JP2009015432A - It asset management system using pc quarantine system, its method, and its program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To restrict access to a network in accordance with an installation situation of agent software of IT asset management software, and to induce a user terminal with the agent software not installed therein into an installation environment of the agent software. <P>SOLUTION: An IT asset management method includes detecting a connection of a user terminal to a network, and acquiring equipment proper information that is proper information of the user terminal. The method determines whether or not IT asset management agent software of the IT asset management software has been installed in the user terminal on the basis of the acquired proper information. If it is determined that the agent software has been installed in the user terminal, the method generates a policy for connecting the user terminal to a backbone network. If it is determined that the agent software has not been installed therein, the method generates a policy for connecting the user terminal to a quarantine network. The method decides an access destination of the user terminal in accordance with the policy. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an IT resource management system, a method thereof, and a program thereof for restricting access of a terminal to a network according to an installation state of agent software of IT resource management software.

  In recent years, with the movement of internal control, the need for IT asset management is increasing. There are many IT resources that are invisible and difficult to discover because they are built into equipment. Therefore, a very large amount of man-hour is required for IT resource management.

  Therefore, various products dedicated to IT asset management have been commercialized. Conventional IT resource management systems that have been commercialized need to install agent software of IT resource management software. The IT resource management information is collected from a user terminal in which agent software for IT resource management software is installed.

  However, there is a problem in that IT resource management information cannot be collected for a user terminal in which agent software for IT resource management software is not installed. There is also a problem that even a user terminal that does not have the IT asset management software installed can be connected to the in-house network.

In order to solve such a problem, there is a technique for restricting communication of a terminal in which agent software is not installed (see, for example, Patent Document 1).
JP 2006-072682 A

  However, the technique described in Patent Document 1 has the following problems.

  Patent Document 1 describes a method in which a communication device transmits an echo packet to a user terminal as a method for confirming the installation state of agent software, and confirms the presence / absence of an agent in response.

  However, the process of transmitting an echo packet and confirming the presence or absence of an agent by the response is a very heavy process. And a communication apparatus is an apparatus which originally assumed only performing the process for connecting a user terminal to a network. Therefore, there is a problem that if such heavy processing is further executed, there is a high possibility that a failure occurs in processing for connecting to the network.

  Japanese Patent Application Laid-Open No. 2004-151561 mentions packet filtering as a method for restricting communication. However, restricting communication by packet filtering is a process that greatly affects the communication apparatus.

  Therefore, assuming an environment where a large number of user terminals are actually connected, it is not easy to implement communication restriction by the packet filtering.

  Patent Document 1 describes that it is desirable to arrange the communication device on a one-to-one basis with a user terminal in order to suppress the influence in consideration of the influence on the communication device as described above.

  However, there is a problem that it is too expensive to prepare the communication device for each user terminal. Further, there is a problem that the operation management becomes complicated as the number of the communication devices increases.

  There is a need for a technique that solves the above problems.

The conventional IT resource management system has the following problems.
-Many IT resource management systems grasp the software installation status and cannot grasp the hardware installation status.
The IT resource management system cannot collect information about IT resources that cannot be installed by the agent software.
-The status of the hardware installed on the user terminal cannot be grasped.
・ If IT resources move, it is difficult to track them.
The user terminal is only part of the IT resource, and there is a limit to the cost that can be applied to IT resource management for the user terminal.
・ IT asset management and network management are often managed separately, and each costs a lot.

  Therefore, according to the present invention, the access to the network can be restricted depending on the installation status of the agent software of the IT resource management software, and the user terminal in which the agent software of the IT asset management software is not installed is guided to the environment where the agent software is installed An object is to provide an IT resource management system that can be used.

  According to the present invention, as a first system, an IT resource management system that is connected to a user terminal via a network and manages IT resources, includes a network component device and a quarantine management terminal, and the network component device includes: , Device specific information for detecting the connection when the user terminal is connected to the network, and for acquiring device specific information, which is information specific to the user terminal detected by the connection detection unit. An acquisition unit; an apparatus specific information transmission unit that transmits the device specific information to the quarantine management terminal; and an access restriction unit that determines an access destination of the user terminal according to a policy transmitted from the quarantine management terminal; The quarantine management terminal sends an IT resource management agent software to the user terminal based on the acquired device specific information. Installation status determining means for determining whether or not software is installed, and when the installation status determining means determines that the IT resource management agent software is installed on the user terminal, the user terminal is A connection destination that transmits a policy to connect to a network to the network component device, and transmits a policy to connect the user terminal to the quarantine network when it is determined that it is not installed. And an IT resource management system comprising a policy transmission means.

