JP2006260027A - Quarantine system, and quarantine method using vpn and firewall - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To simultaneously achieve both security strength and ease of introduction in an LAN environment, to secure security with a small equipment configuration, to perform flexible access control, to perform unitary management and certain operation of an access rule on a center side, and to perform quarantine in the LAN environment and remote access environment, in common. <P>SOLUTION: A management device (a quarantine server 31 + a communication control server 32) receives terminal information from an approval terminal (approval PC 21) to conduct quarantine, distributes communication setting information, according to a quarantine result to the approval terminal, and controls access to an in-company business server 11 by the approval terminal by a VPN and a personal firewall. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a quarantine system and method for quarantine using a VPN (Virtual Private Network) and a personal firewall.

A system that restricts access to resources according to the security level of a client terminal is generally called a quarantine system. Currently, there are four methods listed below as quarantine systems.
(1) Authentication VLAN (Virtual LAN) method based on LAN environment (2) Authentication DHCP (Dynamic Host Configuration Protocol) method based on LAN environment (3) Personal firewall method (4) Remote access environment Remote access VPN method

The technology related to (1) is described in Non-Patent Document 1, the technology related to (2) is Non-Patent Document 2, the technology related to (3) is Non-Patent Document 3, and the technology related to (4) is Non-Patent Documents 4 and 5. Are introduced respectively.
Nikkei Computer October 4, 2004 issue P.160 "Automatically Remove Self-Defending Net Virus" Nikkei Communication November 1, 2004 issue P.48 "Stop the worm's approach to the back door" N + I Network Guide September 2004 P.52 Retrieved March 8, 2005, <Internet URL> http://itpro.nikkeibp.co.jp/free/ITPro/OPINION/20031127/1/ Retrieved March 8, 2005, <Internet URL> http://www.itmedia.co.jp/enterprise/articles/0411/10/news052_2.html

According to the conventional techniques described above, none of the security strength and the ease of introduction can be achieved in a LAN environment.
Specifically, (1) the authentication VLAN method needs to greatly change the VLAN setting of an existing network and install a device in each segment, but has a feature of high defense from unauthorized terminals. (2) The authentication DHCP method does not require a change to the existing network, contrary to the authentication VLAN method. However, if a malicious user gives a fixed IP to an unauthorized terminal, a countermeasure against them is provided. There is no.

On the other hand, (3) the personal firewall method does not require modification of the existing network, but the defense target is a client terminal with a personal firewall installed, which prevents attacks on in-house resources from unauthorized carry-in terminals. Have difficulty.
Also, (4) the remote access VPN system is difficult to use in a LAN environment. The reason is that in-house resources to be protected are generally dispersed in a LAN environment, and it is necessary to install a large number of devices that restrict access to them.

Further, according to the prior art, none of them is an access restriction linked with a network and a client.
Specifically, (1) the authentication VLAN method is an access restriction only on the network side. For this reason, there is no access restriction at the lower part of the point where authentication is performed, and it is impossible to prevent damage caused by unauthorized carry-in terminals. On the contrary, when all terminals are connected to the authentication point, it is necessary to change the configuration of many devices and networks, which is expensive to realize. Further, (2) the authentication DHCP method is an access restriction only on the network side. If a malicious user gives a fixed IP to an unauthorized terminal, there is no defense against them.

On the other hand, (3) the personal firewall system is an access restriction only on the client side. For this reason, it is impossible to restrict access to an in-house server or the like for an illegal brought-in PC.
Further, (4) the remote access VPN method includes a method of restricting access on both the network side and the client side, but these are premised on a remote access environment and are difficult to apply in a LAN environment.

Further, according to the prior art, none of the access restrictions can be flexible according to the security level of the client terminal.
Specifically, (1) the authentication VLAN method is a method for restricting access by connecting a client terminal to only one exclusive VLAN corresponding to the security diagnosis result of the client. Therefore, for example, when there are communication destinations A and B, it is not possible to provide three patterns of access restrictions such as “only A”, “only B”, and “to A and B”. In addition, (2) the authentication DHCP method has only a binary determination as to whether or not to distribute an IP address, and it is difficult to provide a plurality of access restriction states.

(3) The personal firewall system can only provide a plurality of access restriction states, and cannot change access control flexibly.
In addition, (4) the remote access VPN method has only a binary determination as to whether or not to pass through the VPN gateway, and it is difficult to provide a plurality of access restriction states.

The prior art is a system that can avoid the management and application of access restriction rules on the client side. Specifically, (1) the authentication VLAN method manages and restricts access rules on the network side. In addition, (2) the authentication DHCP method determines IP distribution, but the client terminal may not follow it. In other words, by giving a fixed IP, it is possible to escape from the target of communication control.
On the other hand, (3) the personal firewall system is not allowed to follow the rule setting on the server side because of the access restriction on the client side. That is, the effect of access restriction is lost by stopping the personal firewall service on the client side. Further, (4) the remote access VPN system performs access rule management and restriction on the network side, but it is a simple one of whether or not possible contents are passed.

