JP2006065414A - Remote access quarantine system and remote access quarantine method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable simple access to a network that needs quarantine. <P>SOLUTION: A remote access quarantine system 10 includes a firewall 12 provided between an external network N2 and an internal network N1 to retain access settings that correspond to a PC 20, so as to control based on the retained access settings the access to the internal network N1 from the PC 20 connected to the external network N2; an inspection server 13 that inspects the PC 20 for security about information processing; and a quarantine management server 14 that, based on the result of the inspection, varies the access settings retained correspondingly to the PC 20. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a remote access quarantine system and a remote access quarantine method.

Conventionally, when a personal PC (Personal Computer) is connected to a corporate network system from an external network, the safety of information processing, such as whether anti-virus software is resident on the PC, is checked. So-called “quarantine” is performed to control connection to the network based on the result (see, for example, Non-Patent Document 1 below).
“N + I Network Guide”, Softbank Publishing Co., Ltd., September 2004, p. 40-43

  However, the technique described in Non-Patent Document 1 requires complicated advance preparation such as installation of dedicated software for inspecting a PC to be connected to the network. If the software is not installed, you cannot access networks that require quarantine.

  Therefore, the present invention provides a remote access quarantine system and a remote access quarantine method that do not require advance preparation for quarantine such as software installation, and enable simple access to a network that requires quarantine. With the goal.

  The remote access quarantine system according to the present invention is provided between an external network and an internal network, holds an access setting corresponding to a terminal, and an internal network from a terminal connected to the external network based on the held access setting A firewall that controls access to the terminal, an inspection unit that performs a security check on information processing for the terminal, a setting unit that changes an access setting held in correspondence with the terminal based on a result of the inspection, Is provided.

  In the remote access quarantine system of the present invention, the inspection means inspects a terminal that attempts to access the internal network, and the setting means changes the firewall setting based on the inspection result. Therefore, only the terminals whose safety is ensured in terms of information processing in the inspection are permitted to be accessed in the firewall. On the other hand, simple access is possible without requiring preparations for quarantine.

  The inspection means transmits a program for inspection in response to a request from the terminal, receives data acquired by executing the program in the terminal in response to the transmission from the terminal, and transmits the received data to the received data. It is desirable to perform an inspection based on this. According to this configuration, the present invention can be easily implemented, for example, the conventional technique can be used for the inspection portion.

  Further, in the setting corresponding to the terminal in the firewall, it is desirable that the terminal is specified by an IP (Internet Protocol) address assigned to the terminal in order to access the network inside the firewall. In the Internet network, since the terminal is specified by the IP address, according to this configuration, the present invention can be easily implemented.

  The remote access quarantine system preferably further includes an IP address assigning unit that assigns an IP address to the terminal for each access from the terminal. According to this configuration, since an IP address is assigned in the remote access quarantine system, the present invention can be more reliably implemented.

  By the way, the present invention can be described as the invention of the system as described above, and can also be described as the invention of the remote access quarantine method as follows. This is substantially the same invention only in different categories, and has the same operations and effects. The remote access quarantine method of the present invention is provided between an external network and an internal network, holds an access setting corresponding to the terminal, and an internal network from a terminal connected to the external network based on the held access setting A remote access quarantine method in a system including a firewall that controls access to a terminal, and an inspection step for inspecting the safety of information processing for the terminal, and corresponding to the terminal based on the result of the inspection And a setting step for changing the access settings held by the user.

  According to the present invention, only a terminal that is secured for information processing in the inspection is permitted to be accessed in the firewall, and on the other hand, a simple access is possible without requiring preparation for quarantine. Become.

  The teachings of the present invention can be readily understood by considering the following detailed description with reference to the accompanying drawings shown for illustration only. Subsequently, embodiments of the present invention will be described with reference to the accompanying drawings. Where possible, the same parts are denoted by the same reference numerals, and redundant description is omitted.

  FIG. 1 shows a configuration of a remote access quarantine system 10 in the present embodiment. The remote access quarantine system 10 is a system that inspects a PC (terminal) 20 that tries to access the internal network N1 from the outside, and controls access based on the inspection result. Here, “quarantine” refers to information such as whether anti-virus software is resident, whether the virus pattern is the latest, and whether the latest patch is applied to the OS (Operating System). Inspecting whether or not processing safety is ensured, and controlling connection to the network based on the inspection result. The PC 20 is a device that accesses the internal network N1 via the external network N2. The external network N2 is a connection target of the remote access quarantine system 10 and the PC 20, and specifically corresponds to, for example, the Internet network or the telephone line network.

