JP2008077558A - Quarantine network system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To execute security countermeasure of a terminal by dynamically limiting a terminal that is not subjected to security countermeasure only to access to a server for countermeasure regardless of a server for countermeasure to be accessed via a proxy server in accordance with a terminal state. <P>SOLUTION: A management terminal performs quarantine determination as to whether a terminal may be connected to a network on the basis of terminal information transmitted from an agent installed in the terminal and criterion information for performing quarantine determination as to whether the terminal may be connected to the network. When quarantine determination that the terminal must not be connected to the network is made, access information comprising access destination information for executing security countermeasure and address information of the terminal is transmitted to a secure gate device, and the secure gate device allows terminal communication only for access destination information on the basis of the access information. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a quarantine network system for determining whether or not a terminal can be connected to a network when it is connected to the network.

The conventional quarantine network system determines the connection condition of the terminal that has been connected by the connection control server, and repairs the non-permitted terminal in the blocked state of the network connection by switching the network switch ( For example, Patent Document 1).
A method for restricting access destinations based on a list of URLs has also been proposed (for example, Patent Document 2).
Japanese Patent No. 3728536 Japanese Patent No. 3161421

For example, since the method of Patent Document 1 is a mode in which switching between a blocking state and a connection state is performed by switching a network switch, there is a problem that it is not possible to use an external countermeasure server accessed via a proxy. there were.
Further, although there is a method of Patent Document 2 as a URL filtering technique for enabling access via a proxy, there is a problem that the access destination cannot be changed according to the state of the terminal.
This invention was made to solve the above problems, and even if a countermeasure server that accesses a terminal that has not been subjected to security countermeasures via a proxy server according to the state of the terminal, The purpose is to dynamically limit only access to the countermeasure server and to perform security countermeasures using the countermeasure server deployed outside the company.

The quarantine network system according to the present invention is installed on a terminal, and an agent that transmits terminal information acquired from the terminal;
Determination criterion information storage means for storing determination criterion information for determining whether or not the terminal may be connected to the network, and storage in the terminal information and determination criterion information storage means transmitted by the agent Quarantine determination means for determining whether or not the terminal may connect to the network based on the determined determination criterion information, and identification information associated with the quarantine result determined by the quarantine determination hand And access restriction information storage means storing access restriction information comprising access destination information that is accessed to implement security measures corresponding to the quarantine result, and the quarantine determination means connects the terminal to the network. The access restriction information stored in the access restriction information storage means when a quarantine decision is made. And access restriction instruction means for obtaining access destination information, creating access information composed of the access destination information and the address information of the terminal quarantined by the quarantine judgment means, and transmitting the access information. And a management device connected to the terminal via a network;
A secure gate device connected to the terminal and the management device via a network and permitting communication of the terminal only to access destination information of the access information based on the access information transmitted by the management device; It is provided.

  In this invention, the agent installed in the terminal transmits the terminal information acquired from the terminal to the management device, and the management device determines the terminal information transmitted from the agent and the quarantine determination as to whether or not the terminal may be connected to the network. To determine whether or not the terminal may be connected to the network based on the determination criterion information to perform security measures when it is determined that the terminal should not be connected to the network The access information configured by the access destination information to be accessed and the address information of the terminal determined to be quarantined is transmitted to the secure gate device, and the secure gate device transmits the access information of the terminal based on the URL that is the access information transmitted by the management device. By allowing communication only to the access destination information of the access information, Using the server's use, it is possible to implement the security measures of the terminal.

Embodiment 1 FIG.
FIG. 1 is a configuration diagram of a quarantine network system according to the present embodiment.
As shown in the figure, the quarantine network system includes a management device 1, a secure gate device 2, and a terminal 3. The management device 1, the secure gate device 2, and the terminal 3 are connected via a communication line 5.
The management device 1 quarantines the terminal 3 through the secure gate device 2.
The secure gate device 2 performs access restriction on the terminal 3 in accordance with an instruction from the management device 1. Further, the terminal 3 includes an agent 4.
The agent 4 collects information related to the terminal 3, transmits it to the management apparatus 1, and executes quarantine.
The communication line 5 is a network such as an intranet or a LAN (Local Area Network).
The proxy server 6 is a relay server for making it possible to access a server deployed outside the company from the internal network.
The countermeasure server 7 is a server that the terminal 3 that needs countermeasures as a result of the quarantine accesses to implement the countermeasures.
The WWW server 8 is a general WWW server deployed outside the company.

FIG. 2 is a configuration diagram of each device constituting the quarantine network system according to the first embodiment.
In FIG. 2, reference numeral 11 denotes information collecting means for collecting terminal information acquired by the agent 4 on the terminal 3 and storing the collected terminal information in the terminal information storage unit 15.
12 shows whether the terminal 3 that has been connected to the network may be connected to the network using the terminal information stored in the terminal information storage unit 15 and the security information stored in the security information storage unit 16. The quarantine determination means stores the quarantine result as a determination result in the quarantine result storage unit 17.
13 obtains a countermeasure access destination URL (Uniform Resource Locator) list stored in the access restriction information storage unit 18 based on the quarantine result stored in the quarantine result storage unit 17, and the MAC of the terminal that has executed the quarantine (Media Access Control) An access restriction instruction that creates access information composed of address information and a countermeasure access destination URL list (access permission list), transmits it to the secure gate device 2, and instructs access restriction. Means.
Reference numeral 14 denotes countermeasure instruction means for notifying the terminal 3 of the quarantine result stored in the quarantine result storage unit 17 and instructing execution of the countermeasure.

Reference numeral 15 denotes a terminal information storage unit as terminal information storage means for storing terminal information acquired by the agent 4 on the terminal 3.
Reference numeral 16 denotes a security information storage unit as determination criterion information storage means for storing security information, which is determination criterion information for determining whether or not the terminal 3 is in a state where it can be connected to the network.
Reference numeral 17 denotes a quarantine result storage unit as a quarantine result storage unit that stores information on the quarantine result determined by the quarantine determination unit 12.
Reference numeral 18 denotes an access restriction information storage unit that stores access restriction information configured by a quarantine result and an access destination URL (measurement access destination) necessary to implement the countermeasure.

Reference numeral 21 denotes access restriction enforcement means for storing the access information transmitted from the management apparatus 1 in the access information storage unit 22 and restricting the communication of the corresponding terminal to the designated access destination.
Reference numeral 22 denotes an access information storage unit as an access information storage means for storing access information composed of a MAC address for identifying a terminal transmitted from the management apparatus 1 and an access permission list indicating an access destination URL list.

Reference numeral 41 denotes terminal information acquisition means for acquiring terminal information such as OS information on the terminal, information on security countermeasure products, and information on operation processes.
Reference numeral 42 denotes terminal information transmission means for transmitting the terminal information acquired by the terminal information acquisition means 41 to the management apparatus.
Reference numeral 43 denotes countermeasure implementation means for implementing security countermeasures for the terminal in accordance with an instruction from the management apparatus 1.

FIG. 3 is a diagram illustrating an example of access restriction information stored in the access restriction information storage unit 18 according to the first embodiment.
In FIG. 3, reference numeral 18 a denotes a quarantine result for storing identification information for associating with a quarantine result stored in the quarantine result storage unit 17.
Reference numeral 18b denotes a countermeasure access destination in which a list of URLs of access destinations to be accessed for implementing countermeasures based on the quarantine result is stored.

FIG. 4 is a diagram illustrating an example of access information stored in the access information storage unit 22 according to the first embodiment.
In FIG. 4, reference numeral 22a denotes a MAC address that stores a MAC address for identifying a terminal that is subject to access restriction.
Reference numeral 22b denotes an access permission list in which a list of URLs of access destinations permitting communication of the terminal having the MAC address specified in the MAC address 22a, that is, an access permission list permitting communication of the terminal having the MAC address is stored.

Next, the operation will be described.
5 to 7 are flowcharts showing processing operations of the quarantine network system according to the first embodiment. Here, the processes of the management device 1, the secure gate device 2, and the agent 4 on the terminal 3 are shown.
First, the operation of the agent 4 on the terminal 3 will be described with reference to FIG.
Terminal information acquisition means 41 acquires terminal information of terminal 3 (ST101). The terminal information to be acquired includes OS name, version, applied service pack, applied security patch information, computer name, IP address, MAC address, registered service information, service setting information, operation process information, installed application information, application version information, Information such as application setting information.

When the acquisition is completed, the terminal information transmission unit 42 transmits the terminal information acquired in ST101 to the management apparatus 1 (ST102). When the quarantine determination is executed in the management apparatus 1 and the quarantine result is transmitted, the countermeasure implementing means 43 receives the transmitted quarantine result (ST103).
The countermeasure implementation means 43 confirms the quarantine result (ST104). If it is determined that there is no problem as a result of the quarantine, the process ends. If it is determined that there is a problem, the process proceeds to ST105.
The countermeasure implementation unit 43 performs security countermeasures for the terminal based on the quarantine result transmitted from the management apparatus 1, and proceeds to ST101 to execute the quarantine again (ST105).

Next, the operation of the secure gate device 2 will be described with reference to FIGS.
The access control execution means 21 receives the access information configured by the MAC address and the access destination URL list transmitted from the management device 1 (ST111).
The access control execution means 21 determines whether or not it is an access restriction request from the received content (ST112). If there is an access destination URL list corresponding to the MAC address, it is determined as an access restriction request, and the process proceeds to ST113. On the other hand, if there is no access destination URL list corresponding to the MAC address, it is determined as an access restriction release request, and the process proceeds to ST115.

If the access control execution means 21 determines that it is an access restriction request in ST112, it stores in the access information storage unit 22 the access information composed of the MAC address acquired in ST111 and the access permission list that is the access destination URL list. (ST113). An example of information to be stored is shown in FIG.
If the communication of the terminal 3 instructed to restrict access is not described in the access permission list 22b, the access is blocked and only the described one is permitted (ST114).

Further, if the access control execution means 21 determines that it is not an access restriction request in ST112, that is, if it is determined that it is an access restriction release request, an access information storage unit based on the MAC address information of the access information acquired in ST111 The entry of the corresponding MAC address stored in 22 is deleted (ST115).
Further, the access destination restriction for the designated MAC address is released, and the communication of the terminal 3 instructed to release the access restriction is not restricted (ST116).