In addition, according to the prior art, neither can be used in common in both the LAN environment and the remote access environment.
Specifically, (1) there are two authentication VLAN methods: a method that cannot be used and a method that cannot ensure sufficient security because the installation of an authentication point becomes a remote access point in a remote access environment. Also, (2) the authentication DHCP method cannot be used in a remote access environment because terminal identification cannot be performed accurately.
On the other hand, when the (3) personal firewall system is used in a remote access environment, it is necessary to secure the security of the access target by another method. Further, (4) the remote access VPN method is suitable for a remote access environment, but is not suitable for a LAN environment in which access targets are distributed.

  The present invention has been made based on the above various circumstances, and (1) it is possible to achieve both security strength and ease of introduction in a LAN environment. (2) Secure security can be ensured with a small device configuration. (3) Flexible access control is possible. (4) Centralized management and reliable operation of access rules on the center side is possible. Alternatively, (5) It is an object to provide a quarantine system and a quarantine method using a VPN and a firewall, which can perform quarantine in common in a LAN environment and a remote access environment.

  In order to solve the above-described problem, the present invention includes a defense network to which an approved terminal permitted to connect to an in-house server is connected by a system administrator, and an unapproved terminal that is not permitted to connect to the in-house server. A quarantine system comprising a non-defense network to which the approval terminal can be connected, and performing quarantine using a VPN and a firewall, wherein the approval terminal is provided independently of the defense network and the non-defense network Via the communication control agent execution means for connecting according to the communication setting information to the management device connected to the quarantine network, the terminal information of the approval terminal necessary when the management device performs the quarantine, A quarantine agent execution means for urging the quarantine by the management device, the management device from the approval terminal The terminal information is received, quarantine is performed, communication setting information corresponding to the quarantine result is distributed to the approval terminal, and access to the in-house server by the approval terminal is controlled by the VPN and a personal firewall. And

  In the present invention, the management device includes a security level diagnosis unit that diagnoses a security level of the approval terminal, and a communication setting information distribution unit that distributes communication setting information according to the diagnosis result while ensuring security. It is characterized by providing.

  In the present invention, the communication control agent executing means performs communication setting in the defense network according to the communication setting information distributed by the management device, and accesses the in-house server to the approval terminal connected to the defense network. It is characterized by permitting.

  Further, in the present invention, the communication control agent executing means performs communication setting for a part of the defense network according to the communication setting information distributed by the management device, to the in-house server permitted according to the quarantine result. The access is permitted.

  Further, in the present invention, the communication control agent executing means performs access restriction according to communication setting information distributed by the management device, and sets communication to the quarantine network that solves the security problem pointed out by the communication setting information. It is characterized by performing.

  In the present invention, a gateway that terminates IPsec communication from the communication control agent executing means is connected to the defense network and the quarantine network, and the gateway prevents access from the unauthorized terminal. To do.

  In addition, the present invention is connected to a defense network to which an approved terminal permitted to connect to an in-house server by a system administrator is connected, and the approved terminal including an unapproved terminal not permitted to connect to the in-house server. A quarantine method using a VPN and a personal firewall, wherein the approval terminal is connected to the quarantine network via the quarantine network provided independently of the defense network and the non-defense network. Connecting to the management device according to the communication setting information, the approval terminal transmitting terminal information of the approval terminal required when the management device performs quarantine, and prompting quarantine by the management device; The management device receives the terminal information from the approved terminal, performs quarantine, and communicates according to the quarantine result. Distribute the constant information to the authorized terminal, the access to the corporate server by the approval terminal, and having the steps of: controlling by the VPN and personal firewall.

  According to the present invention, it is possible to achieve both security strength and ease of introduction in a LAN environment. Conventionally, each method of the quarantine system has a weak point in either of the security strength and the ease of introduction. However, according to the present invention, the same level of “comparison with the authentication VLAN” is possible. It has high security strength, and requires only a few changes in configuration and configuration of existing networks, which is advantageous from the viewpoint of ease of introduction. Further, as compared with the authentication DHCP, it is similarly “a system that is easy to introduce” and at the same time has a much higher protection from attacks by unauthorized carry-in terminals and malicious users. That is, according to the present invention, it is possible to provide a quarantine system that balances the ease of introduction and security strength of each conventional method in a high dimension.

  Further, according to the present invention, a reliable security level can be ensured with a small device configuration. Specifically, since the system is based on access restrictions linked to the network side and the client side, the same level of security can be ensured with a smaller device configuration than the authentication VLAN method. Further, it is difficult to take an access restriction avoidance measure on the terminal side as compared with the authentication DHCP method. In addition, compared with the personal firewall method, the defense capability of the in-house resource that is the access target of the client is much higher.

  Furthermore, according to the present invention, flexible access restriction can be performed. Specifically, compared to the authentication VLAN method, the authentication DHCP method, and the remote access VPN method, it is possible to access only a part according to the user authority and the client status, as well as the binary result of communication permission / non-permission. It is possible to restrict access with a high degree of freedom, for example, it is possible to partially limit access destinations. Further, if the same thing is to be realized by the remote access VPN method, it is necessary to install authentication points in each part on the LAN, and quarantine in each part is necessary. On the other hand, in the present invention, even in an environment where resources to be accessed are distributed as compared with the remote access VPN method, access restriction can be realized by performing quarantine at one place.

