JP2009043033A - Client server system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a client server system for not only acquiring unauthorized access information to a file server which stores important secret information, such as an encrypting file, but also even prohibiting a client machine where a specific application is not installed from accessing the encrypting file to provide stronger protection of the file server. <P>SOLUTION: An access to an encrypting server is limited by a firewall to an access from a proxy server, so that a client is allowed to access the encrypting file server only via the proxy. A proxy communicates with the client when there is a request from the client, communication with the encrypting file server is allowed when, for example, it is determined that the specific application is installed, or otherwise the communication is rejected to protect the file sever. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a client server system that prohibits access to a file server holding a shared file to a machine in which a specific application is not installed.

  In the conventional encryption file server system, in order to decrypt the encryption file on the file server, it is assumed that a specific client application corresponding to the encryption file server is installed in the client machine. In such a system, a client machine on which a specific application is not installed cannot decrypt the encrypted file on the file server. However, depending on the OS settings, the encrypted file on the file server may be destroyed from the client machine. In some cases, it became possible to perform or falsify.

  Therefore, in such a situation, there is a demand for a file server protection method that allows only access from a machine on which a specific application is installed without depending on OS settings.

As a related technique for protecting a machine, for example, there is a technique described in Patent Document 1 below. This document proposes a method of detecting unauthorized access to a machine, collecting the information to a central server, and managing an unauthorized access history.
JP2004-206683

  However, the technique of Patent Document 1 collects unauthorized access information and does not protect the machine.

  An object of the present invention is not only to obtain unauthorized access information to a file server storing important confidential information such as an encrypted file, but also to access an encrypted file for a client machine in which a specific application is not installed. The object is to provide a client server system that even prohibits and realizes stronger protection of the file server.

  In order to achieve the above object, the present invention is characterized in that a proxy server is provided in a client server system for accessing a cryptographic file server from a client machine. Then, the client machine stores file server list information in which the encrypted file server to which access is permitted, the corresponding proxy server, and encryption key information are stored, and the proxy server described in the file server list information is stored. Issue an authentication request and receive authentication. When a general application operating on the client machine issues an access request to the encrypted file server, the access request is issued by replacing the access request with a proxy server corresponding to the requested encrypted file server. When the encrypted data on the encrypted file server is transmitted by the proxy server in response to the access request, the encrypted data is decrypted using the encryption key information described in the file server list information and decrypted. Send data to the general application. When the proxy server receives the authentication request issued from the client machine, the proxy server executes an authentication process. Also, when an access request issued from a client machine is received, it is confirmed whether or not the client machine is authenticated, and only when it is authenticated, the access request is issued to the requested encryption file server. This mediates the transfer of information between the client machine and the requested encryption file server.

  The above function of the client machine is usually realized by installing a specific application in the client machine. Therefore, in the present invention, it is possible to realize stronger file server protection by incorporating a mechanism for determining whether or not a specific application is installed in a client machine accessed on the file server side. Usually, it is difficult to modify the existing file server itself. Therefore, in the present invention, a proxy is introduced and access control by the proxy is realized.

  The file server list information held on the client machine is, for example, provided with an authentication server in the system, and only when the client machine is formally authenticated by the authentication server, the file server list information is transferred from the authentication server to the client machine. You should send it. In addition, the encryption file server is preferably limited to access permitted by a standard firewall function and can be accessed only from the proxy server. As a result, any client cannot access the actual encrypted file server directly (regardless of whether a specific application is installed) or not, and can access the encrypted file server only through the proxy server.

  When there is an access request from a client machine, the proxy server determines whether or not a specific application is installed on the client machine by communicating with the client machine. Permits transfer of information to and from the encryption file server that is the access request destination. If it is not installed, file server protection is realized by denying access at that time.

The client server system of the present invention has the following effects.
(1) The client machine that can access the encrypted file server can be limited to, for example, a machine on which a specific application is installed. By prohibiting file data destruction / falsification from the server, strong file server protection can be realized.
(2) By acquiring unauthorized access information in a log with a proxy server, it is possible to identify a suspicious machine attempting to access an encrypted file server holding confidential information.
(3) By using the proxy server method, file server protection can be realized without extensive modification to an existing encrypted file server.

  Hereinafter, an embodiment of a client server system to which the present invention is applied will be described.