Next, the operation of the management apparatus 1 will be described with reference to FIGS.
The information collecting unit 11 receives the terminal information transmitted from the terminal 3 (agent 4) (ST121).
The information collecting unit 11 stores the collected terminal information in the terminal information storage unit 15 (ST122).
The quarantine determination unit 12 performs a quarantine determination as to whether or not the terminal 3 can be connected to the network based on the terminal information collected in ST121 and the determination criterion information stored in the security information storage unit 16, and the quarantine result. The quarantine result is stored in the storage unit 17 (ST123).
The access restriction instructing unit 13 refers to the quarantine result stored in the quarantine result storage unit 17 in ST123 (ST124). If the quarantine result is NG, the process proceeds to ST125. If the quarantine result is OK, the process proceeds to ST129.

The access restriction instructing unit 13 acquires information on the quarantine result stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined is quarantine NG, and stores the information in the access restriction information storage unit 18. By referring to the quarantine result 18a of the access restriction information, the countermeasure access destination 18b of the quarantine NG, that is, the URL of the countermeasure access destination necessary for implementing the countermeasure based on the quarantine result is acquired (ST125).
The access restriction instructing unit 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST125 and the MAC address of the terminal 3 that has quarantined (ST126).
The access restriction instructing means 13 transmits the access information created in ST126 to the secure gate device, and performs an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

On the other hand, if the quarantine result is OK, the access restriction instructing unit 13 refers to the quarantine result 18a of the access restriction information stored in the access restriction information storage unit 18, and acquires a countermeasure access destination for quarantine OK. Then, the access information is created by combining the MAC address of the terminal 3 that has executed the quarantine and a list in which the access destination URL does not exist (ST129).
The access restriction instructing means 13 transmits the access information created in ST129 to the secure gate device, and implements an access restriction release instruction for the terminal 3 designated by the MAC address (ST130).

In addition, about the data of the criteria information stored in the security information storage unit 16 as a criterion for executing the quarantine, automatic download from a server corresponding to the security information or registration using a medium such as a CD-ROM It shall be stored by means such as registration from the administrator from the registration screen.
Further, in this configuration, the secure gate device and the management device are configured separately, but the configuration may be such that the quarantine determination performed by the management device is performed in the secure gate device.

As described above, according to the first embodiment, when a terminal 3 that requires countermeasures as a result of quarantine is detected, the restriction is limited to only access to the list of URLs stored in the access restriction information storage unit 18. Since the secure gate device 2 is instructed to be executed, the countermeasure server 7 that is accessed via a proxy server or the like is in a state where access to a server that is generally deployed outside the company such as the WWW server 8 is blocked. Therefore, it is possible to limit only access to the countermeasure server 7 and implement security countermeasures.
Further, since the configuration is such that a list of URLs can be set, it is possible to cope with cases where access to a plurality of URLs is necessary to implement countermeasures.
Furthermore, since the access restriction is performed by the management device 1 and the secure gate device 2 that are remote from the terminal, the setting is not changed by a malicious user.

Embodiment 2. FIG.
In the first embodiment, when it is determined that the quarantine result is NG, the secure gate device is instructed to specify the MAC address for identifying the terminal and the URL registered in the access restriction list, and the access destination until the countermeasure is completed. However, in this embodiment, when there are a wide variety of quarantine items, a case where the URL is limited to the access destination URL corresponding to each quarantine result will be described.

FIG. 8 is a configuration diagram of each device constituting the quarantine network system according to the second embodiment.
In FIG. 8, 201 collects information acquired by the agent 4 and the secure gate device 2 on the terminal 3, stores the terminal information collected from the agent 4 in the terminal information storage unit 15, and collects the terminal information collected from the secure gate device 2. This is information collection means for storing connection information in the connection information storage unit 203.
202 uses the terminal information stored in the terminal information storage unit 15, the terminal connection information stored in the connection information storage unit 203, and the security information stored in the security information storage unit 16 to perform network connection. It is a quarantine determination unit that determines whether or not the terminal 3 is in a state where it can be connected to the network, and stores a quarantine result as a determination result in the quarantine result storage unit 17.

Reference numeral 203 denotes a connection information storage unit that stores terminal connection information of connection terminals collected from the secure gate device 2.
Reference numeral 204 denotes a security information storage unit as security information storage means for storing security information, which is determination criterion information for determining whether or not the terminal 3 is ready to be connected to the network. For example, the following information is stored in the security information storage unit.
Reference numeral 205 denotes terminal list information that stores a list of terminals that can be connected to the managed network.
Reference numeral 206 denotes applied security patch information storing security patch information to be applied.
Reference numeral 207 denotes security product information storing the application name, version, and setting information of the security product to be applied.
Reference numeral 208 denotes operation process information storing a process that must be operated on the terminal 3, a process name of the process that should not be operated, and an execution path.

Reference numeral 209 denotes connection information acquisition means for acquiring the timing at which the terminal 3 is connected under the secure gate device 2 and the MAC address and IP address information (terminal connection information) of the terminal connected periodically.
Reference numeral 210 denotes connection information transmission means for transmitting terminal connection information acquired by the connection information acquisition means 209 to the management apparatus 1.
FIG. 9 is a diagram illustrating an example of access restriction information stored in the access restriction information storage unit 18 according to the second embodiment.
FIG. 10 is a diagram illustrating an example of access information stored in the access information storage unit 22 according to the second embodiment.

Next, the operation will be described.
First, the operation of the secure gate device 2 will be described with reference to FIGS.
The connection information acquisition unit 209 monitors whether a terminal has been connected to itself (ST201). If connected, the process proceeds to ST202. If not connected, the process proceeds to ST111.
If the terminal 3 has not been connected, the access control execution means 21 receives the access information composed of the MAC address and the access destination URL list transmitted from the management apparatus 1 (ST111).
The access control execution means 21 determines whether or not it is an access restriction request from the received content (ST112). If there is an access destination URL list corresponding to the MAC address, it is determined as an access restriction request, and the process proceeds to ST113. On the other hand, if there is no access destination URL list corresponding to the MAC address, it is determined as an access restriction release request, and the process proceeds to ST115.

  If the access control execution means 21 determines that it is an access restriction request in ST112, it stores in the access information storage unit 22 the access information composed of the MAC address acquired in ST111 and the access permission list that is the access destination URL list. (ST113). An example of information to be stored is shown in FIG. Thereafter, if the communication of the terminal 3 instructed to restrict access is not described in the access permission list 22b, the access is blocked and only the described one is permitted (ST114).

  If the access control execution unit 21 determines that the access restriction release request is received in ST112, the access control execution unit 21 determines the entry of the corresponding MAC address stored in the access information storage unit 22 based on the MAC address information of the access information acquired in ST111. Delete (ST115). Thereafter, the communication restriction of the terminal 3 instructed to release the access restriction is not implemented (ST116).

When the terminal 3 is connected, the connection information acquisition unit 209 acquires terminal connection information including the MAC address and IP address information of the connected terminal 3 (ST202).
The connection information transmission means 210 transmits the terminal connection information of the terminal 3 acquired in ST202 to the management apparatus 1 (ST203).

Next, the operation of the management apparatus 1 will be described with reference to FIGS.
Information collecting means 201 receives terminal information transmitted from terminal 3 (agent 4) or terminal connection information transmitted from secure gate device 2 (ST211).
The information collection unit 201 determines the transmission source (ST212). If the transmission source is terminal 3, the received terminal information is stored in terminal information storage unit 15, and the process proceeds to ST214. If the transmission source is secure gate device 2, the received terminal connection information is stored in connection information storage section 203, and the process proceeds to ST213.

When the transmission source is the secure gate device 2, the quarantine determination unit 202 uses the information of the terminal list information 205 stored in the security information storage unit 204 and the terminal connection information stored in the connection information storage unit 203. The comparison is made and the result is stored in the quarantine result storage unit 17 (ST213).
If the quarantine target terminal 3 is a terminal registered in the terminal list information 205, the process proceeds to ST211. If the quarantine target terminal 3 is not registered in the terminal list information 205, the process proceeds to ST219.

When the transmission source is the terminal 3, the quarantine determination unit 202 compares the information of the applied security patch information 206 stored in the security information storage unit 204 and the terminal information of the terminal 3 stored in the terminal information storage unit 15. The applied security patch information is compared, and the result is stored in the quarantine result storage unit 17 (ST214).
If a security patch to be applied to the quarantine target terminal 3 has been applied, the process proceeds to ST215. If the security patch to be applied to the quarantine target terminal 3 is not applied, the process proceeds to ST220.

When the terminal 3 to be quarantined is a terminal to which a security patch has been applied, the quarantine determination unit 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The application information of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST215).
When the security product to be applied to the quarantine target terminal 3 is applied, the process proceeds to ST216. If the security product to be applied to the terminal 3 to be quarantined is not applied, the process proceeds to ST221.

When the terminal 3 to be quarantined is a terminal to which a security product has been applied, the quarantine determination means 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The version information of the application of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST216).
If the versions of the security products to be applied to the quarantine target terminal 3 match, the process proceeds to ST217. If the version of the security product to be applied to the quarantined terminal 3 does not match, the process proceeds to ST222.

If the terminal 3 to be quarantined is a terminal whose security product version also matches, the quarantine determination unit 202 stores the security product information 207 information stored in the security information storage unit 203 and the terminal information storage unit 15. The application setting information of the terminal information stored in the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST217).
If the terminal 3 to be quarantined is a terminal for which the security product to be applied is correctly set, the process proceeds to ST218. If the terminal 3 to be quarantined is a terminal for which the security product to be applied is not set correctly, the process proceeds to ST223.

If the terminal 3 to be quarantined is a terminal in which the security product is correctly set, the quarantine determination unit 202 is stored in the operation process information stored in the security information storage unit 203 and the terminal information storage unit 15. The operation process information of the terminal 3 that is currently in operation is compared, and the result is stored in the quarantine result storage unit 17 (ST218).
If a process registered as a process that should be operating is operating and a process registered as a process that should not be operating is not operating, the process proceeds to ST129. If the process that should be running is not running, or if the terminal is running a process that should not be running, the process proceeds to ST224.