Further, according to the present invention, centralized management of access rules on the center side and its reliable application can be performed. Specifically, according to the present invention, as in the authentication VLAN and remote access VPN systems, rule management and restriction are performed on the center side, so it is difficult to avoid restrictions on clients. Also, if you don't follow the rules, you can't access internal resources, and Personal Firewool's "method of restricting terminal access according to the rules" and authentication DHCP "a method that can avoid access restrictions on the client side" Compared with, the security level is fundamentally high.
Furthermore, compared with the remote access VPN method, there is an advantage in that the access side change, environment change and rule change are unnecessary on the client side.

Further, according to the present invention, quarantine can be performed uniformly in a LAN environment and a remote access environment.
Specifically, it is superior in that it can be used in both the LAN environment and the remote access environment as compared with the authentication VLAN method, the authentication DHCP method, and the remote access VPN method assuming the remote access. . Further, compared with the personal firewall system, there is an advantage from the viewpoint of ease of management operation in that both the access destination and the access source can be protected by one system.

FIG. 1 is a diagram illustrating an example of a system configuration of a quarantine system according to an embodiment of the present invention.
The quarantine system according to the embodiment of the present invention is constructed on a computer network, and the computer network is classified into a defense network 1, a non-defense network 2, and a quarantine network 3. In the present embodiment, the “network” refers to a network system including devices (servers) connected to the network. The defense network 1 has a VPN-GW 12 as a gateway device that terminates IPsec (Security Protocol for Internet Protocol) communication as an entrance, and is approved as an approval terminal permitted to connect to the in-house business server 11 by the system administrator. The PC 21 can also be connected via the non-defense network 2. Further, the non-approved terminal means a terminal (non-approved PC 22) that the system administrator does not permit to connect to the in-house business server 11, such as a personal computer of an employee or a PC brought in by a business operator. Connection is possible.

On the other hand, the quarantine network 3 is a network that can be accessed only by the authorized PC 21, and is operated by a system administrator as described in the claims as a management device by the quarantine server 31 and the communication control server 32 for performing the quarantine, and the VPN-GW 34. The management console 33 to be connected is connected.
Note that a quarantine agent and a communication control agent are installed in the approval PC 21 and executed. The quarantine agent operates on the approval PC 21, the quarantine agent is an agent program that cooperates with the quarantine server 31 regarding terminal information necessary for quarantine, and the communication control agent operates on the approval PC 21, and is approved by the VPN and personal firewall. It is an agent program that performs communication control of the PC 21.

In the above configuration, the communication control agent and the quarantine agent are activated when the approval terminal PC 21 is turned on. Here, the communication control agent connects to the quarantine network 3 according to the initial communication setting, and connects to the communication control server 32. In addition, the quarantine agent transmits predetermined terminal information to the quarantine server 31 connected to the quarantine network 3, and the quarantine server 31 performs quarantine (terminal authentication and security level check) based thereon.
The quarantine server 31 shares the quarantine result with the communication control agent, and the communication control server 32 distributes communication settings according to the quarantine result, specifically, VPN destination information and personal firewall rules to the communication control agent.

There are two types of quarantine results, established (OK) and not established (NG). If established, the communication control agent performs VPN setting for all the defense networks 1 according to the received communication setting information. As a result, the approval PC 21 can access the internal business server 11. It is also possible to permit only access to some of the defense networks 1 according to the quarantine result. In this case, the communication control agent performs VPN setting for some of the defense networks 1 according to the received communication setting information, and the approval PC 21 can only access some of the in-house business servers 11 that are permitted according to the quarantine result. Allowed.
If not established, the communication control agent restricts access according to the received communication setting information. This restriction includes, for example, a personal firewall rule that blocks communication from the authorized PC 21 in addition to a rule for prohibiting communication to all the defense networks 1. At this time, the communication control agent performs communication setting to the quarantine network 3 (in this case, referred to as a treatment network) having means for solving the security problem pointed out by the communication setting information.

  The defense network 1 and the quarantine network 3 are protected by the VPN-GWs 12 and 34 from attacks from the unauthorized PC 22. At this time, the approved PC 21 is protected by the personal firewall from the attack of the unapproved PC 22. Details of both will be described later.

FIG. 2 is a block diagram showing a functional representation of the connection configuration between the management apparatus and the approval PC in the quarantine system shown in FIG.
As shown in FIG. 2, the management apparatus functionally includes a network connection control unit 301, a security level diagnosis unit 302, a communication setting information distribution unit 303, a database storing communication setting information 304, and access control. The unit 305 is roughly divided and configured.

The network connection control unit 301 manages a connection interface with the approval PC 21 connected via the quarantine network 3, and for example, TCP / IP (Transmission Control Protocol / Internet Protocol) is implemented.
The security level diagnosis unit 302 has a function of authenticating based on the terminal information of the approval PC 21 and a function of diagnosing the security level and notifying the communication setting information distribution unit 303. The communication setting information distribution unit 303 distributes the communication setting information 304 including VPN destination information and personal firewall rules to the approved PC while ensuring (encrypting) the security setting information according to the diagnosis result of the security level diagnosis unit 302. Has function.

