 2 have a problem that the terminal cannot be temporarily disconnected from the existing network to check the vulnerability and correct the discovered vulnerability.
The present invention has been made in view of such a situation, and by temporarily disconnecting the terminal from the network and connecting it to the isolated network, the terminal is checked for vulnerabilities, and the found vulnerabilities are corrected. Is to be able to do.

The network connection management system according to claim 1, wherein a terminal that has attempted to connect to the first network is connected to the second terminal by a first terminal connection unit, and the terminal is inspected for vulnerability. Means, a correction program application means for applying a correction program to the terminal when a vulnerability is detected by the inspection means, a virus check execution means for performing a virus check on the terminal, and a virus check execution means from the terminal. A virus removal unit that removes a virus from the terminal when a virus is detected; and a second terminal connection unit that connects the terminal to the first network when the safety of the terminal is confirmed. It is characterized by.
Further, each terminal further includes a first storage unit that stores vulnerability information, and when the vulnerability information is updated after the vulnerability inspection is performed on the terminal, the inspection unit The terminal can be inspected for vulnerabilities based on the updated vulnerability information.
In addition, each terminal may further include a second storage unit that stores the inspection result by the inspection unit and the check result by the virus check execution unit.
Further, the first terminal connection means can connect the terminal to the second network through the VLAN.
The network connection management method according to claim 5 comprises first terminal connection means, inspection means, modification program application means, virus check execution means, virus removal means, and second terminal connection means. A network connection management method in a network connection management system, wherein a first terminal connection unit connects a terminal that has attempted to connect to a first network to a second network, and an inspection unit. An inspection step for inspecting the terminal for a vulnerability, a correction program applying means for applying a correction program to the terminal when a vulnerability is detected in the inspection step, and a virus check. A virus check execution step in which the execution means performs a virus check on the terminal, and virus removal When a virus is detected from the terminal in the virus check execution step, the virus removal step for removing the virus from the terminal and the second terminal connection means confirm that the terminal is safe. And a second terminal connection step of connecting to the first network.
The network connection management program according to claim 6 includes first terminal connection means, inspection means, correction program application means, virus check execution means, virus removal means, and second terminal connection means. A network connection management program for controlling a network connection management system, wherein the first connection means executes a first terminal connection step of connecting a terminal that has attempted to connect to the first network to the second network. , Causing the inspection means to execute an inspection step for inspecting the terminal for vulnerability, and applying the correction program to the correction program application means to apply the correction program to the terminal when a vulnerability is detected in the inspection step The virus check is executed by the virus check execution means. The virus removal means is executed, and when a virus is detected from the terminal in the virus check execution step, the virus removal step for removing the virus from the terminal is executed, and the second terminal connection means When the safety of the terminal is confirmed, a second terminal connection step for connecting the terminal to the first network is executed.

  According to the network connection management system of the present invention, when a terminal tries to connect to the network, it is automatically connected to an isolated network to which security measures have been taken, the terminal is checked for vulnerabilities, and whether there is a virus infection or not. Since the check is performed and corrective processing is performed, it is possible to connect to the network safely without adversely affecting other terminals on the network and without being attacked by other terminals on the network. be able to.

  The present invention enables a computer to be securely connected to a network system, and automatically connects to a protected and isolated network when a new or existing computer is connected to the network system. , Check the security of the connected computer, and if a vulnerability exists or if it is infected with a computer virus, take measures against it, and allow the connection to the network system when the safety is confirmed . This suppresses the adverse effect on the network system by the connected computer, and conversely suppresses the spread of damage due to the adverse effect on the connected computer from the network system.

  FIG. 1 is a diagram showing a configuration example of an embodiment of the present invention. As shown in the figure, the present embodiment is a communication network 100, a computer terminal 10 connected to the communication network 100, and a maintenance isolation for investigating the safety of the computer terminal 10 connected to the communication network 100. The network 20 is configured, and the computer terminal 10 and the maintenance isolation network 20 are connected via the communication network 100.

  The computer terminal 10 is a computer device connected to the communication network 100 and used by a user. The maintenance isolation network 20 is a network independent of the communication network 100 for investigating the safety of the computer terminal 10 when the computer terminal 10 is connected to the communication network 100. 100 and the computer terminal 10 connected to the communication network 100 are operating in a state of being logically isolated using a VLAN (Virtual Local Area Network) technology.