The access restriction instructing unit 13 confirms the quarantine result stored in the quarantine result storage unit 17. If the quarantine result is OK, the access restriction instruction unit 13 displays the quarantine result 18 a of the access restriction information stored in the access restriction information storage unit 18. The access destination for countermeasures for quarantine OK is acquired, and access information is created by combining the MAC address of the terminal 3 that has executed the quarantine and a list in which the access destination URL does not exist (ST129).
The access restriction instructing means 13 transmits the access information created in ST129 to the secure gate device, and implements an access restriction release instruction for the terminal 3 designated by the MAC address (ST130).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instruction unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined is an unregistered terminal, and stores it in the access restriction information storage unit 18. By referring to the quarantine result 18a of the access restriction information, the countermeasure access destination 18b of the unregistered terminal is acquired (S219).
The access restriction instructing unit 13 creates access information that combines the URL list of access destinations for countermeasures acquired in ST219 and the MAC address of the terminal 3 that has quarantined (ST126).
The access restriction instructing means 13 transmits the access information created in ST126 to the secure gate device, and performs an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instruction unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined has not been applied with the security patch, and stores it in the access restriction information storage unit 18. The quarantine result 18a is referred to, and the countermeasure access destination 18b to which the security patch is not applied is acquired (ST220).
The access restriction instructing unit 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST220 and the MAC address of the terminal 3 that has quarantined (ST126).
The access restriction instructing means 13 transmits the access information created in ST126 to the secure gate device, and performs an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit, determines that the terminal 3 to be quarantined is not yet applied with the security countermeasure application, and is stored in the access restriction information storage unit 18. The quarantine result 18a is referred to, and the countermeasure access destination 18b to which the security countermeasure application is not applied is acquired (ST221).
The access restriction instructing unit 13 creates access information that combines the URL list of access destinations for countermeasures acquired in ST221 and the MAC address of the terminal 3 that has quarantined (ST126).
The access restriction instructing means 13 transmits the access information created in ST126 to the secure gate device, and performs an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined does not match the security countermeasure application version, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b that does not match the security countermeasure application version is acquired (ST222).
The access restriction instructing unit 13 creates access information that combines the URL list of access destinations for countermeasures acquired in ST222 and the MAC address of the terminal 3 that has quarantined (ST126).
The access restriction instructing means 13 transmits the access information created in ST126 to the secure gate device, and performs an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be set as a security countermeasure application, and is stored in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b that cannot set the security countermeasure application is acquired (ST223).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST223 and the MAC address of the terminal 3 that has quarantined (ST126).
The access restriction instructing means 13 transmits the access information created in ST126 to the secure gate device, and performs an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be registered process operation information, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b incapable of registering process operation information is acquired (ST224).
The access restriction instructing unit 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST224 and the MAC address of the terminal 3 that has quarantined (ST126).
The access restriction instructing means 13 transmits the access information created in ST126 to the secure gate device, and performs an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

  As described above, according to the present embodiment, security patch information for each OS type is stored as information stored in the security information storage unit 204, and an OS security patch is not applied to the access restriction information storage unit 18. A list of URLs to be accessed when taking countermeasures to be taken is stored, the terminal information acquisition unit 41 acquires OS information, OS version information, and applied security patch information used by the terminal. The terminal information from the agent 4 and the security patch information stored in the security information storage unit 204 are compared to determine whether or not the connected terminal can be connected to the network. Access restriction information stored when 202 determines that the terminal is not connected with a security patch 18 obtains a list of access destination URLs that should be permitted as a countermeasure when connecting a terminal to which a security patch is not applied, and allows the secure gate device 2 to allow the access destination of the corresponding terminal as a countermeasure when a terminal without a security patch is connected. It is characterized in that an instruction for only a list of access destination URLs to be issued is issued.

  In the present embodiment, security countermeasure product information is stored as information to be stored in the security information storage unit 204, and a countermeasure to be taken when a security countermeasure product is not applied to the access restriction information storage unit 18 is taken. A list of URLs to be accessed is held, application application information is acquired as information acquired by the terminal information acquisition unit 41, and the quarantine determination unit 202 is stored in the terminal information from the agent 4 and the security information storage unit 204. The security countermeasure product information is compared to determine whether the connection terminal is connectable to the network. When the quarantine determination means 202 determines that the connection of the security countermeasure product non-applicable terminal is performed, Security countermeasure product unapplied terminal stored in access restriction information storage unit 18 A list of access destination URLs that should be permitted for countermeasures at a subsequent time is acquired, and the access destination of the corresponding terminal is set to only the list of access destination URLs that should be permitted for countermeasures when a terminal to which a security countermeasure product is not applied is connected to the secure gate device 2 It is characterized by issuing instructions.

In the present embodiment, security countermeasure product version information is stored as information to be stored in the security information storage unit 204, and the access restriction information storage unit 18 performs measures to be taken when the security countermeasure product version does not match. Keep a list of URLs to access
Security countermeasure product version information is acquired as information acquired by the terminal information acquisition means 41, and the quarantine determination means 202 obtains the terminal information from the agent 4 and the security countermeasure product version information stored in the security information storage unit 204. In comparison, it is determined whether or not the connected terminal is connectable to the network, and the access restriction instructing means 13 determines that the access restriction information storage unit 18 is in a case where the quarantine determining means 202 determines that the security countermeasure product version mismatch terminal is connected. A list of access destination URLs that should be permitted as countermeasures when a security countermeasure product version mismatch terminal is connected is acquired, and the access destination of the corresponding terminal is connected to the secure gate device 2 as a countermeasure when a security countermeasure product version mismatch terminal is connected. Access destinations that should be allowed Is characterized in that instructs that only the list RL.

In the present embodiment, security countermeasure product setting information is held as information stored in the security information storage unit 204, and the access restriction information storage unit 18 performs measures to be taken when the security countermeasure product setting is insufficient. The security countermeasure product setting information is acquired as information acquired by the terminal information acquisition unit 41, and the quarantine determination unit 13 stores the terminal information from the agent 4 and the security information storage unit 204. Compare the stored security countermeasure product setting information, determine whether the connected terminal can connect to the network,
When the quarantine determination unit 202 determines that a terminal with an inadequate security countermeasure product setting is connected, the access restriction instructing means 13 permits access as a countermeasure when a terminal with an inadequate security countermeasure product setting stored in the access restriction information storage unit 18 is connected. A list of access destination URLs to be acquired, and an instruction is given to the secure gate device 2 so that the access destination of the corresponding terminal is only a list of access destination URLs that should be permitted as a countermeasure when connecting to a terminal with insufficient security countermeasure product settings. To do.

  Also, the present embodiment holds registration process operation information that operates on the terminal as information stored in the security information storage unit 204, and should be performed when the access restriction information storage unit 18 has inadequate registration process operation status. A list of URLs to be accessed when taking countermeasures is held, operation process information is acquired as information acquired by the terminal information acquisition unit 41, and the quarantine determination unit 202 includes the terminal information from the agent 4 and a security information storage unit. The registration process operation information stored in 204 is compared to determine whether or not the connection terminal can be connected to the network, and the access restriction instruction unit 13 determines that the quarantine determination unit 202 is connected to the registration process operation deficient terminal. If this happens, the registration process stored in the access restriction information storage unit 18 will be used for countermeasures when the terminal is inoperable. To obtain a list of access destination URLs to be permitted, and to instruct the secure gate device 2 to make the access destination of the corresponding terminal only a list of access destination URLs to be permitted as a countermeasure when a terminal with a registration process inadequate is connected. It is a feature.

  In the present embodiment, as information stored in the security information storage unit 204, terminal list information connectable to the network, security patch information for each OS type, security countermeasure product information, security countermeasure product version information, security countermeasure One or more of product setting information and registration process operation information are held, the access restriction information storage unit 18 has a list of URLs to be accessed when taking measures to be taken when an unregistered terminal is connected, and an OS security patch is not yet available List of URLs to be accessed when taking countermeasures to be implemented in case of application, list of URLs to be accessed when taking countermeasures when security countermeasure products are not applied, and security countermeasure product version mismatch List of URLs to access when taking countermeasures One or more URL lists to be accessed when taking countermeasures to be taken when the security countermeasure product settings are inadequate, and URL lists to be accessed when taking countermeasures to be taken when the registration process operation status is inadequate As the information acquired by the terminal information acquisition means 41, one or more of OS information, OS version information, applied security patch information, applied application information, security countermeasure product version information, security countermeasure product setting information, and operation process information The quarantine determination unit 202 compares the terminal information from the agent 4 with each information stored in the security information storage unit 204 in order, and determines whether the connecting terminal can be connected to the network. When it is determined that connection to the network is impossible, the determination is finished. When the quarantine determination unit 202 determines that the network access is not possible, the access restriction instruction unit 13 accesses that should be permitted as a countermeasure based on the cause determined that the network access is not stored in the access restriction information storage unit 18. A list of destination URLs is acquired, and an instruction is given to the secure gate device 2 to make only the list of access destination URLs that should be permitted as a countermeasure for the access destination of the corresponding terminal.

Note that the order in which the quarantine determination is performed is not necessarily the main order.
Also, the items for which the quarantine determination is performed are not limited to those shown in the present embodiment.
In addition, the security countermeasure application and the registration process may be subject to a plurality of inspections.
Data stored in the security information storage unit 16 serving as a criterion for executing the quarantine can be automatically downloaded from a server corresponding to the security information, registered using a medium such as a CD-ROM, or from a registration screen. It is assumed that storage is performed by means such as registration from the administrator.
Further, in this configuration, the secure gate device and the management device are configured separately, but the configuration may be such that the quarantine determination performed by the management device is performed in the secure gate device.

  As described above, according to the second embodiment, when a terminal 3 that needs countermeasures as a result of quarantine is detected, the connection of the terminal 3 is dynamically changed only to a countermeasure access destination corresponding to the result. Therefore, it is possible to implement a countermeasure in which communication is restricted only to a countermeasure access destination according to the state of the terminal.

Embodiment 3 FIG.
In the second embodiment, the access destination URL is restricted for each individual quarantine determination. However, in the present embodiment, when all the quarantines are performed, a plurality of countermeasures are required. A case where the result list is limited to an access destination URL combined will be described.
The configuration of each device constituting the quarantine network system in the present embodiment is the same as that in FIG.