  The remote access quarantine system 10 includes an access server (IP address assigning means) 11, a firewall 12, an inspection server (inspection means) 13, a quarantine management server (setting means) 14, and a user authentication server 15. And located between the external network N2 and the internal network N1. Here, each of the above-described components is connected to each other and can transmit and receive data. However, access from the outside of the firewall 12 to the inspection server 13, the quarantine management server 14, the user authentication server 15, and the internal network N1 must pass through the firewall 12.

  The access server 11 provides functions necessary for accessing the internal network N1, the inspection server 13, and the like to the PC 20 connected to the external network N2 outside the firewall 12. If the PC 20 accesses the access server 11 and is not provided with the above functions, the PC 20 cannot access the internal network N1 or the like. Further, the access server 11 assigns an IP address for accessing the internal network N1 and the like to the PC 20. This IP address assignment is performed at every access. The range of IP addresses to be allocated (pool address) is determined in advance. The access server 11 is specifically a VPN (Virtual Private Network) (specifically, using, for example, IPsec (Security Architecture for Internet Protocol) or SSL (Secure Socket Layer)), RAS (Remote). The server apparatus which implement | achieves functions, such as these, is equivalent.

  The firewall 12 prevents unauthorized entry into the firewall 12 (such as the internal network N1 and the inspection server 13) by packet filtering or the like, and is provided between the external network N2 and the internal network N1. Further, the firewall 12 holds a setting of whether or not to access the internal network N1 corresponding to the PC 20, and controls access from the PC 20 to the internal network N1 based on the access setting. Specifically, the access setting is retained by the firewall 12 storing data as shown in the table 12a of FIG. For example, the first line of the table 12a of FIG. 2 is a rule that permits access to the “network N1” to the PC 20 to which the IP address “xx.xx.xx.1” is assigned as “rule 1”. Is defined. However, this rule is “invalid” before the PC 20 is quarantined. That is, in the access setting described in the first line of the table 12a in FIG. 2, the rule is invalid, and the PC 20 to which the IP address “xx.xx.xx.1” is assigned accesses the network N1. Can not do it. The case where the rule is validated will be described later.

  As described above, it is preferable to specify the PC 20 in the access setting using the IP address. The IP address range in the above access setting is the same as the IP address assigned by the access server 11.

  The inspection server 13 inspects the PC 20 trying to access the internal network N1. A specific inspection method will be described later. Information on the inspection result is transmitted to the quarantine management server 14.

  The quarantine management server 14 receives and manages information on the results of the inspection by the inspection server 13. The quarantine management server 14 refers to the inspection information and changes the access setting in the firewall 12 corresponding to the quarantine target PC 20 based on the result. A specific changing method will be described later. The data managed by the quarantine management server 14 includes quarantine date and time (date, time), quarantine result, inspection result, PC information (IP address, MAC address), valid and invalid date and time of access setting of the firewall 12, and It is preferable that the status of the access setting is included.

  The user authentication server 15 authenticates whether or not the PC 20 is a terminal that may access the internal network N1. Specifically, for example, an authentication method using an ID and a password received from the PC 20 and using the information may be used. Other general authentication methods may be used.

  Each of the above components is preferably realized by a server device including a CPU, a memory, a storage, and the like.

  The internal network N1 is a network to be remotely accessed by the PC 20. For example, it corresponds to a business network of a company or the like.

  Hereinafter, processing executed by the remote access quarantine system 10 according to the present embodiment will be described with reference to the flowchart of FIG. This process is executed when the PC 20 tries to access the internal network N1.

  First, the PC 20 accesses the user authentication server 15. The user authentication server 15 receives the ID and password from the PC 20 and authenticates the user of the PC 20 based on the information (S01). Here, if the authentication fails, the process ends in a state where the PC 20 cannot access the internal network N1. If the authentication is successful, information to that effect is transmitted from the user authentication server 15 to the access server 11. The access server 11 selects an arbitrary IP address from the pool address, and assigns the IP address to the PC 20 (S02).

  Subsequently, the remote access quarantine system 10 inspects the PC 20 (S03). The inspection process will be described with reference to the sequence diagram of FIG. First, the PC 20 accesses the inspection server 13 and requests an inspection program (S03a). Access to the inspection server 13 is preferably performed by designating a URL (Uniform Resource Locator) using a Web browser, for example. When the inspection program is executed on the PC 20, it collects data necessary for the inspection from the registry information of the PC 20. As data necessary for the inspection, data used in a conventional quarantine system may be used.

