JP2007272396A - Security management system, relay device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To execute application of a security patch without depending on setting of an OS by preventing connection of a terminal having a security hole to the Internet, and detecting the security hole without introducing management software to each terminal. <P>SOLUTION: The function of inspecting presence/absence of security hole is given to a router of an internal network within a company or a house to perform inspection of presence/absence of security hole to terminals on the internal network to access to an external network, and a terminal in which security holes are entirely blocked is determined as success. Communication with the external network is permitted only to terminals which succeeded in the inspection without restriction, but limited for terminals not succeeded in the inspection. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a security management system, and more particularly to a security management system that inspects security holes of terminals in an internal network.

  Conventionally, various countermeasures have been taken against security holes in terminals directly or indirectly connected to the Internet. For example, when a firewall is installed between an internal network in a company or home and an external network, even if there is a terminal with a security hole in the internal network, the firewall prevents direct attacks from the external network. It becomes possible. For networks and servers that are accessed from external networks, IDS (Intrusion Detection System) is introduced to detect unauthorized intrusions and attacks from external networks in real time. It is possible to take measures to prevent the damage from spreading.

  In addition, for example, when a vulnerability related to a managed terminal (server, client) is found by referring to vulnerability information published by a security vendor in the IT department of a company, the administrator or user of the terminal It may be possible to take measures such as requesting the application of security patches.

  Furthermore, a system is used in which software that collects patch application information of the OS and applications (software) is installed in each terminal in the internal network, the information collected by the software is collected on a server, and the administrator collectively manages the information. In some cases, a terminal having a security hole is grasped, and a patch is applied to a terminal to which a patch has not been applied.

  In addition, there are cases in which a service for a company that audits security is used for a server that is disclosed on the Internet. In such a service, an illegal attack is actually performed on a server to be audited to audit whether the security strength of the server is sufficient. Based on the audit results, the administrator can implement appropriate security measures.

  As a countermeasure against security holes in the client terminal, an automatic update function of the OS or application is made effective to automatically close the security holes.

  However, the automatic update function of the OS or application can be turned off by the user, and if left off, there is a possibility that the security hole is left unsealed. Further, even if the OS or application vendor gives a patch application guide to the user via a website or e-mail, the user does not always apply it.

  In addition, since IDS is a system for an in-company network, it is difficult to introduce it into a home network at this time.

  When connecting to an external network via a broadband router in a home network, the broadband router usually has a firewall function, but even if the terminal is under a broadband router by port mapping using UPnP (Universal Plug and Play) In some cases, direct access is possible from the external network, and attacks are possible from the external network.

  When a system that collects patch application statuses and performs batch management is introduced, only a terminal that runs management software that collects patch application statuses can be managed. For example, in the case of management software that runs only on a specific OS, a terminal using another OS cannot be managed. In addition, terminals that do not have management software installed are excluded from management targets.

  Even if the terminal is a secure terminal with sufficient security hole countermeasures, if there is a dangerous terminal that does not block the security hole in the network, there is a possibility that the safe terminal may be illegally entered via the dangerous terminal. There is.

  As described above, even if the OS or application of the terminal has an automatic update function, there is a possibility that the terminal will continue to be used without closing the security hole of the terminal depending on the usage form of the user. In addition, there is a possibility that a network in which there is a terminal whose security hole is not blocked may be in a dangerous state where unauthorized entry is possible even if a firewall is installed.

As a related technique, Japanese Patent Laid-Open No. 2002-157221 (Patent Document 1) discloses a security vulnerability countermeasure automatic setting system.
The security vulnerability countermeasure setting automation system includes an audited computer to be audited for security strength and an audit computer for auditing the security vulnerability of the audited computer, and the audited computer and the audit computer Are connected to each other via a network. The security vulnerability countermeasure setting automation system includes an audit function that detects the security vulnerability of the audited computer by performing a pseudo attack on the audited computer via the network, and the audit function. A countermeasure execution file generation function for generating a countermeasure execution file including a processing step for executing a countermeasure necessary for overcoming the detected security vulnerability, and a security vulnerability of the audited computer by executing the countermeasure execution file And a measure execution function for setting measures required for overcoming the point to the audited computer via the network.

Japanese Patent Laying-Open No. 2005-157421 (Patent Document 2) discloses a connection permission server.
The connection permission server is connected to a terminal status check network that is logically separated from the user network, and confirms the implementation status of the security measures of the terminal newly connected to the user network. Maintain security. The connection permission server includes an interface, security information storage means, software configuration information reception means, and terminal setting transmission means. The interface connects the connection permission server to the terminal status check network. The security information storage means holds the latest information on items necessary for security for each software program installed in the terminal. Software configuration information receiving means includes software indicating a configuration state of a software program collected by the newly connected terminal in its own terminal from the terminal newly connected to the user network via the terminal state check network Receive configuration information. The terminal setting transmission means determines whether or not the newly connected terminal is implementing the latest security measures by collating the content of the received software configuration information with the information stored in the security information storage means. Only when the latest security measures are confirmed, the connection of the newly connected terminal to the user network is permitted, and when the latest security measures are not implemented, the user network Notification that connection to is not permitted.

Japanese Patent Laying-Open No. 2005-25269 (Patent Document 3) discloses a network relay device.
The network relay device includes a network relay unit that performs a relay process between a computer and a network, a port scan unit that performs a port scan for inspecting a service provided on the computer, a port number related to the service, and And inspection means for referring to inspection information having a port number related to a security hole and performing a security inspection of the computer based on a response result of the port scan.

Japanese Patent Laying-Open No. 2004-356787 (Patent Document 4) discloses a security inspection system.
A gateway device that connects an external network and an internal network to each other, a test host connected to an external network that has a function to perform a security vulnerability test on the host to be tested, and a vulnerability test target In a public host connected to the internal network and a network system in which access control from the external network to the public host is set in the gateway device, the security inspection system is disclosed from the internal network to the inspection host. Means for transmitting inspection request information for performing vulnerability inspection to the host, and determining whether or not vulnerability inspection can be performed based on the inspection request information, and whether to perform vulnerability inspection for the public host Information return means, inspection request information and inspection availability information. Comprising means gateways device holds, on the basis of the inspection request information and the inspection permission information, characterized in that it comprises means gateway device changes its Access Control set automatically.

Japanese Patent Laying-Open No. 2005-222239 (Patent Document 5) discloses a node device.
The node device includes: a first input / output port to which a user terminal is connected; an input / output port group including a second input / output port to which a device capable of communicating with the user terminal is connected; and the input / output port group. It comprises relay means for relaying a series of input packets, and virus detection means for monitoring the packets and detecting computer viruses in communication data reconstructed from the packets.

JP 2002-157221 A JP 2005-157421 A Japanese Patent Laying-Open No. 2005-25269 JP 2004-356787 A JP 2005-222239 A

An object of the present invention is to provide a security management system having a function of inspecting the presence or absence of a security hole in a terminal on an internal network in a company or at home.
Another object of the present invention is to provide a security management system that inspects all terminals on an internal network trying to access an external network for security holes.
Still another object of the present invention is to provide a security management system in which if all security holes are closed, it is accepted and only terminals that pass the inspection can communicate with the external network without restriction.
Still another object of the present invention is to provide a security management system that restricts communication to an external network for a terminal that fails a test.

  In the following, means for solving the problem will be described using the numbers used in [Best Mode for Carrying Out the Invention] in parentheses. These numbers are added to clarify the correspondence between the description of [Claims] and [Best Mode for Carrying Out the Invention]. However, these numbers should not be used to interpret the technical scope of the invention described in [Claims].

The security management system of the present invention comprises a terminal (1) on an internal network (100) and a relay device (10, 30) communicating with the terminal (1) and an external network (200).
When the relay device (10, 30) detects an access request from the terminal (1) to the external network (200), the relay device (10, 30) determines whether the terminal (1) has passed the inspection for the security hole. . If the terminal (1) has already passed the inspection, the communication between the terminal (1) and the external network (200) is relayed. If the terminal (1) has not yet passed the inspection, communication between the terminal (1) and the external network (200) is restricted, and the inspection is performed according to the inspection execution operation from the terminal (1). If the inspection is passed, communication between the terminal (1) and the external network (200) is relayed.

  If the terminal (1) fails the inspection, the relay device (10, 30) notifies the terminal (1) to apply a security patch, and the security patch is sent from the terminal (1). If there is a request, the communication between the terminal (1) and the security patch providing site (220) is relayed.

  The relay device (10, 30) performs the inspection with the router (10) that relays communication between the terminal (1) that has passed the inspection and the external network (200), and the inspection And a security inspection server (30) for notifying the router (10) of the terminal (1) that has passed the above.

  The relay device (10, 30) of the present invention detects an access request from the terminal (1) on the internal network (100) to the external network (200), and the terminal (1) passes the inspection for the security hole. If not, the communication between the terminal (1) and the external network (200) is restricted, and if the inspection is passed, the communication between the terminal (1) and the external network (200) is relayed. The communication processing unit (11, 12, 21) and the communication processing unit (11, 12, 21) receive an inquiry as to whether the terminal (1) has passed the inspection and respond to the inquiry. An inspection terminal list management unit (13), and an inspection execution unit (15) for executing the inspection and notifying the terminal (1) and the inspection terminal list management unit (13) of the inspection result; Comprising.

The communication processing unit (11, 12, 21) is a router (10) on the internal network (100),
When the router (10) detects an access request from the terminal (1) on the internal network (100) to the external network (200), the inspection terminal list management unit (13) Receives an inquiry as to whether the terminal (1) has passed the inspection for the security hole, and responds to the inquiry.

  The inspection execution unit (15) performs the inspection in response to an inspection execution request from the communication processing unit (11, 12, 21) that has received notification that the terminal (1) has not passed the inspection. Execute.

  When the terminal (1) does not pass the inspection, the relay device (10, 30) of the present invention includes a notification unit (14, 20) that notifies the terminal (1) to execute the inspection. In addition. The inspection execution unit (15) executes the inspection in response to an inspection execution request from the terminal (1).

  The notification unit (14, 20) notifies the terminal (1) to apply a security patch when the result of the inspection fails, and the communication processing unit (11, 12, 21) If there is a request for the security patch from the terminal (1), the communication between the terminal (1) and the security patch providing site (220) is relayed.

  When the communication processing unit (21) detects a packet from the terminal (1), the communication processing unit (21) informs the inspection terminal list management unit (13) whether the terminal (1) has passed the inspection. If the terminal (1) does not pass the inspection, the inspection execution unit (15) is instructed to execute the inspection.

  When the terminal (1) on the internal network (100) executes an access request to the external network (200), the program of the present invention determines whether the terminal (1) has passed the inspection. A step of judging pass / fail by referring to the inspection terminal list (18) to be shown; and (b) if the terminal (1) has passed the inspection for the security hole, the terminal (1) and the external network (200) And (c) restricting communication between the terminal (1) and the external network (200) if the terminal (1) does not pass a security hole inspection; and Performing the inspection, and registering the inspection result in the inspection terminal list (18).