Next, the operation will be described.
The operation of the management apparatus 1 will be described with reference to FIG. 9, FIG. 13, and FIG.
The information collection unit 201 determines the transmission source (ST212). If the transmission source is terminal 3, the received terminal information is stored in terminal information storage unit 15, and the process proceeds to ST214.
If the transmission source is secure gate device 2, the received terminal connection information is stored in connection information storage section 203, and the process proceeds to ST213.
The quarantine determination unit 202 compares the information of the terminal list information 205 stored in the security information storage unit 204 with the terminal connection information stored in the connection information storage unit 203 and stores the result in the quarantine result storage unit 17. (ST213).
If the quarantine target terminal 3 is a terminal registered in the terminal list information 205, the process proceeds to ST211. If the quarantine target terminal 3 is not registered in the terminal list information 205, the process proceeds to ST219.

If the terminal 3 to be quarantined is a registered terminal, the quarantine determination unit 202 is stored in the terminal information storage unit 15 and the information of the applied security patch information 206 stored in the security information storage unit 203. The applied security patch information of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST214).
If a security patch to be applied to the quarantine target terminal 3 has been applied, the process proceeds to ST215. If the security patch to be applied to the quarantine target terminal 3 is not applied, the process proceeds to ST220.

  When the terminal 3 to be quarantined is a terminal to which a security patch has been applied, the quarantine determination unit 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The application information of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST215). When the security product to be applied to the quarantine target terminal 3 is applied, the process proceeds to ST216. If the security product to be applied to the terminal 3 to be quarantined is not applied, the process proceeds to ST221.

  If the terminal 3 to be quarantined is a terminal to which a security product has been applied, the quarantine determination means 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The version information of the application of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST216). If the versions of the security products to be applied to the quarantine target terminal 3 match, the process proceeds to ST217. If the versions of the security products to be applied to the quarantine target terminal 3 do not match, the process proceeds to ST222.

  If the terminal 3 to be quarantined is a terminal whose security product version also matches, the quarantine determination unit 202 stores the security product information 207 information stored in the security information storage unit 203 and the terminal information storage unit 15. The application setting information of the terminal information stored in the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST217). If the terminal 3 to be quarantined is a terminal for which the security product to be applied is correctly set, the process proceeds to ST218. If the terminal 3 to be quarantined is a terminal for which the security product to be applied is not set correctly, the process proceeds to ST223.

  If the terminal 3 to be quarantined is a terminal in which the security product is correctly set, the quarantine determination unit 202 is stored in the operation process information stored in the security information storage unit 203 and the terminal information storage unit 15. The operation process information of the terminal 3 that is currently in operation is compared, and the result is stored in the quarantine result storage unit 17 (ST218). If a process registered as a process that should be running is running and a process registered as a process that should not be running is not running, the process proceeds to ST301. If the process that should be running is not running, or if the terminal is running a process that should not be running, the process proceeds to ST224.

The access restriction instructing unit 13 refers to the quarantine result stored in the quarantine result storage unit 17 in the quarantine determination of ST213 to ST218 (ST301). If the quarantine result is NG, the process proceeds to ST302. If the quarantine result is OK, the process proceeds to ST129.
When the quarantine result is OK, the access restriction instructing unit 13 refers to the quarantine result 18a of the access restriction information stored in the access restriction information storage unit 18, acquires the countermeasure access destination for the quarantine OK, Access information is created by combining the MAC address of the terminal 3 that has executed the quarantine and a list in which the access destination URL does not exist (ST129).
The access restriction instructing means 13 transmits the access information created in ST129 to the secure gate device, and performs an access restriction release instruction for the terminal 3 designated by the MAC address of the access information (ST130).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

  When the quarantine result is NG, the access restriction instructing unit 13 acquires all the factors that become the quarantine NG stored in the quarantine result storage unit 17 and accesses stored in the access restriction information storage unit 18. By referring to the quarantine result 18a of the restriction information, an access destination list of all factors that have become quarantine NG is acquired, and all access destination lists necessary for countermeasures of the terminal 3 are generated.

FIG. 14 shows an example of a list (access information) when the terminal of the MAC address 11-11-11-11-11-11 is not applied with the security patch and not applied with the security countermeasure application.
The list of access destinations for countermeasures to which security patches have not been applied and the list of access destinations to which security countermeasure applications have not been applied shown in FIG.
The access restriction instructing means 13 transmits the access information created in ST126 to the secure gate device, and performs an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instruction unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined is an unregistered terminal, and stores it in the access restriction information storage unit 18. The countermeasure access destination 18b of the unregistered terminal is acquired with reference to the quarantine result 18a (S219).
The access restriction instructing means 13 creates access information that combines the countermeasure access destination 18b (access permission list) acquired in ST219 and the MAC address of the terminal 3 that has quarantined (ST302).
The access restriction instructing means 13 transmits the access information created in ST302 to the secure gate device, and performs an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instruction unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined has not been applied with the security patch, and stores it in the access restriction information storage unit 18. The quarantine result 18a is referred to, and the countermeasure access destination 18b to which the security patch is not applied is acquired (ST220).
The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined has not been applied with the security countermeasure application, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b to which the security countermeasure application is not applied is acquired (ST221).
The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined does not match the security countermeasure application version, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b that does not match the security countermeasure application version is acquired (ST222).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be set as a security countermeasure application, and is stored in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b that cannot set the security countermeasure application is acquired (ST223).
The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be registered process operation information, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b incapable of registering process operation information is acquired (ST224).

As described above, in the present embodiment, as information stored in the security information storage unit 204, terminal list information connectable to the network, security patch information for each OS type, security countermeasure product information, security countermeasure product version information , Security measures product setting information,
When one or more of the registration process operation information is held and the access restriction information storage unit 18 is accessed with a list of URLs to be taken when taking measures to be taken when an unregistered terminal is connected, or when an OS security patch is not applied List of URLs to be accessed when taking countermeasures to be taken, list of URLs to be accessed when taking countermeasures when security countermeasure product is not applied, countermeasures to be implemented when security countermeasure product versions do not match List of URLs to be accessed at the time, list of URLs to be accessed when taking measures to be taken when security countermeasure product settings are inadequate, and URLs to be accessed when taking measures to be taken when registration process operating conditions are inadequate One or more of the lists are stored, and information acquired by the terminal information acquisition means 41 is OS information. , OS version information, applied security patch information, applied application information, security countermeasure product version information, security countermeasure product setting information, and operation process information are acquired, and the quarantine determination unit 202 receives terminal information from the agent 4. And the information stored in the security information storage unit 204 are all compared to determine whether or not the connecting terminal is connectable to the network. The access restriction instructing unit 13 determines that the quarantine determining unit 202 cannot access the network. When the determination is made, a list of access destination URLs to be permitted for countermeasures based on one or more causes determined to be inaccessible in the network stored in the access restriction information storage unit 18 is obtained, respectively, and the secure gate device 2 shows the access destination of the corresponding terminal Is characterized in that to issue an instruction to only a list of the access destination URL should be allowed for the measures.

Note that the order in which the quarantine determination is performed is not necessarily the main order.
Also, the items for which the quarantine determination is performed are not limited to those shown in the present embodiment.
In addition, the security countermeasure application and the registration process may be subject to a plurality of inspections.
Data stored in the security information storage unit 16 serving as a criterion for executing the quarantine can be automatically downloaded from a server corresponding to the security information, registered using a medium such as a CD-ROM, or from a registration screen. It is assumed that storage is performed by means such as registration from the administrator.
Further, in this configuration, the secure gate device and the management device are configured separately, but the configuration may be such that the quarantine determination performed by the management device is performed in the secure gate device.

  As described above, according to the third embodiment, when the terminal 3 that needs countermeasures as a result of the quarantine is detected, it is possible to dynamically change the connection of the terminal 3 only to the countermeasure access destination. It is possible to implement a countermeasure in which communication is restricted only to a countermeasure access destination corresponding to the state of the terminal.

Embodiment 4 FIG.
In the above embodiment, the URL is statically specified. In the present embodiment, a case will be described in which a URL that can be dynamically changed can be handled.
FIG. 15 is a diagram showing an example of access restriction information stored in the access restriction information storage unit 18 of the present embodiment.
As shown in FIG. 15, a list of access destinations using a wild card or a regular expression can be set as a countermeasure access destination, and access restriction is performed.

  As described above, according to the present embodiment, as information stored in the access restriction information storage unit 18, it is possible to set an access destination URL using a wild card or a regular expression. By limiting access to only those that match the pattern, it is possible to cope with a mechanism in which the URL is dynamically changed at the time of countermeasures.

  According to the fourth embodiment, when a terminal 3 requiring countermeasures as a result of quarantine is detected, a URL uniquely determined as a countermeasure access destination URL and a plurality of URLs are designated, and the access destination Since the restriction can be implemented, it is possible to deal with a dynamically changed URL.

Embodiment 5. FIG.
In the above embodiment, URL access is restricted. However, in this embodiment, some countermeasures use not only the URL but also the server MAC address or IP address. The case of implementing measures combining the above will be described.
FIG. 16 is a block diagram of the quarantine network system according to the present embodiment. The same reference numerals as those in FIG.
In FIG. 16, reference numeral 301 denotes a countermeasure server deployed in the company that the terminal 3 that needs countermeasures as a result of quarantine accesses to implement the countermeasures.

FIG. 17 is a diagram showing an example of access restriction information stored in the access restriction information storage unit 18 of the present embodiment. Here, the access restriction information stored in the access restriction information storage unit 18 is an access including any one of a URL, a MAC (Media Access Control) address, an IP address to be accessed for implementing security measures, or a combination thereof. It consists of the previous information and the identification information.
FIG. 18 is a diagram illustrating an example of access information stored in the access information storage unit 22 according to the present embodiment.
The configuration of each device constituting the quarantine network system of the present embodiment is the same as the configuration described in FIG.

