JP2008234545A - Terminal monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a terminal monitoring system preventing the leakage of data without preparing rules for every user. <P>SOLUTION: A manager computer M and a plurality of client computers T can communicate through a network N. The operating state of the client computer is detected. Based on the operating state and the installation environment of the client computer, a corresponding security level is selected out of a plurality of security levels, and the selected security level is set. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a terminal monitoring system that monitors a client computer in accordance with the operating status of the client computer.

As conventional computer security, anti-virus software that detects and removes computer viruses is used to prevent the invasion of computer viruses.
In addition, a firewall is installed to prevent entry into the LAN from the outside.
The anti-virus software and firewall prevent unauthorized third parties from gaining access to the computer and preventing the operation of the computer system from being altered, leaking data, causing the computer system to deteriorate or stop functioning. The main purpose is to prevent the occurrence of etc.
In other words, the purpose is to be able to resist attacks from third parties on the computer.

Also, data input / output through the external connection bus that connects the computer and external device is acquired, user identification information is acquired from the input / output data, attribute information corresponding to this identification information is acquired, and illegal rules are stored Refers to the rule corresponding to the attribute information from the rules determined for each user information stored in the section, and further refers to the rule that should generally be determined to be illegal regardless of the attribute stored in the unauthorized rule storage section. There is a fraud monitoring program that performs fraud determination and stops user operation processing when it is determined that the operation is fraudulent (see, for example, Patent Document 1).
JP 2005-322261 A

  However, as mentioned above, security systems such as anti-virus software and firewalls are mainly aimed at combating attacks from third parties. There was a considerable risk of data being leaked by recording data and taking it out, or by a legitimate operator sending data via the Internet.

  Further, in the illegal duplication program described in Patent Document 1, it is determined whether or not data input / output to / from an external device is illegal data based on a general rule and a rule for each user. Although it can prevent copying data and prevent information leakage, it is necessary to set not only general rules but also rules for each user. It is very complicated to set detailed rules for each user. It was necessary to work.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a terminal monitoring system that prevents data leakage without creating rules for each user.

The terminal monitoring system according to the present invention is a terminal monitoring system configured such that an administrator computer and a plurality of client computers can communicate with each other via a network, and the computer constituting the terminal monitoring system is the client computer. An operating status detecting unit for detecting an operating status; an operating status storage unit for storing the operating status detected by the operating status detecting unit; an installation environment storing unit for storing an installation environment of the client computer; Security level selection means for selecting a corresponding security level from a plurality of security levels based on the operating status and the installation environment of the client computer, and one or both of the client computer and the administrator computer It characterized in that it comprises a security level setting means for setting a security level selected by the security level selecting means.
Therefore, since the security level can be set according to the operating status of the client computer, it is not necessary to create a security rule for each client computer.

The operating status detection unit detects a startup status of the client computer or a status of an input operation from the input unit, and the security level selection unit detects a startup status of the client computer or a status of an input operation from the input unit. The security level may be selected by determining whether or not the machine is operating.

  The installation environment storage means stores the installation position data of the client computer in advance, and the security level selection means calculates a distance between the client computer and another operating client computer, and falls within a predetermined distance range. You may select the security level with respect to the said client computer based on the operation condition of the other client computer located.

  Communication state information detecting means for detecting communication state information of the client computer; and installation environment determining means for determining an installation environment of the client computer based on the communication state information detected by the communication state information detecting means. The installation environment storage means may store the installation environment information determined by the installation environment determination means.

  The installation environment determining unit may group the client computers based on the communication state information, and the security level selecting unit may select the security level of the group based on the operating status of client computers in the same group. Good.

  The communication status information may include IP address information set for the client computer itself, and the installation environment determining means may group the client computers for each segment of the IP network based on the IP address.

  The client computer communicates using wireless communication, and the communication state information includes information of the access point of the wireless communication, and the installation environment determination unit groups the client computers based on the access point information. May be.

  The communication status information includes information on the communication strength between the client computer and the access point for wireless communication and the access point information, and the installation environment determination means determines whether the installation environment determination unit is a client computer for each access point based on the communication strength. And the distance between the access point and the access point may be calculated, and client computers within a predetermined distance range may be grouped.

  The administrator computer includes an operation status display means for displaying the operation status of the client computer to be monitored for each client computer and changing the display format in accordance with the security level set by the security level setting means. You may prepare.

Since the terminal monitoring system according to the present invention as described above selects and sets the security level based on the operating status and installation environment of the client computer, it is not necessary to create a security rule for each client computer. Terminal monitoring can be performed without complicated work.
In addition, the security level is automatically set according to the operating status of the client computer, so there is no need to set an excessively strong security level or a weak security level, and the optimal security level can be set according to the operating status. .