  The step (a) includes the step (a1) of determining whether the terminal (1) has passed the inspection when a packet from the terminal (1) is detected.

  In the step (a), (a2) when receiving an inquiry from the router (10) that has detected the access request from the terminal (1) whether the terminal (1) has passed the inspection, Determining whether the terminal (1) has passed the test.

  The step (c) includes the step (c1) of automatically executing the inspection when the terminal (1) does not pass the inspection.

  The step (c) includes the step (c2) of notifying the terminal (1) to execute the inspection when the terminal (1) does not pass the inspection, and (c3) the terminal (1). And executing the inspection in response to the inspection execution request from

  The program of the present invention includes: (d) a step of notifying the terminal (1) to apply a security patch when the result of the inspection fails, and (e) the security patch from the terminal (1). If there is a request, a step of relaying communication between the terminal (1) and the security patch providing site (220) is further provided.

  It solves the problem that a terminal whose security hole is not blocked continues to be used on the network without preparing a special device or program on the terminal side.

Hereinafter, a first embodiment of the present invention will be described with reference to the accompanying drawings.
As shown in FIG. 1, the security management system of the present invention is intended for communication between an internal network 100 and an external network 200.
The internal network 100 includes a terminal 1 and a relay device 10. A terminal 1 (-i, i = 1 to n: n is the number of terminals) is a communication terminal including various PCs (computers). The relay device 10 is a relay device that relays communication between the terminal 1 and the external network 200. Note that the telecommunication circuit (communication network) in the present invention may be wired or wireless.

  The relay apparatus 10 of the present invention includes a routing processing unit 11, a proxy processing unit 12, an inspection terminal list management unit 13, an HTTP communication unit 14, and an inspection execution unit 15.

  The routing processing unit 11 performs routing with reference to the routing table 17. The routing table 17 of the present invention prohibits access from the external network 200 and prohibits the subordinate (internal network 100) terminal 1 from directly connecting to the external network 200.

  The proxy processing unit 12 performs a normal proxy operation. That is, instead of the terminal 1 of the internal network 100 that cannot be directly connected to the external network 200, the connection to the external network 200 is performed as a “proxy”. For this reason, it has a global address for the external network 200 and a private address for the internal network 100. This global address is permitted to access the external network 200 by the routing table 17. The subordinate terminal 1 accesses the proxy processing unit 12 and accesses the external network 200 via the proxy processing unit 12. When the proxy processing unit 12 detects an access request from the subordinate terminal 1 to the external network 200, the proxy processing unit 12 inquires of the inspection terminal list management unit 13 whether or not the terminal 1 is registered in the list. For example, the access to the external network 200 is relayed. If not registered, access to the external network 200 is rejected.

  The inspection terminal list management unit 13 refers to the inspection terminal list 18 in which information for identifying the terminal 1 that has passed the inspection performed by the inspection execution unit 15 is registered. As information for identifying the terminal 1, an IP address or a MAC address can be considered.

  The HTTP communication unit 14 receives the address of the terminal 1 that is denied access to the external network 200 from the proxy processing unit 12, and notifies the terminal 1 of a message that prompts the terminal 1 to execute the inspection. In addition, the test execution operation from the terminal 1 is accepted and the test execution unit 15 is notified of the test execution. Furthermore, after the terminal 1 executes the inspection, the terminal 1 is notified of the inspection result. Here, an HTTP server is used as the HTTP communication unit 14, and the terminal 1 is notified by HTTP communication. However, actually, it is not limited to the HTTP server. Moreover, you may make it notify to the terminal 1 by communication other than HTTP. For example, notification to terminal 1 by e-mail, instant messenger, chat, error display of OS or communication application, voice notification by speaker of terminal 1, flashing of part of terminal 1 screen or light source device It is also possible to do. In addition, since it is only necessary to finally notify the user of the terminal 1, not only the terminal 1 itself but also other communication devices that can be used by the user of the terminal 1, such as a mobile phone of the user of the terminal 1, are notified. Anyway. In this case, the HTTP communication unit 14 has information regarding a communication device that is a notification destination.

  The inspection execution unit 15 inspects the terminal 1 that has requested access to the external network 200 for the presence or absence of a security hole, and if all of the inspected security holes are taken, the inspection is accepted. Then, the terminal 1 that has passed the inspection is registered in the inspection terminal list 18.

  Furthermore, the relay apparatus 10 of the present invention may include an inspection definition information management unit 16. The inspection definition information management unit 16 manages the inspection definition information 19 for the inspection performed by the inspection execution unit 15. Also, the latest examination definition information 19 is acquired from the examination definition information providing site 210 of the external network 200. When the inspection execution unit 15 acquires the inspection definition information directly from the external network and performs the inspection, the inspection definition information management unit 16 is not required in the relay device 10.

  About the inspection method of the presence or absence of security holes, it is a method to inspect by checking whether the ports that are not permitted to all ports are open by the conventionally known “Port Scan”, or the inspection Based on information on the latest security hole recorded in the definition information 19, a method of attempting an attack / entry that can be a security hole for a related port, or a test using a dedicated network vulnerability inspection tool A method is conceivable. In addition to these, it is possible to use existing security hole inspection methods. That is, the security inspection method according to the present invention may be any method that inspects the security hole of “terminal 1” that has made a connection request to the external network 200 from the “relay device 10” side.

  The routing processing unit 11, the proxy processing unit 12, the inspection terminal list management unit 13, the HTTP communication unit 14, the inspection execution unit 15, and the inspection definition information management unit 16 may be programs. By causing the general computer to execute the program, it can be used as the relay device 10 of the present invention.

The operation of the proxy processing unit 12 will be described below.
When each of the terminals 1 of the internal network 100 accesses the external site 230 of the external network 200 by communication, in the present invention, communication is directly performed from the terminal 1 to the external network 200 by the definition of the routing table 17. Therefore, access is always made via the proxy processing unit 12.
When there is access from the terminal 1 to the external site 230 of the external network 200, the proxy processing unit 12 operates in the following steps. Here, when making an inquiry to the inspection terminal list management unit 13, the IP address information of the transmission source (terminal 1) is passed to the inspection list management unit as information for identifying the terminal 1. The redirect operation to the HTTP communication unit 14 is, for example, in response to an access request from the terminal 1 in response to a response code 302 (Moved Temporary (changed to 307 in HTTP 1.1)). This is realized by notifying Uniform Resource Locator).
The terminal 1 that has already passed the inspection is communicated with the external site 230 of the external network 200 by a normal proxy operation. Also, when relaying access to the security patch application site, access by normal proxy operation is permitted regardless of whether the inspection is successful or not.

FIG. 2 shows a flowchart of the operation of the proxy processing unit 12.
(1) Step S101
When there is an access from the terminal 1 of the internal network 100 to the external site 230 of the external network 200, the proxy processing unit 12 determines whether the access is to the security patch application site. When accessing a security patch application site, the normal proxy operation is executed. If there is no access from the terminal 1 to the external site 230 of the external network 200, collation with the inspection terminal list 18 is executed.
(2) Step S102
The proxy processing unit 12 inquires of the inspection terminal list management unit 13 about the inspection result of the terminal 1.
When determining whether to permit access relaying regardless of whether the access is to the security patch application site, if there is an access from the terminal 1 to the external site 230 of the external network 200, the previous operation (step S101) is not performed, and this operation (step S102) is started.
(3) Step S103
The proxy processing unit 12 refers to the inspection result and confirms whether the terminal 1 has passed the inspection. At this time, the proxy processing unit 12 refers to the inspection terminal list 18 and acquires information regarding the pass / fail of the inspection of the terminal 1. If only the terminal 1 that has passed the inspection is registered in the inspection terminal list 18, it is determined that the terminal 1 registered in the inspection terminal list 18 has passed the inspection.
(4) Step S104
If the inspection has not passed, the proxy processing unit 12 performs redirection to the HTTP communication unit 14. Redirection is to change the input source and output destination of a program to something different from usual.
(5) Step S105
When the terminal 1 has passed the inspection, the proxy processing unit 12 performs a normal proxy operation and relays access from the terminal 1 to the external site 230 of the external network 200.

3 and 4 show the configuration of the inspection terminal list 18.
FIG. 3 shows an inspection terminal list 18 in a case where the inspection results for all inspection items are collected and managed for three terminals. FIG. 4 shows an inspection terminal list 18 in the case where port scanning and two vulnerabilities are inspected for three terminals, and inspection results are managed for each inspection item.
Here, the inspection terminal list 18 uses a MAC address (Media Access Control address) as information for identifying the terminal 1. This is because the IP address may change when the terminal 1 uses DHCP (Dynamic Host Configuration Protocol), and the terminal 1 can be uniquely identified even in a network where IPv4 / IPv6 coexists. It is. However, actually, it is not limited to the MAC address. Instead of the MAC address, information that can uniquely identify the terminal 1 may be used. For example, a combination of the name of the terminal 1 and information of the network to which the terminal 1 belongs and login information (ID, password) with the administrator authority of the terminal 1 can be used as the identification information.

FIG. 5 shows a flowchart of the operation of the inspection terminal list management unit 13.
When the inspection terminal list management unit 13 receives an inquiry about the inspection result from the proxy processing unit 12, the inspection terminal list management unit 13 performs the following operation.
(1) Step S201
The examination list management unit acquires the MAC address of the terminal 1 that uses the IP address for which the inquiry has been received.
(2) Step S202
The inspection list management unit searches whether the acquired MAC address is in the inspection terminal list 18.
(3) Step S203
If the acquired MAC address is not in the inspection terminal list 18, the inspection list management unit notifies the proxy processing unit 12 of the inspection result as “failed”.
(4) Step S204
If the acquired MAC address is in the inspection terminal list 18, the inspection list management unit further searches whether the inspection performed by the inspection execution unit 15 has passed. If the inspection has not passed, the proxy processing unit 12 is notified of the inspection result as “failed”.
(5) Step S205
If the inspection is passed, the proxy processing unit 12 is notified that the inspection result is “pass”.

  Here, if only the terminal 1 that has passed the inspection performed by the inspection execution unit 15 is registered in the inspection terminal list 18, “pass” if it is in the inspection terminal list 18, and “ It becomes possible to determine “fail”.

  An access request from the terminal 1 that is not registered in the inspection terminal list 18 or whose inspection result is recorded as “failed” is returned to the terminal 1 as a response of the response code 302 in the case of an HTTP request, for example. When the terminal 1 receives the response of the response code 302, it makes an HTTP request to the URL of the HTTP communication unit 14 included in the response. This URL is a URL that provides information for performing security hole inspection. For example, as shown in FIG. 6, a button for “execute security inspection” is displayed on the browser of the terminal 1. When a button for “execute security inspection” is pressed on the browser of the terminal 1, the HTTP communication unit 14 instructs the inspection execution unit 15 to execute the security inspection of the terminal 1.