Next, the operation will be described.
FIG. 19 is a flowchart showing the processing operation of the secure gate device 2.
First, the operation of the secure gate device 2 will be described with reference to FIG.
The connection information acquisition unit 209 monitors whether a terminal has been connected to itself (ST201). If connected, the process proceeds to ST202. If not connected, the process proceeds to ST111.
If the terminal 3 has not been connected, the access control execution means 21 receives the access information composed of the MAC address and the access destination list transmitted from the management apparatus 1 (ST111).
The access control execution means 21 determines whether or not it is an access restriction request from the received content (ST112). If there is an access destination list corresponding to the MAC address, it is determined as an access restriction request, and the process proceeds to ST113. If there is no access destination list corresponding to the MAC address, it is determined as an access restriction release request, and the process proceeds to ST115.

If the access control execution means 21 determines that it is an access restriction request in ST112, it stores in the access information storage unit 22 the access information composed of the MAC address acquired in ST111 and the access permission list that is the access destination URL list. (ST113). An example of information to be stored is shown in FIG. Thereafter, if the communication of the terminal 3 instructed to restrict access is not described in the access permission list 22b, the access is blocked and only the described one is permitted (ST401).
If the access control execution unit 21 determines that the access restriction release request is received in ST112, the access control execution unit 21 determines the entry of the corresponding MAC address stored in the access information storage unit 22 based on the MAC address information of the access information acquired in ST111. Delete (ST115). Thereafter, the communication restriction of the terminal 3 instructed to release the access restriction is not implemented (ST116).

When the terminal 3 is connected, the connection information acquisition unit 209 acquires terminal connection information including the MAC address and IP address information of the connected terminal 3 (ST202).
The connection information transmission means 210 transmits the terminal connection information of the terminal 3 acquired in ST202 to the management apparatus 1 (ST203).

FIG. 20 is a flowchart showing the processing operation of the management apparatus 1.
Next, the operation of the management apparatus 1 will be described with reference to FIG.
Information collecting means 201 receives terminal information transmitted from terminal 3 (agent 4) or terminal connection information transmitted from secure gate device 2 (ST211).
The information collection unit 201 determines the transmission source (ST212). If the transmission source is terminal 3, the received terminal information is stored in terminal information storage unit 15, and the process proceeds to ST214. If the transmission source is secure gate device 2, the received terminal connection information is stored in connection information storage section 203, and the process proceeds to ST213.

When the transmission source is the secure gate device 2, the quarantine determination unit 202 uses the information of the terminal list information 205 stored in the security information storage unit 204 and the terminal connection information stored in the connection information storage unit 203. The comparison is made and the result is stored in the quarantine result storage unit 17 (ST213).
If the quarantine target terminal 3 is a terminal registered in the terminal list information 205, the process proceeds to ST211. If the quarantine target terminal 3 is not registered in the terminal list information 205, the process proceeds to ST402.

When the transmission source is the terminal 3, the quarantine determination unit 202 compares the information of the applied security patch information 206 stored in the security information storage unit 204 and the terminal information of the terminal 3 stored in the terminal information storage unit 15. The applied security patch information is compared, and the result is stored in the quarantine result storage unit 17 (ST214).
If a security patch to be applied to the quarantine target terminal 3 has been applied, the process proceeds to ST215. When the security patch to be applied to the quarantine target terminal 3 is not applied, the process proceeds to ST403.

When the terminal 3 to be quarantined is a terminal to which a security patch has been applied, the quarantine determination unit 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The application information of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST215).
When the security product to be applied to the quarantine target terminal 3 is applied, the process proceeds to ST216. When the security product to be applied to the quarantine target terminal 3 is not applied, the process proceeds to ST404.

When the terminal 3 to be quarantined is a terminal to which a security product has been applied, the quarantine determination means 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The version information of the application of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST216).
If the versions of the security products to be applied to the quarantine target terminal 3 match, the process proceeds to ST217. If the versions of the security products to be applied to the quarantine target terminal 3 do not match, the process proceeds to ST405.

If the terminal 3 to be quarantined is a terminal whose security product version also matches, the quarantine determination unit 202 stores the security product information 207 information stored in the security information storage unit 203 and the terminal information storage unit 15. The application setting information of the terminal information stored in the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST217).
If the terminal 3 to be quarantined is a terminal for which the security product to be applied is correctly set, the process proceeds to ST218. If the terminal 3 to be quarantined is a terminal for which the security product to be applied is not set correctly, the process proceeds to ST406.

If the terminal 3 to be quarantined is a terminal in which the security product is correctly set, the quarantine determination unit 202 is stored in the operation process information stored in the security information storage unit 203 and the terminal information storage unit 15. The operation process information of the terminal 3 that is currently in operation is compared, and the result is stored in the quarantine result storage unit 17 (ST218).
If a process registered as a process that should be operating is operating and a process registered as a process that should not be operating is not operating, the process proceeds to ST401. If the process that should be running is not running, or if the terminal is running a process that should not be running, the process proceeds to ST407.

The access restriction instructing unit 13 confirms the quarantine result stored in the quarantine result storage unit 17. If the quarantine result is OK, the access restriction instruction unit 13 displays the quarantine result 18 a of the access restriction information stored in the access restriction information storage unit 18. The access destination for countermeasures for quarantine OK is acquired, and access information is created by combining the MAC address of the terminal 3 that has executed the quarantine and a list in which the access destination URL does not exist (ST401).
The access restriction instructing means 13 transmits the access information created in ST401 to the secure gate device, and executes an access restriction release instruction for the terminal 3 designated by the MAC address (ST130).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instruction unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined is an unregistered terminal, and stores it in the access restriction information storage unit 18. By referring to the quarantine result 18a, the countermeasure access destination 18b of the unregistered terminal is acquired (S402).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST402 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined has not been applied with the security patch, and is stored in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b to which the security patch has not been applied is acquired (ST403).
The access restriction instructing unit 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST403 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined has not been applied with the security countermeasure application, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b to which the security countermeasure application is not applied is acquired (ST404).
The access restriction instructing unit 13 creates access information that combines the URL list of access destinations for countermeasures acquired in ST404 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instruction unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined does not match the security countermeasure application version, and stores it in the access restriction information storage unit 18. The quarantine result 18a is referred to, and the countermeasure access destination 18b for the security countermeasure application version mismatch is acquired (ST405).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST405 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be set as a security countermeasure application, and is stored in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b that cannot set the security countermeasure application is acquired (ST406).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST406 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be registered process operation information, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b incapable of registering process operation information is acquired (ST407).
The access restriction instructing unit 13 creates access information that combines the URL list of access destinations for countermeasures acquired in ST407 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

  As described above, according to the present embodiment, as the information stored in the access restriction information storage unit 18, the MAC address and the IP address can be set simultaneously with the URL of the access destination. The present invention is characterized in that it can be implemented even if it is mixed with servers deployed in the network.

In other words, the present embodiment is accessed to implement a security measure corresponding to the quarantine result, and accessed to implement a security measure corresponding to the quarantine result, with the first countermeasure server connected via the Internet. And a second countermeasure server connected via a network,
The access restriction information stored in the access restriction information storage unit is composed of access destination information including a URL, a MAC (Media Access Control) address, an IP address to be accessed for implementing security measures, and the identification information.
When the quarantine determination means determines that the terminal should not be connected to the network, the access restriction instruction means selects the URL, MAC address, and IP address of the access destination information stored in the access restriction information storage means. Select access destination information corresponding to the first countermeasure server or the second countermeasure server, and create access information composed of the selected access destination information and the address information of the terminal that has been quarantined by the quarantine determination means. The access information is transmitted to the secure gate device.

Note that the order in which the quarantine determination is performed is not necessarily the main order.
Also, the items for which the quarantine determination is performed are not limited to those shown in the present embodiment.
In addition, the security countermeasure application and the registration process may be subject to a plurality of inspections.
Data stored in the security information storage unit 16 serving as a criterion for executing the quarantine can be automatically downloaded from a server corresponding to the security information, registered using a medium such as a CD-ROM, or from a registration screen. It is assumed that storage is performed by means such as registration from the administrator.
Further, in this configuration, the secure gate device and the management device are configured separately, but the configuration may be such that the quarantine determination performed by the management device is performed in the secure gate device.
In this embodiment, countermeasures are implemented when individual quarantine determinations are performed. However, as shown in the third embodiment, countermeasures may be implemented collectively.

  As described above, according to the fifth embodiment, when a terminal 3 that requires countermeasures as a result of quarantine is detected, URLs, MAC addresses, and IP addresses can be mixed as countermeasure access destinations. Countermeasure servers coexist inside and outside the company, and the in-house server can be used even when implementing countermeasures using a unique protocol.

Embodiment 6 FIG.
In the above embodiment, all accesses are permitted when the quarantine is OK. However, in this embodiment, when the terminal is disconnected from the network, it is in an unquarantined state. Will be described.
FIG. 21 is a block diagram of each device constituting the quarantine network system according to the sixth embodiment. The same reference numerals as those in FIG.
In FIG. 21, reference numeral 301 denotes a connection terminal information storage unit as connection terminal information storage means for storing the MAC address, IP address, and last communication time of the terminal 3 connected under the secure gate device 2.

FIG. 22 is a diagram illustrating an example of access information stored in the connected terminal information storage unit 301.
In FIG. 22, 301 a is the MAC address of the terminal 3 connected under the secure gate device 2.
301b is the IP address of the terminal 3 connected under the secure gate device 2.
Reference numeral 301 c denotes a final communication time which is the last communication time performed by the terminal 3 connected under the secure gate device 2 via the secure gate device 2.
FIG. 23 is a diagram showing an example of access restriction information stored in the access restriction information storage unit 18 of the present embodiment.

Next, the operation will be described.
FIG. 24 is a flowchart showing the processing operation of the secure gate device 2.
First, the operation of the secure gate device 2 will be described with reference to FIG.
The connection information acquisition unit 209 monitors whether a terminal has been connected to itself (ST201). If connected, the process proceeds to ST502. If not connected, the process proceeds to ST501.
The connection information acquisition unit 209 confirms the final communication time 301c of each terminal stored in the connection terminal information storage unit 301 (ST501). If there is a terminal that has not communicated for a certain time, the process proceeds to ST503. If there is no terminal that has not communicated for a certain time, the process proceeds to ST111.

