JP2006252109A - Network access controller, device for remote operation and system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To change the control conditions of a control condition table according to the change of the numeric value of a threat level. <P>SOLUTION: This network access controller is provided with a signal observation function part for observing a communication signal between different network segments, a signal decoding function part for decoding the information of control conditions when controlling communication between the different network segments from the communication signal, a signal control function part for controlling communication between the different network segments by transmitting or interrupting a signal according to the control conditions, a control condition table in which conditions for controlling the communication signal are stored, a threat level to be decided according to the level of the threat of a network, a threat level change function part for changing the threat level, a threat level detail table in which the combination of the control conditions and the threat level are stored in association with each other and a control condition generating part for extracting control conditions corresponding to the threat level from the threat level detail table, and for storing the control conditions in the control condition table. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a network access control device, a remote operation device, and a system that relay communication between different network segments. The network access control device corresponds to a router or firewall device having an access control function.

  As shown in FIG. 12, in the conventional network access control device, the remote operation function unit 311 is activated in the remote operation device 310, and control of signal passing or blocking in the network access control device 320 is performed by remote operation. .

  The remote operation device 310 sets a condition for this in the control condition table 326 by the control condition setting function unit 324 in the network access control device 320. Further, the control condition change function unit 325 changes the control condition table 326.

  The signal observation function unit 321 observes communication signals between network segments, the signal decoding function unit 322 decodes the data content of the signal, and the signal control function unit 323 uses the protocol type, source, and reception. Control is performed by determining whether to pass or block according to the control conditions set in the control condition table 326 according to the conditions such as the previous one.

  However, in the conventional apparatus, when the control condition table 326 is changed by the control condition change function unit 325 in the network access control device 320, the remote operation function unit 311 of the remote operation device 310 is used as shown in FIG. The control condition change function unit 325 in the network access control device 320 is connected.

  Therefore, when performing a change operation of a plurality of network access control devices, the remote operation function unit 311 is connected to the control condition change function unit 325 in each network access control device for each network access control device, and the control condition table is changed. I had to repeat the operation.

  In addition, signals that threaten the normal operation of information processing devices connected to the network temporarily and urgently, such as when a computer virus is prevalent or a DOS attack is being carried out on an external public server When there is a risk of entering the segment, in the conventional device, the remote operation function unit 311 of the remote operation device 310 is manually activated, and the control condition change function unit 325 in each network access control device controls the control condition. An operation for changing the table 326 is performed to change the control condition to block the signal. Then, after the danger has been resolved by anti-virus measures, it is necessary to restore the original settings again.

  The present invention provides a network access control device that relays communication between different network segments, a signal observation function unit that observes communication signals between different network segments, and control of communication between the different network segments from the communication signals. A signal decoding function unit for decoding the control condition information, a signal control function unit for controlling communication between the different network segments by passing or blocking signals according to the control condition, and a condition for controlling the communication signal. A control condition table to be stored, a threat level determined according to the threat level of the network, a threat level changing function unit for changing the threat level, a combination of the control conditions and the threat level are stored in association with each other From the threat level detail table and the threat level detail table Taking out a control condition corresponding to the serial threat level, the most important feature in that and a control condition generating unit to be stored in the control condition table.

  The network access control device according to the present invention provides a threat level that defines a control condition of the communication signal numerically according to a threat level, a threat level changing function unit that changes the threat level, a combination of the control conditions, The provision of the threat level detail table that stores the threat levels in association with each other has an advantage that the control conditions of the control condition table can be changed by a simple operation by changing the numerical value of the threat level.

  The purpose of easily changing the control conditions was realized by controlling access to the network.

FIG. 1 is a block diagram showing a first embodiment of a network access control apparatus of the present invention.
The network access control device a110 shown in the figure is similar to the conventional one, the signal observation function unit 111, the signal decoding function unit 112, the signal control function unit 113, the control condition setting function unit 114, the control condition change function unit 115, and the control A condition table 116 is provided, and a threat level storage unit 117, a threat level detail table 118, and a control condition table generation unit 119 are provided as characteristic portions of the present invention.