  FIG. 1 shows an outline of the configuration of a client server system according to an embodiment of the present invention. In FIG. 1, 101 indicates a client machine, 102 indicates an authentication server, 103 indicates a proxy server, and 104 indicates an encrypted file server. The encrypted file server 104 is a file server that publishes the encrypted file 141 as a shared file. The proxy server 103 includes an encryption folder access control unit 131, monitors access to the encryption file server 104, and performs processing of restricting the access if necessary. The authentication server 102 includes an authentication control unit 121, and performs processing for authenticating the client machine 101 and providing authentication information to the client machine 101.

  FIG. 2 is a diagram for explaining an outline of an access control realizing method in the system of FIG. 1, and the same reference numerals as those in FIG. 1 denote the same components. 1 and 2, the encryption file server 104 has a standard firewall function 142, and the access is limited to the proxy server 103 only by the firewall function. This makes it impossible for any client machine to directly access the encrypted file server 104 regardless of whether or not a specific application is installed. For example, even if the client machine 202 in which the specific application is not installed directly accesses the encrypted file server 104 (arrow 203), the firewall function 142 rejects it. Similarly, even from the client machine 201 in which the specific application is installed, direct access to the encrypted file server 104 (arrow 204) is similarly denied.

  The client machine 201 in which the specific application is installed receives authentication of the authentication server 102 using the specific application, and acquires predetermined authentication information (described later in FIG. 4). Thereafter, the client machine 201 uses the specific application and uses the acquired information to connect to a predetermined proxy server 103 and receive authentication. When the authentication is successful, when a general application operating on the client machine 201 issues an access request to the encrypted file 141 of the encrypted file server 104, the specific application operating on the client machine 201 receives the access request. Is converted into a request (arrow 206) to the proxy server 103 and issued. The proxy server 103 receives the request, accesses the instructed encrypted file 141 (arrow 207), and returns the result to the client machine 201. As a result, a general application operating on the specific application installation client machine 201 can access the encrypted file 141 on the encrypted file server 104. In this case, the general application need only issue an access request to the encrypted file server 104 directly and does not need to be aware of the existence of the proxy server 103.

  On the other hand, since authentication fails even if a client machine 202 in which a specific application is not installed attempts to connect to the proxy server 103 (arrow 205), it cannot be connected, and therefore access to the encrypted file is also impossible. .

  FIG. 3 shows access control processing by the filter driver of the client. In the client 301 (201 in FIG. 2) in which the specific application is installed, a filter driver 303 that is a part of the specific application is operating. The client 301 is authenticated in advance by the authentication server 102 and acquires predetermined authentication information. The filter driver 303 acquires file server list information in the authentication information.

  FIG. 4 shows an example of file server list information included in the authentication information acquired when the client is authenticated by the authentication server 102. For example, the client 101 in FIG. 1 is authenticated by the authentication server 102 using a specific application, but if it is authenticated as a valid client, predetermined authentication information is transmitted to the client 101. The authentication information includes file server list information as shown in FIG. The file server list information has columns of “encrypted file server”, “corresponding proxy server”, and “encryption key information”. If the client wants to access the encrypted file server described in the "Encrypted File Server" field, the information in each field is the proxy server described in "Supported Proxy Server" instead of issuing an access request directly to the encrypted file server. The encrypted file acquired through the proxy server is decrypted by using the encryption key described in the “encryption key information”.

  Returning to FIG. 3, it is assumed that the filter driver 303 of the client 301 has acquired the file server list information of FIG. 4 through authentication by the authentication server 102. When the general application 302 issues an access request to the encrypted file server A 104 (311), the filter driver 303 hooks the access request and refers to the file server list information in FIG. Replace with a request to the corresponding proxy server P_A (312). Upon receiving the request, the encryption folder access control unit 131 of the proxy server P_A 103 issues an access request to the encryption file server A 104 in response to the request (313). In response to this request, the encrypted file server A 103 returns the encrypted data of the encrypted file 141 (314), and the proxy server P_A 103 returns the encrypted data to the client 301 (315). The filter driver 303 of the client 301 decrypts the encrypted data with the encryption key information acquired at the time of authentication with the authentication server 102, and returns it to the general application 302 as plain text data (316). With the above processing, transparent access to the encrypted file server that does not depend on the application above the filter driver 303 is realized.

  FIG. 5 shows an example of an authentication method for the client 101 in the proxy server 103. The proxy server 103 determines that the specific application is installed in the client 101 by communicating with the client machine 101 and performing authentication. The proxy server 103 is provided with two types of communication ports, which are called an authentication port 502 and a data transfer port 503, respectively.

