JP2006094258A - Terminal device, its policy forcing method, and its program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reject connection/use of a network by an illegal terminal and to record communication contents by forcing connection/use of the network by a terminal device to follow policy. <P>SOLUTION: A terminal device 101 communicates with a policy management server 102 which holds a policy. The terminal device 101 comprises a policy receiving means 105 which communicates with the policy management server 102 to receive a policy, a terminal device state confirming means 106 which transmits a policy receiving means 105 in the terminal device 101 and the operation state of a process for communication to the policy management server 102, for network connection admission, and a policy executing means 108 which admits or does not admit individual communication according to the policy after admission of network connection. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a technique for enforcing a policy for network connection and use of a terminal device.

  There was a technology to record, detect and analyze all unencrypted communications. There is also a technique for recording, detecting, and analyzing the contents of encrypted communication when a specific condition of a specific protocol such as HTTP / SMTP is provided.

  For example, in Patent Document 1, the communication information recording device intercepts data of a data stream flowing through a target network, classifies the intercepted data by one communication sentence, and selects communication item data included in the classified data The analysis result data is created, the search result data is added to the analysis result data and accumulated in the analysis result database, so that the search result data is selectively read out from the search result database based on the search data. It describes that the communication result of the target network can be confirmed.

  In such a conventional technique, for example, as shown in FIG. 2, a communication message sent from a network outside the organization is recorded in the content recording server device 203 via the Ethernet switch 202, and the terminal device 201 stores the content. A communication message is acquired from the recording server device 203. In the content recording server device 203, plaintext communication is recorded in plaintext, ciphertext communication is recorded as ciphertext, and communication between organizations cannot be recorded.

  In this way, in the prior art, since communication records are acquired in the middle of the network and not in the terminal device, connection of devices that violate the organizational policy, recording / detection / analysis of encrypted communication contents, HTTP / SMTP, etc. It could not be applied comprehensively to some protocols.

WO2002 / 029579

  By enforcing a policy (for example, a policy of an organization to which the terminal device belongs) with respect to network connection and use of the terminal device, connection of the unauthorized terminal to the network, use refusal, and recording of communication contents are realized.

  1st invention is a terminal device which communicates with the policy management server apparatus holding a policy, Comprising: The policy receiving means which communicates with the said policy management server apparatus and receives a policy, The said policy in a terminal device A policy for sending and receiving the operating state of the receiving means and the process for performing communication to the policy management server device and requesting network connection permission, and permitting and disallowing individual communication according to the policy after permitting network connection And an implementation means. A second invention is characterized in that, in the first invention, the terminal device state confirmation means uses a cryptographic signature means using a tamper resistant module. The third invention is characterized in that in the first or second invention, it comprises policy enforcement means for transmitting the encrypted communication content to the content recording server device in plain text. A fourth invention is a policy enforcement method in a terminal device that communicates with a policy management server device that holds a policy, the terminal device comprising policy receiving means, terminal device status checking means, and policy enforcement means. A policy receiving step in which the policy receiving means communicates with a policy management server device and receives a policy; and the terminal device status confirmation means indicates an operating state of a process for communicating with the policy receiving means in the terminal device. A terminal device status confirmation step for sending to the server device and requesting network connection permission, and a policy execution step for allowing and disabling individual communication according to the policy after the policy execution means permits network connection. And A fifth invention is characterized in that, in the fourth invention, the terminal device state confirmation means uses a cryptographic signature means using a tamper resistant module. A sixth invention is characterized in that, in the fourth or fifth invention, the policy enforcement means transmits the encrypted communication content to the content recording server device in plain text. A seventh invention is a program for causing a computer to function as means of any one of the first to third inventions.

  By enforcing a policy for the network connection and use of the terminal device, connection of the unauthorized terminal to the network, rejection of use, and recording of communication contents can be realized.