Further, the illustrated remote operation device 130 includes a remote operation function unit 131 as well as a conventional device, and also includes a collective remote operation function unit 132 as a characteristic part of the present invention.
The signal observation function unit 111 observes communication signals between different network segments.
The signal decoding function unit 112 decodes information on a control condition for controlling communication between the different network segments from the communication signal.

The signal control function unit 113 controls communication between the different network segments by passing or blocking signals according to the control conditions.
The control condition table 116 stores conditions for controlling the communication signal, and corresponds to a firewall filtering table or the like.
The threat level storage unit 117 is an area for storing the threat level notified from the remote operation device 130.
The threat level is a numerical value that defines the control condition of the communication signal according to the degree of threat.
The control condition setting function unit 114 inputs a control condition to the control condition table 116 and inputs a numerical value as a threat level.

The control condition changing function unit 115 changes the control condition set in the control condition table 116.
The control condition table generation unit 119 extracts a control condition corresponding to the received threat level from the threat level detail table 118, and generates a control condition table 116 corresponding to the threat level.
The threat level detail table 118 stores the combination of the control conditions and the threat level in association with each other.

  The remote operation device 130 can be connected to an arbitrary network segment, and enables remote operation of a plurality of network access control devices. For example, the network segment A is relayed and the network access control device a110 is operated. Further, the network segment A is relayed and the network access control device b120 is operated (see FIG. 2).

For example, the remote operation function unit 131 issues the setting signal 105 to the network access control apparatus a110. As a result, the control condition setting function unit 114 or the control condition change function unit 115 of the network access control apparatus a110 is activated.
The collective remote operation function unit 132 operates a plurality of network access control devices all at once.
FIG. 2 shows the overall configuration of the system according to the present invention.
As a specific system configuration, each network segment A, B, C is configured by a network device such as a personal computer, a router, or a network printer. That is, these devices are configured as network nodes.

FIG. 3 shows the operation of the network access control apparatus a110 when the network access signal 104 is transmitted from the network segment A101 to the network segment B102.
First, the network access signal 104 is transmitted from the network segment A101. In that case, in the network access control device a110, the signal observation function unit 111 observes whether there is a signal on the communication line with the network segment A101.

When the signal observation function unit 111 observes the network access signal 104, it passes the network access signal 104 to the signal decoding function unit 112.
The signal decoding function unit 112 decodes the data included in the network access signal 104 and checks whether or not it matches the control condition.
Here, the control condition refers to a condition for controlling a signal, and a specific example is as follows. For example, when there is a possibility that the network access signal 104 is transmitted from a virus or the like, the signal is controlled as a countermeasure. The control conditions in that case are determined by the corresponding protocol, transmission source, and reception destination. Alternatively, the determination may be made based on whether or not virus countermeasures have been completed at the receiving destination.

  Therefore, the signal decoding function unit 112 decodes data included in the network access signal 104. The information includes, for example, the IP addresses and communication protocols of the transmission source and the reception destination.

FIG. 4 shows an example of the contents of the control condition table.
This table is used for normal filtering when controlling communication between different network segments. This corresponds to a filtering table in the case of a firewall.
The control condition table shown in FIG. 4 specifically shows an example of the contents of the control conditions when taking anti-virus measures.
The control conditions are a transmission source, a transmission destination, and a communication protocol in the example of FIG.

The specific contents are that only communication by the protocol X from the segment B to the segment A and communication by the protocols Y and Z from the segment A to the segment B are permitted, and other communication is blocked.
Here, the segment refers to a network device such as a personal computer, a router, or a network printer that belongs to the network segment. These are expressed by a range of IP addresses or a plurality of IP addresses.