Further, the access control unit 305 performs access control of the approval PC 21 based on the security level, and here, performs access restriction using a VPN and a personal firewall complying with IPsec.
The functions of the security level diagnosis unit 302 described above are distributed to the quarantine server 31, and the functions of the communication setting information distribution unit 303 are distributed to the communication control server 32.

On the other hand, the approval PC 21 is functionally divided into a network connection control unit 211, a quarantine agent execution unit 212, a communication control agent execution unit 213, and communication setting information 214.
The network connection control unit 211 manages a connection interface between the quarantine server 31 and the communication control server 32 connected via the quarantine network 3, and for example, TCP / IP is implemented. In addition, the quarantine agent execution unit 212 has a function of transmitting terminal information of the approval PC 21 necessary when the quarantine server 31 performs quarantine and prompting the quarantine by the quarantine server 31. Further, the communication control agent execution unit 213 receives the quarantine result from the quarantine server 31 and communicates by connecting to the communication control server 32 according to the default communication setting when the terminal is started and thereafter dynamically changing the communication setting. have.

In the functional configuration described above, in the quarantine system according to the embodiment of the present invention, the security administrator of the security level diagnosis unit 302 authenticates the authorized PC 21 that the system administrator has authorized to connect to the defense network 1 to which the internal business server 11 belongs, and Then, it is confirmed that the approval PC 21 satisfies a certain security level, and the communication range of the approval PC 21 is controlled by the VPN and personal firewall according to the result.
At this time, the communication setting information distribution unit 303 uses the communication setting information (IPsec-VPN destination) for restricting access to the approval PC 21 in the access control unit 305 according to the authentication result of the approval PC 21 and the determination result of the security level. Information and personal firewall rules) are acquired from the communication setting information 304 and distributed to the approval PC 21 via the network connection control unit 301.

At this time, the communication setting information is distributed in an encrypted form while ensuring security so that only the authorized PC 21 can decrypt the communication setting information.
On the other hand, the approval PC 21 that has received the communication setting information via the network connection control unit 211 stores the communication setting information in a storage unit that stores the communication setting information 214 in a manner that also ensures security, and the communication control agent execution unit 213. Dynamically changes the VPN and personal firewall communication settings according to the communication setting information.
In this way, it is possible to control access from the approved PC 21 to the internal resource (internal business server 11) to be protected, and to prevent access to the internal resource from an unauthorized PC such as a carry-in PC.

3 to 7 are diagrams cited for explaining the operation of the quarantine system according to the embodiment of the present invention. The operation at the time of activation (FIG. 3), the operation when the quarantine result is OK (FIG. 4), The operation in the case of partial OK (FIG. 5), the operation in the case of NG (FIG. 6), and the defense operation from an unapproved PC (FIG. 7) are shown.
Hereinafter, the operation of the quarantine system according to the embodiment of the present invention will be described in detail with reference to FIGS.

The operation when the terminal is activated will be described with reference to FIG. First, the communication control agent is activated when the approval PC 21 is turned on. The communication control agent decrypts the default communication setting information prepared in advance, and sets its own VPN and personal firewall based on it (S1).
Subsequently, the communication control agent connects via the VPN-GW 34 to the quarantine network 3 permitted to be accessed by the default communication setting information, and connects to the communication control server 32 (S2). At this time, the communication control server 32 confirms that the approval PC 21 for which the connection request has been issued is indeed an approval PC (S3).
Next, the quarantine agent extracts the PC information necessary for quarantine and transmits it to the quarantine server 3. Here, the information necessary for quarantine means (1) installed software information, (2) virus definition file information for virus checking, (3) OS security patch information, and the like. These are security check items.

On the other hand, the quarantine server 31 determines the security level of the approval PC 21 (S4). The security level is set in advance in the quarantine server 31 in association with one or more of information regarding software that should not be installed on the PC, virus definition file version information, and security patch contents such as the OS. . The communication control server 32 inquires the quarantine server 31 about the security level determination result of the approved PC (S5).
The communication control server 32 comprehensively determines the authentication of the approved PC 21, the determination result of the security level, the validity period of the communication setting information, and distributes the dynamic communication setting information to the communication control agent according to the determination result. (S6). For example, the security level, the valid period, and communication setting information corresponding to them are stored in association with each other, and the communication control server 32 selects the communication setting information accordingly.

Next, the operation in the case of the quarantine OK will be described with reference to FIG. If the quarantine result is OK, the approval PC 21 is recognized as an appropriate PC. The quarantine result OK here refers to a state where all the security check items are satisfied, that is, a state where the security level is high. The communication control agent decrypts the dynamic communication setting information when the received quarantine result is OK. This communication setting information can be set differently for each appropriate approved PC.
For example, communication setting information that enables access to all the defense networks 1 is distributed to a certain proper approval PC 21, and communication that allows only a part of the defense networks to be accessed to other appropriate approval PCs. Configuration information can be distributed. That is, it is possible to apply communication setting information that can change the authority of the appropriate user as required (S7).