  Furthermore, as a second system, an IT resource management system connected to a user terminal via a network and managing IT resources, comprising an unauthorized connection detection terminal and a quarantine management terminal, wherein the unauthorized connection detection terminal When the user terminal is connected to the network, a connection detection unit that detects the connection, and a device specific information acquisition unit that acquires device specific information that is unique information of the user terminal detected by the connection detection unit A device-specific information transmitting unit that transmits the device-specific information to the quarantine management terminal; and an access permission determination unit that determines whether the user terminal can access the network according to a policy transmitted from the quarantine management terminal. And the quarantine management terminal sends an IT resource management agent to the user terminal based on the acquired device specific information. In the installation status determination means for determining whether or not the software is installed, and in the installation status determination means, if it is determined that the IT resource management agent software is installed in the user terminal, the user terminal A policy of permitting access to the network is transmitted to the network component device, and if it is determined that the network device is not installed, the policy that the user terminal is not permitted to access the network is detected. There is provided an IT resource management system comprising an access permission / prohibition policy transmission means for transmitting to a terminal.

Furthermore, as a third system, an IT resource management system connected to a user terminal via a network and managing IT resources, comprising an unauthorized connection detection terminal and an IT resource management terminal,
The unauthorized connection detection terminal holds permission information holding means for holding information on a user terminal that permits access to the network, and a connection detection means for detecting the connection when the user terminal is connected to the network; Determining means for determining whether the user terminal detected by the connection detecting means is a user terminal that is permitted to access based on information held in the permission information holding means; and the determining means The access blocking means for blocking the connection of the user terminal determined to be unable to permit access to the network, and permitting access to the network for the user terminal determined to be unable to permit the access by the determination means Permission means; means for acquiring IT resource management information from the user terminal permitted to access; Management information transmitting means for transmitting the acquired IT resource management information to an IT resource management terminal, wherein the IT resource management terminal receives and accumulates IT resource management information transmitted from an unauthorized connection detection terminal; An IT resource management system comprising a management information receiving unit is provided.

  Furthermore, as a first method, there is an IT resource management method in a system for managing IT resources that is connected to a user terminal via a network, and when the network component device is connected to the network, A connection detection step for detecting the connection; a device specific information acquisition step for acquiring device specific information, which is information specific to the user terminal detected by the network configuration device in the connection detection step; Transmitting the device-specific information to the quarantine management terminal, and whether the quarantine management terminal has installed IT resource management agent software on the user terminal based on the acquired device-specific information. The installation status determination step and the quarantine management terminal In the installation status determining step, if it is determined that the IT resource management agent software has been installed on the user terminal, a policy for connecting the user terminal to the backbone network is transmitted to the network component device and installed. If it is determined that there is no connection, a policy for connecting the user terminal to the quarantine network is transmitted to the quarantine network, and a connection destination policy transmission step is transmitted from the quarantine management terminal. There is provided an IT resource management method comprising: an access restriction step of determining an access destination of the user terminal according to an established policy.

  Furthermore, as a second method, there is an IT resource management method in a system for managing IT resources that is connected to a user terminal via a network, and when the unauthorized connection detection terminal is connected to the network, A connection detection step for detecting connection, an unauthorized connection detection terminal for acquiring device unique information, which is unique information of the user terminal detected in the connection detection step, and an unauthorized connection detection terminal. Transmitting the device specific information to the quarantine management terminal, and whether the quarantine management terminal has the IT resource management agent software installed on the user terminal based on the acquired device specific information. An installation status determining step for determining whether or not the quarantine management terminal In the situation determination step, if it is determined that the IT resource management agent software is installed in the user terminal, a policy is permitted to allow the user terminal to access the network. If it is determined that the user terminal does not allow the user terminal to access the network, an access permission policy transmission step for transmitting to the unauthorized connection detection terminal a policy for not permitting the user terminal to access the network; There is provided an IT resource management method comprising: an access permission / prohibition determining step of determining whether or not the user terminal can access the network according to a policy transmitted from the terminal.

  Furthermore, as a third method, an IT resource management method in a system for managing IT resources connected to a user terminal via a network, in which an unauthorized connection detection terminal holds information on a user terminal that permits access to the network. The permission information holding step and the unauthorized connection detection terminal detect the connection when the user terminal is connected to the network. The connection detection step and the previous unauthorized connection detection terminal detect in the connection detection step. And determining whether the user terminal is a user terminal capable of permitting access based on the information held in the permission information holding step, and the unauthorized connection detecting terminal in the determining step. , Block the connection of the user terminal that is determined to be unable to allow access to the network A disconnecting step, and the unauthorized connection detecting terminal permits access to the network for the user terminal determined to be unable to permit access in the determining step, and the permitting step and the unauthorized connection detecting terminal permitted the access. A step of acquiring IT resource management information from a user terminal, a management information transmission step in which the unauthorized connection detection terminal transmits the acquired IT resource management information to the IT resource management terminal, and an IT resource management terminal in unauthorized connection There is provided an IT resource management method comprising a management information receiving step for receiving and storing IT resource management information transmitted from a detection terminal.