  Only when the computer terminal 10 is connected to the communication network 100 and checks its safety, the computer terminal 10 and the maintenance isolation network 20 are temporarily reconfigured as the same network by using VLAN technology. Provides a connection between them.

  The communication network 100 is a network system for connecting the computer terminals 10 to each other and the computer terminal 10 and the maintenance isolation network 20, and is normally logically isolated from the maintenance isolation network 20 using VLAN technology. It is operating in the state.

  Only when the computer terminal 10 is connected to the communication network 100 and checks its safety, by using the VLAN technology, the computer terminal 10 and the maintenance isolation network 20 are temporarily reconfigured as the same network, A connection between the computer terminal 10 and the maintenance isolation network 20 is provided.

  FIG. 2 is a block diagram illustrating a configuration example of the maintenance isolation network 20. As shown in the figure, the maintenance isolation network 20 includes four types of servers, a vulnerability detection server 201, an update server 202, a virus detection server 203, and a management server 204, a terminal information management database 205, and a vulnerability information management database. 206, a patch information management database 207 and a virus information management database 208, and a maintenance isolation network system 209 for connecting them.

  The vulnerability detection server 201 is an information processing apparatus that exists in the maintenance isolation network 20, and when the computer terminal 10 is connected to the communication network 100, a security inspection of the computer terminal 10 is performed. Yes.

  The update server 202 is an information processing apparatus existing in the maintenance isolation network 20, and if the vulnerability detection server 201 detects that the computer terminal 10 connected to the communication network 100 is vulnerable, the update server 202 A fix program is available to fix the vulnerability.

  The virus detection server 203 is an information processing apparatus that exists in the maintenance isolation network 20. When the computer terminal 10 connects to the communication network 100, the computer terminal 10 is checked for viruses and a virus is detected. The virus will be removed.

  The management server 204 is an information processing apparatus existing in the maintenance isolation network 20, manages safety inspections performed in the maintenance isolation network 20, registers inspection results in the terminal information management database 205, and manages them Information is sent to the person.

  The terminal information management database 205 is host information including an IP (Internet Protocol) address, a MAC (Media Access Control) address, a host name, OS (Operating System) information, a final inspection date, and the like of the computer terminal 10 connected to the communication network 100. (Terminal information), history of each inspection such as vulnerability inspection and virus inspection, and information of countermeasure results (in vulnerability inspection, vulnerability detection history (history of information indicating vulnerability), detection date and time, countermeasure content In the virus inspection, a database storing virus detection history (history of information indicating a detected virus), detection date and time, and countermeasures), and the vulnerability detection server 201 performs vulnerability detection processing of the computer terminal 10. Used when Test results by the management server 204 are registered.

  The vulnerability information management database 206 is a database in which known vulnerability information is stored for each terminal system such as the OS and version of the computer terminal 10, and the vulnerability detection server 201 detects the vulnerability of the computer terminal 10. It is used when performing processing.

  The patch information management database 207 is a database that stores information on a modification program for a known vulnerability for each terminal system of the computer terminal 10 (for example, a URL (uniform resource locator) where the modification program is located). The server 202 is used when providing a correction program for correcting the vulnerability of the computer terminal 10.

  The virus information management database 208 is a database that stores known computer virus information, and is used when the virus detection server 203 performs a virus check on the computer terminal 10.

  The maintenance isolation network system 209 is a network system for connecting each of the servers, databases, and computer terminals 10 in the maintenance isolation network 20 to the communication network 100, and usually uses VLAN technology. At times, the communication network 100 and the maintenance isolation network 20 are kept in a logical isolation state.

  When the computer terminal 10 is connected to the communication network 100, the computer terminal 10 and each server in the maintenance isolation network 20 are used only when the security of the computer terminal 10 is checked. Are temporarily reconfigured as the same network to provide a connection between them.

FIG. 3 is a block diagram illustrating a configuration example of the communication network 100. As shown in the figure, the communication network 100 includes a terminal connection switch 101 and a network connection router 102.