A preferred embodiment of the present invention will be described with reference to FIG.
In FIG. 1, 101 is a terminal device, 102 is a policy management server device that holds a policy, 103 is an access control device that controls access of the terminal device 101 to the network, and 104 is transmitted by the terminal device 101. It is a content recording server apparatus which records the content which performed. The terminal device 101 is connected to a network outside the organization via the access control device 103. The access control means 103 can be installed at the boundary between the network of the own organization and the network outside the organization, or can be installed at a location relatively close to the terminal device inside the network of the own organization. The terminal device 101 modifies the operating state of the policy receiving unit 105 that communicates with the policy management server device 102 and receives a policy, the policy receiving unit 105 in the terminal device 101 and other processes that perform communication on the terminal device 101 side. Terminal status confirmation means 106 that sends to the policy management server apparatus 102 to request network connection permission, encryption signature means 107 that performs encryption processing and signature processing, and policy enforcement that permits and disallows individual communication according to the policy after network connection permission Means 108 are provided. The policy enforcement means 108 converts the plaintext content as it is, converts the encrypted content into plaintext, and transmits it to the content recording server device 104. The content recording server device 104 may be on the terminal device 101 side of the access control device 103 or on the outside of the access control device 103. Needless to say, the terminal device 101 is a computer having an application program, an OS, or the like not shown.

  When the terminal apparatus 101 is activated, the policy receiving unit 105 accesses the policy management server apparatus 102 and receives the latest policy at that time. The policy includes a version number. Specifically, a virus definition file, an IDS (intrusion detection system) signature (unauthorized access and attack pattern database), and what kind of communication partner the terminal device 101 has and what protocol An access list that describes whether communication is possible, a list of process names that perform communication that is allowed to operate on the terminal device 101, and the like are described.

  The terminal apparatus status confirmation unit 106 first receives a list of processes for performing communication permitted to operate on the terminal apparatus 101 and the version number of the policy from the policy reception unit 105. Of the processes that operate on the terminal device 101, the process that performs communication is checked to see if it is a process that is permitted to receive the operation. If all are OK, it is OK. If there is any process that is not permitted, it is NG. Save state. Whether or not a process communicates can be known by monitoring a socket that the process actually secures and a system call issued. This confirmation operation is performed at the time of activation and every time a process for performing communication is activated thereafter. The process operating on the terminal device 101 is a program executed in the terminal device 101.

  The terminal device state confirmation unit 106 passes the policy version number and the result of the previous OK / NG to the policy management server device 102. However, this may be counterfeited if a malicious operator handles the terminal device, and there is also a possibility of eavesdropping or falsification during communication, obstruction by a malicious operator, or the like. Therefore, the terminal device status confirmation unit 106 uses the cryptographic signature unit 107 to confirm the operator, prevent eavesdropping and tampering during communication, prevent interference by a malicious operator, and the like.

  First, if it is not guaranteed that the correct operator is handling, it can be confirmed by giving a secret key to each operator and signing the above result. Also, when it is assumed that a malicious other person may eavesdrop on or tamper with during communication, it is avoided by encrypting the result signed above with the public key of the policy management server apparatus 102 and transmitting the ciphertext. The

  Furthermore, if it is assumed that a correct operator maliciously connects an unauthorized terminal that hinders the operation of the system of the present embodiment, the operator's private key and a part of the terminal device status confirmation means 106 are written in the tamper resistant module. In other words, the above-described signature encryption procedure may be performed in a form that cannot be seen. The policy management server analyzes the operation of the program and forges the operating state of the policy receiving means 105 when all the programs constituting the terminal device status confirmation means 106 are placed in the HDD in a disassembleable state. This is because it can be sent to the device 102. Therefore, if a part of the terminal device state confirmation unit 106 (for example, a part of the data to be referred to) is separately held in the tamper-resistant module that cannot be read, such a disturbance by a malicious operator can be prevented. It is. Note that the tamper resistant module is a module (for example, an IC card) having a function of preventing reading of information from the outside and tampering.

The policy management server apparatus 102 that has received the confirmation result performs any of the following 1) to 3).
1) If the latest version and the state are OK, the access control apparatus 103 is instructed to permit or relax the network connection of the terminal apparatus 101.
2) If the version is not the latest and the state is OK, the latest policy is sent to the policy receiving means 105 again.
3) If it is NG, the network connection relaxation of the terminal device 101 is not permitted, and the policy reception means is notified that it has not been permitted.

  When the access control device 103 receives a notification from the policy management server 102 that permits or relaxes the network connection of the terminal device 101 by the above 1), the access control device 103 switches the VLAN or rewrites the packet filter. The network connection of the terminal device 101 is permitted, or the access conditions of the terminal device 101 are relaxed. Note that the accessible range of the terminal device 101 before permission or relaxation according to 1) is not limited to the control of the access control device 103, but for example, the access control device 103 is a terminal device in its own network. The terminal device 101 may be installed near the terminal 101 so that it can be accessed if the terminal device 101 is within its own organization even before permission or relaxation by 1).

