JP2007052550A - Computer system and information processing terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a terminal and a computer system capable of dynamically switching security policies. <P>SOLUTION: The user terminal 10 has: a means for requesting a security countermeasure situation management center terminal (hereinafter, a management terminal) 30 of determining whether a client filtering function is in a latest setup; a means for changing setup of the client filtering function according to policy information received from the management terminal 30; and a means for displaying the setup after changing. The management terminal 30 has: a means for determining whether or not the client filtering function is the latest setup according to the request from the user terminal 10; a means for notifying setup of the latest client filtering function to the user terminal 10 which is determined not to be the latest setup; and a means for notifying setup of the client filtering function which restricts access to a network to the user terminal 10 of which is notified of a behavioral problem from an IDS center terminal 40. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a computer system having a defense against computer viruses, and more particularly to an information processing terminal and a computer system that can dynamically switch security policies.

  In recent years, damage caused by computer viruses and worms (hereinafter simply referred to as computer viruses) has frequently occurred, and the amount of damage caused by these has also become enormous.

  For this reason, there is an increasing need for a computer system having a defense against computer viruses.

As a defense against computer viruses, a system using a client firewall function (client filter function) has been put into practical use.
The client filter function is a function for permitting or denying access to a network from a computer terminal and access from a network to a computer terminal in consideration of a transmission source, a destination IP address, and a port number. It is.

  The computer system using the client filter function currently in practical use has the following problems.

There are many client filter products, but there are many products that cannot change the filter policy dynamically.
-Even if the product can change the policy, it operates in synchronization with the anti-virus software, so the policy cannot be changed dynamically in an environment using anti-virus software from a different vendor.
Since it cannot be operated in cooperation with an IDS (Intrusion Detection System) product, even if a user terminal infected with an unknown virus is connected to the network, communication from the terminal cannot be rejected.
-When constructing a PC quarantine system, the products that constitute the quarantine network and the products that manage the security countermeasure status are limited, and the system cannot be constructed easily.
When constructing a PC quarantine system, a special network terminal for restricting the access destination of the user terminal 10 is required according to the security check result, and the system cannot be easily constructed.

  The conventional client filter function can restrict access to the network for each program installed in the user terminal, but cannot perform access control in consideration of the security state of the user terminal. As for the client filter function provided by antivirus software vendors, there are products that can control the access destination dynamically by checking the version of the virus data file of the antivirus software. If you are infected with an unknown computer virus, you cannot deal with it.

Moreover, as a prior art regarding the security of a computer system, there is an “intrusion detection management system” disclosed in Patent Document 1.
JP 2003-85139 A

The invention disclosed in Patent Document 1 uses a firewall function as a device for monitoring a network.
The invention disclosed in Patent Document 1 is a computer system that has taken measures against unauthorized intrusion into a computer terminal, so-called hacking, but a computer virus has entered a computer through a normal route (for example, e-mail). Therefore, the invention disclosed in Patent Document 1 does not contribute to the improvement of security against computer viruses.
Moreover, since the countermeasure rules for intrusion detection are selected from those registered in advance, it is not possible to deal with situations outside the expected range. In other words, it cannot cope with computer viruses in which new species and variants appear one after another.
Thus, conventionally, a computer system capable of dynamically switching the security policy of terminals constituting the system has not been realized.

  The present invention has been made in view of such a problem, and an object of the present invention is to provide a computer system capable of dynamically switching the security policy of terminals constituting the system.

  In order to achieve the above object, the present invention provides, as a first aspect, a plurality of user terminals, a network security management terminal that determines whether each of the plurality of user terminals has sufficient network security, and a plurality of users. A computer system in which an IDS terminal that detects a suspicious behavior among terminals is connected via a network, and the user terminal determines whether or not the network security setting of its own terminal is the latest setting Requesting the network security management terminal to change the network security settings according to the policy information received from the network security management terminal, and changing the network security settings according to the policy information received from the network security management terminal In Means for displaying the network security setting after the change, and the network security management terminal determines whether the network security setting of the requesting user terminal is the latest setting in response to a request from each user terminal. To the user terminal that has determined that the network security setting is not the latest setting, and the IDS terminal is notified that the behavior is suspicious. And a means for notifying the user terminal of network security settings for restricting access to the network. When the IDS terminal detects a user terminal having a suspicious behavior, the IDS terminal It has means for notifying existence to the network security management terminal There is provided a computer system for.