  When the inspection execution unit 15 receives the security inspection execution instruction from the HTTP communication unit 14, the inspection execution unit 15 executes a security inspection for the IP address included in the instruction. As a security inspection means, it is possible to use a conventional method for performing a security inspection from outside the terminal 1 to be audited by a security audit service or the like. For example, a method combining inspection by port scan and vulnerability inspection for a network service is conceivable.

  In the inspection by the port scan, the inspection execution unit 15 holds a list of TCP / UDP port numbers that are permitted to be used in the terminal 1, and inspects the usage status of all the terminals 1 or a port that can be a security hole. This is an inspection that fails the inspection when an unauthorized port number is used. The inspection process for all TCP ports of the terminal 1 is as follows.

FIG. 7 shows a flowchart of the operation of the inspection execution unit 15.
(1) Step S301
The inspection execution unit 15 sets an initial value. For example, the port number is set to p, and the value of p is set to 1 first.
(2) Step S302
The inspection execution unit 15 determines whether the value of p exceeds a predetermined value (for example, 65535). If p exceeds a predetermined value (for example, 65535), the inspection is terminated.
(3) Step S303
If p is equal to or smaller than a predetermined value (for example, 65535), the test execution unit 15 determines whether a port corresponding to the value of p (hereinafter, port p) is a non-permitted port.
(4) Step S304
If the port p is not a non-permitted port, the test execution unit 15 increments the value of p by 1 and determines whether the value of p after the increase exceeds a predetermined value (for example, 65535). .
(5) Step S305
If the port p is a non-permitted port, the inspection execution unit 15 transmits a SYN packet to the port p.
(6) Step S306
The inspection execution unit 15 determines whether or not an ACK packet is returned for the transmitted SYN packet. That is, it is determined whether an ACK packet has been received. If an ACK packet has not been received, the test execution unit 15 increments the value of p by 1 and determines whether the value of p after the increase exceeds a predetermined value (for example, 65535).
(7) Step S307
If the ACK packet is received, the inspection execution unit 15 rejects the inspection result. Here, if even one port fails, the inspection is terminated, but it may be recorded that the inspected port is unacceptable and the inspection is continued for all the ports as they are.

  In the vulnerability test for network services, the port that is permitted to be used on the terminal 1 is accessed for checking the vulnerability, and when there is a vulnerability, the test is rejected. It is an inspection. In the vulnerability inspection, first, the latest inspection definition information 19 is acquired from the database managed by the inspection definition information providing site 210.

FIG. 8 shows an example of the inspection definition information 19.
The inspection definition information 19 includes a protocol, a port number, inspection transmission information, normal reception information, abnormal reception information, and a mismatch inspection result.
The transmission information for inspection includes transmission data whose response changes depending on the presence or absence of vulnerability. The normal-time reception information and the abnormal-time reception information describe a pattern of received data that the terminal 1 that has received the inspection transmission information returns to the inspection execution unit 15. At this time, the pattern to be described may be an entire data pattern or a characteristic partial pattern of data. If the terminal 1 has been subjected to countermeasures for vulnerability, such as by applying a security patch, the normal-time reception information is returned from the terminal 1. On the other hand, if vulnerability countermeasures are not implemented, the reception information at the time of abnormality is returned. The mismatch test result is information that defines a test result when the reception information returned from the terminal 1 does not match either the normal reception information or the abnormal reception information.

FIG. 9 shows a vulnerability check for a network service by each check definition information.
(1) Step S401
The inspection execution unit 15 transmits inspection transmission information to the terminal 1.
(2) Step S402
The inspection execution unit 15 confirms whether there is a response from the terminal 1.
(3) Step S403
When there is a response, the inspection execution unit 15 compares it with the reception information at the time of abnormality.
(4) Step S404
The inspection execution unit 15 rejects the inspection result if the response matches the abnormal reception information.
(5) Step S405
If the response does not match the abnormal reception information, the inspection execution unit 15 compares the normal reception information. If the response matches the received information when normal, the inspection result is accepted.
(6) Step S406
If the response does not match the normal reception information, the inspection execution unit 15 confirms whether or not the inspection result at the time of mismatch is acceptable. If the inspection result at the time of mismatch is unacceptable, the inspection result is rejected.
(7) Step S407
The inspection execution unit 15 accepts the inspection result if the inspection result at the time of mismatch is acceptable.

  The result of the security inspection executed by the inspection execution unit 15 is returned to the HTTP communication unit 14 and simultaneously notified to the inspection terminal list management unit 13. The inspection terminal list management unit 13 reflects the inspection result received from the inspection execution unit 15 in the inspection terminal list 18.

  When the HTTP communication unit 14 receives the test result from the test execution unit 15, the HTTP communication unit 14 updates the browser display according to the pass / fail of the test. FIG. 10 is an example in the case where the security inspection is acceptable, and FIG. 11 is an example in the case where the security inspection is unacceptable (when a vulnerability is found).

  When the security inspection is passed, “passed” is registered in the inspection terminal list 18, so that it is possible to access the external site 230 of the external network 200 from the next access. If the security inspection fails, for example, if a vulnerability is found, a link to the security patch providing site 220 is displayed on the browser, and the application of the security patch is prompted. At this time, since “fail” is registered in the inspection terminal list 18, access to other than the security patch providing site 220 is not permitted.

As another embodiment of the present invention, the following two methods are conceivable.
(A) Expansion of inspection terminal list 18 (b) Cooperation between inspection terminal list management unit 13 and routing processing unit 11

The expansion of the inspection terminal list 18 will be described.
For example, when the OS of the terminal 1 is reinstalled, the state returns to a state where security hole countermeasures are not taken, but since the inspection terminal list 18 remains in a state of passing inspection, the security hole is not blocked. The terminal 1 will communicate with the external network 200.
In order to cope with this, in the inspection terminal list 18, by registering the browser version information together with the MAC address and managing the terminal 1, the presence or absence of reinstallation of the OS is detected, and re-inspection is executed Is possible.
FIG. 12 shows an example of an inspection terminal list to which browser version information is added when the results of all inspection items are collected and managed.

The cooperation between the inspection terminal list management unit 13 and the routing processing unit 11 will be described.
By coordinating the inspection terminal list management unit 13 and the routing processing unit 11, communication of various standards (protocols) can be controlled.
First, the initial setting of the routing table 17 is set so that communication via the routers of all the terminals 1 is “not permitted”. Next, when communication from the terminal 1 to the external site 230 of the external network 200 is executed, the routing processing unit 11 inquires of the inspection list management unit about the inspection result. Then, only when the inspection result is “pass”, only the terminal 1 is updated to the “permitted” state in the routing table 17 and the routing process is executed.

FIG. 13 shows a flowchart of the above operation.
(1) Step 501
The routing processing unit 11 confirms whether the terminal 1 address has been registered in the routing table 17. If registered, normal routing operation is executed.
(2) Step 502
If not registered, the routing processing unit 11 inquires of the inspection terminal list management unit 13 about the inspection result of the terminal 1.
(3) Step 503
The inspection terminal list management unit 13 refers to the inspection result, confirms the pass / fail of the security inspection of the terminal 1, and notifies the routing processing unit 11 of information regarding the pass / fail.
(4) Step 504
If the terminal 1 fails the inspection, the routing processing unit 11 rejects the routing operation.
(5) Step 505
If the terminal 1 passes the inspection, the routing processing unit 11 registers the address (IP address, MAC address) of the terminal 1 in the routing table 17.
(6) Step 506
The routing processing unit 11 executes the normal routing operation after registering the address of the terminal 1 in the routing table 17.

When DHCP is used in the internal network 100, the IP address of the terminal 1 is changed every time the external site 200 of the external network 200 is accessed. This case can be dealt with by any of the following methods.
(A) After the routing table 17 is updated to the “permitted” state, the state is returned to the “nonpermitted” state after a predetermined time has elapsed. When communication to the external site 230 of the external network 200 occurs after returning to “not permitted”, the inspection result is again inquired of the inspection terminal list 18.
(B) For communication from the terminal 1 to the external site 230 of the external network 200, each time communication occurs, the inspection result is inquired of the inspection terminal list 18 to determine whether or not routing is possible, and only when it passes. Perform routing processing.

The overall operation of the security management system of the present invention will be described in detail below.
FIG. 14A and FIG. 14B show sequence diagrams of operations when the terminal is a newly connected terminal and it is determined that the test is successful.
(1) Step S601
The terminal 1 transmits an access request to the proxy processing unit 12 in order to access the external site 230.
(2) Step S602
The proxy processing unit 12 transmits a test result acquisition request to the test terminal list management unit 13 in order to check the security test result of the terminal 1.
(3) Step S603
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is a newly connected terminal and is not registered in the inspection terminal list 18.
(4) Step S604
The inspection terminal list management unit 13 notifies the proxy processing unit 12 that the inspection result is unacceptable.
(5) Step S605
The proxy processing unit 12 transmits a redirect response to the HTTP communication unit 14 to the terminal 1. In this embodiment, it is assumed that the HTTP communication unit 14 is an HTTP server.
(6) Step S606
The terminal 1 executes redirection to the HTTP communication unit 14 based on the redirect response to the HTTP communication unit 14 received from the proxy processing unit 12.
(7) Step S607
The HTTP communication unit 14 transmits an inspection Web page for security inspection to the terminal 1.
(8) Step S608
When an operation for executing inspection is performed in the terminal 1, a request for executing inspection is transmitted from the terminal 1 to the HTTP communication unit 14. Here, when the “execute inspection” button displayed on the inspection web page is pressed, it is determined that an operation for executing the inspection has been performed. However, actually, it is not necessary to display the “execute inspection” button, and it may be determined that an operation for executing the inspection is performed when a predetermined key of the terminal 1 is pressed.
(9) Step S609
When the HTTP communication unit 14 receives a test execution request from the terminal 1, the HTTP communication unit 14 instructs the test execution unit 15 to execute the test.
(10) Step S610
The inspection execution unit 15 executes a security inspection of the terminal 1.
(11) Step S611
The inspection execution unit 15 transmits a request for registration of the inspection result to the inspection terminal list management unit 13 when the result of the security inspection of the terminal 1 is acceptable. That is, it requests to register that the terminal 1 is passed in the inspection terminal list 18. In the case of a system in which only terminals that pass the inspection are registered in the inspection terminal list 18, the identification information of the terminal 1 is added to the inspection terminal list 18.
(12) Step S612
Moreover, the test | inspection execution part 15 notifies that the test result is a pass to the HTTP communication part 14, when the result of the security test of the terminal 1 is a pass.
(13) Step S613
The HTTP communication unit 14 transmits, to the terminal 1, a notification web page indicating that the inspection result is acceptable.
(14) Step S614
The terminal 1 transmits an access request to the proxy processing unit 12 in order to access the external site 230.
(15) Step S615
The proxy processing unit 12 transmits a test result acquisition request to the test terminal list management unit 13 in order to check the security test result of the terminal 1.
(16) Step S616
Since the terminal 1 has already been registered in the inspection terminal list 18, the inspection terminal list management unit 13 passes the inspection result.
(17) Step S617
The inspection terminal list management unit 13 notifies the proxy processing unit 12 that the inspection result is acceptable.
(18) Step S618
The proxy processing unit 12 performs proxy access to the external site 230 in order to mediate access from the terminal 1 to the external site 230.
(19) Step S619
The external site 230 transmits a response to access to the proxy processing unit 12.
(20) Step S620
The proxy processing unit 12 transmits a response to access from the external site 230 to the terminal 1. That is, the proxy processing unit 12 makes a proxy response to the terminal 1 instead of the external site 230.