Subsequently, the communication control agent performs VPN setting and personal firewall setting change according to the decrypted communication setting information (S8).
On the other hand, the proper approval PC 21 can access the defense network 1 via the set VPN and communicate with the in-house business server 11 or the like (S9).

Next, the operation when the quarantine result is partially OK will be described with reference to FIG. If the quarantine result is partially OK, the approval PC 21 is recognized as an appropriate approval PC as described above. The quarantine result partially OK here does not satisfy all the security check items, but is at a level where connection to a part of the defense network 1 or access to the defense network 1 by a specific protocol can be permitted. Say state.
For example, the virus definition file is the latest (having the check items satisfied) but the security patch is not applicable (the check items are not satisfied). Therefore, depending on the items checked by the quarantine server 31, there may be a plurality of quarantine partial OK states. At this time, the communication control agent combines the received dynamic communication setting information when the quarantine result is partially OK (S10).

The communication control agent also changes VPN settings and personal firewall rule settings in accordance with the decrypted communication setting information (S11).
On the other hand, the proper approval PC 21 can access the permitted defense network 1 via the set VPN-GW 12 using the permitted communication protocol and communicate with the in-house business server 11 or the like (S12).

Next, the operation in the case of the quarantine NG will be described with reference to FIG. If the quarantine result is NG, the approved PC 21 is recognized as an inappropriate PC. The quarantine result NG here refers to a state at a security level where connection to the defense network 1 is not allowed. The communication control agent decrypts the dynamic communication setting information when the received quarantine result is NG (S13).
The communication control agent also changes the VPN setting and personal firewall rule setting according to the decrypted communication setting information (S14). As an example, the connection to the defense network 1 is prohibited, or communication setting information for blocking all communication to and from the ineligible PC can be considered. As a result, the proper approval PC 21 cannot access the defense network 1 according to the applied communication setting information.

It is also possible to provide a network (in this case referred to as a treatment network) provided with a means for solving the security problem part of the improperly approved PC 21 and apply communication setting information that enables only communication there. Yes (S16). These networks can be configured to set the VPN-GW 34 and access via the VPN.
Note that the treatment network can also serve as the quarantine network 3, and the VPN-GW 34 can be a subordinate network. In the embodiment of the present invention shown in FIG. 6, as an example, the quarantine network 3 also serves as a treatment network, and shows a state where communication to other than the treatment network is blocked by a personal firewall.

Finally, the defense operation from the unapproved PC 22 will be described with reference to FIG. The defense network 1 and the quarantine network 3 are protected by the VPN-GWs 12 and 34 blocking unauthorized communication (attack) from the unauthorized PC 22 (S17).
At this time, the communication control agent blocks communication from the unapproved PC 22 by the personal firewall function (S18).

Here, a supplementary description will be given of a method of automatic distribution and setting registration of communication setting information used in the embodiment of the present invention. Therefore, in the following description, processing related to the quarantine server 31 is omitted.
Here, the system administrator registers in advance communication setting information necessary for using personal firewall software, IPsec software, and the like in the communication control server 32, and the communication control server 32 receives the approval from the approval PC 21. By performing terminal authentication based on terminal identification information sent when the PC 21 is turned on, distributing communication setting information according to the result and prompting the setting, it is possible to avoid security problems and The communication setting information is updated. This will be specifically described below.

The approval PC 21 communicates with the communication control server 32 connected to the quarantine network 3, and communicates with the in-house business server 11 according to the communication setting information distributed from the communication control server 32.
A communication control agent is installed on the approval PC 21. As described above, this communication control agent is agent software that performs access control of the approved PC 21 by dynamically switching a VPN (Virtual Private Network) based on IPsec and a rule of a personal firewall.

On the other hand, the communication control server 32 manages communication setting information registered in advance by the system administrator, receives a connection request from the approval PC 21, performs terminal identification, and communicates to the approval PC 21 according to the identification result. Encrypt and distribute the setting information.
Here, the communication setting information refers to the VPN communication control information by IPsec and the filtering rule of the personal firewall, which are used by the authorization PC 21 for communication control.

The communication setting information is managed on the communication control server 32 and distributed in an encrypted form to the approval PC 21 based on a request from a communication control agent operating on the approval PC 21.
Further, there are two types of communication setting information, default communication setting information and dynamic communication setting information. The former describes destination information to a network that is permitted to communicate in the initial activation state of the approved PC 21, and the latter includes The destination information to the network that can communicate after the terminal identification is described. The communication control server 32 receives the connection request in the initial activation state from the approval PC 21 and distributes the default communication setting information, receives the connection request in the normal use state, and distributes the dynamic communication setting information.

  The VPN-GW 12 is a gateway that terminates IPsec communication from the approved PC 21 based on the communication setting information described above, and is installed at the entrance of a network that is to be protected by access from a third party. Only the approved PC 21 that is permitted by the communication control server 32 can access.

