JP2008102702A - Security management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security management system determining whether or not an appropriate security policy has been set by automatically determining whether a target device is a stationary device or a portable device. <P>SOLUTION: When information is sent from the information sending function of a client PC, the security managing function of a security management server identifies the kind of client shown in the information received. When the kind of client is a mobile terminal, the function determines whether or not each piece of security policy information set in a security policy has appropriate content. For example, as to whether or not encryption is necessary, whether or not installation of vaccine software is necessary, whether or not a basic software patch is necessary, and whether or not a setting for disabling taking out is necessary, a determination is made as to whether or not they are all necessary ("encryption necessary," etc.); if there is any item that is not necessary, it is determined to be a violation of the security policy. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a security management system for information processing equipment.

  As computer hardware becomes more sophisticated, cheaper, and smaller, it has become common to use computers in all aspects of daily life. In particular, nowadays, opportunities for connecting computers to a network such as a LAN or the Internet are increasing. For example, information necessary for corporate activities is centrally managed by a server device, and each employee is allowed to use a personal computer (hereinafter simply referred to as “PC”) as a terminal device. By connecting to the network, information necessary for business is obtained, information on the server device is updated, and the like.

  The so-called information that occurs due to the loss of the information processing device itself or the taking of a recording medium on which information is recorded due to the centralization of information using the network and the wide access to information processing by information processing devices such as PCs. Leakage has become a major social problem. Therefore, various measures are taken to prevent information leakage. The most common method is to display a so-called login screen when the information processing device starts up, and to prevent the information processing device from being operated unless a valid user ID and password are entered. It has been broken.

  Further, as in the invention described in Patent Document 1, an automatic encryption / decryption program is installed in an information processing device, and is automatically encrypted when information is written to a recording medium such as a hard disk. A technique of automatically decoding when reading is also known. Further, as in the invention described in Patent Document 2, a security management server is connected in the network, and the security status of each information processing device connected to the network is inspected by the security management server and displayed on the monitoring screen. The technology is also known. By combining the techniques described in Patent Documents 1 and 2, it is possible to display whether or not the encryption / decryption program is installed on the monitoring screen, thereby enabling the security administrator to perform information processing connected to the network. It is possible to know whether an automatic encryption / decryption program is installed in all of the devices.

  Furthermore, as in the invention described in Patent Document 3, a technique for prohibiting copying of files recorded in a confidential folder to a so-called removable medium such as a USB memory is also known. By the way, the more information leakage prevention measures are applied to the information processing device, the lower the risk of information leakage. However, on the other hand, the user-friendliness of the information processing device is deteriorated for the user. Therefore, instead of taking measures to prevent information leakage unnecessarily, it is necessary to determine the possibility of loss of the information processing device according to the purpose and location of use of the information processing device, and to take optimum measures. is there. In order to achieve this object, a method of setting a security policy for each information processing device is generally taken.

  Here, the security policy is, for example, an information processing device that can start an information processing device only with a removable medium in which activation permission information is recorded, or prohibits copying of a file to the removable medium. This information defines the operating conditions. Specifically, it is set in the information processing device as one or more “security policy” files. By installing a security policy suitable for each information processing device and a monitoring program that is permitted to operate only in accordance with this security policy on each information processing device, it is suitable for the purpose of use of the information processing device. Measures can be taken.

JP 2001-27964 A JP-A-6-282527 JP 2002-288030 A

  By the way, information processing devices can be classified into two types: stationary devices such as desktop PCs and portable devices such as notebook PCs. A stationary device is a device that is arranged at a predetermined position such as a desktop and is not scheduled to be carried. Therefore, there is no risk of losing during transportation, and theft can be prevented by measures such as connecting to a wall or desk with a sturdy chain or the like. In many cases, since the user is determined for each information processing device, the risk of copying a file due to unauthorized use is small.

  On the other hand, portable devices are often carried and used in various places. Therefore, there is a high possibility of being lost or being stolen during transportation. Furthermore, portable devices are often shared by a plurality of unspecified users. Therefore, there is a risk that a file created and forgotten to be deleted by one user is copied to a removable medium by another user.