  The terminal connection switch 101 is a terminal connection switching hub for connecting the computer terminal 10 to the communication network 100. When the computer terminal 10 connects to the communication network 100, a safety inspection is performed by using VLAN technology. Therefore, the computer terminal 10 is disconnected from the communication network 100 and temporarily connected to the maintenance isolation network 20. That is, an independent VLAN ID that is not used in any of the communication networks 100 is assigned to the maintenance isolation network 20 in advance to form a logically isolated state. When connecting the computer terminal 10 to the communication network 100, the same VLAN ID as that of the maintenance isolation network 20 is temporarily assigned to the port of the terminal connection switch 101 to which the computer terminal 10 is directly connected, and communication is performed. In a state of being isolated from the network 100, first, it is connected to the maintenance isolation network 20. Further, after the safety inspection is completed and the safety of the computer terminal 10 is confirmed, the computer terminal 10 is connected to the communication network 100 as usual. The network connection router 102 is a router for connecting the communication network 100 and the maintenance isolation network 20.

  Next, the operation of the present embodiment will be described in detail with reference to the flowcharts of FIGS. First, when the computer terminal 10 tries to connect to the communication network 100 (step A1), the terminal connection switch 101 that is an access point to the communication network 100 does not connect the computer terminal 10 directly to the communication network 100. The port to which the computer terminal 10 is connected is assigned to the same VLAN as the maintenance isolation network 20 by VLAN technology (step A2).

  This VLAN constitutes a network independent of the existing communication network 100 and the computer terminal 10 that is already connected to the communication network 100, and the computer terminal 10 enters the communication network 100 or the communication network 100 from the computer. Communication to the terminal 10 is not permitted. The computer terminal 10 can be inspected for its own safety in the secure maintenance isolation network 20 isolated from the existing communication network 100.

  The terminal connection switch 101 changes the connection target of the computer terminal 10 attempting to connect to the communication network 100 from the existing communication network 100 to the maintenance isolation network 20 and manages the maintenance in the maintenance isolation network 20. The server 204 is notified that the computer terminal 10 is trying to connect to the communication network 100. Upon receiving this notification, the management server 204 notifies the vulnerability detection server 201 of the IP address of the computer terminal 10 and requests execution of the vulnerability check.

  Upon receiving this request, the vulnerability detection server 201 performs a simple scan on the computer terminal 10, and a unique terminal of the computer terminal 10, such as the host name, MAC address, OS type, and OS version of the computer terminal 10. Collect information. Based on the collected terminal information, the computer terminal 10 that is a connection terminal is identified and compared with the terminal information in the terminal information management database 205 shown in FIG. 6 (step A3).

  Whether this computer terminal 10 is new, is the same as the one connected to the communication network 100 in the past, or is the same, the computer terminal 10 is compared with the terminal information in the terminal information management database 205. It is determined whether or not there is any evidence that the system configuration has been changed.

  If the terminal information of the computer terminal 10 is not registered in the terminal information management database 205 and it is determined that the computer terminal 10 is new, the vulnerability detection server 201 is registered in the vulnerability information management database 206. Based on the information on the vulnerabilities that are present, an inspection for vulnerabilities is performed (step A4), and it is determined whether or not the vulnerabilities exist (step A5).

  When the vulnerability detection server 201 finds a vulnerability by this inspection, the vulnerability detection server 201 transmits information on the found vulnerability and the IP address of the computer terminal 10 to the management server 204. The management server 204 that has received the vulnerability information transmits the detected vulnerability information and the IP address of the computer terminal 10 to the update server 202, and requests correction of the vulnerability.

  Upon receiving this request, the update server 202 refers to the patch information management database 207 and applies a correction program for correcting the found vulnerability to the computer terminal 10 (step A6). On the other hand, if no vulnerability is found, it is determined that there is no vulnerability in the system of the computer terminal 10.

  If it is determined that the computer terminal 10 is an existing computer terminal 10 that has connected to the communication network 100 in the past, the vulnerability detection server 201 is a computer registered in the vulnerability information management database 206. With reference to the inspection history of the terminal 10, it is confirmed whether or not information about a new vulnerability has been registered in the vulnerability information management database 206 since the computer terminal 10 was last subjected to a vulnerability inspection ( Step A8).

  As a result, when information about a new vulnerability is registered in the vulnerability information management database 206, the vulnerability detection server 201 performs only the inspection corresponding to the information about the vulnerability on the computer terminal 10. (Step A4), it is determined whether or not there is a vulnerability (Step A5). When the vulnerability detection server 201 finds a vulnerability by this inspection, the vulnerability detection server 201 transmits information on the found vulnerability and the IP address of the computer terminal 10 to the management server 204. The management server 204 that has received this information transmits vulnerability information and the IP address of the computer terminal 10 to the update server 202 and requests correction of the vulnerability.