  Since the security level is selected based on whether or not the client computer is activated and the input operation status from the input unit, the presence or absence of the operator of the client computer can be determined, and the security level can be set based on the determination. In particular, when detecting the operating status based on the input interval from the input unit, it is possible to detect the difference between whether or not the client computer is running, so that more detailed operating status Security level can be set based on

  The client computer installation position data is stored in advance, the distance between the client computers is calculated based on the installation position data, and the security level is selected according to the number of operating clients and the operating rate included in the predetermined range. Therefore, the security level can be set high when no other operator is nearby, and the security level can be set low when an operator is nearby.

  Since the installation environment of the client computer is determined based on the communication status information of the client computer, there is no need for the administrator to create data relating to the installation environment. Even when the client computer is moved or newly installed, the security level can be set based on the communication state information.

  Since the client computers are grouped on the basis of the communication status information of the client computers, the computers installed at close distances can be made into the same group.

  Since grouping is performed for each segment of the IP network, client computers can be grouped regardless of wired communication or wireless communication.

  Since grouping is performed for each wireless communication access point, client computers that can communicate with the access point can be grouped into the same group. Therefore, client computers that are relatively close to each other can be in the same group.

  Since the communication state information includes information on the communication strength between the client computer and the access point and the access point information, the distance from the client computer can be calculated for each access point. In other words, client computers using the same access point can be further divided into a plurality of groups, and detailed grouping and a security level corresponding to the grouping can be set.

  Since the operation status is displayed on the administrator computer in correspondence with the security level of the monitored client computer, the security level of the operating client computer can be easily recognized.

  According to the present invention, when a computer operator performs an unauthorized operation, it is easy to perform an unauthorized operation when there are no or few people around the operator. Conversely, when there are many people around the operator, the unauthorized operation is performed. The security level is set based on the viewpoint that it is difficult to do.

As shown in FIG. 1, the terminal monitoring system 1 according to the present invention is configured such that an administrator computer M and a plurality of client computers T,...
The present invention divides a plurality of client computers T,..., T into groups G1, G2,..., And sets a monitoring level according to the operating status of the client computers T,. The monitoring level is set according to the distance between the target client computer T and another client computer T and the operating status of the client computers T,..., T in the group.

  First, as shown in FIG. 3, based on the installation position data of the client computers T,..., T (A1 to A6,...), The security level is determined based on the distance between the client computers T,. The case of setting will be described.

FIG. 2 is a block diagram of the terminal monitoring system 1 according to the first embodiment.
For the sake of explanation, FIG. 2 illustrates an example in which one administrator computer M and one client computer T are communicatively connected. However, as shown in FIG. The computer M is in communication with a plurality of client computers T,.

The administrator computer M and the client computer T are provided with an operating state detecting means 2.
The administrator computer M includes an operation status storage unit 3, an installation environment storage unit 4, a security level selection unit 5, a security level notification unit 6, a first security level setting unit 7, an operation status display unit 8, and a client computer monitoring unit 9. And.
The client computer T includes second security level setting means 10 and control means 11.

The operating status detecting means 2 is a means for detecting operating statuses such as whether or not the monitored client computers T,... The operating status detection unit 2 includes an operating status notifying unit 2a provided in the client computer T and an operating status receiving unit 2b provided in the administrator computer M.
The operating status notifying unit 2a notifies the administrator computer M of its operating status when the client computer T is started up and ended. Further, when an input signal from an input unit such as a keyboard or a mouse has not been input for a predetermined time (for example, 30 minutes), it is determined that the user is away from the seat, and an input signal is input from the input unit. If it is determined that it is in the working state, the operating state such as the starting state or the working state is notified to the administrator computer M.
The operating status receiving unit 2b receives the operating status data notified from the operating status notifying unit 2a.
The operating status detection means 2 periodically transmits a detection signal for confirming the operating status to the client computers T,..., T to be monitored, receives a response signal to the detected signal, and receives the operating status. May be detected.

  The operating status storage means 3 is a means for storing the operating status of each monitored client computer T,..., T detected by the operating status detection means 2.

The installation environment storage means 4 is means for previously storing information on the installation positions of the client computers T,..., T, and as shown in FIG. 3, the client computer T and other client computers T,. Is a means for storing data that can be used to determine the distance to the other client computers, or data obtained by calculating the distance from other client computers T,.
In addition, data obtained by grouping a plurality of client computers T,..., T into several groups G1, G2,.