FIG. 15A and FIG. 15B show sequence diagrams of operations when the terminal is a newly connected terminal and it is determined that the terminal is rejected by inspection execution.
(1) Step S701
The terminal 1 transmits an access request to the proxy processing unit 12 in order to access the external site 230.
(2) Step S702
The proxy processing unit 12 transmits a test result acquisition request to the test terminal list management unit 13 in order to check the security test result of the terminal 1.
(3) Step S703
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is a newly connected terminal and is not registered in the inspection terminal list 18.
(4) Step S704
The inspection terminal list management unit 13 notifies the proxy processing unit 12 that the inspection result is unacceptable.
(5) Step S705
The proxy processing unit 12 transmits a redirect response to the HTTP communication unit 14 to the terminal 1. In this embodiment, it is assumed that the HTTP communication unit 14 is an HTTP server.
(6) Step S706
The terminal 1 executes redirection to the HTTP communication unit 14 based on the redirect response to the HTTP communication unit 14 received from the proxy processing unit 12.
(7) Step S707
The HTTP communication unit 14 transmits an inspection Web page for security inspection to the terminal 1.
(8) Step S708
When an operation for executing inspection is performed in the terminal 1, a request for executing inspection is transmitted from the terminal 1 to the HTTP communication unit 14. Here, when the “execute inspection” button displayed on the inspection web page is pressed, it is determined that an operation for executing the inspection has been performed. However, actually, it is not necessary to display the “execute inspection” button, and it may be determined that an operation for executing the inspection is performed when a predetermined key of the terminal 1 is pressed.
(9) Step S709
When the HTTP communication unit 14 receives a test execution request from the terminal 1, the HTTP communication unit 14 instructs the test execution unit 15 to execute the test.
(10) Step S710
The inspection execution unit 15 executes a security inspection of the terminal 1.
(11) Step S711
When the result of the security inspection of the terminal 1 is unacceptable, the inspection execution unit 15 transmits a request for registering the inspection result to the inspection terminal list management unit 13. That is, it requests to register in the inspection terminal list 18 that the terminal 1 has failed. In the case of a system in which only terminals that pass the inspection are registered in the inspection terminal list 18, nothing is performed.
(12) Step S712
Moreover, the test | inspection execution part 15 notifies that the test result is unsuccessful to the HTTP communication part 14, when the result of the security test of the terminal 1 is unsuccessful.
(13) Step S713
The HTTP communication unit 14 transmits to the terminal 1 a notification web page indicating that the test result is unacceptable. At this time, the URL information of the security patch providing site 220 is also provided. For example, a link to the security patch providing site 220 is added to the notification web page.
(14) Step S714
The terminal 1 transmits an access request to the proxy processing unit 12 in order to access the security patch providing site 220.
(15) Step S715
The proxy processing unit 12 performs proxy access to the security patch providing site 220 to mediate access from the terminal 1 to the security patch providing site 220. Only when the terminal 1 accesses the security patch providing site 220, the security check is not performed.
(16) Step S716
The security patch providing site 220 transmits a response to access to the proxy processing unit 12.
(17) Step S717
The proxy processing unit 12 transmits a response to the access from the security patch providing site 220 to the terminal 1. That is, the proxy processing unit 12 sends a proxy response to the terminal 1 instead of the security patch providing site 220.
(18) Step S718
The terminal 1 transmits a patch acquisition request to the proxy processing unit 12 in order to make a patch acquisition request to the security patch providing site 220.
(19) Step S719
The proxy processing unit 12 performs proxy access to the external site 230 to mediate a patch acquisition request from the terminal 1 to the security patch providing site 220.
(20) Step S720
The external site 230 transmits a response to access to the proxy processing unit 12.
(21) Step S721
The proxy processing unit 12 transmits a response to the access from the security patch providing site 220 to the terminal 1. That is, the proxy processing unit 12 sends a proxy response to the terminal 1 instead of the security patch providing site 220.
Since this response is a response to a patch acquisition request to the security patch providing site 220, the patch is included, and the terminal 1 downloads the patch.

  14A and B, except that the terminal 1 is a terminal that has failed the inspection and is determined to have passed by the inspection execution, except that the corresponding terminal is previously registered as “failed” in the inspection terminal list 18. It becomes the sequence of.

  15A and 15B, except that the terminal 1 is a terminal terminal that has failed the inspection and is determined to be unsuccessful by the inspection execution, except that the corresponding terminal is previously registered as “failed” in the inspection terminal list 18. Is the same sequence as

  When the terminal 1 is an inspection-passed terminal, the second access sequence to the external site in the sequence of FIGS. 14A and 14B, that is, the sequence after step S614 is the same.

  In the above description, when the terminal 1 fails the security check, the relay device 10 notifies the terminal 1 and the security patch is applied on the terminal 1 side. However, in practice, the relay device 10 can automatically apply a security patch to the terminal 1. In this case, after confirming that the security patch has been applied to the terminal 1, it is registered in the inspection terminal list 18. Note that after the confirmation, the security inspection may be performed again.

  As another method, it is conceivable to block communication using the corresponding port from the terminal 1 in which the security hole is found for the specific port. Alternatively, communication of application software that uses the corresponding port is blocked. Note that port information and application software information are included in the communication packet. The relay device 10 refers to the communication packet and determines to block these communications.

Below, 2nd Embodiment of this invention is described with reference to an accompanying drawing.
Here, a case where the proxy processing unit 12 provides an inspection Web page will be described. The difference from the first embodiment is that the HTTP communication unit 14 is not provided.
As illustrated in FIG. 16, the relay device 10 according to the present embodiment includes a routing processing unit 11, a proxy processing unit 12, an inspection terminal list management unit 13, and an inspection execution unit 15. In the present embodiment, the proxy processing unit 12 further has the function of the HTTP communication unit 14 of FIG.

17A and 17B show sequence diagrams of the operation of the present embodiment.
The present embodiment is a configuration example in which the function of the HTTP communication unit 14 (examination Web page presentation function) is integrated into the proxy processing unit 12. Here, a sequence in a case where the terminal 1 is a newly connected terminal and is determined to be passed by the inspection execution is shown. Other than the web page presentation sequence to the terminal 1, it is the same as in the first embodiment.
(1) Step S801
The terminal 1 transmits an access request to the proxy processing unit 12 in order to access the external site 230.
(2) Step S802
The proxy processing unit 12 transmits a test result acquisition request to the test terminal list management unit 13 in order to check the security test result of the terminal 1.
(3) Step S803
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is a newly connected terminal and is not registered in the inspection terminal list 18.
(4) Step S804
The inspection terminal list management unit 13 notifies the proxy processing unit 12 that the inspection result is unacceptable.
(5) Step S805
The proxy processing unit 12 transmits an inspection Web page for security inspection to the terminal 1.
(6) Step S806
When an operation for executing inspection is performed in the terminal 1, a request for executing inspection is transmitted from the terminal 1 to the proxy processing unit 12. Here, when the “execute inspection” button displayed on the inspection web page is pressed, it is determined that an operation for executing the inspection has been performed. However, actually, it is not necessary to display the “execute inspection” button, and it may be determined that an operation for executing the inspection is performed when a predetermined key of the terminal 1 is pressed.
(7) Step S807
When the proxy processing unit 12 receives an inspection execution request from the terminal 1, the proxy processing unit 12 instructs the inspection execution unit 15 to execute the inspection.
(8) Step S808
The inspection execution unit 15 executes a security inspection of the terminal 1.
(9) Step S809
The inspection execution unit 15 transmits a request for registration of the inspection result to the inspection terminal list management unit 13 when the result of the security inspection of the terminal 1 is acceptable. That is, it requests to register that the terminal 1 is passed in the inspection terminal list 18. In the case of a system in which only terminals that pass the inspection are registered in the inspection terminal list 18, the identification information of the terminal 1 is added to the inspection terminal list 18.
(10) Step S810
Moreover, when the result of the security inspection of the terminal 1 is acceptable, the inspection execution unit 15 notifies the proxy processing unit 12 that the inspection result is acceptable.
(11) Step S811
The proxy processing unit 12 transmits to the terminal 1 a notification web page indicating that the inspection result is acceptable.
(12) Step S812
The terminal 1 transmits an access request to the proxy processing unit 12 in order to access the external site 230.
(13) Step S813
The proxy processing unit 12 transmits a test result acquisition request to the test terminal list management unit 13 in order to check the security test result of the terminal 1.
(14) Step S814
Since the terminal 1 has already been registered in the inspection terminal list 18, the inspection terminal list management unit 13 passes the inspection result.
(15) Step S815
The inspection terminal list management unit 13 notifies the proxy processing unit 12 that the inspection result is acceptable.
(16) Step S816
The proxy processing unit 12 performs proxy access to the external site 230 in order to mediate access from the terminal 1 to the external site 230.
(17) Step S817
The external site 230 transmits a response to access to the proxy processing unit 12.
(18) Step S818
The proxy processing unit 12 transmits a response to access from the external site 230 to the terminal 1. That is, the proxy processing unit 12 makes a proxy response to the terminal 1 instead of the external site 230.

Below, 3rd Embodiment of this invention is described with reference to an accompanying drawing.
In the present embodiment, a protocol that does not pass through the proxy processing unit 12 is also targeted. As an example, a case in which ICMP (Internet Control Message Protocol) is used will be described. ICMP is a protocol for transferring IP error messages and control messages.
The configuration of the security management system of this embodiment is the same as that of the first embodiment shown in FIG.

  Here, a sequence for performing communication with an external site using a protocol other than HTTP communication is shown. Since the sequence at the time of HTTP communication and the sequence for executing the inspection are triggered by the HTTP communication from the terminal 1, they are the same as those in the first embodiment.

  The parameters of the ICMP packet when the routing is not executed are, for example, Type value = 3 (Destination Unreachable), Code value = 11 (Communication with Destination Network is Adjointly Optimized).

  After receiving the ICMP response, the terminal 1 can also indicate to the user that it cannot communicate with the external network.

FIG. 18 shows a sequence diagram when the terminal 1 is a newly connected terminal.
(1) Step S901
The terminal 1 transmits an access request to the routing processing unit 11 in order to access the external site 230 using a protocol other than HTTP.
(2) Step S902
The routing processing unit 11 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1.
(3) Step S903
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is a newly connected terminal and is not registered in the inspection terminal list 18.
(4) Step S904
The inspection terminal list management unit 13 notifies the routing processing unit 11 that the inspection result is unacceptable.
(5) Step S905
The routing processing unit 11 transmits to the terminal 1 an ICMP response indicating that routing is not performed.