  Therefore, when setting a security policy for an information processing device, generally, the security policy of the portable device is tightened. For example, for a portable device, only a state where a removable medium in which activation permission information is recorded is attached. Is set so that it can be booted with, or the removable media is completely prohibited from copying files.

  Here, the difference between whether it is an installation type device or a portable type device depends on an artificial determination of whether or not to carry and use. For this reason, conventionally, it is considered that it is impossible to automatically determine whether the device is a stationary device or a portable device, and this is a matter that should be judged by the security administrator when setting a security policy. I came.

  However, if the decision on whether or not the device is a portable device is left to the security administrator's decision as before, the security policy for the stationary device may be set on the portable device due to an error in the decision or an illegal act of the security administrator. For this reason, information leakage may occur. Conversely, a security policy for a portable device is set for the stationary device, which may cause the device to become unusable.

  The present invention has been made to solve these problems, and an appropriate security policy is set by automatically determining whether the target device is a stationary device or a portable device. It is an object of the present invention to provide a security management system that makes it possible to determine whether or not there is.

In order to achieve the above object, a security management system of the present invention is a security management system using a computer system in which a security management server and a terminal device used by a user are connected to a network so as to communicate with each other. The security management server has a determination function for determining whether or not the terminal device is a portable device.
Further, the determination function determines whether or not the terminal device is a portable device by obtaining information about whether or not a power supply device is mounted on the terminal device from the terminal device. It is characterized by.
Further, when the determination function determines that the terminal device is a portable device, the determination function further determines whether the terminal device violates a security policy based on information transmitted from the terminal device. It is characterized by.

  According to the security management system of the present invention, it is possible to determine whether or not an appropriate security policy is set by automatically determining whether the target device is a stationary device or a portable device. It becomes possible.

Hereinafter, an embodiment of a security management system to which the present invention is applied will be described. In the present embodiment, a so-called mobile PC such as a notebook PC will be described as an example of a portable device.
As shown in FIG. 1, this system includes a plurality of client PCs 11 as terminal devices, a security management server 12, and the Internet 13 as a network. The client PC 11 and the security management server 12 are connected via the Internet 13 so that they can communicate with each other.

  As shown in FIG. 2, the client PC 11 has a security management function 14, an information collection function 15, an information transmission function 16, and an information display function 17. Actually, as with a general PC, a program corresponding to each function is loaded into a main storage device (not shown) of the client PC 11. Each function described above is realized by the CPU (not shown) of the client PC 11 executing the instruction code of each program. In the following, for the sake of brevity, the hardware functions of the security management function 14, the information collection function 15, the information transmission function 16, and the information display function 17 exist as actual conditions, as if the processing is executed. Describe in.

Further, the client PC 11 also includes a recording device 18, a display device 19, and an input device 20, as shown in FIG.
The security management function 14 is a function for controlling each function of the information collection function 15, the information transmission function 16, and the information display function 17, and starts processing when the client PC 11 is activated and at an appropriate timing. The information collection function 15, the information transmission function 16, or the information display function 17 is executed.

  The information collection function 15 is a function for collecting information such as a security policy set in the client PC 11 and recording it in the recording device 18. The information transmission function 16 is a function for transmitting information such as a security policy collected by the information collection function 15 and recorded in the recording device 18 to the security management server 12. The information display function 17 is a function for displaying information such as a warning message transmitted from the security management server 12 on the display device 19.

  The recording device 18 is specifically an internal or external recording medium such as a hard disk or a removable medium. The recording device 18 records a collection information file 21 and a setting information file 22. In the collection information file 21, information such as a security policy at the time of collection collected by the information collection function 15 is recorded. In the setting information file 22, various information that defines the operating conditions of the client PC 11 such as a security policy and an activation timing of the information collection function 15 is recorded. The setting information file 22 may be one file or a collection of a plurality of files. Of course, the recording device 18 also records files other than the collected information file 21 and the setting information file 22, for example, files such as documents and spreadsheets created by the user of the client PC 11.

The display device 19 is a CRT, a liquid crystal display device or the like. The input device 20 is an input device such as a keyboard and a mouse.
The security management server 12 is a computer such as a PC, and has a security management function 23 as a determination function, as shown in FIG. The security management function 23 receives information such as a security policy transmitted by the information transmission function 16 of the client PC 11 and determines whether or not this content is appropriate for the client PC 11. If the security management function 23 determines that the determination is not appropriate, the security management server 12 transmits information such as a warning message to the client PC 11.