  Upon receiving this request, the update server 202 refers to the patch information management database 207 and applies a correction program for correcting the found vulnerability to the computer terminal 10 (step A6). If no vulnerability is found, it is determined that there is no vulnerability in the system of the computer terminal 10.

  In step A8, if it is confirmed that information about a new vulnerability has not been registered in the vulnerability information management database 206 since the computer terminal 10 was last tested for vulnerabilities, After the implemented vulnerability check, it is determined that no problem has occurred, and it is determined that there is no vulnerability in the system of the computer terminal 10, and the process proceeds to step A9.

  Further, if the computer terminal 10 is an existing computer that has been connected to the communication network 100 in the past, but it is determined that some change has been made thereafter, the vulnerability test performed in the past is invalid. It is assumed that the vulnerability detection server 201 performs a vulnerability check on the basis of vulnerability information registered in the vulnerability information management database 206 (step A4), and whether or not there is a vulnerability. Is determined (step A5).

  When a vulnerability is found by this inspection, the vulnerability detection server 201 transmits information on the found vulnerability and the IP address of the computer terminal 10 to the management server 204. The management server 204 that has received these pieces of information transmits vulnerability information and the IP address of the terminal to the update server 202 and requests correction of the vulnerability. In response, the update server 202 refers to the patch information management database 207 and applies a correction program for correcting the found vulnerability to the computer terminal 10 (step A6). On the other hand, if no vulnerability is found, it is determined that there is no vulnerability in the system of the computer terminal 10.

  After the vulnerability inspection and the vulnerability correction processing are completed, the vulnerability detection server 201 notifies the management server 204 of the inspection date and time, the system information regarding the system of the computer terminal 10 that has been inspected, and the detected vulnerability. Information on the information and its correction status is transmitted, and the end of the inspection is notified.

  The management server 204 transmits the information transmitted from the vulnerability detection server 201 to the terminal information management database 205 and registers it (step A9). FIG. 6 shows an example of data registered in the terminal information management database 205. FIG. 6A shows terminal information (host information), and FIG. 6B shows vulnerability test results and virus test results.

  After the vulnerability check of the computer terminal 10 is completed, the management server 204 notifies the virus detection server 203 of the IP address of the computer terminal 10 and requests execution of a computer virus check. Upon receiving this request, the virus detection server 203 refers to the virus information management database 207, performs a virus check on the computer terminal 10 (step A10), and determines whether it is infected with a virus (step A11). .

  If a virus infection is found in the computer terminal 10, the virus detection server 203 executes the corresponding virus removal (step A12). On the other hand, if no virus infection is found in the computer terminal 10, it is determined that no virus exists in the computer terminal 10 (step A13).

  After the completion of the computer virus inspection and removal process, the virus detection server 203 transmits to the management server 204 the inspection date and time, the computer terminal 10 to be inspected, information on the detected virus, and the removal result thereof. Notify the end of the inspection. The management server 204 supplies the detected virus information transmitted from the virus detection server 203 and the removal result thereof to the terminal information management database 205 and registers them (step A14).

  When the security of the computer terminal 10 is confirmed after the vulnerability inspection and the computer virus inspection are completed, the management server 204 authenticates the VLAN of the connection port of the computer terminal 10 with respect to the terminal connection switch 101. And instruct to permit connection to the communication network 100 (step A15). Upon receiving this instruction, the terminal connection switch 101 changes the VLAN of the connection port of the computer terminal 10 to a regular one, and permits the connection to the communication network 100 by the computer terminal 10 (step A16).

  The management server 204 notifies the computer terminal 10 of the result (inspection result) of the security check performed this time (step A17). The computer terminal 10 displays the result of the security check notified from the management server 204 on the screen. FIG. 7 shows the result of the security check displayed on the screen of the computer terminal 10. In this example, the title “terminal inspection result notification” indicating the result of the security check, the inspection date, the IP address of the computer terminal 10, the MAC address, the host name, and the newly detected vulnerability are indicated. Information (vulnerability detection history and countermeasure content) and newly detected virus information are notified and displayed on the screen of the computer terminal 10. If any problem is found as a result of the inspection, the inspection result is transmitted to the administrator.

  As described above, the following effects can be obtained by this embodiment. That is, even when a computer terminal 10 to which a security patch is not applied and a computer terminal 10 infected with a virus attempt to connect to the communication network 100, the maintenance isolation network 20 to which security measures are automatically applied is provided. Since it is connected, there is no possibility that other computer terminals 10 connected to the existing communication network 100 will be affected. Conversely, even if there is a computer terminal 10 infected with a virus or the like on the existing communication network 100, the computer terminal 10 will not be attacked.