FIG. 19 shows a sequence diagram in the case where the terminal 1 is an inspection-failed terminal.
(1) Step S1001
The terminal 1 transmits an access request to the routing processing unit 11 in order to access the external site 230 using a protocol other than HTTP.
(2) Step S1002
The routing processing unit 11 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1.
(3) Step S1003
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is an inspection failure terminal and is not registered in the inspection terminal list 18 or is registered as being unacceptable.
(4) Step S1004
The inspection terminal list management unit 13 notifies the routing processing unit 11 that the inspection result is unacceptable.
(5) Step S1005
The routing processing unit 11 transmits to the terminal 1 an ICMP response indicating that routing is not performed.

FIG. 20 shows a sequence diagram when the terminal 1 is an inspection-passed terminal.
(1) Step S1101
The terminal 1 transmits an access request to the routing processing unit 11 in order to access the external site 230 using a protocol other than HTTP.
(2) Step S1102
The routing processing unit 11 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1.
(3) Step S1103
The inspection terminal list management unit 13 sets the inspection result as acceptable because the terminal 1 is a terminal that has passed the inspection and the inspection terminal list 18 has been registered as passing.
(4) Step S1104
The inspection terminal list management unit 13 notifies the routing processing unit 11 that the inspection result is acceptable.
(5) Step S1105
The routing processing unit 11 performs routing and accesses the external site 230.
(6) Step S1106
The routing processing unit 11 relays the response from the external site 230 and transmits the response to the terminal 1.

Below, 4th Embodiment of this invention is described with reference to an accompanying drawing.
In this embodiment, an instant message (IM) is used.
When the IM function capable of P2P communication is implemented in the terminal 1, the same IM function is also implemented in the relay device 10 to notify the terminal 1 by IM in addition to the ICMP response in the third embodiment. Thus, a message can be presented to the user. As a function of IM, when there is a function of starting a browser directly from a URL included in a message and referring to the corresponding URL, it is possible to display an inspection Web page directly from the IM message.

  The relay apparatus 10 of this embodiment has a configuration in which an IM communication unit 20 is added to the relay apparatus 10 of the first embodiment. The IM communication unit 20 communicates with the routing processing unit 11.

22A and 22B show sequence diagrams of operations when the terminal is a newly connected terminal and it is determined that the test is successful.
(1) Step S1201
The terminal 1 transmits an access request to the routing processing unit 11 in order to access the external site 230 using a protocol other than HTTP.
(2) Step S1202
The routing processing unit 11 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1.
(3) Step S1203
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is a newly connected terminal and is not registered in the inspection terminal list 18.
(4) Step S1204
The inspection terminal list management unit 13 notifies the routing processing unit 11 that the inspection result is unacceptable.
(5) Step S1205
The routing processing unit 11 transmits to the terminal 1 an ICMP response indicating that routing is not performed.
(6) Step S1206
The routing processing unit 11 transmits to the IM communication unit 20 an IM notification request indicating that the terminal 1 has failed.
(7) Step S1207
In response to the IM notification request, the IM communication unit 20 transmits an IM notification that fails the inspection to the terminal 1. This IM notification includes the URL of the inspection Web page.
(8) Step S1208
The terminal 1 refers to the URL of the inspection Web page included in the received IM notification. Reference to the URL includes clicking a link of the inspection Web page included in the IM notification.
(9) Step S1209
The terminal 1 accesses the inspection Web page managed by the HTTP communication unit 14 based on the URL of the referred inspection Web page.
(10) Step S1210
The HTTP communication unit 14 transmits an inspection Web page for security inspection to the terminal 1.
(11) Step S1211
When an operation for executing inspection is performed in the terminal 1, a request for executing inspection is transmitted from the terminal 1 to the HTTP communication unit 14. Here, when the “execute inspection” button displayed on the inspection web page is pressed, it is determined that an operation for executing the inspection has been performed. However, actually, it is not necessary to display the “execute inspection” button, and it may be determined that an operation for executing the inspection is performed when a predetermined key of the terminal 1 is pressed.
(12) Step S1212
When the HTTP communication unit 14 receives a test execution request from the terminal 1, the HTTP communication unit 14 instructs the test execution unit 15 to execute the test.
(13) Step S1213
The inspection execution unit 15 executes a security inspection of the terminal 1.
(14) Step S1214
The inspection execution unit 15 transmits a request for registration of the inspection result to the inspection terminal list management unit 13 when the result of the security inspection of the terminal 1 is acceptable. That is, it requests to register that the terminal 1 is passed in the inspection terminal list 18. In the case of a system in which only terminals that pass the inspection are registered in the inspection terminal list 18, the identification information of the terminal 1 is added to the inspection terminal list 18.
(15) Step S1215
Moreover, the test | inspection execution part 15 notifies that the test result is a pass to the HTTP communication part 14, when the result of the security test of the terminal 1 is a pass.
(16) Step S1216
The HTTP communication unit 14 transmits, to the terminal 1, a notification web page indicating that the inspection result is acceptable.
(17) Step S1217
The terminal 1 transmits an access request to the routing processing unit 11 in order to access the external site 230 using a protocol other than HTTP.
(18) Step S1218
The routing processing unit 11 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1.
(19) Step S1219
Since the terminal 1 has already been registered in the inspection terminal list 18, the inspection terminal list management unit 13 passes the inspection result.
(20) Step S1220
The inspection terminal list management unit 13 notifies the routing processing unit 11 that the inspection result is acceptable.
(21) Step S1221
The routing processing unit 11 accesses the external site 230 to mediate access from the terminal 1 to the external site 230.
(22) Step S1222
The external site 230 transmits a response to access to the routing processing unit 11, and the routing processing unit 11 transmits a response to access from the external site 230 to the terminal 1.

  If the terminal 1 is a newly connected terminal and is determined to be unacceptable as a result of the inspection execution, the sequence after “pressing the“ inspection execution ”button”, that is, the sequence from step S1211 is the same as in the first embodiment.

If the terminal 1 is a terminal that fails the inspection, “Send Web page for inspection”, that is, up to step S1210, is the same as the above-described sequence of the present embodiment. The sequence after S1211 is the same as that in the first embodiment. The inspection terminal list 18 registers that the corresponding terminal is unacceptable.
When the terminal 1 is an inspection pass terminal, it is the same as in the third embodiment.

Below, 5th Embodiment of this invention is described with reference to an accompanying drawing.
As shown in FIG. 23, the relay device 10 of the present embodiment has a configuration in which a terminal detection unit 21 is added to the relay device 10 of the fourth embodiment. That is, the relay apparatus 10 according to the first embodiment further includes an IM communication unit 20 and a terminal detection unit 21. The terminal detection unit 21 communicates with the inspection terminal list management unit 13.
In the present embodiment, when a new terminal is connected, an inspection is automatically performed and a notification is made by an instant message (IM). Here, focusing on the operation in which the terminal 1 detects an IP address of a communication destination by broadcasting an ARP (Address Resolution Protocol) packet, the terminal detection unit 21 monitors the ARP packet, and transmits the detected ARP packet. When the original terminal is not registered in the inspection terminal list 18 or fails, the security inspection is automatically executed. ARP is an address resolution protocol, and is a protocol used to obtain a physical address (MAC address) from an IP address in a TCP / IP network. Broadcasting means transmitting data to a large number of unspecified parties in the network. This is done by specifying a special address that signifies the entire network.

FIG. 24 shows a sequence in the case where the terminal 1 is a newly connected terminal and is determined to be passed by the inspection execution. In addition, the sequence diagram of the inspection failure terminal is the same as that of this newly connected terminal.
(1) Step S1301
Terminal 1 broadcasts an ARP packet.
(2) Step S1302
When the terminal detection unit 21 monitors the ARP packet and detects the ARP packet, the terminal detection unit 21 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1 that is the transmission source of the detected ARP packet. To do.
(3) Step S1303
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is a newly connected terminal and is not registered in the inspection terminal list 18.
(4) Step S1304
The inspection terminal list management unit 13 notifies the terminal detection unit 21 that the inspection result is unacceptable.
(5) Step S1305
When the inspection result of the terminal 1 is unacceptable, the terminal detection unit 21 instructs the inspection execution unit 15 to execute the inspection.
(6) Step S1306
The inspection execution unit 15 executes a security inspection of the terminal 1.
(7) Step S1307
The inspection execution unit 15 transmits a request for registration of the inspection result to the inspection terminal list management unit 13 when the result of the security inspection of the terminal 1 is acceptable. That is, it requests to register that the terminal 1 is passed in the inspection terminal list 18. In the case of a system in which only terminals that pass the inspection are registered in the inspection terminal list 18, the identification information of the terminal 1 is added to the inspection terminal list 18.
(8) Step S1308
Moreover, the test | inspection execution part 15 notifies that the test result is a pass to the terminal detection part 21, when the result of the security test | inspection of the terminal 1 is a pass.
(9) Step S1309
The terminal 1 transmits an access request to the proxy processing unit 12 in order to access the external site 230.
(10) Step S1310
The proxy processing unit 12 transmits a test result acquisition request to the test terminal list management unit 13 in order to check the security test result of the terminal 1.
(11) Step S1311
Since the terminal 1 has already been registered in the inspection terminal list 18, the inspection terminal list management unit 13 passes the inspection result.
(12) Step S1312
The inspection terminal list management unit 13 notifies the proxy processing unit 12 that the inspection result is acceptable.
(13) Step S1313
The proxy processing unit 12 performs proxy access to the external site 230 in order to mediate access from the terminal 1 to the external site 230.
(14) Step S1314
The external site 230 transmits a response to access to the proxy processing unit 12.
(15) Step S1315
The proxy processing unit 12 transmits a response to access from the external site 230 to the terminal 1. That is, the proxy processing unit 12 makes a proxy response to the terminal 1 instead of the external site 230.