  The security level selecting means 5 includes the operating statuses of the client computers T,..., T stored in the operating status storage means 3 and the client computers T,. It is a means for selecting the corresponding security level from the installation environment. For example, as shown in FIG. 3, when setting the security level of the client computer A2, the distance between the client computer A2 and the other client computers T,..., T (A1, A3, 6,...) Is calculated. , T is selected from other client computers included in the preset distance range, a low security level is selected if the selected client computer T,..., T has a high operating status, and high if the operating status is low. Select a security level. That is, if the number of computers installed near the client computer A2 and the operation rate are high, other workers are present in the surrounding area, so the security level is lowered. On the other hand, if the number of computers installed near the client computer A2 and the operation rate are low, there are few or no other workers in the vicinity, so the security level is increased.

  The security level notifying means 6 is means for notifying the client computer T to be set of the security level selected by the security level selecting means 5. In the above example, data including the selected security level is transmitted to the client computer A2.

  The operating status display means 8 corresponds to the security level selected by the security level selecting means 5 as shown in FIGS. 4 to 6, and the operating status of the monitored client computers T,. Corresponding means for displaying on the display unit of the administrator computer M.

  The first security level setting means 7 is a means for setting the security level selected by the security level selection means 5.

  Based on the security level set by the first security level setting means 7, the client computer monitoring means 9 is means for monitoring by capturing communication data (packets) of the client computer T for which the security level is set. It is.

  On the other hand, the second security level setting means 10 provided in the client computer T is a means for setting the security level notified by the security level notification means 6.

  When the security level is set by the second security level setting means 10, the control means 11 is a means for controlling its own client computer T according to the security level. Specifically, according to the security level, the function of the client computer T such as controlling whether data can be written to the removable medium or whether electronic mail can be used is controlled.

Next, a more specific example will be described with reference to FIGS.
As shown in FIG. 3, the client computers T,..., T are arranged in four blocks of six (six persons). The administrator computer M monitors these 24 client computers T,...

4 to 6 are screen views of the administrator computer M showing the monitoring state of the client computers T,..., T (A1,..., D6) shown in FIG. FIG. 4 shows a state in which all 24 client computers T,..., T to be monitored are operating.
If the client computer T is in operation, the client computer T transmits data obtained by capturing its own screen to the administrator computer M, and displays the captured data on the administrator screen as shown in FIG. On the other hand, if the client computer T is not in operation, the capture screen of the client computer T is not displayed on the administrator screen as in A4 to A6 of FIG.
Therefore, on the management screen of the administrator computer M, not only the presence / absence of the operation status of the client computer T but also the operation status can be confirmed if it is operating.
The capture screens shown in FIGS. 4 to 6 may display the screens of the client computers T in real time. However, considering the communication data amount and the processing capability of the computers, the screens of the client computers T are displayed every few minutes. It may be displayed.

In FIG. 4, the operating status detection unit 2 detects the operating statuses of all client computers T,..., T and stores them in the operating status storage unit 3. Then, the distance between the client computer T whose security level is to be set and the other client computers T,..., T is calculated, and the operating rate of the other client computers T,. And the security level corresponding to the operating rate is selected. Then, the administrator computer M monitors the client computer T at the security level. In addition, the client computer T sets and controls the notified security level. Then, this process is performed for all client computers T,.
In FIG. 4, all client computers T, ..., T are operating. Therefore, the operating rate of the client computer T existing within a predetermined distance range is 100%, and a low security level is selected.
That is, in the situation where all the client computers T,..., T are operating as shown in FIG. 4, since there is another operator near the operator, it is difficult for an unauthorized action to be performed. In such a situation, the security level can be set low, and the calculation processing function of the client computer T can be assigned to processing other than security. Similarly, the administrator computer M can also allocate calculation processing functions to processes other than security, and can effectively use hardware resources.

Next, as shown in FIG. 5, when the client computer is operating only A2 of the A block and D3 of the D block, the security level selecting means 5 determines the distance between the client computer A2 and the client computer D3. Calculate. If the distance between the client computers A2 and D3 is outside the predetermined distance range for determining the security level, a higher security level is selected for the client computer A2. Similarly, a high security level is selected for the client computer D3, and the security level is set.
Further, the security level selected by the security level selection means 5 is notified to the client computers A2 and D3, and each client computer A2 and D3 controls according to the security level.
As shown in A2 and D3 of FIG. 5, the administrator screen when the security level is set high is displayed with a large capture screen of each client computer when the security level is high. Make security levels easier to recognize.