  In the first aspect of the present invention, when the user terminal requests the network security management terminal to determine whether or not the network security setting of its own terminal is the latest setting, the network security setting of its own terminal is set. Is transmitted to the network security management terminal, and the network security management terminal compares the information received from the user terminal with the information indicating the latest network security setting stored in advance, thereby obtaining the requesting user. It is preferable to determine whether the network security setting of the terminal is the latest setting.

  In order to achieve the above object, the present invention provides, as a second aspect, a plurality of user terminals, a network security management terminal that manages network security settings for each of the plurality of user terminals, and a plurality of user terminals. A computer system connected to an IDS terminal that detects suspicious behavior from the network via a network, wherein the user terminal changes network security settings according to policy information received from the network security management terminal; When network security settings are changed according to the policy information received from the network security management terminal, there are means for displaying the changed network security settings and network security for restricting access to the network. The network security management terminal has a means for transmitting to the network security management terminal a request for releasing the restriction on access to the network, and the network security management terminal confirms that the behavior is suspicious from the IDS terminal. Means for notifying the notified user terminal of the network security setting for restricting access to the network, and means for notifying the user terminal of the release request transmission source of the network security setting for releasing the access restriction The IDS terminal provides a computer system characterized by having means for notifying the network security management terminal of the presence of a user terminal having a suspicious behavior when a user terminal having a suspicious behavior is detected. To do.

  In the first or second aspect of the present invention described above, the network security management terminal sets the network security for prohibiting access to the network for the user terminal notified of the suspicious behavior from the IDS terminal. Is preferably notified.

  In order to achieve the above object, as a third aspect, the present invention manages a plurality of user terminals and network security settings of each of the plurality of user terminals, and the behavior is suspicious from among the plurality of user terminals. A computer system in which an IDS terminal for detecting an object is connected via a network, and the user terminal receives from the IDS terminal a means for changing network security settings according to policy information received from the IDS terminal When the network security setting is changed according to the policy information, the network access setting after the change is displayed, and the network access restriction is released when the network security that restricts the access to the network is set. Request And a means for transmitting a removal request to the IDS terminal. When the IDS terminal detects a user terminal having a suspicious behavior, the IDS terminal sets a network security setting for restricting access to the network for the user terminal. The present invention provides a computer system comprising notification means and means for notifying a user terminal that is a transmission source of a release request of network security settings for releasing access restrictions.

  In the third aspect of the present invention, it is preferable that the IDS terminal notifies the user terminal that has detected that the behavior is suspicious of the network security setting for prohibiting access to the network.

  In order to achieve the above object, according to a fourth aspect of the present invention, there is provided an information processing terminal that transmits / receives information to / from another terminal via a network, and accesses a network that exceeds a previously permitted range. A means for detecting and notifying the user that access to the network exceeding the pre-permitted range has been detected, and requesting input of information indicating whether or not the access is made by the user's intention And means for blocking access to the network and means for notifying the user that access to the network has been blocked when the access is not made by the user's intention. An information processing terminal is provided.

  ADVANTAGE OF THE INVENTION According to this invention, the computer system and information processing terminal which can change dynamically the security policy of the terminal which comprises a system can be provided.

In the present invention, the access to the network is controlled by installing a client filter function unrelated to the antivirus software in the user terminal in the computer terminal. Therefore, the present invention can be applied to a computer system that has already introduced a defense against computer viruses.
In addition, it is possible to link with products having various functions by publishing an interface for the client filter function unit to link with external products. This allows for a wider range of usage.

There are two main types of defense against computer viruses:
-Ensure that security measures are in place to prevent infection by computer viruses (proactive measures).
When a user terminal infected with a computer virus is connected to the system, in order to prevent secondary infection, the user terminal infected with the virus is isolated from other user terminals (reactive countermeasures).
In the present invention, both of the above two measures can be taken, or only one of them can be taken. Therefore, it is possible to construct a computer system with security measures taken as necessary.