The access control execution means 21 receives the access information configured by the MAC address and the access destination URL list transmitted from the management device 1 (ST111).
The access control execution means 21 determines whether or not it is an access restriction request from the received content (ST112). If there is an access destination list corresponding to the MAC address, it is determined as an access restriction request, and the process proceeds to ST113. If there is no access destination list corresponding to the MAC address, it is determined as an access restriction release request, and the process proceeds to ST115.
If it is determined that the request is an access restriction request, the access information configured by the MAC address acquired in ST111 and the access permission list that is the access destination URL list is stored in the access information storage unit 22 (ST113). An example of information to be stored is shown in FIG. Thereafter, if the communication of the terminal 3 instructed to restrict access is not described in the access permission list 22b, the access is blocked and only the described one is permitted (ST401).

If it is determined as an access restriction release request, the entry of the corresponding MAC address stored in the access information storage unit 22 is deleted based on the MAC address information of the access information acquired in ST111 (ST115). Thereafter, the communication restriction of the terminal 3 instructed to release the access restriction is not implemented (ST116).
When the terminal 3 is connected, the connection information acquisition unit 209 acquires the MAC address, IP address, and current time of the connected terminal 3 and stores them in the connected terminal information storage unit 301 (ST502).
The connection information transmitting means 210 transmits the MAC address and IP address information of the terminal 3 acquired in ST202 to the management apparatus 1 (ST203).

When there is a terminal that has not communicated for a certain period of time, the connection information acquisition unit 209 acquires the MAC address and IP address of the corresponding terminal from the connection terminal information storage unit 301 and deletes it from the connection terminal information storage unit 301 (ST503).
The connection information transmission means 210 transmits the MAC address and IP address information of the terminal acquired in ST503 to the management apparatus 1 (ST504).

FIG. 25 is a flowchart showing the processing operation of the management apparatus 1.
Next, the operation of the management apparatus 2 will be described with reference to FIG.
Information collecting means 201 receives terminal information transmitted from terminal 3 (agent 4) or terminal connection information transmitted from secure gate device 2 (ST211).
The information collection unit 201 determines the transmission source (ST212). If the transmission source is terminal 3, the received terminal information is stored in terminal information storage unit 15, and the process proceeds to ST214. If the transmission source is secure gate device 2, the received terminal connection information is stored in connection information storage section 203, and the process proceeds to ST505.

Quarantine determination means 202 determines whether the transmitted information is terminal connection information or terminal connection disconnection information (ST505). In the case of terminal connection information, the process proceeds to ST213. In the case of terminal connection disconnection information, the process proceeds to ST506.
In the case of the terminal connection information, the quarantine determination unit 202 compares the information of the terminal list information 205 stored in the security information storage unit 204 with the terminal connection information stored in the connection information storage unit 203, and the result Is stored in the quarantine result storage unit 17 (ST213).
If the quarantine target terminal 3 is a terminal registered in the terminal list information 205, the process proceeds to ST211. If the quarantine target terminal 3 is not registered in the terminal list information 205, the process proceeds to ST402.

In the case where the terminal 3 to be quarantined is registered, the quarantine determination unit 202 is stored in the terminal information storage unit 15 and the information of the applied security patch information 206 stored in the security information storage unit 204. The applied security patch information of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST214).
If a security patch to be applied to the quarantine target terminal 3 has been applied, the process proceeds to ST215. When the security patch to be applied to the quarantine target terminal 3 is not applied, the process proceeds to ST403.

When the terminal 3 to be quarantined is a terminal to which a security patch has been applied, the quarantine determination unit 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The application information of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST215).
When the security product to be applied to the quarantine target terminal 3 is applied, the process proceeds to ST216. When the security product to be applied to the quarantine target terminal 3 is not applied, the process proceeds to ST404.

When the terminal 3 to be quarantined is a terminal to which a security product has been applied, the quarantine determination means 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The version information of the application of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST216).
If the versions of the security products to be applied to the quarantine target terminal 3 match, the process proceeds to ST217. If the versions of the security products to be applied to the quarantine target terminal 3 do not match, the process proceeds to ST405.

If the terminal 3 to be quarantined is a terminal whose security product version also matches, the quarantine determination unit 202 stores the security product information 207 information stored in the security information storage unit 203 and the terminal information storage unit 15. The application setting information of the terminal information stored in the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST217).
If the terminal 3 to be quarantined is a terminal for which the security product to be applied is correctly set, the process proceeds to ST218. If the terminal 3 to be quarantined is a terminal for which the security product to be applied is not set correctly, the process proceeds to ST406.

  If the terminal 3 to be quarantined is a terminal in which the security product is correctly set, the quarantine determination means 202 is stored in the operation process information stored in the security information storage unit 203 and the terminal information storage unit 15. The operation process information of the terminal 3 that is currently in operation is compared, and the result is stored in the quarantine result storage unit 17 (ST218). If a process registered as a process that should be operating is operating and a process registered as a process that should not be operating is not operating, the process proceeds to ST401. If the process that should be running is not running, or if the terminal is running a process that should not be running, the process proceeds to ST407.

The access restriction instructing unit 13 confirms the quarantine result stored in the quarantine result storage unit 17. The access address for countermeasures for quarantine OK is obtained by referring to the access information that combines the MAC address of the terminal 3 that has executed the quarantine and a list in which the access destination does not exist (ST401).
The access restriction instructing means 13 transmits the access information created in ST401 to the secure gate device, and executes an access restriction release instruction for the terminal 3 designated by the MAC address (ST130).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instruction unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined is an unregistered terminal, and stores it in the access restriction information storage unit 18. By referring to the quarantine result 18a, the countermeasure access destination 18b of the unregistered terminal is acquired (S402).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST402 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined has not been applied with the security patch, and is stored in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b to which the security patch has not been applied is acquired (ST403).
The access restriction instructing unit 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST403 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined has not been applied with the security countermeasure application, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b to which the security countermeasure application is not applied is acquired (ST404).
The access restriction instructing unit 13 creates access information that combines the URL list of access destinations for countermeasures acquired in ST404 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instruction unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined does not match the security countermeasure application version, and stores it in the access restriction information storage unit 18. The quarantine result 18a is referred to, and the countermeasure access destination 18b for the security countermeasure application version mismatch is acquired (ST405).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST405 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be set as a security countermeasure application, and is stored in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b that cannot set the security countermeasure application is acquired (ST406).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST406 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be registered process operation information, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b incapable of registering process operation information is acquired (ST407).
The access restriction instructing unit 13 creates access information that combines the URL list of access destinations for countermeasures acquired in ST407 and the MAC address of the terminal 3 that has quarantined (ST408).

The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).
In the case of the terminal connection disconnection information, the access restriction instructing unit 13 refers to the quarantine result 18a of the access restriction information stored in the access restriction information storage unit 18 and obtains an unquarantined countermeasure access destination 18b ( ST506).

Note that the order in which the quarantine determination is performed is not necessarily the main order.
Also, the items for which the quarantine determination is performed are not limited to those shown in the present embodiment.
In addition, the security countermeasure application and the registration process may be subject to a plurality of inspections.
Data stored in the security information storage unit 16 serving as a criterion for executing the quarantine can be automatically downloaded from a server corresponding to the security information, registered using a medium such as a CD-ROM, or from a registration screen. It is assumed that storage is performed by means such as registration from the administrator.
Further, in this configuration, the secure gate device and the management device are configured separately, but the configuration may be such that the quarantine determination performed by the management device is performed in the secure gate device.
In this embodiment, countermeasures are implemented when individual quarantine determinations are performed. However, as shown in the third embodiment, countermeasures may be implemented collectively.

As described above, according to the sixth embodiment, when the terminal connected to the network is in a state where communication is not performed due to power-off or disconnection from the network, the access restriction of the corresponding terminal is changed. Even if the terminal 3 is connected to the network again, it is possible to carry out the quarantine.
Even when the terminal communication cannot be notified due to the OS being down or the like, the quarantine can be performed when the terminal is connected again.

Embodiment 7 FIG.
In the above embodiment, the access restriction of the terminal is performed at the time when the quarantine is executed. In the present embodiment, a case will be described in which the timing of executing the quarantine on the terminal is controlled.
FIG. 26 is a block diagram of each device constituting the quarantine network system according to the seventh embodiment. The same reference numerals as those in FIG.
In FIG. 26, reference numeral 401 denotes terminal status monitoring means for monitoring the status when the terminal is connected to the network or when there is a quarantine request from the user.

Next, the operation will be described.
FIG. 27 is a flowchart showing the processing operation of the agent 4 on the terminal 3.
First, the operation of the agent 4 will be described with reference to FIG.
Terminal state monitoring means 401 monitors the timing for executing quarantine such as network connection, user logon, and user request (ST601).
Terminal state monitoring section 401 determines whether or not terminal information (terminal state) has been acquired (ST602). If it is determined that the terminal information is to be acquired, the process proceeds to ST101. If it is determined that the terminal information is not being acquired, the process proceeds to ST601.

Terminal information acquisition means 41 acquires terminal information of terminal 3 (ST101). The terminal information to be acquired includes OS name, version, applied service pack, applied security patch information, computer name, IP address, MAC address, registered service information, service setting information, operation process information, installed application information, application version information, Information such as application setting information.
When the acquisition is completed, the terminal information transmission unit 42 transmits the terminal information acquired in ST101 to the management apparatus 1 (ST102).

When the quarantine determination is executed in the management apparatus 1 and the quarantine result is transmitted, the countermeasure implementing means 43 receives the transmitted quarantine result (ST103).
The countermeasure implementation means 43 confirms the quarantine result (ST104). If it is determined that there is no problem as a result of the quarantine, the process proceeds to ST601. If it is determined that there is a problem, the process proceeds to ST105.
The countermeasure implementation means 43 performs security countermeasures for the terminal based on the quarantine result transmitted from the management apparatus 1, and proceeds to ST601 to execute the quarantine again, and issues a terminal information acquisition request from the user (ST105). ).

As described above, by monitoring the timing for executing the quarantine on the terminal side, by defining the timing at which quarantine is considered necessary in the system rather than simply quarantine only when connecting to the network, Quarantine can be carried out.
In addition, since the terminal status is monitored, it is possible to execute the quarantine even when the terminal once connected to the network disconnects the network cable and connects again.