In the case of a general packet filtering type firewall, the control conditions include parameters such as a port number and a communication direction in addition to the illustrated control conditions. However, in describing the present invention, it is considered sufficient to list only the above-mentioned minimum conditions, and will be omitted.
The content of FIG. 4 described above shows the case of the threat level 3.
Here, the threat level is a numerical value that defines the control condition of the communication signal according to the degree of threat.

The threat level in the present invention will be described with reference to the drawings.
FIG. 5 shows an example of a threat level and control condition setting policy.
In the figure, threat level 1 represents the highest threat and threat level 5 represents the lowest threat. For example, threat level 1 is applicable when a virus or worm with a high degree of risk is in fashion and the external network needs to be blocked.
FIG. 6 shows an example of a threat level detail table in the present invention.
In addition to the parameters included in the control condition table, a threat level is added for each condition.
When a threat level is designated from the remote control device, a control condition table is generated based on the designated threat level and the threat level detail table.
The generation method is as shown in FIG.

Specifically, for example, when threat level 3 is designated, control conditions of threat levels 1 to 3 are extracted from the threat level detail table of FIG.
At this time, the above setting contents are set so that communication contents that may be permitted are added as the threat level becomes lower, based on the control condition (all blocking) in the case of threat level 1. That is, the control condition is more relaxed as the threat level becomes lower.

  When the control condition table is generated, if the conditions of the transmission source, the transmission destination, and the communication protocol overlap, they are overwritten with the control condition of a lower threat level. For example, in the threat level detail table, when the threat level is 3, the communication of the protocol X passes only from the segment A to B, but when the threat level is 4, the segment B passes through all the segments. In addition, for communications of protocols Y and Z, only the segments A to B pass, but in the case of the threat level 4, the segments B pass to all segments. Therefore, these settings are overwritten by the threat level 4 settings.

This process is realized as shown in FIG.
FIG. 7 is a flowchart of the control condition table generation process.
First, in step S1, one control condition is extracted from the threat level detail table. Then, in step S2, it is determined whether the same communication protocol exists at a higher threat level. If it exists, it is determined in step S3 whether the transmission destination and the transmission source match. At that time, if ANY, that is, the transmission destination and the transmission source are unquestioned, they are regarded as matching. As a result, if they match, the control condition is overwritten in step S4.

On the other hand, if there is no communication protocol at a higher threat level in step S2, the control condition extracted in step S1 is added to the control condition table as a new control condition in step S5.
The above processing is repeated until all the control conditions up to the specified threat level are completed.
As a result, when the threat level is 3, the control condition table of FIG. 4 is obtained from the threat level detail table of FIG.
Further, the control condition table when the threat level 4 is designated is as shown in FIG.

Next, an operation when the control condition table 116 described above is set or changed will be described.
The administrator uses the remote operation function unit 131 in the remote operation device 130 shown in FIG. 9 to transmit the control condition information 108 corresponding to the threat level information 109 together with the setting signal 105 via the network segment A101. a110. Then, the control condition setting function unit 114 or the control condition change function unit 115 is activated by the setting signal 105.
At this time, in the case of new registration, the control condition setting function unit 114 is used. When changing a setting that has already been made, the control condition changing function unit 115 is used. However, the control condition setting function unit 114 may have a change function.

The control condition setting function unit 114 and the control condition change function unit 115 set or change the threat level detail table 118 based on the received control condition information 108 and threat level information 109.
At this time, the setting content of the threat level detail table 118 is such that more relaxed control conditions are set when the threat level is lower. For this check, a processing unit is provided on the network access control device a110 side or the remote operation device 130 side to check whether the input control condition is a relaxed condition compared to the control condition of a higher threat level. May be.

Next, the operation when changing the control conditions in a batch will be described.
The administrator transmits the current threat level instruction signal 106 to the network access control devices a110 and b120 via the network segment A101 using the collective remote operation function unit 132 of the remote operation device 130 shown in FIG. Then, the current threat level is designated for the network access control devices a110 and b120 by the threat level instruction signal.
Thereby, in the network access control devices a110 and b120, the control condition table generation units 119 and 129 are activated, respectively.