[First Embodiment]
A first embodiment in which the present invention is suitably implemented will be described.
FIG. 1 shows a configuration of a computer system according to the present embodiment. In the computer system according to the present embodiment, a plurality of user terminals 10 in which the client filter function 20 is implemented, a security countermeasure status management center terminal 30, and an IDS center terminal 40 are mutually connected via a network 100 (such as an intranet). It is a connected configuration.

  The user terminal 10 is an information processing apparatus such as a computer terminal, and has a function of accessing the network 100 (a function of transmitting and receiving information via the network 100).

The client filter function unit 20 is mounted on the user terminal 10 and monitors all data sent from the user terminal 10 to the network 100 and all data received from the network 100, and passes these data. Is controlled for each program and each communication partner.
The client filter function unit 20 has a function of dynamically switching a filter function policy (rules on what data is allowed to pass and what data is blocked). Further, the client filter function unit 20 is an interface for changing the policy of the client filter function in response to a request from another terminal (security countermeasure status management center terminal 30 in this embodiment) connected to the network 100. Is provided.

  In addition, the client filter function unit 20 includes an interface for notifying the user of the user terminal 10 when communication with a terminal other than the communication partner permitted by the policy occurs. The client filter function unit 20 has a function of communicating with the security countermeasure status management center terminal 30 and dynamically changes the policy of the client filter function in response to a request from the security countermeasure status management center terminal 30.

  In addition, the client filter function unit 20 has a function of transmitting the device-specific information of the user terminal 10 and the security countermeasure status to the security countermeasure status management center terminal 30 as a security countermeasure status confirmation request. The device unique information includes the MAC address of the user terminal 10 and the like. The security countermeasure status includes virus pattern file version information of the antivirus software, operating status of the antivirus software, security patch application status, and the like.

  Further, the client filter function unit 20 provides an interface for the user of the user terminal 10 to transmit a security measure status confirmation request to the security measure information management center terminal 30 at an arbitrary timing. For example, the client filter function unit 20 provides an interface by displaying a transmission button on the display of the user terminal 10.

The security countermeasure status management center terminal 30 is an information processing apparatus (workstation, server, etc.) installed in the center that manages the security countermeasure status, and the user terminal transmitted from the user terminal 10 by the client filter function unit 20 Collect 10 security countermeasure status information.
Further, the security countermeasure status management center terminal 30 holds the latest information necessary for security countermeasures, and compares the information collected from all the user terminals 10 with the latest information. Determine whether the measures are sufficient.
Further, the security countermeasure status management center terminal 30 determines the security countermeasure status based on various information transmitted from the user terminal 10 by the client filter function unit 20 and transmits the policy of the client filter function to the user terminal 10.
Furthermore, information regarding the user terminal 10 that performs suspicious behavior is received from the IDS center terminal 40, and a policy for blocking communication with the network 100 is transmitted to the client filter function unit 20 of the user terminal 10.

  The IDS center terminal 40 is an information processing device (workstation, server, or the like) or a network appliance device, monitors all packets flowing through the network 100, and detects a user terminal 10 that behaves suspiciously. Further, information related to the user terminal 10 that is performing suspicious behavior is transmitted to the security countermeasure status management center terminal 30.

The operation of the computer system will be described.
FIG. 2 shows a flow of operations of the security countermeasure status management center terminal 30.
In order to determine the security countermeasure status, the latest security countermeasure information is acquired (step A1). The security countermeasure information includes virus pattern file version information of antivirus software, security patch information, and the like.

  The security countermeasure status management center terminal 30 waits for a request from the IDS center terminal 40 or the client filter function unit 20. Upon receiving a request from the IDS center terminal 40 or the client filter function unit 20, the security countermeasure status management center terminal 30 determines the requested content. If a suspicious user terminal notification is received from the IDS center terminal 40 (step A2 / Yes), a policy for blocking communication to the network 100 is transmitted to the suspicious user terminal (step A3).