  Next, the data structure of the collection information file 21 in the client PC 11 according to the present embodiment will be described. As illustrated in FIG. 4, information such as a security policy collected by the information collection function 15 is recorded in the collection information file 21. For example, the information collection function 15 continues to collect security policies at predetermined time intervals, and cumulatively records the security policies collected at each time point.

  In order to realize this purpose, the collected information file 21 includes data items of information collection date / time 24, security management server transmission state 25, and security policy 26. That is, the collection information file 21 can record a plurality of records having different information collection dates / times 24. When attention is paid to a certain point in time, the number of records in the collection information file 21 can be 0, 1 or 2 or more.

  In the information collection date / time 24, the date / time collected by the information collection function 15 such as the security policy 26 is recorded. The information collection date / time 24 may be, for example, the date / time when the information collection function 15 is activated by the security management function 14, or the information collection function 15 collects information in the recording device 18. It may be the date and time when the file 21 is to be written. In short, any date / time consistent in the client PC 11 may be used.

  In the security management server transmission state 25, the state of whether or not the security policy 26 of the record has been transmitted to the security management server 12 is recorded. Accordingly, at the time when the security policy 26 is collected and recorded by the information collecting function 15, the state of “unsent” is recorded. Then, when the security policy 26 of the record is transmitted to the security management server 12 by the information transmission function 16, it is updated to the “sent” state. As will be described later, the security management server transmission state 25 is used to delete records that are no longer needed.

The security policy 26 is information that collectively refers to various security policy information such as whether encryption is required 27, whether vaccine software is installed 28, whether basic software patches 29 are required, and whether carry-out prohibition setting 30 is required.
The encryption necessity 27 records information indicating whether or not the document file or the like is to be encrypted and recorded when the user of the client PC 11 records the document file or the like on the recording device 18. For example, if “encryption required” is set in the encryption necessity 27, driver software that performs I / O processing of the recording device 18 (not shown) automatically encrypts and records the recording target file. .

  Information indicating whether or not it is necessary to install predetermined vaccine software in the client PC 11 is recorded in the necessity 28 of installing vaccine software. For example, a vaccine installation program (not shown) is installed in the client PC 11. Then, the vaccine installation program can be activated when the client PC 11 is activated.

  The vaccine installation program downloads and installs the latest vaccine software from a vaccine management server (not shown) connected to the Internet 13 when “installation required” is set in the necessity 28 of installing the vaccine software. In this way, it is possible to ensure that the client PC 11 always operates with the latest vaccine software installed.

  The basic software patch necessity 29 records information indicating whether or not it is necessary to always apply the latest patch to the basic software of the client PC 11. For example, a basic software patch program (not shown) is installed in the client PC 11. The basic software patch program can be activated when the client PC 11 is activated. The basic software patch program downloads and applies the latest patch from a patch management server (not shown) connected to the Internet 13 when “Patch Required” is set in the necessity 29 of the basic software patch. In this way, it is possible to ensure that the client PC 11 always operates in the latest state, that is, the basic software in which the security hole is blocked to the maximum extent.

  Information indicating whether or not the user of the client PC 11 is permitted to duplicate information on the removable medium is recorded in the necessity / unnecessary setting 30 of the export prohibition. For example, when “prohibition setting required” is set in the necessity / unnecessary setting 30 of the export prohibition setting, when the user of the client PC 11 tries to copy information to the removable medium, the I / O processing of the removable medium is performed. The driver software does not copy.

  In the transmission information, security policy information and the like collected by the information collection function 15 and recorded in the collection information file 21 are set. Specifically, as shown in FIG. 5, the information collection date / time and the security policy data items are set in the information collection date / time 24 and the security policy 26, respectively.

  In addition to this, client ID 31 and client type 32 are set as transmission information. The client ID 31 is information for uniquely identifying each client PC 11 in the present system. For example, the client ID 31 may be recorded in the setting information file 22 when setting the security policy information of the client PC 11. The client type 32 is information for identifying whether or not the client PC 11 is a “mobile terminal”, that is, a portable device.