  Furthermore, as a first program, there is an IT asset management program in a system that is connected to a user terminal via a network, includes a network component device, a quarantine management terminal, and manages IT resources, and the user terminal is connected to the network. A connection detection function for detecting the connection when connected, a device specific information acquisition function for acquiring device specific information, which is information specific to the user terminal detected by the connection detection function, and the device specific A computer is realized with a device-specific information transmission function for transmitting information to a quarantine management terminal and an access restriction function for determining an access destination of the user terminal according to a policy transmitted from the quarantine management terminal. IT resource management program is provided.

  Further, as a second program, an IT asset management program in a system that is connected to a user terminal via a network, includes a network component device, a quarantine management terminal, and manages IT resources, the acquired device specific information Based on the installation status determination function and the installation status determination function for determining whether or not the IT resource management agent software is installed on the user terminal, the IT resource management agent software is installed on the user terminal. If it is determined that the user terminal is connected to the backbone network, a policy for connecting the user terminal to the backbone network is transmitted to the network constituent device. If it is determined that the user terminal is not installed, the policy for connecting the user terminal to the quarantine network is transmitted. And transmits to the transmission quarantine network over click configuration device, IT asset management program for causing realized with the attached policy sending function, to the computer is provided.

  Further, as a third program, an IT asset management program in a system that is connected to a user terminal via a network, includes an unauthorized connection detection terminal, and a quarantine management terminal, and manages IT resources, the user terminal is connected to the network. A connection detection function for detecting the connection when connected to a device, a device specific information acquisition function for acquiring device specific information, which is information specific to the user terminal detected by the connection detection function, and the device A device specific information transmission function for transmitting unique information to the quarantine management terminal, and an access permission determination function for determining whether or not the user terminal can access the network according to a policy transmitted from the quarantine management terminal. An IT resource management program characterized by being realized in the following is provided.

  Furthermore, as a fourth program, an IT asset management program in a system that is connected to a user terminal via a network, includes an unauthorized connection detection terminal, and a quarantine management terminal, and manages IT resources, the acquired device specific information In the installation status determination function and the installation status determination function for determining whether or not the IT resource management agent software is installed on the user terminal, the IT resource management agent software is installed on the user terminal. If it is determined that the user terminal is not installed, the user terminal is allowed to access the network. If it is determined that the user terminal is not installed, the user terminal accesses the network. Allow The sending to the unauthorized connection detection terminal a policy of not, IT asset management program for causing realized and accessibility policy sending function, to the computer is provided.

  Furthermore, as a fifth program, there is an IT asset management program in a system that is connected to a user terminal through a network, includes an unauthorized connection detection terminal, and an IT resource management terminal, and manages IT resources. A permission information holding function that holds information of a user terminal to be permitted, a connection detection function that detects the connection when the user terminal is connected to a network, and a user terminal that is detected by the connection detection function, A determination function that determines whether a user terminal is permitted to access based on information held in the permission information holding function, and a user terminal that is determined to be unable to permit access in the determination function In the connection blocking function that blocks connection to other networks and the discrimination function, access is permitted. A permission function for permitting access to a network to a user terminal determined to be impossible, a function for acquiring IT resource management information from the user terminal permitted to access, and the acquired IT resource management information There is provided an IT resource management program characterized in that a computer realizes a management information transmission function to be transmitted to a management terminal.

  According to the present invention, it is possible to restrict access to the network depending on the installation status of the agent software of the IT resource management software for a terminal that accesses the network.

  The embodiment of the present invention is a system that performs management of in-house IT resources by utilizing a PC quarantine system. First, an outline of the operation of the system will be described.

  First, a device connected to the in-house network is detected, and the information is managed by the IT resource management terminal. If IT asset management software is not installed on a device connected to the in-house network, it cannot be connected to the backbone network due to the function of the PC quarantine system.

  The connected device is isolated in the quarantine network in order to install the IT resource software. Then, in the quarantine network, it is possible to connect to the backbone network by installing the agent software of the IT resource management software.