  If a security measure status confirmation request is received from the client filter function unit 20 (step A2 / No, step A4 / Yes), the client filter function unit 20 is compared with the latest security measure information acquired in advance. Is notified of the security countermeasure status check result (step A5). The notified content includes a policy (rule) to be applied to the client filter function unit 20. For example, if the security countermeasure status check result is OK, a policy that does not particularly restrict access to the network 100 is transmitted. On the other hand, if the security countermeasure status check result is NG, a policy for prohibiting access to the network 100 or restricting access is transmitted.

  Thereafter, if monitoring is continued, the process returns to step A1 (step A6).

The operation flow of the entire system is shown in FIG.
When the user activates the user terminal 10, the client filter program is executed by the CPU in the user terminal 10, and the client filter function unit 20 is installed on the user terminal 10 (step B1). In order to prevent the client filter function unit 20 from being implemented by the user's operation of the user terminal 10, the client filter program is automatically executed when the user terminal 10 is started, and the execution of the program is stopped by the user's operation. It is preferable not to do so.

  The activated client filter function unit 20 collects device-specific information and security countermeasure information of the user terminal 10 and transmits them to the security countermeasure status management center terminal 30 as a security countermeasure status confirmation request (step B2). The device specific information is information for specifying the user terminal 10 and includes a host name, an IP address, a MAC address, and the like. The security countermeasure information includes virus pattern file version information of the antivirus software, the operating status of the antivirus software, the security patch application status, and the like.

  When the security countermeasure status management center terminal 30 receives the security countermeasure status confirmation request transmitted from the user terminal 10 by the client filter function 20, the latest security countermeasure information already obtained and the client filter function section 20 transmit the security countermeasure status confirmation request. The security countermeasure information of the user terminal 10 that has been received is compared (step B3). The method for obtaining the latest security countermeasure status is not particularly limited, and a known method such as obtaining from a specific Web site via a network can be applied.

  If the security countermeasure status check result is NG (step B3 / NG), the security countermeasure status management advanced terminal 30 sets the policy for restricting access to the network 100 to the client that is the transmission source of the security countermeasure status confirmation request. It transmits to the filter function part 20 (step B4). If the security countermeasure status check result is OK (step B3 / OK), the security countermeasure status management center terminal 30 sends a policy that does not restrict access to the network 100 to the client that is the source of the security countermeasure status confirmation request. It transmits to the filter function part 20 (step B5).

  When the client filter function unit 20 receives the policy of the client filter function from the security countermeasure status management center terminal 30, it applies it (step B6). Then, the contents of the applied policy are displayed on the screen of the user terminal 10 (step B7), thereby notifying the user of the state of the client filter function. If the security check result is NG, the cause is also displayed on the screen of the user terminal 10.

  By applying the policy received from the security countermeasure status management center 30, if the security check result is OK, the user of the user terminal 10 can access the network 100 without being restricted. On the other hand, if the security check result is NG, it becomes possible to access a limited range of resources.

Next, the operation of the system when the IDS center terminal 40 detects the user terminal 10 behaving suspiciously will be described. FIG. 4 shows the flow of operation of the system in this case.
The IDS center terminal 40 monitors all packets flowing through the network 100 to detect a user terminal having a suspicious behavior (step C1). Suspicious behavior here refers to behavior often seen when a user's terminal is infected with a computer virus (communication to a partner that is unthinkable in normal operations, simultaneous communication to a large number of partners, etc.) Point to.

  If the IDS center terminal 40 detects a user terminal 10 that is suspicious (step C2 / Yes), the IDS center terminal 40 sends a suspicious user terminal notification including device-specific information for identifying the user terminal 10 as a security measure. It is transmitted to the status management center terminal 30 (step C3).

  When the security countermeasure status management center terminal 30 receives the suspicious user terminal notification, the security countermeasure status management center terminal 30 identifies the suspicious user terminal based on the device specific information, and accesses the network filter 100 to the client filter function unit 20 on the user terminal 10. A policy for restricting is transmitted (step C4).