FIGS. 25A and 25B show a sequence when the terminal 1 is a newly connected terminal and is determined to be unacceptable due to the inspection execution.
(1) Step S1401
Terminal 1 broadcasts an ARP packet.
(2) Step S1402
When the terminal detection unit 21 monitors the ARP packet and detects the ARP packet, the terminal detection unit 21 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1 that is the transmission source of the detected ARP packet. To do.
(3) Step S1403
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is a newly connected terminal and is not registered in the inspection terminal list 18.
(4) Step S1404
The inspection terminal list management unit 13 notifies the terminal detection unit 21 that the inspection result is unacceptable.
(5) Step S1405
When the inspection result of the terminal 1 is unacceptable, the terminal detection unit 21 instructs the inspection execution unit 15 to execute the inspection.
(6) Step S1406
The inspection execution unit 15 executes a security inspection of the terminal 1.
(7) Step S1407
When the result of the security inspection of the terminal 1 is unacceptable, the inspection execution unit 15 transmits a request for registering the inspection result to the inspection terminal list management unit 13. That is, it requests to register in the inspection terminal list 18 that the terminal 1 has failed. In the case of a system in which only terminals that pass the inspection are registered in the inspection terminal list 18, nothing is performed.
(8) Step S1408
Moreover, the test | inspection execution part 15 notifies that the test result is unsuccessful to the terminal detection part 21, when the result of the security test of the terminal 1 is unsuccessful.
(9) Step S1409
The terminal detection unit 21 transmits to the IM communication unit 20 an IM notification request for inspection failure for the terminal 1.
(10) Step S1410
In response to the IM notification request, the IM communication unit 20 transmits an IM notification that fails the inspection to the terminal 1. This IM notification includes the URL of the notification Web page indicating that the inspection result is unsuccessful, that is, the URL of the inspection result (failure) notification Web page.
(11) Step S1411
The terminal 1 refers to the URL of the inspection result (failure) notification Web page included in the received IM notification. Reference to the URL includes clicking a link of a Web page for inspection result (failure) notification included in the IM notification.
(12) Step S1412
The terminal 1 accesses the inspection result (failure) notification Web page managed by the terminal detection unit 21 based on the URL of the referred inspection result (failure) notification Web page.
(13) Step S1413
The terminal detection unit 21 transmits an inspection result (failure) notification Web page to the terminal 1. At this time, the URL information of the security patch providing site 220 is also provided. For example, a link to the security patch providing site 220 is added to the notification web page.
(14) Step S1414
The terminal 1 transmits an access request to the proxy processing unit 12 in order to access the security patch providing site 220.
(15) Step S1415
The proxy processing unit 12 performs proxy access to the security patch providing site 220 to mediate access from the terminal 1 to the security patch providing site 220. Only when the terminal 1 accesses the security patch providing site 220, the security check is not performed.
(16) Step S1416
The security patch providing site 220 transmits a response to access to the proxy processing unit 12.
(17) Step S1417
The proxy processing unit 12 transmits a response to the access from the security patch providing site 220 to the terminal 1. That is, the proxy processing unit 12 sends a proxy response to the terminal 1 instead of the security patch providing site 220.
(18) Step S1418
The terminal 1 transmits a patch acquisition request to the proxy processing unit 12 in order to make a patch acquisition request to the security patch providing site 220.
(19) Step S1419
The proxy processing unit 12 performs proxy access to the external site 230 to mediate a patch acquisition request from the terminal 1 to the security patch providing site 220.
(20) Step S1420
The external site 230 transmits a response to access to the proxy processing unit 12.
(21) Step S1421
The proxy processing unit 12 transmits a response to the access from the security patch providing site 220 to the terminal 1. That is, the proxy processing unit 12 sends a proxy response to the terminal 1 instead of the security patch providing site 220.
Since this response is a response to a patch acquisition request to the security patch providing site 220, the patch is included, and the terminal 1 downloads the patch.

FIG. 26 shows a sequence in the case where the terminal 1 is an inspection-passed terminal.
(1) Step S1501
Terminal 1 broadcasts an ARP packet.
(2) Step S1502
When the terminal detection unit 21 monitors the ARP packet and detects the ARP packet, the terminal detection unit 21 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1 that is the transmission source of the detected ARP packet. To do.
(3) Step S1503
The inspection terminal list management unit 13 sets the inspection result as acceptable because the terminal 1 is a terminal that has passed the inspection and the inspection terminal list 18 has been registered as passing.
(4) Step S1504
The inspection terminal list management unit 13 notifies the terminal detection unit 21 that the inspection result is acceptable.
(5) Step S1505
The terminal 1 transmits an access request to the proxy processing unit 12 in order to access the external site 230.
(6) Step S1506
The proxy processing unit 12 transmits a test result acquisition request to the test terminal list management unit 13 in order to check the security test result of the terminal 1.
(7) Step S1507
Since the terminal 1 has already been registered in the inspection terminal list 18, the inspection terminal list management unit 13 passes the inspection result.
(8) Step S1508
The inspection terminal list management unit 13 notifies the proxy processing unit 12 that the inspection result is acceptable.
(9) Step S1509
The proxy processing unit 12 performs proxy access to the external site 230 in order to mediate access from the terminal 1 to the external site 230.
(10) Step S1510
The external site 230 transmits a response to access to the proxy processing unit 12.
(11) Step S1511
The proxy processing unit 12 transmits a response to access from the external site 230 to the terminal 1. That is, the proxy processing unit 12 makes a proxy response to the terminal 1 instead of the external site 230.

The sixth embodiment of the present invention will be described below with reference to the accompanying drawings.
Here, a case where there are a plurality of relay apparatuses will be described. For example, in a corporate network, a plurality of relay devices may be used, such as a main router that is normally used and a subrouter that is used when the main router is abnormal.
At this time, as shown in FIG. 27, the security inspection function of the relay apparatus 10 of FIG. In FIG. 27, the relay device 10 includes a routing processing unit 11. The security inspection server 30 includes a proxy processing unit 12, an inspection terminal list management unit 13, an HTTP communication unit 14, and an inspection execution unit 15. The security inspection server 30 may include the inspection definition information management unit 16.

  Here, there are a plurality of relay apparatuses 10 (-i, i = 1 to n: n is the number of apparatuses), and each relay apparatus 10 includes a routing processing unit 11. Accordingly, there are a plurality of routing processing units 11 (-i, i = 1 to n). In FIG. 27, the 1st relay apparatus 10-1 and the 2nd relay apparatus 10-2 are shown as an example. The first relay device 10-1 is a relay device that is normally used, and the second relay device 10-2 is a backup relay device.

  The first relay device 10-1 and the second relay device 10-2 are, for example, routers, and relay communication between the terminal 1 and the external site 230 of the external network 200. The security inspection server 30 is connected to the first relay device 10-1 and the second relay device 10-2, confirms whether the terminal 1 has passed the security hole inspection, and obtains an inspection result (pass / fail of inspection). The notification based on this is transmitted to the first relay device 10-1, the second relay device 10-2, and the terminal 1. If the terminal 1 that has requested access to the external site 230 of the external network 200 has passed the inspection, the first relay device 10-1 and the second relay device 10-2 may correspond to the corresponding terminal 1 and the external network 200. The communication with the external site 230 is relayed.

  As an example of the security inspection server 30, a proxy server or a gateway server can be considered. In this case, when the terminal 1 makes an access request to the external network, first, the access request is transmitted to the security inspection server 30, and the security inspection server 30 transmits the access request from the terminal 1 to the relay device 10. If the terminal 1 has passed the inspection, the relay device 10 relays communication with the external network. That is, the security inspection server 30 is a relay device that relays communication between the terminal 1 and the relay device 10. However, in practice, the security inspection server 30 may be a monitoring server for monitoring communication between the terminal 1 and the relay device 10.

FIG. 28 shows a sequence when terminal 1 is a newly connected terminal and both first relay apparatus 10-1 and second relay apparatus 10-2 can be used.
(1) Step S1601
The terminal 1 transmits an access request to the routing processing unit 11-1 in order to access the external site 230 using a protocol other than HTTP.
(2) Step S1602
The routing processing unit 11-1 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1.
(3) Step S1603
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is an inspection failure terminal and is not registered in the inspection terminal list 18 or is registered as being unacceptable.
(4) Step S1604
The inspection terminal list management unit 13 notifies the routing processing unit 11-1 that the inspection result is unacceptable.
(5) Step S1605
The routing processing unit 11-1 transmits to the terminal 1 an ICMP response indicating that the routing is not executed.

FIG. 29 shows a sequence when terminal 1 is a newly connected terminal and first relay device 10-1 is down (stopped).
(1) Step S1701
The terminal 1 transmits an access request to the routing processing unit 11-1 in order to access the external site 230 using a protocol other than HTTP. Since the first relay device 10-1 is down, there is no response.
(2) Step S1702
The terminal 1 transmits an access request to the routing processing unit 11-2 instead of the routing processing unit 11-1.
(3) Step S1703
The routing processing unit 11-2 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1.
(4) Step S1704
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is an inspection failure terminal and is not registered in the inspection terminal list 18 or is registered as being unacceptable.
(5) Step S1705
The inspection terminal list management unit 13 notifies the routing processing unit 11-2 that the inspection result is unacceptable.
(6) Step S1706
The routing processing unit 11-2 transmits to the terminal 1 an ICMP response indicating that the routing is not executed.

FIG. 30 shows a sequence in a case where the terminal 1 is a test-passing terminal and both the first relay device 10-1 and the second relay device 10-2 can be used.
(1) Step S1801
The terminal 1 transmits an access request to the routing processing unit 11-1 in order to access the external site 230 using a protocol other than HTTP.
(2) Step S1802
The routing processing unit 11-1 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1.
(3) Step S1803
The inspection terminal list management unit 13 sets the inspection result as acceptable because the terminal 1 is a terminal that has passed the inspection and the inspection terminal list 18 has been registered as passing.
(4) Step S1804
The inspection terminal list management unit 13 notifies the routing processing unit 11-1 that the inspection result is acceptable.
(5) Step S1805
The routing processing unit 11-1 executes routing and accesses the external site 230.
(6) Step S1806
The routing processing unit 11-1 relays the response from the external site 230 and transmits the response to the terminal 1.

FIG. 31 shows a sequence in the case where the terminal 1 is a test-passed terminal and the first relay device 10-1 is down (stopped).
(1) Step S1901
The terminal 1 transmits an access request to the routing processing unit 11-1 in order to access the external site 230 using a protocol other than HTTP. Since the first relay device 10-1 is down, there is no response.
(2) Step S1902
The terminal 1 transmits an access request to the routing processing unit 11-2 instead of the routing processing unit 11-1.
(3) Step S1903
The routing processing unit 11-2 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1.
(4) Step S1904
The inspection terminal list management unit 13 sets the inspection result as acceptable because the terminal 1 is a terminal that has passed the inspection and the inspection terminal list 18 has been registered as passing.
(5) Step S1905
The inspection terminal list management unit 13 notifies the routing processing unit 11-2 that the inspection result is acceptable.
(6) Step S1906
The routing processing unit 11-2 executes routing and accesses the external site 230.
(7) Step S1907
The routing processing unit 11-2 relays the response from the external site 230 and transmits the response to the terminal 1.

  In the above sequence, when the terminal 1 communicates with the routing processing unit 11 (11-1, 11-2), the terminal 1 may pass through the proxy processing unit 12 of the security inspection server 30. At this time, the proxy processing unit 12 can also transmit an inspection result acquisition request to the inspection terminal list management unit 13 instead of the routing processing unit 11 (11-1, 11-2). Then, based on the acquired inspection result, the proxy processing unit 12 sends the routing processing unit 11 (11-1 or 11-2) in operation to the external network from the terminal 1 that has passed the inspection. Relay access requests.