  Further, when the user terminal is connected to the in-house network, IT resource management information is collected by the agent software of the IT resource management software that detects the hardware installed in the user terminal and the installed software. IT resource management information collected by the agent software of the IT resource management software is collected at the IT resource management terminal and managed there.

  Also, IT resources that cannot be installed with the agent software of the IT resource management software can be registered as IT resource information based on information collected by the PC quarantine management terminal or the unauthorized connection detection terminal.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

  Referring to FIG. 1, this embodiment includes a user terminal 10, an IT resource management terminal 20, a PC quarantine management terminal 30, and a network component device 40. Each of the terminals and devices is connected to a network 100, which is a network such as an intranet or the Internet.

  The user terminal 10, the IT resource management terminal 20, and the PC quarantine management terminal 30 operate by program control and are connected to each other via the network 100.

  The user terminal 10 is an information processing apparatus such as a personal computer, and can install agent software of IT resource management software. In addition, it has a function of transmitting information collected by the agent software to the IT resource management terminal 20 via the network 100 to the IT resource management terminal 20.

  The IT resource management terminal 20 is an information processing apparatus such as a workstation server installed in a center that manages IT resource information, and has a function of accumulating IT resource management information distributed from the user terminal 10. Yes.

  The PC quarantine management terminal 30 is an information processing apparatus such as a workstation server and has a function of managing information for constructing a PC quarantine network.

  The network component device 40 is a network device constituting the network 100 and has a function for constructing a PC quarantine system.

"Operation of Example"
Next, the operation of this embodiment will be described in detail with reference to FIGS.

  First, the movement of the entire system will be described with reference to FIG.

  The user terminal 10 is connected to the network component device 40 in order to access the network 100 (step A1).

  The network component device 40 detects the user terminal 10 connected to the network. The network component device 40 transmits a security countermeasure information confirmation request to the PC quarantine management terminal 30 using the device specific information of the connected user terminal as a key (step A2).

  The PC quarantine management terminal 30 that has received the security countermeasure status confirmation request confirms the security countermeasure status of the user terminal 10 using the device specific information as a key (step A3).

  Normally, the PC quarantine management terminal checks the status of anti-virus software data files, security patch application status, etc. as the security countermeasure status. In this example, the installation status of the agent software of the IT asset management software is confirmed. To do.

  If the agent software of the IT resource management software is not installed, a policy condition for restricting access to the network 100 is transmitted to the network component device 40 (step A4).

  On the other hand, if the agent software of the IT resource management software is installed, policy conditions that do not restrict access to the network 100 are transmitted to the network constituent device 40 (step A5). In this case, the processes of Steps B6 to B10 shown in FIG. 3 are subsequently performed. This point will be described later.

  Normally, the PC quarantine system differs in the way of allocating the network to which access is restricted (quarantine network) and the network to which access is not restricted (core network) depending on the method of configuring the quarantine network.

  Here, examples of methods for configuring the network include an authentication VLAN method, an IEEE 802.1x method, a personal firewall method, a gateway method, and the like. In addition, as a specific example of how to allocate the network, in the case of the IEEE 802.1x system, a RADIUS server is used.

  In this embodiment, the distribution method of the quarantine network is not limited. Therefore, it is described only that the distribution process is executed by the PC quarantine management terminal 30.

  Next, the network component device 40 applies the network access policy transmitted from the PC quarantine management terminal 30 (step A6). The user terminal 10 is permitted to access a network where access is restricted (step A7).

  The user terminal 10 is connected to a network whose access is restricted (step A8). Then, the IT resource management terminal 20 is accessed and the agent software of the IT resource management software is installed (step A9).

  Next, an operation when the user terminal after installing the agent software accesses the network 100 will be described with reference to FIG.

  The user terminal 10 is connected to the network component device 40 in order to access the network 100 (step B1).

  The network component device 20 detects the user terminal 10 connected to the network. The network component device 20 transmits a security countermeasure information confirmation request to the PC quarantine management terminal 30 using the device specific information of the connected user terminal as a key (step B2).

  The PC quarantine management terminal 30 that has received the security countermeasure status confirmation request confirms the security countermeasure status of the user terminal 10 using the device-specific information as a key (step B3).

  If the agent software of the IT resource management software is not installed, the policy condition for restricting access to the network 100 is transmitted to the network component device 40 (step B4). In this case, the processing of steps A6 to A9 shown in FIG. 2 is performed.

  On the other hand, when the agent software of the IT resource management software is installed, policy conditions that do not restrict access to the network 100 are transmitted to the network constituent device 40 (step B5).

  Next, the network component device 40 applies the network access policy transmitted from the PC quarantine management terminal 30 (step B6). The user terminal 10 is allowed network access with no access restriction (step B7).