  Thereby, in the network access control apparatus a110, the control condition table generation unit 119 stores the received threat level information 109 in the threat level storage unit 117. Based on the stored threat level and threat level detail table 118, the control condition table generation unit 119 generates the control condition table 116 corresponding to the designated threat level according to the flowchart of FIG. 7, as described above.

  On the other hand, in the network access control apparatus b120, the control condition table generation unit 129 stores the received threat level information 109 in the threat level storage unit 127. The control condition table generation unit 129 generates a control condition table 126 corresponding to the designated threat level based on the stored threat level and threat level detail table 128 according to the flowchart of FIG.

  Note that the control condition table is once cleared prior to generation of the control condition. From the time when the control condition table is cleared until the time when the generation of the control condition table is finished, all communication is blocked or blocked.

  The remote control device 130 is provided with a virus countermeasure status receiving unit for notifying and receiving the virus countermeasure status from each segment so as to hold the virus countermeasure status of each segment, and a threat corresponding to the virus countermeasure status at that time The level may be automatically specified.

  Further, information such as the virus epidemic status and the attack status may be received from a network monitoring system such as IDS, and the threat level corresponding thereto may be automatically designated. For example, the anti-virus information notified from each segment is compared with the latest anti-virus software version obtained from the server of the anti-virus software provider. If you list, you can automatically update the control table.

As described above, according to the first embodiment, since the remote operation device is provided with the collective remote operation function unit, it is possible to perform a plurality of network accesses by performing the threat level information change operation once from the remote operation device. The threat level of the control device can be changed.
Also, by providing the threat level detail table in the network access control device, when the numerical value of the level information at the threat level is changed, the threat level changing function unit controls the control condition in the control condition table associated with the level information. Since the information is also changed, a plurality of control conditions can be changed with a simple operation.
In addition, since the control condition table has the same format as the prior art, the conventional processing logic for access control can be used as it is.

In the second embodiment, as shown in FIG. 11, the collective remote operation function unit 232 of the remote operation device 230 includes a plurality of remote operation function units 231 and 241.
As a result, the control condition setting function units 114 and 124 or the control condition change function units 115 and 125 of the plurality of network access control devices a110 and b120 are activated simultaneously.

Next, the operation when the control conditions are set and changed collectively will be described.
The administrator activates the collective remote operation function unit 232 provided in the remote operation device 230 shown in FIG. The collective remote operation function unit 232 controls the remote operation function units 231 and 241 to specify the specified threat level for all network access control devices to be operated. At this time, it may be made to designate which network access control device designates the threat level.

As a result, the setting signal 105 is transmitted from the network segment A101 to the network access control devices a110 and b120. Then, the control condition setting function unit 114 or the control condition change function unit 115 is activated by the setting signal 105.
The control condition setting function units 114 and 124 and the control condition change function units 115 and 125 set or change the threat level detail tables 118 and 128 based on the received control condition information 108 and threat level information 109.
At this time, the setting contents of the threat level detail tables 118 and 128 are such that more relaxed control conditions are set when the threat level is lower. For this check, a processing unit that checks whether the control conditions input to the network access control devices a110 and b120 or the remote operation device 230 side are relaxed compared to control conditions with a higher threat level. May be provided.

  As in the first embodiment, the remote control device 130 is notified of the anti-virus status from each segment so that the anti-virus status of each segment is maintained, and the threat level corresponding to the anti-virus status at that time is You may make it make it designate collectively collectively.

  Further, information such as a virus epidemic state or an attack state may be received from a network monitoring system such as an IDS (intrusion detection system), and threat levels corresponding to the information may be automatically specified collectively. The anti-virus status for each segment can be confirmed in the same way as in the first embodiment, but further, the batch remote control function is used to specify a high threat level only to the network access control device adjacent to the segment for which anti-virus measures have not been completed. The unit 132 may be operated.