  The authentication port 502 is a communication port for confirming whether a specific application is installed in the client. When the filter driver 303 of the client 101 detects access from the general application 302 to the encrypted file server 104, the filter driver 303 converts the destination to the proxy server 103 and simultaneously connects to the authentication port 502 of the proxy server 103. There are several possibilities for the authentication method at the authentication port 502 by the proxy server 103, but one general method will be described here. Secret information shared between the proxy server and the client is embedded in an installation medium used when installing a specific application on the client machine 101. When installing with the installation media, the secret information shared with the proxy server is retained on the client machine, and when connecting to the authentication port, the proxy server authenticates the client by performing Challenge & Response authentication using the secret information. Is possible.

  The data transfer port 503 is a port used for data transfer between the client 101 and the encrypted file server 104. The proxy server 103 uses the data transfer port on the condition that the client A 101 that issued the access request has been authenticated by the authentication port 502 and that the connection from the client A 101 continues to be held by the authentication port 502. Data transfer between the client A 101 and the file server 104 via 503 is executed.

  Note that the proxy server 103 outputs to the log information related to the client that failed to authenticate at the authentication port 502, thereby auditing whether there is suspicious access to the protected file server. It becomes possible.

  FIG. 6 shows a series of authentication flows by the authentication server 102 and the proxy server 103 in the system of this embodiment. As shown in (1) of FIG. 6, the client machine 101 first communicates with the authentication server 102 to perform authentication. When the authentication is successful, as shown in (2), a list of encrypted file servers accessible by the authenticated user and the encryption key information of those file servers (file server list information described in FIG. 4) is acquired. In the example of FIG. 6, since the authenticated user of the client 101 is permitted to access the encrypted file servers B and C, file server list information regarding the servers B and C (encrypted file servers B and C in the format of FIG. 4). C 101) is acquired by the client 101. Next, the client 101 requests authentication from each of the proxy servers (in this case, B and C) described in the “corresponding proxy server” column of the acquired file server list information ((3 in FIG. 6). ), (5)) If the authentication is successful, the connection with the authentication port of each proxy server is maintained. The client 101 that maintains the connection with the authentication port of the proxy server can access the encrypted file servers B and C via the proxy server.

  FIG. 7 shows access control processing by the proxy server. When the client 101 makes an access request to an unauthenticated proxy server A, the proxy server A confirms the IP address list of the client that maintains the connection with its own authentication port. The client 101 in FIG. 7 does not maintain a connection with the authentication port of the proxy server A. Therefore, the proxy server A does not transfer the access request from the client 101 to the encrypted file server A. When the client 101 makes an access request to the authenticated proxy server C, the proxy server C transfers the access request to the encrypted file server C because the client 101 maintains a connection with the authentication port, and the encrypted file Relay access to server C.

1 is a system configuration diagram showing an embodiment of the present invention. It is the outline of the access control implementation method to the file server by a proxy server. It is an outline of processing for switching access to a file server by a filter driver to a proxy server. It is an outline of a file server list included in authentication information passed from an authentication server to a client. It is the outline of the determination method of the presence or absence of specific application installation in the client in the proxy server. It is an outline of a series of authentication flows by an authentication server and a proxy server. It is an outline of proxy server access control processing.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 101 ... Client machine, 102 ... Authentication server, 103 ... Proxy server, 104 ... Encryption file server, 121 ... Authentication control part, 131 ... Encryption folder access control part, 141 ... Encryption file

Claims (1)

A client server system comprising an encrypted file server for storing an encrypted file and a client machine for issuing an access request for the encrypted file,
Set up a proxy server
The client machine is
Means for storing file server list information describing an encrypted file server to which access is permitted, a proxy server corresponding to the encrypted file server, and encryption key information;
Means for issuing an authentication request and receiving authentication to the proxy server described in the file server list information;
When a general application operating on the client machine issues an access request to the encrypted file server, the access request is replaced with a proxy server corresponding to the requested encrypted file server and issued,
When the encrypted data on the encrypted file server is transmitted by the proxy server in response to the access request, the encrypted data is decrypted using the encryption key information described in the file server list information, Means for sending the decrypted data to the general application,
The proxy server is
Means for executing an authentication process when receiving an authentication request issued from the client machine;
When the access request issued from the client machine is received, it is confirmed whether or not the client machine is authenticated, and only when the client machine is authenticated, the access request is issued to the encryption file server of the request destination, A client server system comprising: means for mediating transfer of information between the client machine and the requested encryption file server.

Images