  The user terminal 10 is connected to a network where access is not restricted (step B8), and the agent software of the IT resource management software installed in the user terminal 10 accesses the IT resource management terminal 20 and transmits IT resource management information. (Step B9).

  The IT resource management terminal 20 accumulates the received IT resource management information (step B10).

  Next, the operation of the agent software of the IT resource management software will be described.

  The agent software of the IT resource management software is installed in all user terminals 10 connected to the network 100 using the PC quarantine system. The agent software accesses the IT resource management terminal 20 through the network 100 and transmits the IT resource management information of the user terminal 10.

  As IT resource management information, hardware information of the user terminal 10, software information installed in the user terminal 10, and the like are collected.

  In addition, in order to reliably grasp the IT resource information of the user terminal 10, the agent software detects the operation when the hardware or software is installed on the user terminal 10, and controls the installation operation itself. It has a function that can be. Thereby, in addition to the function of collecting information already installed in the user terminal 10, information management of assets to be installed from now on becomes possible. Therefore, it becomes possible to cope with control of installation operations (such as rejecting installation of assets that are not permitted) and IT resource movement.

"Description of effects"
As described above, according to the present embodiment, it is possible to reliably collect information on IT resources such as the user terminal 10 connected to the network 100 without omission.

  In addition, it is possible to restrict the connection to the network 100 of a device in which the agent software for IT resource management software is not installed.

  In addition, it is possible to lead a device in which the agent software of the IT resource management software is not installed to the environment where the IT resource management software is installed, and the effect of improving the convenience of introducing the agent software and reducing the cost can be obtained.

  In addition, management that integrates IT resource management and network management becomes possible, and the effect of reducing management costs can be obtained.

  Next, a second embodiment of the present invention will be described in detail below.

  In the present embodiment, the network configuration device 40 is a simple network configuration device that does not have an authentication function or a VLAN distribution function, and differs from the above-described embodiment in that an unauthorized connection detection terminal 50 is used (FIG. 4). reference).

  The unauthorized connection detection terminal 50 is an information processing apparatus such as a workstation server or a dedicated appliance server, and has a function of collecting information on devices connected to the network 100. In addition, it has a function of rejecting connection to the network 100 for an illegally connected device.

  Next, the operation of the present embodiment will be described in detail with reference to FIG.

  The user terminal 10 connects to the network component device 40 in order to access the network 100 (step C1).

  The unauthorized connection detection device 50 detects the user terminal 10 connected to the network (step C2).

  The unauthorized connection detection device 50 transmits a security countermeasure information confirmation request to the PC quarantine management terminal 30 using the device specific information of the connected user terminal as a key (step C3).

  The PC quarantine management terminal 30 that has received the security countermeasure status confirmation request confirms the security countermeasure status of the user terminal 10 using the device-specific information as a key (step C4). Here, when the agent software of the IT resource management software is not installed, a policy condition for restricting access to the network 100 is transmitted to the unauthorized connection detection terminal 50 (step C5).

  On the other hand, if the agent software of the IT resource management software is installed, policy conditions that do not restrict access to the network 100 are transmitted to the unauthorized connection detection terminal 50 (step C6). In this case, the processing of steps D7 to D10 shown in FIG. 6 is performed. This point will be described later.

  Next, the unauthorized connection detection terminal 50 applies the network access policy transmitted from the PC quarantine management terminal 30 (step C7). In the embodiment of FIG. 4, since it is assumed that the agent software of IT resource management software is not installed in the user terminal 10, the user terminal 10 is blocked from network access (step C8).

  Since the user terminal 10 is blocked from network access (step C9), the agent software of the IT resource management software is installed without using the network (step C10).

  Next, the operation when the agent software of IT resource management software is already installed in the user terminal 10 in the embodiment of FIG. 4 will be described in detail with reference to FIG.

  The user terminal 10 is connected to the network component device 40 in order to access the network 100 (step D1).

  The unauthorized connection detection device 50 detects the user terminal 10 connected to the network (step D2).

  The unauthorized connection detection device 50 transmits a security countermeasure information confirmation request to the PC quarantine management terminal 30 using the device specific information of the connected user terminal as a key (step D3).

  The PC quarantine management terminal 30 that has received the security countermeasure status confirmation request confirms the security countermeasure status of the user terminal 10 using the device specific information as a key (step D4). If the agent software of the IT resource management software is not installed, a policy condition for restricting access to the network 100 is transmitted to the unauthorized connection detection terminal 50 (step D5). In this case, the processes of Steps C7 to C10 shown in FIG. 5 are performed.