Upon receiving the client filter function policy from the security countermeasure status management center terminal 30, the client filter function unit 20 applies it (step C5). Then, the state of the applied policy is displayed on the screen of the user terminal 10 (step C6). Thereby, the user of the user terminal 10 can notify the state of the client filter function unit 20 and the cause thereof.
In this way, the user of the user terminal 10 can know that access to the network 100 is restricted because the user terminal 10 is suspected of being infected with a computer virus.

  As the IDS center terminal 40, it is conceivable to use a commercially available IDS product. However, when an IDS product that is commercially available generally finds a suspicious terminal, the information is transmitted using the SNMP protocol. It often has a notification function. In this embodiment, since the security countermeasure status management center terminal 30 receives the suspicious user terminal notification of the IDS product by the SNMP protocol, a commercially available IDS product can be applied as the IDS center terminal 40.

  As described above, when the computer system according to the present embodiment allows the user terminal to access the network, the computer system dynamically determines the security countermeasure status of the user terminal used by the user, and according to the result. Since the access to the network is dynamically switched, the network itself can be kept secure.

  Further, by providing an IDS center terminal, it is possible to cope with an unknown computer virus, and even if a user terminal infected with a computer virus is connected to the network, it can be detected and eliminated quickly.

  Further, since communication between the IDS center terminal 40 and the security countermeasure status management center terminal 30 can be realized by a generally used protocol, it is not necessary to use a special device for the IDS center terminal 40.

  In addition, it dynamically determines the status of security measures on user terminals connected to the network. If it is illegal, only security measures such as installing security software, upgrading data files of security software, and applying security patches. The effect of being able to access the network for treatment that can be performed is obtained.

  Further, since the access restriction to the network is realized by the client filter function, it can be dealt with without performing the network connection form of the user terminal (for example, replacement of the network cable in the case of wired connection).

  Further, since access restriction to the network is realized by the client filter function, access control can be realized regardless of whether the IP address of the user terminal is set statically or dynamically from the DHCP server.

  In addition, since no special network device is required, the present invention can be applied to a wide variety of network forms from intranet connection to remote connection.

[Second Embodiment]
A second embodiment in which the present invention is suitably implemented will be described.
The configuration of the computer system according to this embodiment is the same as that of the first embodiment.
This embodiment is different from the first embodiment in that the security countermeasure status center terminal 30 does not manage the security countermeasure status of all user terminals.

FIG. 5 shows an operation flow of the computer system according to the present embodiment.
When the user activates the user terminal 10, the client filter program is executed by the CPU in the user terminal 10, and the client filter function unit 20 is installed on the user terminal 10 (step D1). In order to prevent the client filter function unit 20 from being implemented by the user's operation of the user terminal 10, the client filter program is automatically executed when the user terminal 10 is started, and the execution of the program is stopped by the user's operation. It is preferable not to do so.

  The activated client filter function unit 20 applies a policy that does not restrict access to the network 100 (step D2).

  The IDS center terminal 40 monitors all packets flowing through the network 100, thereby detecting a user terminal having a suspicious behavior (step D3). Suspicious behavior here refers to behavior often seen when a user's terminal is infected with a computer virus (communication to a partner that is unthinkable in normal operations, simultaneous communication to a large number of partners, etc.) Point to.

  If the IDS center terminal 40 detects a user terminal 10 that is suspiciously behaved (step D4 / Yes), the IDS center terminal 40 sends a suspicious user terminal notification that includes device-specific information for identifying the user terminal 10 as a security measure. The data is transmitted to the status management center terminal 30 (step D5).

  When the security countermeasure status management center terminal 30 receives the suspicious user terminal notification, the security countermeasure status management center terminal 30 identifies the suspicious user terminal based on the device specific information, and accesses the network filter 100 to the client filter function unit 20 on the user terminal 10. A policy for restricting is transmitted (step D6).

When the client filter function unit 20 receives the policy of the client filter function from the security countermeasure status management center terminal 30, it applies it (step D7). Then, the state of the applied policy is displayed on the screen of the user terminal 10 (step D8). Thereby, the user of the user terminal 10 can notify the state of the client filter function unit 20 and the cause thereof.
In this way, the user of the user terminal 10 can know that access to the network 100 is restricted because the terminal 10 used by the user terminal 10 is suspected of being infected with a computer virus.