In the configuration described above, the communication control agent operating on the approval PC 21 makes an authentication request to the communication control server 32 using the dynamic communication setting information when the approval PC 21 is activated or connected to the network. Dynamic communication setting information of IPsec and personal firewall suitable for the authentication result of the control server 32 is acquired from the communication control server 32. Then, it expands in a volatile memory built in the approval PC 21 and performs access control to the in-house business server 11.
After developing the dynamic communication control information, the communication control server 32 is notified of its own connection state by a response of the approval PC 21 to polling periodically issued by the communication control server 32. In addition to the dynamic communication setting information for the authentication result of the communication control server 32, the system administrator can change the dynamic communication setting information to the communication control server 32 if the communication setting information is changed. The dynamic communication setting information changed to the approval PC 21 at the time when the registration process is performed can be immediately developed.

8 to 10 are flowcharts cited for explaining the above-described automatic distribution and setting registration operation of the communication setting information. The preparatory operation (FIG. 8) and the operation leading to the acquisition of default communication setting information (FIG. 9). FIG. 10 shows the flow of operations (FIG. 10) leading to acquisition of dynamic communication setting information.
The automatic distribution and setting operation of communication setting information will be described below with reference to FIGS.

As shown in the flowchart of FIG. 8, the operation in advance preparation is started when the approval PC (authorization terminal) 21 first acquires its own identification ID (S31). Then, the identification ID is transmitted to the communication control server 32 by e-mail or the like.
The identification ID is generated by a terminal ID generation tool (not shown) that has been installed in the approval PC 21 in advance. Here, the terminal ID generation tool is software for generating a unique identification ID for each terminal used when the communication control server 32 performs terminal authentication of the approval PC 21. The terminal ID generation tool is provided as an executable file that can be manually activated by the user.

On the other hand, it is assumed that the communication control server 32 encrypts and stores default communication setting information (here, authentication VPN information setting) with the previously received identification ID (S32). The above communication control agent (PSC.EXE) is also installed in the approval PC 21, and the above preparation work is completed by restarting (S33, S35).
As described above, the encrypted default communication setting information is linked to the Web function in the communication control server 32, and the default communication setting information can be downloaded and distributed by browser connection from the approval PC 21 to be used. At this time, distribution can be performed by normal HTTP (Hyper Text Transfer Protocol) communication depending on settings, but distribution by HTTPS (Hyper Text Transfer Protocol Security) communication is also possible.

Next, the flow of operations leading to default communication information acquisition will be described with reference to FIG. Here, the approval PC 21 can access the communication control server 32 by using the default communication setting information.
The default communication setting information can be obtained by installing a communication control agent on the approval PC 21 and then accessing the communication control server 32 using a browser. Specifically, the default communication information request issued from the approval PC 21 (S41) is received by the communication control server 32, and corresponding default communication information is transmitted in response thereto. Here, the default communication information encrypted with the previously received identification ID is transmitted.

On the other hand, the approval PC 21 can perform normal communication by initializing the received default communication information in the communication control agent. If there are a plurality of default communication information, information corresponding to the communication destination is selected.
Default communication setting information distributed from the communication control server 32 and dynamic communication setting information to be described later are encrypted with an identification ID, and the approval PC 21 uses its own identification ID when expanding in the built-in volatile memory. The default communication setting information or the dynamic communication setting information is expanded only when decrypted.

  For this reason, in the program including the communication control agent installed in the approved PC 21, (1) a function for executing IPsec and personal firewall based on default communication setting information and dynamic communication setting information, and (2) generating an identification ID (3) a function for performing authentication and communication with the communication control server 32, (4) a function for developing dynamic communication setting information from the communication control server 32 in a built-in volatile memory, (5) A function of decrypting the encrypted default communication setting information and the dynamic communication setting information based on the identification ID; (6) if there is a plurality of default communication setting information, one default communication setting information is obtained according to the communication means; Function to select, (7) function to monitor the connection status of the network, (8) A log collection function for each of these functions is required.

Next, operations from terminal authentication to dynamic communication setting information acquisition will be described with reference to the flowchart shown in FIG.
The approval PC 21 first activates the communication control agent when the power is turned on (S51, S52). Then, the network connection is confirmed (S53), and the default communication setting information acquired previously is confirmed (S54). Here, if the setting has not been made yet, an initial setting instruction is given (S55) to prompt the initial setting.

After confirming the setting of the default communication setting information, the approval PC 21 decrypts the encrypted default communication setting information with its own identification ID, and expands the decrypted default communication setting information in the built-in volatile memory. Then, an authentication request (dynamic communication setting information request) with a hash value of the identification ID and a value obtained by encrypting the identification ID with the identification ID as parameters is issued to the communication control server 32 (S56). If any of the processes described above fails, default communication setting information for denial is set and registered (S57).
The communication control server 32 that has received the authentication request executes the authentication process (S61), specifically, searches for the hash value of the identification ID, extracts the identification ID, and decrypts the value obtained by encrypting the identification ID with the identification ID. When the result matches the extracted identification ID, the corresponding Dyn (dynamic) communication setting information is extracted and transmitted (S62). Here, when the authentication is not established, Dyn communication setting information for denial is transmitted (S63).