  On the other hand, if the agent software of the IT resource management software is installed, policy conditions that do not restrict access to the network 100 are transmitted to the unauthorized connection detection terminal 50 (step D6).

  Next, the unauthorized connection detection terminal 50 applies the network access policy transmitted from the PC quarantine management terminal 30 (step D7). In the example of FIG. 5, since it is assumed that agent software of IT resource management software is installed in the user terminal 10, the user terminal 10 permits network access (step D8).

  Since the user terminal 10 is permitted to access the network (step D9), the IT resource management information is transmitted from the agent software to the IT resource management terminal 20 through the network 100 (step D10).

  Next, the operation when a user terminal that cannot install the agent software of IT resource management software is connected to the network will be described in detail with reference to FIG.

  The administrator of the PC quarantine management terminal 30 cannot install the agent software of the IT resource management software, but registers information on the user terminal 10 that is permitted to connect to the unauthorized connection detection terminal 50 (step E1).

  The user terminal 10 is connected to the network 100 (step E2).

  The unauthorized connection detection terminal 50 detects the user terminal 10 connected to the network (step E3).

  The unauthorized connection detection terminal 50 confirms whether the connection is permitted by using the device specific information of the connected user terminal as a key (step E4).

  If the user terminal is not permitted to connect, the network connection is blocked (step E5). If the user terminal is permitted to connect, the network connection is permitted (step E6). The user terminal 10 is permitted network access (step E7).

  Next, the unauthorized connection detection terminal 50 accesses the user terminal 10 and collects IT resource management information that can be collected (step E8).

  The unauthorized connection detection terminal 50 transmits IT resource management information to the IT resource management terminal 20 through the network 100 (step E9).

  The IT resource management terminal 20 accumulates the IT resource management information of the user terminal 10 (step E10).

  In the second embodiment described above, the agent software of the IT resource management software is not installed even in an environment where a network configuration device having no network authentication or VLAN distribution function is used by using an unauthorized connection detection terminal. The effect that the access to the network 100 of the device can be restricted is obtained.

  In the above description, the user terminal that cannot install the agent software of the IT resource management software is described as an example.

  Here, the above-described user terminal is not limited to a personal computer or the like directly used by the user. In addition to personal computers, it is possible to deal with all IT resources that can be connected to a network such as a printer.

  The IT resource management system can be realized by hardware, software, or a combination thereof.

It is a figure showing the structure of the 1st Example of this invention. It is a sequence diagram (1/2) showing the operation | movement when the IT resource management agent software is not installed in the 1st Example of this invention. It is a sequence diagram (2/2) showing operation | movement in case the IT resource management agent software is installed in the 1st Example of this invention. It is a figure showing the structure of the 2nd Example of this invention. It is a sequence diagram (1/2) showing the operation | movement when the IT resource management agent software is not installed in the 2nd Example of this invention. It is a sequence diagram (2/2) showing operation | movement in case the IT resource management agent software in the 2nd Example of this invention is installed. It is a sequence diagram showing operation | movement when the user terminal which cannot install IT asset management agent software is connected to the network.

Explanation of symbols

10 User terminal 20 IT resource management terminal 30 PC quarantine management terminal 40 network component equipment 50 unauthorized connection detection terminal 100 network

Claims (17)