As shown in FIG. 6, when only three client computers A2, A3, D3 are operating, the security level selection means 5 selects and sets a security level for each client computer.
At this time, when the client computer D3 is distant from the other client computers A2 and A3 and is outside the range of the security level determination criterion, the highest security level is selected.
On the other hand, when the distance between the client computer A2 and the client computer A3 is within the range of the criterion for judging the security level, and the distance between the client computer A2 and the client computer D3 is outside the predetermined distance range for judging the security level, the client A security level lower than the security level selected for the client computer D3 is selected for the computer A2. Similarly, the same security level as that of the client computer A2 is selected for the client computer A3.
That is, the client computer D3 is considered to be an environment in which it is relatively easy to perform an illegal act because there are no other active client computers A2 and A3 at positions close to each other. Therefore, a high security level is set for the client computer D3.
On the other hand, the client computers A2 and A3 are considered to be an environment in which it is relatively difficult to perform fraudulent activities because another active client computer A3 (A2) exists at a position close to the distance. Accordingly, the client computers A2 and A3 are set to a security level lower than the security level selected for the client computer D3.
As shown in FIG. 6, when the display sizes of the screen displays A2, A3, and D3 are switched corresponding to the security level, A2 and A3 are displayed so as to be smaller than D3.

  Next, the case where the security level is set based on the communication state information of the client computers T,..., T will be described with reference to FIG.

FIG. 7 is a block diagram of the terminal monitoring system 21 of the second embodiment.
In FIG. 7, for the sake of explanation, a state in which one administrator computer M and one client computer T are connected for communication is described as an example. However, as shown in FIG. The computer M is in communication with a plurality of client computers T,.

The administrator computer M and the client computer T are provided with an operating state detecting unit 2 and a communication state information detecting unit 22.
The administrator computer M includes an operation status storage unit 3, an installation environment determination unit 23, an installation environment storage unit 24, a security level selection unit 25, a security level notification unit 6, a first security level setting unit 27, and an operation status display unit 8. The client computer T includes a second security level setting unit 10 and a control unit 11.
The operating status detection unit 2, the operating status storage unit 3, the security level notification unit 6, the operating status display unit 8, the client computer monitoring unit 9, the second security level setting unit 10, and the control unit 11 are the same as those in the first embodiment. The description is omitted because it is the same as each means described above.

  The communication state information detecting means 22 is means for detecting communication state information of the client computer T. Specifically, the IP address information such as the IP address and subnet mask set in the client computer T, or the client computer T via the access point through wireless communication such as a wireless LAN, the administrator computer M This is a means for detecting information on the access point with which the client computer T is communicating and information such as the communication strength of wireless communication.

The installation environment determination unit 23 is a unit that determines the installation environment based on the communication state detected by the communication state information detection unit 22.
For example, when using IP address information as communication status information, the IP network segment of the client computer T is determined from the IP address and the subnet mask, and the client computers T,... Divide into groups. When the client computer T,..., T and the administrator computer M communicate with each other by wired communication in the IP network, the client computer T,..., T included in the same segment may be installed at a relatively close position. Many. That is, it can be said that the operators of the client computers T,..., T belonging to the same segment are in a relatively close position and can be alerted to each other. Further, even a network in which wired communication and wireless communication are mixed can be grouped.
When using access point information as communication state information, client computers T,..., T using the same access point are grouped as the same group. That is, since the same access point is used, the client computers T,..., T installed within the communication distance range of the access point are determined as the same group. Persons can call attention to each other.
Furthermore, when using both the information on the communication strength between the access point and the client computer T as the communication status information and the access point information, the information is first divided into groups for each access point, and further divided into groups based on the communication strength level. To do. Therefore, the security level can be set by dividing the client computers T,..., T communicating with the same access point into more detailed groups.

  The installation environment storage unit 24 is a unit that stores the installation environment information determined by the installation environment determination unit 23. That is, the information grouped based on the communication state is stored.

  The security level selection means 25 is based on the installation environment information stored in the installation environment storage means 24 and the operation status information stored in the operation status storage means 3. This is means for selecting a security level for each group corresponding to the number of operations.

  For example, as shown in FIG. 8, when the client computers T,... (A1 to A6,...) Are performing wireless communication with the access points P1 and P2 using the wireless LAN, the A block client close to the access point P1. Computers A1 to A6 and C block client computers C1 to C6 communicate with the administrator computer M using the access point P1. On the other hand, the D block client computers D1 to D6 and the B block client computers B1 to B6 close to the access point P2 communicate with the administrator computer M using the access point P2.