  As described above, according to the second embodiment, it is possible to collectively set the control conditions of a plurality of network access control devices by including the remote operation function unit in the collective remote operation function unit of the remote operation device. It becomes possible. Thereby, the control condition can be set or changed in all the network access control devices in the network segment to be managed by the control condition setting operation or the control condition changing operation for one network access control device.

  In addition, the threat level of the network access control device has a meaning corresponding to the threat level of the network, the lower control conditions are shared with the upper level, and only the differences are added to or deleted from the control condition table. The control condition change is inevitably reflected in the control condition corresponding to the higher threat level, so that the control condition can be managed consistently.

  In addition, the network is exposed when it is necessary to urgently block communication with the external network segment, for example, when a worm-type virus epidemic occurs or a large number of attacks (DOS) that cause denial of service flow from the external network segment. If the “predetermined value” is changed in accordance with the threat level (for example, changed from 3 to 1 or 2), the threat level value is relatively exceeded without changing the threat level value in the threat level detail table. Network segment isolation is possible.

  In the first and second embodiments described above, the firewall, the router, and the like that perform access control to the network segments A101, B102, and C103 have been described as the network access control devices a110 and b120. The present invention can also be applied as an access control device to the electronic resource of the processing device. That is, in the above-described embodiment, the communication relay destination is the information processing apparatus, and the communication decoding target is the service port or file access destination in the information processing apparatus.

It is a block diagram which shows Example 1 of the network access control apparatus of this invention. 1 is a block diagram showing an overall configuration of a system according to the present invention. It is a figure which shows operation | movement of the network access control apparatus a110 when the network access signal 104 is transmitted to network segment B102 from network segment A101. It is a figure which shows the example of a control condition table. It is a figure which shows the example of the setting policy of a threat level and control conditions. It is a figure which shows the example of a threat level detailed table. It is a flowchart explaining a control condition table production | generation process. It is a figure which shows the other example of a control condition table. It is a figure which shows operation | movement when a control condition is set with respect to the network access control apparatus a110 from the apparatus 130 for remote operation. It is a figure which shows operation | movement in case control conditions are collectively set with respect to network access control apparatus a110, b120 from the apparatus 130 for remote operation. It is a block diagram which shows Example 2 of the network access control apparatus of this invention. It is a figure which shows the structure of a prior art example.

Explanation of symbols

101 Network segment A
110 Network access control device a
DESCRIPTION OF SYMBOLS 111 Signal observation function part 112 Signal decoding function part 113 Signal control function part 114 Control condition setting function part 115 Control condition change function part 116 Control condition table 117 Threat level 118 Threat level detailed table 119 Threat level change function part 130 Device for remote operation 131 Remote operation function part 132 Collective remote operation function part

Claims (4)

In a network access control device that relays communication between different network segments,
A signal observation function unit for observing communication signals between different network segments;
A signal decoding function unit for decoding information on a control condition when controlling communication between the different network segments from the communication signal;
A signal control function unit that controls communication between the different network segments by passing or blocking signals according to the control conditions;
A control condition table for storing conditions for controlling the communication signal;
Threat levels determined by the degree of network threat,
A threat level changing function unit for changing the threat level;
A threat level detail table for storing the combination of the control conditions and the threat level in association with each other;
A control condition generating unit that extracts control conditions corresponding to the threat level from the threat level detail table and stores them in the control condition table;
A network access control device comprising: A remote operation function unit for transmitting the threat level to the network access control device according to claim 1;
A batch remote control function unit that transmits the threat level to the plurality of network access control devices by the remote control function unit;
A remote control device characterized by comprising: An anti-virus status receiving unit that receives the anti-virus status of each network segment is further provided.
Raise the threat level when there are network segments that are not antivirus protected,
The remote control device according to claim 2, wherein the device is a remote control device. A network access control device according to claim 1;
The remote control device according to claim 2 or 3,
A system consisting of

Images