  Upon receiving the request, the inspection server 13 transmits an inspection program to the PC 20 (S03b). The PC 20 to which the inspection program is transmitted receives and executes the inspection program (S03c). Since the data necessary for the inspection is collected by executing the program, the PC 20 transmits these data to the inspection server 13 (S03d). The inspection server 13 receives these data and performs an inspection process on the PC 20 (S03e). Specifically, the inspection is performed by comparing the data transmitted from the PC with the inspection reference information held in advance in the inspection server 13. Subsequently, the inspection server 13 creates inspection result information and transmits it to the quarantine management server 14. The inspection result information includes information such as an IP address that identifies the PC 20 to be quarantined. The inspection server 13 preferably transmits the inspection result information to the PC 20 so that the user can know whether the user can access the internal network N1.

  Subsequently, in the quarantine management server 14 to which the inspection result information has been transmitted, the PC 20 determines whether or not the terminal is a terminal for which safety is ensured for information processing by receiving and referring to the inspection result information (see FIG. 3 S04). If it is determined that there is a problem, the process ends in a state where the PC 20 cannot access the internal network N1. If it is determined that there is no problem, the quarantine management server 14 changes the access settings held by the firewall 12 so that the PC 20 can access the internal network N1 (S05). Specifically, the status of the portion corresponding to the IP address of the PC 20 in the access setting table shown in FIG. 2 is validated. In order to validate the status, for example, the quarantine management server 14 transmits a command character string that validates the rule No. 1 to the firewall 12. Specifically, for example, a character string such as “unset policy id1 disabled” is used. When the access setting is changed, the PC 20 can access the internal network N1.

  When the connection from the PC 20 is disconnected, the access server 11 notifies the quarantine management server 14 to that effect. The quarantine management server 14 invalidates the access setting of the firewall 12 corresponding to the PC 20 and capable of accessing the internal network N1. In order to invalidate the status, for example, the quarantine management server 14 transmits a command character string for invalidating the rule No. 1 to the firewall 12. Specifically, for example, a character string such as “set policy id1 disabled” is used.

  As described above, according to the remote access quarantine system 10 in the present embodiment, only the PC 20 whose information processing safety is ensured in the inspection is allowed to access the internal network N1 in the firewall 12. On the other hand, from the PC 20, simple access to the internal network N1 is possible without requiring preparation for quarantine.

  Further, if the inspection is performed using the inspection program as in the present embodiment, the present invention can be easily implemented, such as using the conventional technique for the inspection portion. However, an inspection method that is not a method for executing the program as described above may be used.

  If the PC 20 is specified using an IP address as in the present embodiment, the present invention can be easily implemented in the Internet network. Note that the PC 20 may be specified by other than the IP address.

  If the access server 11 assigns an IP address to the PC 20 as in this embodiment, the remote access quarantine system 10 assigns an IP address, so that the present invention can be implemented more reliably.

It is a figure which shows the structure of the remote access quarantine system in embodiment. It is a figure which shows the table of the access control which a firewall memorize | stores. It is a flowchart which shows the process performed with a remote access quarantine system in embodiment. It is a sequence diagram which shows the flow of a test | inspection in embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Remote access quarantine system, 11 ... Access server, 12 ... Firewall, 13 ... Inspection server, 14 ... Quarantine management server, 15 ... User authentication server, 20 ... PC, N1 ... Internal network, N2 ... External network.

Claims (5)

A firewall that is provided between an external network and an internal network, holds an access setting corresponding to the terminal, and controls access to the internal network from a terminal connected to the external network based on the held access setting When,
Inspection means for performing information processing safety inspection for the terminal;
Based on the result of the inspection, setting means for changing the access setting held corresponding to the terminal;
A remote access quarantine system comprising:   The inspection means transmits a program for inspection in response to a request from the terminal, receives data acquired by executing the program in the terminal in response to the transmission, and receives the data received from the terminal The remote access quarantine system according to claim 1, wherein the inspection is performed based on data. In the setting corresponding to the terminal in the firewall, the terminal is specified by an IP address assigned to the terminal in order to access a network inside the firewall.
The remote access quarantine system according to claim 1 or 2.   The remote access quarantine system according to claim 3, further comprising IP address assigning means for assigning the IP address to a terminal for each access from the terminal. A firewall that is provided between an external network and an internal network, holds an access setting corresponding to the terminal, and controls access to the internal network from a terminal connected to the external network based on the held access setting A remote access quarantine method in a system comprising:
An inspection step for inspecting information processing safety for the terminal;
Based on the result of the inspection, a setting step for changing the access setting held corresponding to the terminal;
Remote access quarantine methods including.

Images