Next, the operation after removing the computer virus of the user terminal 10 will be described.
FIG. 6 shows the flow of operation.
After the infected computer virus is removed, when an operation for transmitting an access restriction release request to the security countermeasure status management center terminal 30 is performed, the client filter function unit 20 sends the access restriction release request to the security countermeasure status. It transmits to the management center terminal 30 (step E1).

  The security countermeasure status management center terminal 30 that has received the access restriction release request transmits a policy for releasing the access restriction to the network 100 to the client filter function unit 20 of the user terminal 10 that is the transmission source (step E2).

  The client filter function unit 20 that has received the policy transmitted from the security countermeasure status management center terminal 30 applies it (step E3). Then, the state of the applied policy is displayed on the screen of the user terminal 10 (step E4). Thereby, the user of the user terminal 10 can grasp the state of the client filter function.

  As the access restriction to the network 100 is released, the user terminal 10 can freely access the network 100.

  As described above, the computer system according to the present embodiment does not check the security countermeasure status of all user terminals 10 in the security countermeasure status management center terminal 30, but has a defense against computer viruses.

  Generally, since a large amount of money is required to construct a system for managing the security countermeasure status of all user terminals, it cannot be easily introduced. The computer system according to the present embodiment can detect a user terminal actually infected with a computer virus and block network access without using an apparatus for checking the security countermeasure status of all user terminals. Therefore, a computer system with computer virus countermeasures can be constructed at a low cost.

[Third Embodiment]
A third embodiment in which the present invention is preferably implemented will be described.
FIG. 7 shows a configuration of a computer system according to the present embodiment.
The computer system according to this embodiment is different from the second embodiment in that the computer system does not include the security countermeasure status management center terminal 30. The functions provided by the security countermeasure status management center terminal 30 in the second embodiment are realized by the IDS center terminal 40.

FIG. 8 shows an operation flow of the computer system according to the present embodiment.
When the user activates the user terminal 10, the client filter program is executed by the CPU in the user terminal 10, and the client filter function unit 20 is mounted on the user terminal 10 (step F1). In order to prevent the client filter function unit 20 from being implemented by the user's operation of the user terminal 10, the client filter program is automatically executed when the user terminal 10 is started, and the execution of the program is stopped by the user's operation. It is preferable not to do so.

  The activated client filter function unit 20 applies a policy that does not restrict access to the network 100 (step F2).

  The IDS center terminal 40 monitors all packets flowing through the network 100, thereby detecting a user terminal having a suspicious behavior (step F3). Suspicious behavior here refers to behavior often seen when a user's terminal is infected with a computer virus (communication to a partner that is unthinkable in normal operations, simultaneous communication to a large number of partners, etc.) Point to.

  When the IDS center terminal 40 detects the user terminal 10 behaving suspiciously (step F4 / Yes), the IDS center terminal 40 identifies the user terminal 10 and, with respect to the client filter function unit 20 on the user terminal 10, A policy for restricting access to the network 100 is transmitted (step F5).

Upon receiving the client filter function policy from the IDS center terminal 40, the client filter function unit 20 applies it (step F6). Then, the state of the applied policy is displayed on the screen of the user terminal 10 (step F7). Thereby, the user of the user terminal 10 can notify the state of the client filter function unit 20 and the cause thereof.
In this way, the user of the user terminal 10 can know that access to the network 100 is restricted because the terminal used by the user terminal 10 is suspected of being infected with a computer virus.

Next, an operation after deleting a computer virus that has infected the user terminal 10 will be described.
FIG. 9 shows the operation flow of the system.

  After an infected computer virus is removed, when an operation for transmitting an access restriction release request to the IDS center terminal 40 is performed, the client filter function unit 20 transmits an access restriction release request to the IDS center terminal 40. (Step G1).