Embodiment 8 FIG.
In the above embodiment, the quarantine request from the terminal side is performed at the time of network connection, logon, or user request, but in this embodiment, the registration process is activated. A case where quarantine is executed based on the state will be described.
FIG. 28 is a block diagram of each device constituting the quarantine network system according to the eighth embodiment. The same reference numerals as those in FIG.
In FIG. 28, reference numeral 501 denotes monitoring target information distribution means for distributing timing information for executing the quarantine to the agent 4 on the terminal 3.
Reference numeral 502 denotes a monitoring target information storage unit as a monitoring target information storage unit that stores the timing at which information for performing quarantine is executed by the agent 4 on the terminal 3.
Reference numeral 503 denotes monitoring target information acquisition means for acquiring monitoring target information to be monitored from the management apparatus 1.
A monitoring information storage unit 504 stores monitoring target information acquired by the monitoring target information acquisition unit 503.

Next, the operation will be described.
FIG. 29 is a flowchart showing the processing operation of the agent 4 on the terminal 3.
First, the operation of the agent 4 will be described with reference to FIG.
The monitoring target information acquisition unit 503 acquires the monitoring target information from the management apparatus 1, and stores the acquired information in the monitoring information storage unit 504 (ST701).
The terminal state monitoring unit 401 monitors the monitoring items stored in the monitoring information storage unit 504. Items specified as items to be monitored monitor the timing of execution of quarantine such as network connection, user logon, user request, down of a process that must be running, and operation of a process that should not be running (ST601).

Terminal state monitoring section 401 determines whether or not terminal information acquisition has been entered (ST602). If it is determined that the terminal information is to be acquired, the process proceeds to ST101. If it is determined that the terminal information is not being acquired, the process proceeds to ST601.
Terminal information acquisition means 41 acquires terminal information of terminal 3 (ST101). The terminal information to be acquired includes OS name, version, applied service pack, applied security patch information, computer name, IP address, MAC address, registered service information, service setting information, operation process information, installed application information, application version information, Information such as application setting information.
When the acquisition is completed, the terminal information transmission unit 42 transmits the terminal information acquired in ST101 to the management apparatus 1 (ST102).

When the quarantine determination is executed in the management apparatus 1 and the quarantine result is transmitted, the countermeasure implementing means 43 receives the transmitted quarantine result (ST103).
The countermeasure implementation means 43 confirms the quarantine result (ST104). When it is determined that there is no problem as a result of the quarantine, the process proceeds to ST601. If it is determined that there is a problem, the process proceeds to ST105.
The countermeasure implementation means 43 performs security countermeasures for the terminal based on the quarantine result transmitted from the management apparatus 1, and proceeds to ST601 to execute the quarantine again, and issues a terminal information acquisition request from the user (ST105). ).

FIG. 30 is a flowchart showing the processing operation of the management apparatus 1.
Next, the operation of the management apparatus 1 will be described with reference to FIG.
Information collecting means 201 receives terminal information transmitted from terminal 3 (agent 4) or terminal connection information transmitted from secure gate device 2 (ST211).
The information collection unit 201 determines the transmission source (ST212). If the transmission source is terminal 3, the process proceeds to ST702. If the transmission source is secure gate device 2, the received terminal connection information is stored in connection information storage section 203, and the process proceeds to ST505.
Information collection means 201 determines whether information transmission from terminal 3 is acquisition of monitoring information or transmission of terminal information (ST702). In the case of obtaining monitoring information, the process proceeds to ST703. In the case of terminal information transmission, the received terminal information is stored in terminal information storage section 15, and the process proceeds to ST214.

The monitoring target information distribution unit 501 acquires the information stored in the monitoring target information storage unit 502 and the operation process information 208 in the security information storage unit 204, and sends them to the terminal 3 (ST703).
Quarantine determination means 202 determines whether the transmitted information is terminal connection information or terminal connection disconnection information (ST505). In the case of terminal connection information, the process proceeds to ST213. In the case of terminal connection disconnection information, the process proceeds to ST506.

In the case of the terminal connection information, the quarantine determination unit 202 compares the information of the terminal list information 205 stored in the security information storage unit 204 with the terminal connection information stored in the connection information storage unit 203, and the result Is stored in the quarantine result storage unit 17 (ST213).
If the quarantine target terminal 3 is a terminal registered in the terminal list information 205, the process proceeds to ST211. If the quarantine target terminal 3 is not registered in the terminal list information 205, the process proceeds to ST402.

If the terminal 3 to be quarantined is a registered terminal, the quarantine determination unit 202 is stored in the terminal information storage unit 15 and the information of the applied security patch information 206 stored in the security information storage unit 203. The applied security patch information of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST214).
If a security patch to be applied to the quarantine target terminal 3 has been applied, the process proceeds to ST215. When the security patch to be applied to the quarantine target terminal 3 is not applied, the process proceeds to ST403.

When the terminal 3 to be quarantined is a terminal to which a security patch has been applied, the quarantine determination unit 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The application information of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST215).
When the security product to be applied to the quarantine target terminal 3 is applied, the process proceeds to ST216. When the security product to be applied to the quarantine target terminal 3 is not applied, the process proceeds to ST404.

When the terminal 3 to be quarantined is a terminal to which a security product has been applied, the quarantine determination means 202 is stored in the security information information 207 stored in the security information storage unit 203 and the terminal information storage unit 15. The version information of the application of the terminal information of the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST216).
If the versions of the security products to be applied to the quarantine target terminal 3 match, the process proceeds to ST217. If the versions of the security products to be applied to the quarantine target terminal 3 do not match, the process proceeds to ST405.

If the terminal 3 to be quarantined is a terminal whose security product version also matches, the quarantine determination unit 202 stores the security product information 207 information stored in the security information storage unit 203 and the terminal information storage unit 15. The application setting information of the terminal information stored in the terminal 3 is compared, and the result is stored in the quarantine result storage unit 17 (ST217).
If the terminal 3 to be quarantined is a terminal for which the security product to be applied is correctly set, the process proceeds to ST218. If the terminal 3 to be quarantined is a terminal for which the security product to be applied is not set correctly, the process proceeds to ST406.

  If the terminal 3 to be quarantined is a terminal in which the security product is correctly set, the quarantine determination means 202 is stored in the operation process information stored in the security information storage unit 203 and the terminal information storage unit 15. The operation process information of the terminal 3 that is currently in operation is compared, and the result is stored in the quarantine result storage unit 17 (ST218). If a process registered as a process that should be operating is operating and a process registered as a process that should not be operating is not operating, the process proceeds to ST401. If the process that should be running is not running, or if the terminal is running a process that should not be running, the process proceeds to ST407.

The access restriction instructing unit 13 confirms the quarantine result stored in the quarantine result storage unit 17. If the quarantine result is OK, the access restriction instruction unit 13 displays the quarantine result 18 a of the access restriction information stored in the access restriction information storage unit 18. The access destination for countermeasures for quarantine is acquired, and access information is created by combining the MAC address of the terminal 3 that has performed the quarantine and a list in which no access destination exists (ST401).
The access restriction instructing means 13 transmits the access information created in ST401 to the secure gate device, and executes an access restriction release instruction for the terminal 3 designated by the MAC address (ST130).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instruction unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined is an unregistered terminal, and stores it in the access restriction information storage unit 18. By referring to the quarantine result 18a, the countermeasure access destination 18b of the unregistered terminal is acquired (S402).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST402 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined has not been applied with the security patch, and is stored in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b to which the security patch has not been applied is acquired (ST403).
The access restriction instructing unit 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST403 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined has not been applied with the security countermeasure application, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b to which the security countermeasure application is not applied is acquired (ST404).
The access restriction instructing unit 13 creates access information that combines the URL list of access destinations for countermeasures acquired in ST404 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and performs the access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit, determines that the terminal 3 to be quarantined does not match the security countermeasure application version, and is stored in the access restriction information storage unit 18. The quarantine result 18a is referred to, and the countermeasure access destination 18b for which the security countermeasure application version does not match is acquired (ST405).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST405 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be set as a security countermeasure application, and is stored in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b that cannot set the security countermeasure application is acquired (ST406).
The access restriction instructing means 13 creates access information that combines the URL list of countermeasure access destinations acquired in ST406 and the MAC address of the terminal 3 that has quarantined (ST408).
The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).

The access restriction instructing unit 13 acquires the quarantine result information stored in the quarantine result storage unit 17, determines that the terminal 3 to be quarantined cannot be registered process operation information, and stores it in the access restriction information storage unit 18. Referring to the quarantine result 18a, the countermeasure access destination 18b incapable of registering process operation information is acquired (ST407).
The access restriction instructing unit 13 creates access information that combines the URL list of access destinations for countermeasures acquired in ST407 and the MAC address of the terminal 3 that has quarantined (ST408).

The access restriction instructing means 13 transmits the access information created in ST408 to the secure gate device, and implements an access restriction instruction for the terminal 3 designated by the MAC address (ST127).
The countermeasure instruction unit 14 transmits the quarantine result stored in the quarantine result storage unit 17 to the terminal 3, and causes the agent 4 of the terminal 3 to implement the countermeasure (ST128).
In the case of the terminal connection disconnection information, the access restriction instructing unit 13 refers to the quarantine result 18a of the access restriction information stored in the access restriction information storage unit 18 and obtains an unquarantined countermeasure access destination 18b ( ST506).

Note that the order in which the quarantine determination is performed is not necessarily the main order.
Also, the items for which the quarantine determination is performed are not limited to those shown in the present embodiment.
In addition, the security countermeasure application and the registration process may be subject to a plurality of inspections.
Data stored in the security information storage unit 16 serving as a criterion for executing the quarantine can be automatically downloaded from a server corresponding to the security information, registered using a medium such as a CD-ROM, or from a registration screen. It is assumed that storage is performed by means such as registration from the administrator.
Further, in this configuration, the secure gate device and the management device are configured separately, but the configuration may be such that the quarantine determination performed by the management device is performed in the secure gate device.
In this embodiment, countermeasures are implemented when individual quarantine determinations are performed. However, as shown in the third embodiment, countermeasures may be implemented collectively.

  As described above, according to the eighth embodiment, the timing for executing the quarantine on the terminal side is set on the management apparatus and distributed, so that the timing at which the quarantine is considered necessary in the system is set. It can be reflected in all terminals.