Next, the flow of processing in this system will be described.
Although the operation of the security management function 14 is not illustrated, when the client PC 11 is activated, the security management function 14 starts processing. The security management function 14 continues to operate as a resident process until the client PC 11 stops. The main functions of the security management function 14 are the following three.

  1) The information collection function 15 is activated when the current date / time of the client PC 11 reaches a predetermined date / time. This “predetermined date / time” may be, for example, immediately after the security management function 14 is activated or may be when the user instructs the client PC 11 to stop. Alternatively, the latest date / time when the information collection function 15 is activated is recorded in the setting information file 22, and the information collection function 15 is again performed after a predetermined time (for example, 1 hour) from the latest date / time. May be started. Furthermore, in addition to the above conditions or in addition to the above conditions, the information collecting function 15 may be activated when the CPU usage rate becomes a predetermined value or less.

  2) The information transmission function 16 is activated when the current date / time of the client PC 11 reaches a predetermined date / time. This “predetermined date / time” can be, for example, a predetermined time after the information collection function 15 is activated. Alternatively, the latest date / time when the information transmission function 16 is activated is recorded, and the information transmission function 16 is activated again after a predetermined time (for example, one hour) from the latest date / time. Also good. Further, in addition to the above conditions or in addition to the above conditions, the information transmission function 16 may be activated when the CPU usage rate becomes a predetermined value or less.

  3) When the current date / time of the client PC 11 has reached a predetermined date / time, the presence / absence of information such as a warning message transmitted from the security management server 12 is confirmed and the information is transmitted. If yes, the information display function 17 is activated. When the information display function 17 is activated, information such as a warning message transmitted from the security management server 12 is delivered to the information display function 17. This “predetermined date / time” can be set to an interval of a predetermined time (for example, 1 minute) after the security management function 14 is activated, for example.

Next, the operation of each of the information collection function 15, information transmission function 16, and information display function 17 will be described.
First, the processing of the information collection function 15 will be described.
When the information collection function 15 is activated, the information collection function 15 periodically collects the current date / time and the security policy information recorded in the setting information file 22 (S61). Then, a new record of the collected information file 21 is created and the collected information is accumulated and recorded (S62).

  At this time, the system date / time is set as the information collection date / time 24. The security management server transmission state 25 is set to “not transmitted”. In the security policy 26, the collected security policy information is set. In the process of S62, among the records that have been accumulated and recorded in the collection information file 21, the security policy 26 in which the information collection date / time 24 is recorded in the latest record and the collected security policy information The contents may be compared with each other, and only when there is a difference, a new record may be created and stored.

By doing so, it is possible to avoid the same security policy information from being accumulated and recorded and transmitted to the security management server 12, and it is possible to avoid an increase in network traffic due to unnecessary processing.
Next, the information collection function 15 deletes a record (that is, information that is no longer necessary) in which the security management server transmission state 25 of each record accumulated and recorded in the collection information file 21 is “sent” (ie, information that is no longer necessary). S63).

Next, processing of the information transmission function 16 will be described.
As shown in FIG. 7, when the information transmission function 16 is activated, the information transmission function 16 selects a record whose security management server transmission state 25 is “untransmitted” among the records accumulated and recorded in the collected information file 21. Search periodically (S71). If there is no “unsent” record, the process ends (in the case of “NO” in S72). On the other hand, if there is a record “unsent”, communication with the security management server 12 is started, and if communication is not possible, the process ends (in the case of “NO” in S73).

  When communication with the security management server 12 is possible, the contents set in the information collection date / time 24 and the security policy 26 of the record whose security management server transmission state 25 is “not transmitted” The collection date / time 24 is transmitted to the security management server 12 in the order of oldest (S74). Specifically, in the client ID 31, information that can identify the position of the client PC 11 recorded in the setting information file 22 within the system is set, and the information collection date / time 24 and the security policy 26 are set. Sets the information collection date / time 24 and the contents of the security policy 26, respectively.