  The IDS center terminal 40 that has received the access restriction release request transmits a policy for releasing the access restriction to the network 100 to the client filter function unit 20 of the user terminal 10 that is the transmission source of the access restriction release request (step). G2).

  The client filter function unit 20 that has received the policy transmitted from the IDS center terminal 40 applies it (step G3). Then, the state of the applied policy is displayed on the screen of the user terminal 10 (step G4). Thereby, the user of the user terminal 10 can grasp the state of the client filter function.

  As the access restriction to the network 100 is released, the user terminal 10 can freely access the network 100.

As described above, the computer system according to the present embodiment is configured not to include the security countermeasure status management center terminal, but has a defense against computer viruses.
Generally, since a large amount of money is required to construct a system for managing the security countermeasure status of all user terminals, it cannot be easily introduced. The computer system according to the present embodiment can detect a user terminal actually infected with a computer virus and block network access without using an apparatus for managing the security countermeasure status of all user terminals. Therefore, a computer system with computer virus countermeasures can be constructed at a low cost.

  Further, the system configuration can be simplified as compared with the computer system according to the second embodiment.

[Fourth Embodiment]
A fourth embodiment in which the present invention is preferably implemented will be described.
FIG. 10 shows a configuration of a computer system according to the present embodiment.
The computer system according to the present embodiment has a configuration in which a plurality of user terminals 10 are connected via a network 100.

An operation of the computer system according to the present embodiment will be described.
FIG. 11 shows a flow of system operation.
When the user activates the user terminal 10, the client filter program is executed by the CPU in the user terminal 10, and the client filter function unit 20 is installed on the user terminal 10 (step H1). In order to prevent the client filter function unit 20 from being implemented by the user's operation of the user terminal 10, the client filter program is automatically executed when the user terminal 10 is started, and the execution of the program is stopped by the user's operation. It is preferable not to do so.

  The client filter function unit 20 installed in the user terminal 10 applies a policy limited to a predetermined access destination (step H2).

  When a computer virus that infects the user terminal 10 is activated, access from the user terminal 10 to the network 100 occurs (step H3).

  The client filter function unit 20 detects that there is communication with the other party not set in the policy, and notifies the user of the user terminal 10 to that effect (step H4). At the same time, the client filter function unit 20 requests the user to input information as to whether or not the notified communication is communication intended by the user (step H5).

  When information indicating that the communication was not intended is input from the user (step H6 / No), the client filter function unit 20 determines that the access is due to virus infection and blocks access to the network 100. The policy to be applied is applied (step H7). Then, the applied policy is displayed on the screen of the user terminal 10, and the state of the client filter function and the cause thereof are notified to the user (step H8).

As described above, the computer system according to the present embodiment is configured not to include the security countermeasure status management center terminal and the IDS center terminal, but has a defense against computer viruses.
Generally, since a large amount of money is required to construct a system for managing the security countermeasure status of all user terminals, it cannot be easily introduced. The computer system according to the present embodiment can detect a user terminal actually infected with a computer virus and block network access without using an apparatus for managing the security countermeasure status of all user terminals. Therefore, a computer system with computer virus countermeasures can be constructed at a low cost.

  Further, the system configuration can be simplified as compared with the computer system according to the third embodiment.

  Each of the above embodiments is an example of a preferred embodiment of the present invention, and the present invention is not limited to these and can be modified.

It is a figure which shows the structure of the computer system concerning 1st Embodiment which implemented this invention suitably. It is a figure which shows the flow of operation | movement of the security countermeasure status management center terminal concerning 1st Embodiment. It is a figure which shows the flow of operation | movement of the computer system concerning 1st Embodiment. It is a figure which shows the flow of operation | movement of the computer system concerning 1st Embodiment. It is a figure which shows the flow of operation | movement of the computer system concerning 2nd Embodiment which implemented this invention suitably. It is a figure which shows the flow of operation | movement of the computer system concerning 2nd Embodiment. It is a figure which shows the structure of the computer system concerning 3rd Embodiment which implemented this invention suitably. It is a figure which shows the flow of operation | movement of the computer system concerning 3rd Embodiment. It is a figure which shows the flow of operation | movement of the computer system concerning 3rd Embodiment. It is a figure which shows the structure of the computer system concerning 4th Embodiment which implemented this invention suitably. It is a figure which shows the flow of operation | movement of the computer system concerning 4th Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 User terminal 20 Client filter function part 30 Security countermeasure status management center terminal 40 IDS terminal