At this time, the communication state information detecting means 22 detects which of the access points P1 or P2 is used for communication with the administrator computer M for each client computer T to be monitored. Further, the communication strength between the access point P and the client computer T is also detected.
When the communication state information of all the monitoring target client computers T,... (A1 to A6,...) Is detected, the installation environment determination unit 23 detects the client computers T,. A1 to A6, ...) are grouped. Specifically, the A block client computers A1 to A6 and the C block client computers C1 to C6 are determined as the same group, and the B block client computers B1 to B6 and the D block client computers D1 to D6 Judge as the same group.
Further, the installation environment determination unit 23 further divides the above-described groups based on the communication strength between the client computers A1 to A6, C1 to C6 and the access point P. For example, in the A block and C block client computers A1 to A6 and C1 to C6 communicating with the access point P1, the A block client computers A1 to A6 have stronger communication strength, and the C block client computers C1 to C6 The communication strength is weak. Similarly, in the D block and B block client computers B1 to B6 and D1 to D6 that communicate with the access point P2, the D block client computers D1 to D6 have stronger communication strength, and the B block client computers B1 to B6. The communication strength is weak. In other words, not only grouping according to the access point to be used but also grouping according to the communication strength enables further grouping.

  After the security level is selected by the security level selection means 25, the processing is the same as that of the first embodiment, and thus the description thereof is omitted.

It is the schematic of a terminal monitoring system. It is a block diagram of the terminal monitoring system of 1st Example. It is explanatory drawing of the installation position of a client computer. It is explanatory drawing of the management screen of an administrator computer when all the client computers are operate | moving. It is explanatory drawing of the management screen of an administrator computer when only two client computers are operating. It is explanatory drawing of the management screen of an administrator computer when only three client computers are operating. It is a block diagram of the terminal monitoring system of 2nd Example. It is explanatory drawing of the installation position of a client computer and an access point.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Terminal monitoring system 2 Operation condition detection means 2a Operation condition notification part 2b Operation condition reception part 3 Operation condition storage means 4 Installation environment storage means 5 Security level selection means 6 Security level notification means 7 First security level setting means 8 Operation condition display Means 9 Client computer monitoring means 10 Second security level setting means 11 Control means 21 Terminal monitoring system 22 Communication state information detection means 23 Installation environment determination means 24 Installation environment storage means 25 Security level selection means 27 First security level setting means M Management Computer N network P access point T client computer

Claims (9)

A terminal monitoring system configured such that an administrator computer and a plurality of client computers can communicate via a network,
The computer constituting the terminal monitoring system is
An operating condition detecting means for detecting an operating condition of the client computer;
Operating status storage means for storing the operating status detected by the operating status detection means;
Installation environment storage means for storing the installation environment of the client computer;
Security level selection means for selecting a corresponding security level from a plurality of security levels based on the operating status of the client computer and the installation environment of the client computer;
A terminal monitoring system comprising security level setting means for setting a security level selected by the security level selection means in one or both of the client computer and the administrator computer. The operating status detection means detects the startup status of the client computer or the status of an input operation from the input unit,
The terminal monitoring system according to claim 1, wherein the security level selection unit determines whether or not the client computer is operating based on a startup status of the client computer or an input operation status from an input unit. The installation environment storage means stores in advance installation position data of the client computer,
The security level selection means calculates the distance between the client computer and another client computer that is operating, and determines the security level for the client computer based on the operating status of another client computer located within a predetermined distance range. The terminal monitoring system according to claim 1 or 2 selected. Communication state information detecting means for detecting communication state information of the client computer;
An installation environment determination unit that determines an installation environment of the client computer based on the communication state information detected by the communication state information detection unit;
The terminal monitoring system according to claim 1, wherein the installation environment storage unit stores installation environment information determined by the installation environment determination unit. The installation environment determining means groups the client computers based on the communication state information,
5. The terminal monitoring system according to claim 4, wherein the security level selection means selects the security level of the group based on the operating status of client computers in the same group. The communication state information includes IP address information set in the client computer itself,
6. The terminal monitoring system according to claim 5, wherein the installation environment determining means groups the client computers for each segment of the IP network based on the IP address. The client computer communicates using wireless communication,
The communication state information includes information on the wireless communication access point,
The terminal monitoring system according to claim 5, wherein the installation environment determination unit divides the client computers into groups based on the access point information. The communication status information includes information on the communication strength between the client computer and the wireless communication access point, and the access point information.
8. The installation environment determining unit calculates a distance between a client computer and the access point for each access point based on the communication strength, and groups client computers within a predetermined distance range. Terminal monitoring system. The administrator computer includes an operation status display means for displaying the operation status of the client computer to be monitored for each client computer and changing the display format in accordance with the security level set by the security level setting means. A terminal monitoring system according to any one of claims 1 to 8.

Images