An IT asset management system that is connected to a user terminal via a network and manages IT resources,
Network equipment and quarantine management terminal
The network component device is
A connection detecting means for detecting the connection when the user terminal is connected to a network;
Device-specific information acquisition means for acquiring device-specific information, which is information specific to the user terminal detected by the connection detection means;
A device specific information transmitting means for transmitting the device specific information to the quarantine management terminal;
An access restriction unit for determining an access destination of the user terminal according to a policy transmitted from the quarantine management terminal;
The quarantine management terminal
An installation status determining means for determining whether or not IT resource management agent software is installed in the user terminal based on the acquired device specific information;
When the installation status determining means determines that the IT resource management agent software is installed on the user terminal, the policy is sent to the network component device to connect the user terminal to the backbone network and installed. A connection destination policy transmission means for transmitting a policy to connect the user terminal to the quarantine network to the transmission quarantine network when it is determined that the user terminal is connected to the quarantine network;
An IT asset management system comprising: The IT asset management system according to claim 1,
Installation execution means for installing IT asset management agent software on a user terminal connected to the quarantine network;
Management information storage means for acquiring and storing IT resource management information from a user terminal in which the IT asset management agent software is installed;
An IT resource management system, further comprising an IT resource management terminal. An IT asset management system that is connected to a user terminal via a network and manages IT resources,
It has an unauthorized connection detection terminal and a quarantine management terminal.
The unauthorized connection detection terminal is
A connection detecting means for detecting the connection when the user terminal is connected to a network;
Device-specific information acquisition means for acquiring device-specific information, which is information specific to the user terminal detected by the connection detection means;
A device specific information transmitting means for transmitting the device specific information to the quarantine management terminal;
An access permission determination unit that determines whether the user terminal can access the network according to a policy transmitted from the quarantine management terminal;
The quarantine management terminal
An installation status determining means for determining whether or not IT resource management agent software is installed in the user terminal based on the acquired device specific information;
In the installation status determination means, if it is determined that the IT resource management agent software is installed in the user terminal, a policy that allows the user terminal to access the network is transmitted to the network component device, An access permission policy transmitting means for transmitting, to the unauthorized connection detection terminal, a policy that does not permit the user terminal to access the network when it is determined that the user terminal is not installed;
An IT asset management system comprising: An IT asset management system according to claim 3,
An IT resource management system further comprising an IT resource management terminal having management information acquisition means for acquiring and storing IT resource management information from a user terminal permitted to access the network. The IT resource management system according to any one of claims 1 to 4,
The IT asset management agent software installed in the user terminal is capable of detecting whether or not the installation operation can be executed when installing hardware or software in the user terminal. IT resource management system, characterized in that it is software comprising An IT asset management system that is connected to a user terminal via a network and manages IT resources,
It has an unauthorized connection detection terminal and an IT asset management terminal,
The unauthorized connection detection terminal is
Permission information holding means for holding information on user terminals that are allowed to access the network;
A connection detecting means for detecting the connection when the user terminal is connected to a network;
A determination unit configured to determine whether the user terminal detected by the connection detection unit is a user terminal capable of permitting access based on information held in the permission information holding unit;
A connection blocking means for blocking the connection of the user terminal determined to be unable to permit access to the network in the determination means;
Permission means for permitting access to the network for the user terminal determined to be unable to permit access in the determination means;
Means for acquiring IT resource management information from the user terminal permitted to access;
A management information transmitting means for transmitting the acquired IT resource management information to an IT resource management terminal;
The IT resource management terminal
An IT resource management system comprising management information receiving means for receiving and storing IT resource management information transmitted from an unauthorized connection detection terminal. An IT resource management method in a system for managing IT resources connected to a user terminal via a network,
A connection detecting step of detecting the connection when the network device is connected to the network; and
A device specific information acquisition step for acquiring device specific information, which is specific information of the user terminal detected by the network configuration device in the connection detection step;
A network component device transmits the device specific information to the quarantine management terminal, a device specific information transmission step;
An quarantine management terminal that determines whether or not IT resource management agent software is installed in the user terminal based on the acquired device specific information; and
The quarantine management terminal sends a policy to the network component device to connect the user terminal to the backbone network when it is determined in the installation status determination step that the IT resource management agent software is installed in the user terminal. A policy for connecting the user terminal to the quarantine network when it is determined that the user terminal is not installed, transmitting the policy to the network quarantine network to the quarantine network;
An access restriction step in which a network component device determines an access destination of the user terminal according to a policy transmitted from the quarantine management terminal;
An IT resource management method comprising: The IT resource management method according to claim 7,
An installation execution step in which the IT resource management terminal installs IT asset management agent software on a user terminal connected to the quarantine network;
A management information accumulation step in which the IT resource management terminal acquires and accumulates IT asset management information from a user terminal in which the IT asset management agent software is installed;
An IT resource management method, further comprising: An IT resource management method in a system connected to a user terminal via a network and performing IT resource management,
A connection detection step in which an unauthorized connection detection terminal detects the connection when the user terminal is connected to a network; and
A device-specific information acquisition step in which the unauthorized connection detection terminal acquires device-specific information, which is information specific to the user terminal detected in the connection detection step;
An unauthorized connection detection terminal transmits the device specific information to the quarantine management terminal, a device specific information transmission step,