  Upon receiving the dynamic communication setting information or the denial Dyn communication setting information, the approval PC 21 decrypts them with the identification ID, expands them in a volatile memory, and performs settings (S58). Then, the normal end is displayed on a display device (not shown) (S59).

  Here, a supplementary explanation will be given for the above-described authentication processing. The communication control server 32 receives the value obtained by hashing the identification ID and the value obtained by encrypting the identification ID with the identification ID from the approval PC 21, and the agent information possessed by the communication control agent is a value obtained by hashing the received identification ID. A database (not shown) is searched to extract the corresponding identification ID. Then, the “value obtained by encrypting the identification ID with the identification ID” sent with the extracted identification ID is decrypted, and if the result matches the extracted identification ID, authentication is established. In the above, if the result does not match the extracted identification ID, the authentication is not established.

  If the authentication is established, the corresponding encrypted dynamic communication setting information is transmitted to the approval PC 21 from the agent information. At this time, the communication control server 32 performs a schedule check if schedule information such as a usage time zone, a specific day of the week and a deadline is added to the corresponding dynamic communication setting information, and the result is inconsistent. If there is, it is possible to transmit dynamic communication setting information for use outside the expiration date to the approval PC 21. If authentication is not established, the corresponding dynamic communication setting information is transmitted from the agent information to the requested approval PC 21. The dynamic communication setting information transmitted at this time is transmitted as plain text.

On the other hand, the setting change of the dynamic communication setting information is performed as follows. As described above, the approval PC 21 and the communication control server 32 always perform communication by polling at regular intervals.
The communication control server 32 can know the network connection state of the approval PC 21 by this polling, and can dynamically change the setting of the communication setting information accordingly. The communication control server 32, which has detected that the setting change of the dynamic communication setting information is necessary by polling, selects the corresponding dynamic communication setting information, performs the encryption process, and transmits to the approval PC 21 and decrypts it as described above. Encourage customization and configuration.
When changing the current dynamic communication setting information, the system administrator needs to change the setting on the information setting screen. At that time, the changed dynamic communication setting information can be immediately transmitted to the approval PC 21 receiving the polling.

As described above, according to the communication setting information distribution and setting registration method described above, the user or a third party can not know the communication setting information. It becomes possible.
In addition, the user or the system administrator does not need to manually set the communication profile, so that it is freed from complicated setting work and the burden is reduced. In addition, communication settings suitable for the environment of each terminal device can be performed, and communication setting information can be distributed only to a terminal (approval PC 21) approved by the system administrator. And virus infection can be prevented.

Furthermore, setting registration of communication setting information includes not only authentication of the terminal approved by the system administrator, but also intelligent authentication such as the ID and password of the user to be used, IC card, USB (Universal Serial Bus) token, etc. By combining device authentication, identity authentication can also be performed.
In addition, the system administrator can immediately change the communication setting information for each terminal device or for each individual that is ready for the network environment. Further, since the communication setting information to be distributed can set contents such as a usable time zone, a specific day of the week, and a period, it is possible to perform detailed network operation management. This makes it possible to centrally manage access restrictions of servers and hosts to which terminal devices can be connected, and to reduce work for operations.

  As described above, according to the present invention, it is possible to achieve both security strength and ease of introduction in a LAN environment. Specifically, compared with the authentication VLAN, it has the same level of “high security strength”, and the setting change and configuration change of the existing network can be remarkably reduced, which is advantageous from the viewpoint of ease of introduction. Further, as compared with the authentication DHCP, it is similarly “a system that is easy to introduce” and at the same time has a much higher protection from attacks by unauthorized carry-in terminals and malicious users. In other words, according to the present invention, it is possible to provide a quarantine system that balances the ease of introduction and security strength of each conventional method in a high dimension.

  Further, according to the present invention, a reliable security level can be ensured with a small device configuration. Specifically, since the system is based on access restrictions linked to the network side and the client side, the same level of security can be ensured with a smaller device configuration than the authentication VLAN method. Further, it is difficult to take an access restriction avoidance measure on the terminal side as compared with the authentication DHCP method. In addition, compared with the personal firewall method, the defense capability of the in-house resource that is the access target of the client is much higher.

  Furthermore, according to the present invention, flexible access restriction can be performed. Specifically, compared to the authentication VLAN method, the authentication DHCP method, and the remote access VPN method, it is possible to access only a part according to the user authority and the client status, as well as the binary result of communication permission / non-permission. It is possible to restrict access with a high degree of freedom, for example, it is possible to partially limit access destinations. Further, if the same thing is to be realized by the remote access VPN method, it is necessary to install authentication points in each part on the LAN, and quarantine in each part is necessary. On the other hand, in the present invention, even in an environment where resources to be accessed are distributed as compared with the remote access VPN method, access restriction can be realized by performing quarantine at one place.

Further, according to the present invention, centralized management of access rules on the center side and its reliable application can be performed. Specifically, according to the present invention, as in the authentication VLAN and remote access VPN systems, rule management and restriction are performed on the center side, so it is difficult to avoid restrictions on clients. Also, if you don't follow the rules, you can't access internal resources, and Personal Firewool's "method of restricting terminal access according to the rules" and authentication DHCP "a method that can avoid access restrictions on the client side" Compared with, the security level is fundamentally high.
Furthermore, compared with the remote access VPN method, there is an advantage in that the access side change, environment change and rule change are unnecessary on the client side.