Claims (7)

A plurality of user terminals, a network security management terminal that determines whether or not the network security of each of the plurality of user terminals is sufficient, and an IDS terminal that detects a suspicious behavior from the plurality of user terminals; Is a computer system connected via a network,
The user terminal is
Means for requesting the network security management terminal to determine whether or not the network security setting of its own terminal is the latest setting;
Means for changing network security settings according to the policy information received from the network security management terminal;
Means for displaying the changed network security setting when the network security setting is changed according to the policy information received from the network security management terminal;
The network security management terminal is:
Means for determining whether or not the network security setting of the requesting user terminal is the latest setting in response to a request from each user terminal;
A means for notifying a user terminal that the network security setting is not the latest setting to notify the latest network security setting;
Means for notifying a user terminal notified of suspicious behavior from the IDS terminal of network security settings for restricting access to the network;
The IDS terminal
A computer system comprising means for notifying the network security management terminal of the presence of a user terminal having a suspicious behavior when a user terminal having a suspicious behavior is detected. When the user terminal requests the network security management terminal to determine whether or not the network security setting of its own terminal is the latest setting, information indicating the network security setting of its own terminal is sent to the network security management terminal Send to
The network security management terminal compares the information received from the user terminal with information representing the latest network security setting stored in advance, so that the network security setting of the requesting user terminal is the latest setting. 2. The computer system according to claim 1, wherein it is determined whether or not. A plurality of user terminals, a network security management terminal that manages network security settings of each of the plurality of user terminals, and an IDS terminal that detects a suspicious behavior among the plurality of user terminals via a network A connected computer system,
The user terminal is
Means for changing network security settings according to the policy information received from the network security management terminal;
Means for displaying the changed network security settings when the network security settings are changed according to the policy information received from the network security management terminal;
Means for transmitting, to the network security management terminal, a release request for requesting release of restriction on access to the network when network security for restricting access to the network is set;
The network security management terminal is:
Means for notifying a user terminal notified of suspicious behavior from the IDS terminal of a network security setting for restricting access to the network;
Means for notifying the user terminal that is the transmission source of the cancellation request of network security settings for canceling the access restriction;
The IDS terminal
A computer system comprising means for notifying the network security management terminal of the presence of a user terminal having a suspicious behavior when a user terminal having a suspicious behavior is detected.   2. The network security management terminal notifies a user terminal notified of suspicious behavior from the IDS terminal of a network security setting for prohibiting access to the network. 4. The computer system according to any one of items 1 to 3. A computer in which a plurality of user terminals and an IDS terminal that manages network security settings of each of the plurality of user terminals and detects a suspicious behavior among the plurality of user terminals are connected via a network A system,
The user terminal is
Means for changing network security settings in accordance with the policy information received from the IDS terminal;
Means for displaying the changed network security setting when the network security setting is changed according to the policy information received from the IDS terminal;
Means for transmitting, to the IDS terminal, a release request for requesting release of restriction on access to the network when network security for restricting access to the network is set;
The IDS terminal
Means for notifying the user terminal of network security settings for restricting access to the network when a user terminal having a suspicious behavior is detected;
A computer system comprising: means for notifying a user terminal as a transmission source of the cancellation request of a network security setting for canceling the access restriction.   6. The computer system according to claim 5, wherein the IDS terminal notifies the user terminal that has detected that the behavior is suspicious of a network security setting that prohibits access to the network. An information processing terminal that transmits / receives information to / from other terminals via a network,
Means for detecting access to a network beyond a pre-authorized range;
Means for notifying the user that access to a network exceeding a pre-permitted range has been detected, and requesting input of information indicating whether or not the access has been made by the user's intention;
Means for blocking access to the network if the access is not intended by the user;
An information processing terminal comprising: means for notifying a user that access to the network has been blocked.

Images