In the present invention, the inspection definition information management unit 16 periodically accesses the inspection definition information providing site 210 independently from the security inspection sequence of the terminal 1, and the latest inspection is performed when the inspection definition information 19 is updated. Definition information 19 is downloaded. You may make it download by the method similar to the existing vulnerability inspection tool.
Hereinafter, an example of a sequence in which the inspection definition information management unit 16 acquires the latest inspection definition information 19 from the inspection definition information providing site 210 will be shown.

FIG. 32 shows a sequence when the inspection definition information providing site 210 determines the version and transmits / receives the inspection definition information 19.
(1) Step S2001
The inspection definition information management unit 16 transmits an inspection definition information acquisition request to the inspection definition information providing site 210 in order to acquire the latest inspection definition information 19. At this time, the inspection definition information 19 on the inspection definition information management unit 16 side is “definition version 10”, and the definition version information is added to the inspection definition information acquisition request.
(2) Step S2002
Since the version information notified by the examination definition information acquisition request received from the examination definition information management unit 16 is “definition version 10” and the current version is “definition version 11”, the examination definition information providing site 210 has The test definition information 19 of “definition version 11” which is the latest definition version is determined to be transmitted to the test definition information management unit 16.
(3) Step S2003
The examination definition information providing site 210 transmits the latest examination definition information 19 to the examination definition information management unit 16. The inspection definition information management unit 16 updates the inspection definition information 19 of “definition version 10” to the inspection definition information 19 of “definition version 11”.
(4) Step S2004
When a predetermined time has elapsed after the update, the test definition information management unit 16 transmits a test definition information acquisition request to the test definition information providing site 210 in order to newly acquire the latest test definition information 19. At this time, the inspection definition information 19 on the inspection definition information management unit 16 side is “definition version 11”.
(5) Step S2005
Since the version information notified by the examination definition information acquisition request received from the examination definition information management unit 16 is “definition version 11” and the current version is “definition version 11”, the examination definition information providing site 210 has The examination definition information management unit 16 determines that the latest examination definition information 19 has already been acquired.
(6) Step S2006
The examination definition information providing site 210 notifies the examination definition information management unit 16 that it is already the latest examination definition information 19.

FIG. 33 shows a sequence when the inspection definition information management unit 16 determines the version and transmits / receives the inspection definition information 19.
(1) Step S2101
The inspection definition information management unit 16 transmits an acquisition request for version information of the inspection definition information 19 to the inspection definition information providing site 210 in order to acquire the latest inspection definition information 19. At this time, the inspection definition information 19 on the inspection definition information management unit 16 side is “definition version 10”.
(2) Step S2102
Since the current version is “definition version 11”, the inspection definition information providing site 210 determines to notify the inspection definition information management unit 16 that the latest definition version is “definition version 11”.
(3) Step S2103
The inspection definition information providing site 210 transmits the version information of the inspection definition information 19 indicating that the latest definition version is “definition version 11” to the inspection definition information management unit 16.
(4) Step S2104
The inspection definition information management unit 16 determines to acquire the inspection definition information 19 of “definition version 11” which is the latest definition version, based on the version information of the inspection definition information 19 received from the inspection definition information providing site 210.
(5) Step S2105
The inspection definition information management unit 16 transmits an inspection definition information acquisition request to the inspection definition information providing site 210 in order to acquire the inspection definition information 19 of “definition version 11” which is the latest definition version.
(6) Step S2106
The inspection definition information providing site 210 transmits the inspection definition information 19 of “definition version 11” that is the latest definition version to the inspection definition information management unit 16 in response to the inspection definition information acquisition request received from the inspection definition information management unit 16. . The inspection definition information management unit 16 updates the inspection definition information 19 of “definition version 10” to the inspection definition information 19 of “definition version 11”.
(7) Step S2107
When a predetermined time has elapsed after the update, the examination definition information management unit 16 requests the examination definition information providing site 210 to obtain version information of the examination definition information 19 in order to newly obtain the latest examination definition information 19. Send. At this time, the inspection definition information 19 on the inspection definition information management unit 16 side is “definition version 11”.
(8) Step S2108
Since the current version is “definition version 11”, the inspection definition information providing site 210 determines to notify the inspection definition information management unit 16 that the latest definition version is “definition version 11”.
(9) Step S2109
The inspection definition information providing site 210 transmits the version information of the inspection definition information 19 indicating that the latest definition version is “definition version 11” to the inspection definition information management unit 16.
(10) Step S2110
The inspection definition information management unit 16 is already the latest definition version because the inspection definition information 19 on the inspection definition information management unit 16 side is “definition version 11” and the latest definition version is also “definition version 11”. Judge that, do nothing.

The seventh embodiment of the present invention will be described below with reference to the accompanying drawings.
As a possible network environment, a case where a terminal (for example, a file server (NAS)) installed on the internal network is accessed from a terminal on the internal network will be described.
As shown in FIG. 34, the network environment of this embodiment has a configuration in which the server 2 is added to the network environment of the fifth embodiment. The server 2 belongs to the internal network 100 under the relay device 10 as with the terminal 1.
At the same time that the IM communication unit 20 notifies the corresponding terminal 1 of IM (instant message) when the inspection of the terminal 1 fails, the identification information (MAC address etc.) of the terminal 1 and the pass / fail of the inspection are also sent to the server 2. Notify information. At this time, information (for example, the IP address of the server 2) necessary for the relay apparatus 10 to perform IM notification to the server 2 is set in the relay apparatus 10 in advance. With this operation, for example, an operation such as stopping the service provided by the server 2 can be performed on the terminal 1 that has failed the inspection. That is, it becomes possible to restrict the use of the internal network by the terminal that fails the inspection.

FIG. 35 shows a sequence in a case where the terminal 1 is a newly connected terminal and is determined to be passed by the inspection execution. In addition, the sequence diagram of the inspection failure terminal is the same as that of this newly connected terminal. In addition, the sequence for acquiring a security patch after the terminal is notified of the failure of the inspection is the same as in the fifth embodiment.
(1) Step S2201
Terminal 1 broadcasts an ARP packet.
(2) Step S2202
When the terminal detection unit 21 monitors the ARP packet and detects the ARP packet, the terminal detection unit 21 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1 that is the transmission source of the detected ARP packet. To do.
(3) Step S2203
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is a newly connected terminal and is not registered in the inspection terminal list 18.
(4) Step S2204
The inspection terminal list management unit 13 notifies the terminal detection unit 21 that the inspection result is unacceptable.
(5) Step S2205
When the inspection result of the terminal 1 is unacceptable, the terminal detection unit 21 instructs the inspection execution unit 15 to execute the inspection.
(6) Step S2206
The inspection execution unit 15 executes a security inspection of the terminal 1. In the security inspection, the presence or absence of security holes is inspected. If a security hole is not found in the port to be inspected, “pass”, and if a security hole is found, “fail”.
(7) Step S2207
The inspection execution unit 15 transmits a request for registration of the inspection result to the inspection terminal list management unit 13 when the result of the security inspection of the terminal 1 is acceptable. That is, it requests to register that the terminal 1 is passed in the inspection terminal list 18. In the case of a system in which only terminals that pass the inspection are registered in the inspection terminal list 18, the identification information of the terminal 1 is added to the inspection terminal list 18.
(8) Step S2208
Moreover, the test | inspection execution part 15 notifies that the test result is a pass to the terminal detection part 21, when the result of the security test | inspection of the terminal 1 is a pass.
(9) Step S2209
In response to the notification that the inspection result is acceptable, the terminal detection unit 21 requests the IM communication unit 20 to make an IM notification that the terminal 1 is “inspected” to the server 2.
(10) Step S2210
The IM communication unit 20 performs IM notification of “pass inspection” including identification information of the inspection pass terminal to the server 2.
(11) Step S2211
The server 2 performs processing for permitting access of the terminal notified from the IM communication unit 20. For example, the server 2 registers the notified terminal in the access-permitted terminal list inside the server 2.
(12) Step S2212
The terminal 1 accesses the server 2.
(13) Step S2213
The terminal 1 receives a normal response from the server 2.

FIG. 36 shows a sequence in the case where the terminal 1 is a newly connected terminal and is determined to be unacceptable due to inspection execution.
(1) Step S2301
Terminal 1 broadcasts an ARP packet.
(2) Step S2302
When the terminal detection unit 21 monitors the ARP packet and detects the ARP packet, the terminal detection unit 21 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1 that is the transmission source of the detected ARP packet. To do.
(3) Step S2303
The inspection terminal list management unit 13 rejects the inspection result because the terminal 1 is a newly connected terminal and is not registered in the inspection terminal list 18.
(4) Step S2304
The inspection terminal list management unit 13 notifies the terminal detection unit 21 that the inspection result is unacceptable.
(5) Step S2305
When the inspection result of the terminal 1 is unacceptable, the terminal detection unit 21 instructs the inspection execution unit 15 to execute the inspection.
(6) Step S2306
The inspection execution unit 15 executes a security inspection of the terminal 1. In the security inspection, the presence or absence of a security hole is inspected. If a security hole is not found in the port to be inspected, “pass”, and if a security hole is found, “fail”.
(7) Step S2307
When the result of the security inspection of the terminal 1 is unacceptable, the inspection execution unit 15 transmits a request for registering the inspection result to the inspection terminal list management unit 13. That is, it requests to register in the inspection terminal list 18 that the terminal 1 has failed. In the case of a system in which only terminals that pass the inspection are registered in the inspection terminal list 18, nothing is performed.
(8) Step S2308
Moreover, the test | inspection execution part 15 notifies that the test result is unsuccessful to the terminal detection part 21, when the result of the security test of the terminal 1 is unsuccessful.
(9) Step S2309
The terminal detection unit 21 transmits to the IM communication unit 20 an IM notification request for inspection failure for the terminal 1.
(10) Step S2310
In response to the IM notification request, the IM communication unit 20 transmits an IM notification that fails the inspection to the terminal 1. As in the case of the fifth embodiment, this IM notification may include the URL of the notification Web page indicating that the inspection result is unsuccessful, that is, the URL of the inspection result (failure) notification Web page.
(11) Step S2311
In response to the notification that the inspection result is unacceptable, the terminal detection unit 21 requests the server 2 to perform IM notification that the terminal 1 is “inspection failure” to the IM communication unit 20. .
(12) Step S2312
The IM communication unit 20 performs IM notification of “inspection failure” including identification information of the inspection failure terminal to the server 2.
(13) Step S2313
The server 2 performs processing for restricting access of the terminal notified from the IM communication unit 20. For example, the server 2 deletes the notified terminal from the access-permitted terminal list inside the server 2. Alternatively, the notified terminal is registered in the access denied terminal list inside the server 2.
(14) Step S2314
The terminal 1 accesses the server 2.
(15) Step S2315
The terminal 1 is rejected from the server 2 by the response.