Further, according to the present invention, quarantine can be performed uniformly in a LAN environment and a remote access environment.
Specifically, it is superior in that it can be used in both the LAN environment and the remote access environment as compared with the authentication VLAN method, the authentication DHCP method, and the remote access VPN method assuming the remote access. . Further, compared with the personal firewall system, there is an advantage from the viewpoint of ease of management operation in that both the access destination and the access source can be protected by one system.

  The procedure executed by each of the quarantine agent, communication control agent, quarantine server 31 and communication control server 32 of FIG. 1 is recorded on a computer-readable recording medium, and the program recorded on this recording medium is stored in the computer system. The quarantine system of the present invention is realized by reading and executing. The computer system mentioned here includes hardware such as an OS (Operating System) and peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

It is a figure which shows an example of the system configuration | structure of the quarantine system concerning this invention embodiment. FIG. 2 is a block diagram functionally expressing a connection configuration between a management apparatus and an approval PC in the quarantine system illustrated in FIG. 1. It is the figure quoted in order to demonstrate operation | movement of the quarantine system concerning this invention embodiment. It is the figure quoted in order to demonstrate operation | movement of the quarantine system concerning this invention embodiment. It is the figure quoted in order to demonstrate operation | movement of the quarantine system concerning this invention embodiment. It is the figure quoted in order to demonstrate operation | movement of the quarantine system concerning this invention embodiment. It is the figure quoted in order to demonstrate operation | movement of the quarantine system concerning this invention embodiment. It is the flowchart quoted in order to demonstrate the method of automatic distribution and setting registration of communication setting information used in embodiment of this invention. It is the flowchart quoted in order to demonstrate the method of automatic distribution and setting registration of communication setting information used in embodiment of this invention. It is the flowchart quoted in order to demonstrate the method of automatic distribution and setting registration of communication setting information used in embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Defense network, 2 ... Non-defense network, 3 ... Quarantine network, 11 ... Internal business server, 12, 34 ... VPN-GW, 31 ... Quarantine server, 32 ... Communication control server, 33 ... Management console, 211, 301 ... Network connection control unit, 212 ... Quarantine agent execution unit, 213 ... Communication control agent execution unit, 214 ... Communication setting information, 302 ... Security level diagnosis unit, 303 ... Communication setting information distribution unit, 214, 304 ... Communication setting information, 305 ... Access control unit

Claims (7)

From a defensive network to which an approved terminal permitted to connect to the in-house server is connected by a system administrator and an unprotected network to which the approved terminal including an unapproved terminal not permitted to connect to the in-house server can be connected A quarantine system that performs quarantine using a VPN and a firewall,
The approval terminal is
A communication control agent executing means for connecting according to communication setting information to a management apparatus connected to the quarantine network via a quarantine network provided independently of the defense network and the non-defense network;
Quarantine agent execution means for transmitting terminal information of the approval terminal required when the management device performs quarantine, and urging quarantine by the management device;
The management device receives the terminal information from the approval terminal, performs quarantine, distributes communication setting information according to the quarantine result to the approval terminal, and accesses the internal server by the approval terminal to the VPN And a quarantine system controlled by a personal firewall. The management device
Security level diagnosis means for diagnosing the security level of the approved terminal;
Communication setting information distribution means for distributing communication setting information according to the diagnosis result while ensuring security;
The quarantine system according to claim 1, comprising: The communication control agent execution means includes
3. The communication setting information distributed by the management device is set in the defense network, and an approval terminal connected to the defense network is allowed to access the in-house server. The quarantine system described. The communication control agent execution means includes
2. The communication setting information distributed by the management device is set to a part of the defense network, and access to the in-house server permitted according to the quarantine result is permitted. 4. The quarantine system according to any one of items 3. The communication control agent execution means includes
5. Access restriction is performed according to communication setting information distributed by the management device, and communication setting to the quarantine network that solves a security problem pointed out by the communication setting information is performed. The quarantine system as described in that section.   The gateway to terminate the IPsec communication from the communication control agent executing means is connected to the defense network and the quarantine network, and access from the unauthorized terminal is protected by the gateway. The quarantine system according to any one of the paragraphs. From a defensive network to which an approved terminal permitted to connect to the in-house server is connected by a system administrator and an unprotected network to which the approved terminal including an unapproved terminal not permitted to connect to the in-house server can be connected A quarantine method using a VPN and a personal firewall,
Connecting the approval terminal according to communication setting information to a management device connected to the quarantine network via a quarantine network provided independently of the defense network and the non-defense network;
The approval terminal transmits terminal information of the approval terminal required when the management device performs quarantine, and prompts quarantine by the management device;
The management device receives the terminal information from the approval terminal, performs quarantine, distributes communication setting information according to the quarantine result to the approval terminal, and accesses the internal server by the approval terminal, Controlling by VPN and personal firewall;
A quarantine method using a VPN and a personal firewall.

Images