An quarantine management terminal that determines whether or not IT resource management agent software is installed in the user terminal based on the acquired device specific information; and
The quarantine management terminal sets a policy for permitting the user terminal to access the network when the installation status determining step determines that the IT resource management agent software is installed in the user terminal. An access permission policy transmission step of transmitting to the unauthorized connection detection terminal a policy that the user terminal is not allowed to access the network if it is determined that the user terminal is not installed, transmitted to the device;
An unauthorized connection detection terminal determines whether or not the user terminal can access the network according to a policy transmitted from the quarantine management terminal;
An IT resource management method comprising: An IT resource management method according to claim 9,
An IT resource management method, further comprising: a management information acquisition step in which the IT resource management terminal acquires and accumulates IT resource management information from a user terminal permitted to access the network. The IT resource management method according to any one of claims 7 to 10,
The IT asset management agent software installed in the user terminal is capable of detecting whether or not the installation operation can be executed when installing hardware or software in the user terminal. An IT resource management method characterized by being software comprising An IT resource management method in a system connected to a user terminal via a network and performing IT resource management,
An unauthorized connection detection terminal that holds information on a user terminal that is permitted to access the network;
A connection detection step in which an unauthorized connection detection terminal detects the connection when the user terminal is connected to a network; and
A determination step in which the unauthorized connection detection terminal determines whether the user terminal detected in the connection detection step is a user terminal that can be permitted to access based on information held in the permission information holding step. When,
The unauthorized connection detection terminal blocks the connection to the network of the user terminal determined to be unable to permit access in the determination step, a connection blocking step,
An unauthorized connection detection terminal permits access to the network for the user terminal determined to be unable to permit access in the determination step;
An unauthorized connection detection terminal acquiring IT resource management information from a user terminal permitted to access;
A management information transmission step in which the unauthorized connection detection terminal transmits the acquired IT resource management information to the IT resource management terminal;
A management information receiving step in which the IT resource management terminal receives and accumulates IT resource management information transmitted from the unauthorized connection detection terminal;
An IT resource management method comprising: An IT asset management program in a system that is connected to a user terminal via a network, includes a network component device, a quarantine management terminal, and manages IT resources,
A connection detection function for detecting the connection when the user terminal is connected to a network; and
A device specific information acquisition function for acquiring device specific information, which is specific information of the user terminal detected in the connection detection function;
A device specific information transmission function for transmitting the device specific information to the quarantine management terminal;
An access restriction function for determining an access destination of the user terminal according to a policy transmitted from the quarantine management terminal;
IT resource management program characterized in that a computer is realized. An IT asset management program in a system that is connected to a user terminal via a network, includes a network component device, a quarantine management terminal, and manages IT resources,
An installation status determination function for determining whether or not IT resource management agent software is installed in the user terminal based on the acquired device specific information;
In the installation status determination function, if it is determined that the IT resource management agent software has been installed on the user terminal, a policy for connecting the user terminal to the backbone network is transmitted to the network component device and installed. A connection destination policy transmission function for transmitting a policy to connect the user terminal to the quarantine network to the transmission quarantine network to the network constituent device when it is determined that there is no connection;
IT resource management program characterized in that a computer is realized. An IT asset management program in a system that is connected to a user terminal via a network, includes an unauthorized connection detection terminal, a quarantine management terminal, and manages IT resources,
A connection detection function for detecting the connection when the user terminal is connected to a network; and
A device specific information acquisition function for acquiring device specific information, which is specific information of the user terminal detected in the connection detection function;
A device specific information transmission function for transmitting the device specific information to the quarantine management terminal;
An access permission determination function for determining whether the user terminal can access the network according to a policy transmitted from the quarantine management terminal;
IT resource management program characterized in that a computer is realized. An IT asset management program in a system that is connected to a user terminal via a network, includes an unauthorized connection detection terminal, a quarantine management terminal, and manages IT resources,
An installation status determination function for determining whether or not IT resource management agent software is installed in the user terminal based on the acquired device specific information;
In the installation status determination function, if it is determined that the IT resource management agent software has been installed in the user terminal, a policy that allows the user terminal to access the network is transmitted to the network component device, An access permission policy transmission function for transmitting to the unauthorized connection detection terminal a policy that does not permit the user terminal to access the network when it is determined that the user terminal is not installed;
IT resource management program characterized in that a computer is realized. An IT asset management program in a system that is connected to a user terminal via a network, includes an unauthorized connection detection terminal, an IT resource management terminal, and manages IT resources,
A permission information holding function that holds information on user terminals that are allowed to access the network;
A connection detection function for detecting the connection when the user terminal is connected to a network; and
A discrimination function for discriminating whether the user terminal detected in the connection detection function is a user terminal capable of permitting access based on information held in the permission information holding function;
In the determination function, a connection blocking function for blocking the connection of the user terminal determined to be unable to permit access to the network;
In the determination function, a permission function for permitting access to the network for a user terminal determined to be unable to permit access; and
A function of acquiring IT resource management information from the user terminal permitted to access;
A management information transmission function for transmitting the acquired IT resource management information to an IT resource management terminal;
IT resource management program characterized in that a computer is realized.

Images