FIG. 37 shows a sequence in a case where the terminal 1 is an inspection pass terminal.
(1) Step S2401
Terminal 1 broadcasts an ARP packet.
(2) Step S2402
When the terminal detection unit 21 monitors the ARP packet and detects the ARP packet, the terminal detection unit 21 transmits an inspection result acquisition request to the inspection terminal list management unit 13 in order to check the security inspection result of the terminal 1 that is the transmission source of the detected ARP packet. To do.
(3) Step S2403
The inspection terminal list management unit 13 sets the inspection result as acceptable because the terminal 1 is a terminal that has passed the inspection and is registered in the inspection terminal list 18.
(4) Step S2404
The inspection terminal list management unit 13 notifies the terminal detection unit 21 that the inspection result is acceptable.
(5) Step S2405
In response to the notification that the inspection result is acceptable, the terminal detection unit 21 requests the IM communication unit 20 to make an IM notification that the terminal 1 is “inspected” to the server 2.
(6) Step S2406
The IM communication unit 20 performs IM notification of “pass inspection” including identification information of the inspection pass terminal to the server 2.
(7) Step S2407
The server 2 performs processing for permitting access of the terminal notified from the IM communication unit 20. For example, the server 2 registers the notified terminal in the access-permitted terminal list inside the server 2.
(8) Step S2408
The terminal 1 accesses the server 2.
(9) Step S2409
The terminal 1 receives a normal response from the server 2.

  In the present invention, the terminal 1 may be any communication device that can access the network. Examples of the terminal 1 include a computer, a PDA (Personal Digital Assistance), a mobile phone, an information appliance, a game machine, and a portable music player.

  In addition, the relay device 10 of the present invention may be a communication device that passes when the terminal 1 accesses the external network 200. Examples of the relay device 10 include a router, a gateway server (may be a firewall), a provider (ISP) server, an access point, a wireless base station, and an exchange. However, actually, it is not limited to these examples.

Under a general Internet environment, the type and number of ports used may differ for each application. There may also be security holes due to vulnerabilities in the application itself.
In the security hole inspection according to the present invention, it is possible to execute a security hole inspection for each application. For example, the relay device 10 acquires a list of applications installed (installed) in the terminal 1 from the terminal 1 and performs a security hole inspection regarding the corresponding application. If the relay device 10 is a provider (ISP) server, when a security hole inspection service is performed, charging can be performed in units of applications according to the number of applications to be inspected.

  Further, the relay device 10 may relay only communication using a predetermined application even in the terminal 1 that is not permitted to access the external site 230 of the external network 200. For example, if the terminal 1 does not upgrade the OS to use an application that cannot be started by the latest OS, there is a high possibility of failing the security hole inspection. However, if there is no problem with the communication of the application, it is possible to relay only the communication using the port used by the application. At this time, the routing processing unit 11 or the proxy processing unit 12 of the relay apparatus 10 is set to relay only communication using the port used by the application.

  As described above, the present invention provides a function of inspecting the presence or absence of a security hole in a router in an internal network at home or in the home, and the presence or absence of a security hole in a terminal on the internal network that attempts to access an external network. If all security holes are closed, it will be accepted. Only terminals that pass the inspection can communicate with the external network without restrictions, and terminals that fail the inspection are restricted from communicating to the external network, so that terminals that do not block security holes are networked. Solve the problem that continues to be used above.

FIG. 1 is a block diagram showing the configuration of the security management system of the present invention. FIG. 2 is a flowchart showing the operation of the proxy processing unit. FIG. 3 is a diagram illustrating a first example of the inspection terminal list. FIG. 4 is a diagram illustrating a second example of the inspection terminal list. FIG. 5 is a flowchart showing the operation of the inspection terminal list management unit. FIG. 6 is a diagram illustrating an example of a pass / fail notification of an inspection result. FIG. 7 is a flowchart showing the operation of the inspection execution unit. FIG. 8 is a diagram illustrating an example of examination definition information. FIG. 9 is a flowchart of vulnerability inspection for a network service by each inspection definition information. FIG. 10 is a diagram illustrating a first example of security inspection result notification. FIG. 11 is a diagram illustrating a second example of the security inspection result notification. FIG. 12 is a diagram illustrating an example of an inspection terminal list to which browser version information is added. FIG. 13 is a flowchart showing the operation of the routing processing unit. FIG. 14A is a sequence diagram of operations of the first example of the first embodiment. FIG. 14B is a sequence diagram of operations of the first example of the first embodiment. FIG. 15A is a sequence diagram of an operation of the second example of the first embodiment. FIG. 15B is a sequence diagram of operations of the second example of the first embodiment. FIG. 16 is a block diagram illustrating a configuration of the second embodiment. FIG. 17A is a sequence diagram of the operation of the first example of the second embodiment. FIG. 17B is a sequence diagram of the operation of the first example of the second embodiment. FIG. 18 is a sequence diagram of the operation of the first example of the third embodiment. FIG. 19 is a sequence diagram of the operation of the second example of the third embodiment. FIG. 20 is a sequence diagram of the operation of the third example of the third embodiment. FIG. 21 is a block diagram showing the configuration of the fourth embodiment. FIG. 22A is a sequence diagram of the operation of the first example of the fourth embodiment. FIG. 22B is a sequence diagram of the operation of the first example of the fourth embodiment. FIG. 23 is a block diagram showing the configuration of the fifth embodiment. FIG. 24 is a sequence diagram of the operation of the first example of the fifth embodiment. FIG. 25A is a sequence diagram of the operation of the second example of the fifth embodiment. FIG. 25B is a sequence diagram of the operation of the second example of the fifth embodiment. FIG. 26 is a sequence diagram of the operation of the third example of the fifth embodiment. FIG. 27 is a block diagram showing the configuration of the sixth embodiment. FIG. 28 is a sequence diagram of the operation of the first example of the sixth embodiment. FIG. 29 is a sequence diagram of the operation of the second example of the sixth embodiment. FIG. 30 is a sequence diagram of operations of the third example of the sixth embodiment. FIG. 31 is a sequence diagram of the operation of the fourth example of the sixth embodiment. FIG. 32 is a sequence diagram of a first operation in which the examination definition information management unit acquires examination definition information. FIG. 33 is a sequence diagram of a second operation in which the examination definition information management unit acquires examination definition information. FIG. 34 is a block diagram showing the configuration of the seventh embodiment. FIG. 35 is a sequence diagram of operations of the first example of the seventh embodiment. FIG. 36 is a sequence diagram of the operation of the second example of the seventh embodiment. FIG. 37 is a sequence diagram of the operation of the third example of the seventh embodiment.

Explanation of symbols

1 (-i, i = 1 to n) Terminal (PC etc.)
DESCRIPTION OF SYMBOLS 10 Relay apparatus 11 Routing processing part 12 Proxy processing part 13 Inspection terminal list management part 14 HTTP communication part 15 Inspection execution part 16 Inspection definition information management part 17 Routing table 18 Inspection terminal list 19 Inspection definition information 20 IM (instant message) communication part 21 Terminal detection unit 30 Security inspection server 100 Internal network 200 External network 210 Inspection definition information providing site 220 Security patch providing site 230 External site

Claims (10)

A terminal on the internal network,
When a terminal list connected to the terminal and permitting connection to an external network is registered and a connection request from the terminal to the external network is detected, the terminal is included in the terminal list If the terminal is included in the terminal list, the communication between the terminal and the external network is relayed. If the terminal is not included in the terminal list, the terminal and the external Perform security inspection on the terminal by restricting communication with the network, and if a security hole is not found, register the terminal in the terminal list, and if the security hole is found, apply a security patch to the terminal And relaying the communication between the terminal and the external network by registering the terminal in the terminal list Security management system that includes the location. The security management system according to claim 1,
When the security hole is found in the terminal as a result of the security check, the relay device restricts communication using the port in which the security hole exists to the terminal, and does not use the port. Security management system that relays. The security management system according to claim 1,
Further comprising a server on the internal network;
When the relay device detects a connection request from the terminal to the server, the relay device checks whether the terminal is included in the terminal list, and if the terminal is included in the terminal list, Notify the device “pass inspection”
If the terminal is not included in the terminal list, communication between the terminal and the server is restricted and a security check is performed on the terminal. If no security hole is found, the server displays “ If the security hole is found, the server is notified of the inspection failure.
When the server receives a notification of “inspection pass” of the terminal from the relay device, the server permits access from the terminal, and receives a notification of “inspection failure” of the terminal from the relay device, the terminal Security management system that restricts access from An inspection terminal list management unit for storing a terminal list in which terminals that are allowed to connect to an external network are registered;
When a connection request from the terminal on the internal network to the external network is detected, if the terminal is not included in the terminal list, communication between the terminal and the external network is restricted, and the terminal A communication processing unit that relays communication between the terminal and the external network,
If the terminal is not included in the terminal list, a security check is performed. If a security hole is found, a security patch is applied to the terminal. If no security hole is found, the terminal is added to the terminal list. A relay apparatus comprising: an inspection execution unit registered in the network. The relay device according to claim 4,
The communication processing unit is a router on an internal network,
When the router detects a connection request from a terminal on the internal network to the external network, the inspection terminal list management unit receives an inquiry from the router as to whether or not the terminal is included in the terminal list. A relay device that responds to. In the relay device according to claim 4 or 5,
The inspection execution unit executes the security inspection in response to an inspection execution request from the communication processing unit that has received a notification that the terminal is not included in the terminal list. In the relay device according to claim 4 or 5,
If the terminal is not included in the terminal list, further comprising a notification unit for notifying the terminal to execute the security check,
The inspection execution unit performs the security inspection in response to an inspection execution request from the terminal. The relay device according to claim 7,
When the communication processing unit detects a connection request from the terminal to a server on the internal network, if the terminal is included in the terminal list, the communication processing unit notifies the server of “inspection pass” of the terminal. If the terminal is not included in the terminal list, the inspection execution unit is instructed to execute the security inspection for the terminal, and the inspection notified from the inspection execution unit. Request the notification unit to notify the server of the result,
The inspection execution unit executes the security inspection on the terminal according to an instruction to execute the security inspection, and if a security hole is not found, the inspection result is “pass inspection” of the terminal. Notifying the communication processing unit, if the security hole is found, notify the communication processing unit of "inspection failure" of the terminal as the inspection result,
The notification unit, in response to a request from the communication processing unit, as information for determining whether or not the server permits a connection from the terminal, “inspection pass” of the terminal or “ A relay device that notifies the server of “failed inspection”. In the relay device according to claim 4 or 5,
When the communication processing unit detects a packet from the terminal, the communication processing unit requests the inspection terminal list management unit for information on whether the terminal is included in the terminal list, and the terminal passes the inspection. If not, a relay device that instructs the inspection execution unit to execute the inspection. (A) When a terminal on an internal network executes a connection request to an external network, the terminal list is included in the terminal list with reference to a terminal list in which terminals that are permitted to connect to the external network are registered. Step to check whether and
(B) if the terminal is included in the terminal list, relaying communication between the terminal and the external network;
(C) If the terminal is not included in the terminal list, the communication between the terminal and the external network is restricted and a security check is performed. If a security hole is found, a security patch is added to the terminal. A program comprising: registering in the terminal list after application, registering the terminal in the terminal list if the security hole is not found, and relaying communication between the terminal and the external network.

Images