  The client type 32 is information for determining whether or not a power supply device such as a battery is mounted on the client PC 11. Then, information indicating that the mobile device is “mobile terminal (portable device)” is set, and if it is not mounted, information indicating that it is “installed terminal” is set. That is, not only a PC but also a portable device is planned to be used in an environment in which it is difficult to receive power supply from the outside of the terminal, so some power supply device must be provided inside the terminal. Therefore, whether or not a power supply device such as a battery is installed has the same meaning in terms of security management as determining whether or not the terminal is a mobile terminal.

  Here, when a power supply device such as a battery is installed, the user needs to know the remaining battery level, so the basic software of the PC generally provides an API for notifying the remaining power level of the battery or the like. (Application Program Interface). Furthermore, as a premise that the application program uses the API, the application program needs to know whether or not the PC is originally equipped with a power source such as a battery. Therefore, the basic software of the PC generally has an API for notifying whether or not a power source such as a battery is mounted. For example, in the case of Windows XP (registered trademark) which is basic software, it is possible to know whether or not a power source such as a battery is mounted by appropriately issuing a GetSystemPowerStatus function. Similar APIs exist for other basic software.

  After the transmission process (S74) ends, the information transmission function 16 updates the security management server transmission state 25 of the record transmitted to the security management server 12 to “transmitted” (S75). In the process of S74, not all the setting contents of the record whose security management server transmission state 25 is “unsent” are transmitted, but the information collection date / The setting content may be transmitted only for the record with the latest time 24.

  In this case, when the security policy information setting is temporarily changed to an inappropriate content and then restored to the original appropriate setting, only the final state is transmitted to the security management server 12. Therefore, the security management server 12 determines that there is no problem with the security policy of the client PC 11. As a result, warning information and the like are sent from the security management server 12 to the client PC 11 for which security policy information is set appropriately at this time, and the current user of the client PC 11 does not know the reason for the warning and has difficulty in dealing with it. You can prevent such a situation. However, in such a case, there is a risk that, when the security policy information is temporarily changed maliciously, it will not be noticed.

  It should be noted that the security management server transmission status is also transmitted when the setting contents are transmitted only for the record with the latest information collection date / time 24 among the records whose security management server transmission status 25 is “unsent”. It is necessary to change all records in which “25” is “not transmitted” to “transmitted” and delete them as unnecessary records by the processing of S63 described above.

Next, processing of the information display function 17 will be described.
When the information display function 17 is activated, the information display function 17 displays information such as a warning message delivered from the security management function 14 on the display device 19. As shown in FIG. 8, when one or more screens 33 (for example, screens of other application software) are already displayed on the display surface of the display device 19, the warning screen 34 is the top of these screens 33. Displayed in the upper layer.

  In addition, the warning screen 34 is displayed and the input device 20 or the like cannot be operated (hereinafter referred to as “operation lock”), and the operation with inappropriate security policy information set cannot be continued. You may do it. In this case, for example, a password input field and a button may be provided on the warning screen 34, and only an input operation to this password field and a button pressing operation (such as clicking with a mouse) may be permitted. Then, after displaying the warning, the information display function 17 waits for the button to be clicked. When the button is clicked, the information display function 17 determines whether or not the input content in the password field matches a predetermined value. The lock is released, and if it does not match, the operation lock is continued.

By doing so, it is possible to prevent the user of the client PC 11 from continuing the operation at the time when the operation is locked, and to perform the operation lock by the security administrator who knows the appropriate password, the investigation of the client PC 11, and the like. can do.
Next, the operation of the security management function 23 of the security management server 12 will be described.

  As shown in FIG. 9, when the security management server 12 is activated, the security management function 23 starts processing. The security management function 23 continues to wait for information such as security policy information to be transmitted from the information transmission function 16 of the client PC 11 (S91). When the information is transmitted, the client type 32 of the received information is determined. When the client type 32 is “mobile terminal”, it is determined whether each security policy information set in the security policy 26 has appropriate contents. Specifically, for example, encryption necessity 27, vaccine software installation necessity 28, basic software patch necessity 29, and export prohibition setting necessity 30 are all “necessary” (“encryption required”, etc.) If there is an item that is not “necessary”, it is determined that it is a security policy violation.