  A series of processes of “quarantine”, “detection”, and “correction” are automatically performed on the management server 204 and various inspection servers (the vulnerability detection server 201, the update server 202, and the virus detection server 203). Therefore, it is not necessary for the computer terminal 10 and the user to take special procedures, and consistent security measures are surely taken. Since a series of these processes can be performed in an integrated manner, the management thereof is also easy. As a result, it is possible to improve the ease of security management of the computer terminal 10 and prevent the communication network 100 from being adversely affected by the user's careless connection to the communication network 100, and the computer terminal newly connected to the communication network 100. 10 and the computer terminal 10 that is frequently moved and changed can be safely operated.

  It should be noted that the configuration and operation of the above-described embodiment are examples, and it goes without saying that they can be changed as appropriate without departing from the spirit of the present invention.

It is a figure which shows the structural example of one embodiment of this invention. It is a figure which shows the structural example of the isolation network for a maintenance. It is a figure which shows the structural example of a communication network. It is a flowchart for demonstrating operation | movement of this Embodiment. It is a flowchart for demonstrating operation | movement of this Embodiment. It is a figure which shows the example of the data stored in a terminal information management database. It is a figure which shows the example of a test result report which a management server notifies to a computer terminal.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Computer terminal 20 Maintenance isolation network 100 Communication network 201 Vulnerability detection server 202 Update server 203 Virus detection server 204 Management server 205 Terminal information management database (DB)
206 Vulnerability Information Management Database (DB)
207 Patch information management database (DB)
208 Virus information management database (DB)
209 Isolation network system for maintenance

Claims (6)

First terminal connection means for connecting a terminal that has attempted to connect to the first network to the second network;
Inspection means for inspecting the terminal for vulnerabilities;
A correction program applying means for applying a correction program to the terminal when the vulnerability is detected by the inspection means;
Virus check execution means for performing virus check on the terminal;
When a virus is detected from the terminal by the virus check execution means, a virus removal means for removing the virus from the terminal;
A network connection management system comprising: second terminal connection means for connecting the terminal to the first network when the safety of the terminal is confirmed. A first storage means for storing the vulnerability information for each terminal;
When the vulnerability information is updated after the vulnerability inspection is performed on the terminal, the inspection unit is vulnerable to the terminal based on the updated vulnerability information. The network connection management system according to claim 1, wherein the inspection is performed. 3. The network connection management system according to claim 1, further comprising a second storage unit that stores an inspection result by the inspection unit and a check result by the virus check execution unit for each terminal. The network connection management system according to any one of claims 1 to 3, wherein the first terminal connection means connects the terminal to the second network through a VLAN. A network connection management method in a network connection management system comprising first terminal connection means, inspection means, modification program application means, virus check execution means, virus removal means, and second terminal connection means. ,
A first terminal connection step in which the first terminal connection means connects a terminal that has attempted to connect to the first network to the second network;
An inspection step in which the inspection means inspects the terminal for vulnerabilities;
A correction program applying step for applying a correction program to the terminal when the vulnerability is detected in the inspection step;
A virus check execution step in which the virus check execution means performs a virus check on the terminal; and
A virus removal step for removing the virus from the terminal when the virus removal means detects a virus from the terminal in the virus check execution step;
The network connection management system comprising: a second terminal connection step in which the second terminal connection means connects the terminal to the first network when the safety of the terminal is confirmed. A network connection management program for controlling a network connection management system comprising first terminal connection means, inspection means, modification program application means, virus check execution means, virus removal means, and second terminal connection means There,
Causing the first connection means to execute a first terminal connection step of connecting a terminal that has attempted to connect to the first network to the second network;
Causing the inspection means to execute an inspection step for inspecting the terminal for vulnerabilities;
When the vulnerability is detected in the inspection step, the correction program application means executes a correction program application step of applying a correction program to the terminal,
Causing the virus check execution means to execute a virus check execution step for performing virus check on the terminal;
Causing the virus removal means to execute a virus removal step for removing the virus from the terminal when a virus is detected from the terminal in the virus check execution step;
A network connection management program for causing the second terminal connection means to execute a second terminal connection step of connecting the terminal to the first network when the safety of the terminal is confirmed.

Images