1 is a configuration diagram of a quarantine network system according to a first embodiment. FIG. 3 is a configuration diagram of each device of the quarantine network system according to the first embodiment. The figure which showed the access restriction information stored in the access restriction information storage part 18 in Embodiment 1. FIG. The figure which showed the access information stored in the access information storage part 22 in Embodiment 1. FIG. 5 is a flowchart showing processing operations of an agent 4 in the first embodiment. 5 is a flowchart showing processing operations of the secure gate device 2 according to the first embodiment. 5 is a flowchart showing a processing operation of the management apparatus 1 according to the first embodiment. The block diagram of each apparatus of the quarantine network system in Embodiment 2. FIG. The figure which showed the access restriction information stored in the access restriction information storage part 18 in Embodiment 2. FIG. The figure which showed the access information stored in the access information storage part 22 in Embodiment 2. FIG. 9 is a flowchart showing a processing operation of the secure gate device 2 according to the second embodiment. 9 is a flowchart showing a processing operation of the management apparatus 1 in the second embodiment. 10 is a flowchart showing a processing operation of the management apparatus 1 according to the third embodiment. The figure which showed the access information stored in the access information storage part 22 in Embodiment 3. FIG. The figure which showed the access restriction information stored in the access restriction information storage part 18 in Embodiment 4. FIG. FIG. 6 is a configuration diagram of a quarantine network system according to a fifth embodiment. The figure which showed the access restriction information stored in the access restriction information storage part 18 in Embodiment 5. FIG. The figure which showed the access information stored in the access information storage part 22 in Embodiment 5. FIG. 10 is a flowchart showing processing operations of the secure gate device 2 according to the fifth embodiment. 10 is a flowchart showing a processing operation of the management apparatus 1 according to the fifth embodiment. The block diagram of each apparatus of the quarantine network system in Embodiment 6. FIG. The figure which showed the access information stored in the connecting terminal information storage part 301 in Embodiment 6. FIG. The figure which showed the access restriction information stored in the access restriction information storage part 18 in Embodiment 6. FIG. 18 is a flowchart showing processing operations of secure gate device 2 in the sixth embodiment. 18 is a flowchart showing a processing operation of the management apparatus 1 in the sixth embodiment. The block diagram of each apparatus of the quarantine network system in Embodiment 7. FIG. 18 is a flowchart showing processing operations of the agent 4 in the seventh embodiment. The block diagram of each apparatus of the quarantine network system in Embodiment 8. FIG. 19 is a flowchart showing processing operations of an agent 4 in the eighth embodiment. FIG. 19 is a flowchart showing a processing operation of the management apparatus 1 in the eighth embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 Management apparatus, 2 Secure gate apparatus, 3 Terminal, 4 Agent, 5 Communication line, 6 Proxy server, 7 Countermeasure server, 8 WWW server, 9 Internet, 11 Information collection means, 12 Quarantine judgment means, 13 Access restriction instruction means, 14 countermeasure instruction means, 15 terminal information storage section, 16 security information storage section, 17 quarantine result storage section, 18 access restriction information storage section, 21 access restriction implementation means, 22 access information storage section, 41 terminal information acquisition means, 42 terminal Information transmission means, 43 countermeasure implementation means, 201 information collection means, 202 quarantine determination means, 203 connection information storage section, 204 security information storage section, 205 terminal list information, 206 applied security patch information, 207 security product information, 208 operation process Information, 2 9 connection information acquiring unit, 210 the connection information transmitting unit, 301 measures server 401 the terminal status monitoring unit, 501 monitor target information distribution unit, 502 monitor target information storage unit, 503 monitor target information acquiring unit, 504 monitoring information storage unit.

Claims (14)

An agent installed on the terminal that sends the terminal information obtained from this terminal,
Determination criterion information storage means for storing determination criterion information for determining whether or not the terminal may be connected to the network, and storage in the terminal information and determination criterion information storage means transmitted by the agent Quarantine determination means for determining whether or not the terminal may connect to the network based on the determined determination criterion information, and identification information associated with the quarantine result determined by the quarantine determination hand And access restriction information storage means storing access restriction information comprising access destination information that is accessed to implement security measures corresponding to the quarantine result, and the quarantine determination means connects the terminal to the network. The access restriction information stored in the access restriction information storage means when a quarantine decision is made. And access restriction instruction means for obtaining access destination information, creating access information composed of the access destination information and the address information of the terminal quarantined by the quarantine judgment means, and transmitting the access information. And a management device connected to the terminal via a network;
A secure gate device connected to the terminal and the management device via a network and permitting communication of the terminal only to access destination information of the access information based on the access information transmitted by the management device;
A quarantine network system characterized by comprising: The management means includes a countermeasure instruction means for transmitting the quarantine result determined by the quarantine determination means to the terminal,
The quarantine network system according to claim 1, wherein the agent implements security measures for the terminal based on the quarantine result transmitted by the countermeasure instruction unit. The secure gate device includes connection information acquisition means for acquiring terminal connection information of a terminal connected to a network,
The determination criterion information storage means stores a list of terminals connectable to the network,
The quarantine determination unit is configured to connect a terminal connected to the network based on the terminal connection information acquired by the connection information acquisition unit and a list of terminals stored in the determination criterion information storage unit to the network. 3. The quarantine network system according to claim 1, wherein a quarantine determination is made as to whether or not it is acceptable. The agent transmits security patch information used by the terminal acquired from the terminal,
The determination criterion information storage means stores security patch information to be used by the terminal,
The quarantine determination means performs a quarantine determination as to whether or not the terminal may be connected to the network based on the security patch information transmitted by the agent and the security patch information stored in the determination criterion information storage means. The quarantine network system according to claim 1 or 2, characterized by the above. The agent transmits security countermeasure product information used by the terminal acquired from the terminal,
The determination criterion information storage means stores security countermeasure product information to be used by the terminal,
The determination means determines whether or not the terminal may connect to the network based on the security countermeasure product information transmitted by the agent and the security countermeasure product information stored in the determination criterion information storage means. The quarantine network system according to claim 1 or 2, characterized in that: The agent transmits the security countermeasure product version information used by the terminal acquired from the terminal,
The determination criterion information storage means stores security countermeasure product version information to be used by the terminal,
The determination means determines whether or not the terminal may connect to the network based on the security countermeasure product version information transmitted by the agent and the security countermeasure product version information stored in the determination criterion information storage means. The quarantine network system according to claim 1, wherein the determination is made. The agent transmits process operation information operating on the terminal acquired from the terminal,
The determination criterion information storage means stores process operation information to be used by the terminal,
The determination means makes a quarantine determination as to whether or not the terminal may be connected to the network based on the process operation information transmitted by the agent and the process operation information stored in the determination criterion information storage means. The quarantine network system according to claim 1 or 2, characterized by the above. The agent transmits security patch information, security countermeasure product information, security countermeasure product version information, and process operation information used by the terminal acquired from the terminal,
The determination criterion information storage means includes security patch information to be used by the terminal, security countermeasure product information to be used by the terminal, security countermeasure product version information to be used by the terminal, and process operation information to be used by the terminal. And store
The determination means includes the security patch information transmitted from the agent, the security countermeasure product information, the security countermeasure product version information, the process operation information, the security patch information stored in the determination criterion information storage means, and the security countermeasure. 3. The quarantine network according to claim 1, wherein product information, security countermeasure product version information, and process operation information are sequentially compared to determine whether or not the terminal can be connected to the network. system. The determination means includes the security patch information transmitted from the agent, the security countermeasure product information, the security countermeasure product version information, the process operation information, the security patch information stored in the determination criterion information storage means, and the security countermeasure. Comparing all product information, security countermeasure product version information and process operation information to determine whether or not the terminal may be connected to the network,
The access restriction instructing means is an access destination corresponding to one or a plurality of causes determined that the terminal should not be connected to the network when the quarantine determining means determines that the terminal should not be connected to the network. 9. The quarantine network according to claim 8, wherein access information including information and address information of the terminal that has been quarantined by the quarantine determination unit is created, and the access information is transmitted to the secure gate device. system. A first countermeasure server that is accessed to implement security measures corresponding to the quarantine result and connected via the Internet, and is accessed to implement security measures corresponding to the quarantine result, via the network A second countermeasure server connected,
The access restriction information stored in the access restriction information storage unit includes access destination information including a URL (Uniform Resource Locator), a MAC (Media Access Control) address and an IP address to be accessed in order to implement security measures, and the identification. Information and
The access restriction instructing means, when the quarantine judgment means judges that the terminal should not be connected to the network, the URL, MAC address and IP of the access destination information stored in the access restriction information storage means The access destination information corresponding to the first countermeasure server or the second countermeasure server is selected from the addresses, and the selected access destination information and the address information of the terminal that has been quarantined by the quarantine determination means, 3. The quarantine network system according to claim 1 or 2, wherein the access information configured as described above is created, and the access information is transmitted to the secure gate device. The secure gate device includes connection terminal information storage means for storing the terminal connection information and a final communication time between terminals connected to the network,
The connection information acquisition means checks whether there is no terminal communication for a fixed time based on the final communication time stored in the connection terminal information storage means, and when there is no terminal communication for a certain time, the connection terminal information storage means 4. The quarantine network system according to claim 3, wherein the stored terminal connection information is acquired. The agent includes a terminal state monitoring unit that monitors whether or not the terminal information of the terminal connected to the network has been acquired, and is determined to have acquired the terminal information by the terminal state monitoring unit. 3. The quarantine network system according to claim 1, wherein the terminal information is acquired from the terminal and transmitted to the management apparatus. The management device includes monitoring target information storage means storing timing information for performing a quarantine determination, and monitoring target information acquisition means for acquiring the timing information stored in the monitoring target information storage means and distributing the timing information to the agent. With
The terminal status monitoring means determines whether the terminal information is obtained by monitoring the timing information distributed by the management means;
13. The agent according to claim 12, wherein the agent acquires the terminal information from the terminal and transmits it to the management device when it is determined by the terminal state monitoring means that the terminal information has been acquired. Quarantine network system. The quarantine network system according to any one of claims 1 to 13, wherein the access restriction information includes the identification information and access destination information using a wild card or a regular expression.

Images