  If no security policy violation is detected (“NO” in S92), the security management function 23 continues to wait for information such as security policy information from the information transmission function 16 of the client PC 11 again. (S91). Conversely, when a security policy violation is detected ("YES" process in S92), information such as a warning message is transmitted to the client PC 11 (S93). At this time, the IP address of the information transmission destination client PC 11 can be known from the client ID 31. More specifically, the client ID 31 and the IP address or the like may be recorded in advance in a recording device (not shown) in the security management server 12.

The embodiment described above may be modified as follows.
In the system of the above embodiment, the number of security management servers 12 is one. However, for example, a plurality of security management servers 12 may be installed for load distribution.
The network is not limited to the Internet 13 and may be a LAN or the like because it is a device for connecting the client PC 11 and the security management server 12 so that they can communicate with each other. Further, either a wired network or a wireless network may be used.

  In the system of the above embodiment, it has been described that the security policy violation is determined only when the client type 32 is “mobile terminal”. However, for example, the setting content that should be set for the client PC 11 that is a stationary device is determined. If the client type 32 is not “mobile terminal”, the security policy violation can be similarly determined. In addition, for example, it is also possible to associate each client ID 31 with information on the owning department in advance and record it in the recording device of the security management server 12 and change the determination method of the security policy violation depending on the owning department.

  In the system of the above-described embodiment, only a few examples of security policy information are illustrated for easy understanding. In addition, the security policy 26 may include any information related to the security policy.

  In the system of the above embodiment, each client PC 11 and the security management server 12 are described as being always connected via the Internet 13. However, for example, the client PC 11 is used without being connected to the Internet 13 when it is moving. In this case, the information collecting function 15 performs the information collecting process, and is reconnected to the Internet 13 so that the information transmitting function 16 can transmit the information when it can communicate with the security management server 12.

  In addition, when the client PC 11 is used for a predetermined time or more when the client PC 11 and the security management server 12 are not connected via the Internet 13, the information collection function 15 requests the display device 19 to install a removable medium such as a USB memory. A message is displayed, and input operations and the like can be prohibited until the user wears a removable medium. When the removable medium is loaded, the record information stored and recorded in the collection information file 21 is copied to the removable medium, the duplicated record is deleted from the collection information file 21, and the setting information file of the recording device 18 is deleted. The device identification information of the removable medium to be copied may be recorded in 22.

  By doing so, it is possible to prevent the capacity of the collection information file 21 from becoming too large and exceeding the recordable capacity of the recording device 18. In this case, the information transmission function 16 determines whether or not the device identification information of the copy destination removable medium is recorded in the recording device 18 and requests the user to attach the removable medium. Then, input operations are prohibited until the user installs the removable medium, and when an appropriate removable medium is installed, the collected information file 21 copied to the removable medium is transmitted to the security management server 12. You can do that.

  Furthermore, when the client PC 11 is used without being connected to the security management server 12 over the Internet 13 for a long period of time, the removable medium in which the collection information file 21 is recorded is physically stored in the security management server 12. The collected information file 21 may be acquired by being delivered to the security manager and attached to the security management server 12.

  In this way, when the removable medium is not delivered, the security administrator can infer that the client PC 11 is not properly managed based on the fact. Further, for example, when a record recorded in the collection information file 21 is copied to a removable medium, only the latest one record is not deleted from the recording device 18 and duplicated when the next copy is made to the removable medium. By doing so, it becomes possible to guarantee the continuity of a plurality of removable media.

The system block diagram of a security management system. The block diagram of client PC. The block diagram of a security management server. The data structure figure of the collection information in a client. The data block diagram of transmission information. The flowchart of an information collection function. The flowchart of an information transmission function. Warning screen. The flowchart of a security management function.

Explanation of symbols

11: Client PC as a terminal device,
12: Security management server,
13 ... The Internet as a network,
23: Security management function as a judgment function.

Claims (3)

A security management system using a computer system in which a security management server and a terminal device used by a user are communicably connected to a network,
The security management system, wherein the security management server has a determination function for determining whether or not the terminal device is a portable device. The determination function determines whether or not the terminal device is a portable device by obtaining information about whether or not a power supply device is mounted on the terminal device from the terminal device. The security management system according to claim 1. When the determination function determines that the terminal device is a portable device, the determination function further determines whether the terminal device violates a security policy based on information transmitted from the terminal device. The security management system according to claim 2.

Images