  The policy enforcement unit 108 receives the policy from the policy receiving unit 105. Then, while the network connection is permitted or relaxed, whether or not communication of a packet transmitted and received by the terminal device 101 is determined according to the received policy. The virus check, IDS, and access list operations can be performed in the terminal device 101 by conventional techniques.

  As for the process for performing encrypted communication, only a process having an interface (API) capable of acquiring the plaintext communication content, that is, only a process in which the policy enforcement unit 108 can acquire the plaintext of the ciphertext is permitted by the policy. By sending the plaintext communication content acquired from this interface to the content recording server device 104, the plaintext communication content including the encrypted communication content transmitted and received by the terminal device 101 is transmitted to the content recording server device 104. It is possible to record without hesitation. Further, the content recording server device 104 can realize detection of communication contents that should not be transmitted / received from the recorded plaintext communication contents using the conventional technology. The contents of communication that should not be transmitted / received are in-house confidential information and the like that should not be leaked. For example, it is possible to detect that an e-mail attached with a file containing the keyword “inside secret” is transferred outside the company.

  In short, in the embodiment of the present invention, policy enforcement is performed in the terminal device as follows. Software that implements the above-described means of the present embodiment is installed in the terminal device 101 so that the policy is acquired from the policy management server device 102 of the organization. When the terminal device 101 is connected or when communication is started, the terminal device status such as the operation of the software, the reflection of the intended latest policy, the operation / non-operation of the specified application is confirmed, and a secret key that cannot be extracted by the user of the terminal device Use it to sign and send to the network. Then, at the stage where policy enforcement to the terminal device 101 has been confirmed, network connection is permitted or access conditions are relaxed by switching VLANs or rewriting packet filtering. Also, the plaintext copy of the encrypted communication content is broadcast to the content recording server device 104 on the network, so that the encrypted communication information is recorded in plaintext using the prior art, including the case where the encrypted communication is performed. It is possible to detect a specific content of communication in real time or to analyze it later.

  The terminal device 101, the policy management server device 102, and the content recording server device 104 of the present embodiment can also be configured by a computer and a program.

  As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

It is a figure which shows one Example of this invention. It is a figure which shows the structure of a prior art.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 ... Terminal apparatus, 102 ... Policy management server apparatus, 103 ... Access control apparatus, 104 ... Content recording server apparatus, 105 ... Policy receiving means, 106 ... Terminal apparatus status confirmation means, 107 ... Encryption signature means, 108 ... Policy enforcement means , 201 ... terminal device, 202 ... ether switch, 203 ... content recording server device

Claims (7)

A terminal device that communicates with a policy management server device holding a policy,
Policy receiving means for communicating with the policy management server device and receiving a policy;
The policy receiving means in the terminal device and the operating state of the process performing communication are sent to the policy management server device, and the terminal device status confirmation means for requesting network connection permission;
Policy enforcement means for permitting and not permitting individual communication according to the policy after permitting network connection;
A terminal device comprising:   2. The terminal apparatus according to claim 1, wherein the terminal apparatus state confirmation means uses cryptographic signature means using a tamper resistant module.   3. The terminal device according to claim 1, further comprising policy enforcement means for transmitting encrypted communication contents to the content recording server device in plain text. A policy enforcement method in a terminal device that communicates with a policy management server device that holds a policy,
The terminal device comprises policy receiving means, terminal device status confirmation means, and policy enforcement means,
A policy receiving step in which the policy receiving means communicates with a policy management server device and receives a policy;
A terminal apparatus state confirmation step in which the terminal apparatus state confirmation means sends the policy reception means in the terminal apparatus and the operating state of the process for communicating to the policy management server apparatus, and requests network connection permission;
A policy enforcement step in which the policy enforcement means permits and disallows individual communication according to the policy after permitting network connection;
A policy enforcement method characterized by comprising:   5. The policy enforcement method according to claim 4, wherein said terminal device state confirmation means uses cryptographic signature means using a tamper resistant module.   6. The policy enforcement method according to claim 4, further comprising the step of transmitting the encrypted communication content to the content recording server device in plain text by the policy enforcement means.   The program for functioning a computer as a means of any one of Claim 1 thru | or 3.

Images