JP2009239331A - Access management system, access management method, and program for access control - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an access management system capable of confirming the management state of an opposite party server before performing transmission. <P>SOLUTION: A firewall is connected to a network, and transmits a transmission request packet from a transmission source to the network. In accessing an opposite party on the network via the firewall, a state evaluating means stores the transmission request package from the transmission source in a transmission queue, and evaluates the management state of the opposite party. If the management of the opposite party is appropriate, it means takes the transmission request packet out of the transmission queue and delivers it to the firewall. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an access management system, and more particularly to an access management system that controls access to a network.

  A network access control system represented by a firewall mainly includes an access control policy DB (database) in which a policy for determining whether communication is possible according to a combination of an access control means, a packet transfer means, a specified address, a port number, and the like. ). In the network access control system, based on this policy, the access control means determines whether transmission / reception is possible, and the packet transfer means transmits a packet. For this reason, depending on the status of the destination server to be accessed, the virus is infected, and if the antivirus software is not compatible with the virus, the same infection will spread until the signature of the antivirus software is updated. was there.

  Further, the network access control system has a problem that the management status of the destination server is not confirmed when accessing. Furthermore, there is a problem in that the confirmation result of the management status of the destination server is not presented to the transmission source user and the transmission source network administrator when accessing. The reason is that the network access control system so far does not consider the situation of the destination server at all.

As a related technique, Japanese Patent Laid-Open No. 2002-208986 (Patent Document 1) discloses a communication device, a communication method, and a medium.
In this related technology, an information system for confirming a security level when exchanging information between systems includes a system A that provides information, a system B that receives provision of information, and an administrator terminal. The system A is constituted by a personal computer, for example. When providing information, the system A inquires of the information provider (information acquisition side) for security data in advance in order to determine the security level of the provider. A system that makes such an inquiry is called an inquiry system. On the other hand, the system B receiving the information responds to this inquiry. Such a system is called a responding system. This system B is also constituted by a personal computer, for example. In this related technology, the destination server has a database for accumulating information on whether or not the response is possible, and the management status is answered based on the availability information.

Japanese Patent Laying-Open No. 2006-277633 (Patent Document 2) discloses a computer network having a security guarantee function, a security guarantee method, and a program.
In this related technology, one computer (regardless of whether it is a server or a client) interacts with the other party's computer (regardless of whether it is a server or a client) prior to data transmission / reception with the other party. Confirm that the mutual security level meets a predetermined standard. As a result of the confirmation, when the mutual security level satisfies a predetermined standard, each computer can transmit and receive data. On the other hand, as a result of the confirmation, the computer on the side that has been found to have a low security level suspends transmission / reception of data and is necessary for raising the security level of a predetermined computer (which may be a communication partner computer) Request transmission of a correct file. When a file necessary for raising the security level is received from a predetermined computer, the computer performs update processing using the file to raise the security level, and then cancels suspension of data transmission / reception. In this related technology, when performing communication, a mutual authentication security driver for confirming the virus definition file must be mounted not only on the transmission source but also on the communication partner of the partner server.

JP 2006-318292 A (Patent Document 3) discloses a communication terminal, a secure device, and an integrated circuit.
In this related technology, the data analysis unit analyzes the header part of the acquired transmission data of the e-mail, and extracts the destination address and the name of the recipient as terminal identification information as information for identifying the destination terminal. . Such extracted information is called terminal identification information. In the permission information database, there is a permission information data table indicating environment information corresponding to the terminal identification information, and the data analysis unit accesses the permission information database, refers to the permission information data table, and extracts the terminal identification information. Check whether the environment information of the counterpart terminal corresponding to is registered. When the environmental information corresponding to the terminal identification information is registered, the data analysis unit acquires the environmental information. Further, the permission information database holds a security processing list for each environment that is a list of security processing corresponding to the environment information and a security processing list for each data that is a list of security processing corresponding to the type of data indicated by the application information. ing. The data analysis unit compares the acquired environment information of the partner terminal with the security processing list for each environment, and selects the security processing essential for the environment of the partner, and further, the acquired application information for the security processing list for each data The necessary security processing is selected according to the type of data, and the security processing to be finally executed is determined by comparing the selection results. In this related technology, a database storing information for determining the security management status of the other party is installed on the transmission side, and the result of the management status is determined based on the unique information of the communication destination.

JP 2002-208986 A JP 2006-277633 A JP 2006-318292 A

  An object of the present invention is to provide an access management system capable of confirming the management state of a destination server when accessing a network.

  Another object of the present invention is to provide an access management system that presents a result of confirming the management status of a destination server to a transmission source user and a transmission source network administrator when accessing the network.

  The access management system of the present invention is connected to a network, transmits a transmission request packet from a transmission source to the network, acquires the transmission request packet from the transmission source, and transmits a transmission request to a destination on the network via the firewall. Before sending the packet, store the transmission request packet in the transmission queue, evaluate the other party's management status, and if the other party's management status is appropriate, take the transmission request packet from the transmission queue and send it to the firewall Passing state evaluation means.

  The access management method of the present invention includes a step of acquiring a transmission request packet from a transmission source, and a transmission from the transmission source before transmitting the transmission request packet to a destination on the network via a firewall connected to the network. Storing the request packet in the transmission queue and evaluating the management state of the counterpart, and extracting the transmission request packet from the transmission queue and passing it to the firewall if the management state of the counterpart is appropriate.

The access management program of the present invention includes a step of acquiring a transmission request packet from a transmission source, and a transmission from the transmission source before transmitting the transmission request packet to a destination on the network via a firewall connected to the network. Storing the request packet in a transmission queue and evaluating the other party's management state; and if the other party's management state is appropriate, extracting the transmission request packet from the transmission queue and passing it to the firewall. This is a program to be executed.

  You can check the management status of the destination server before sending.

Hereinafter, a first embodiment of the present invention will be described with reference to the accompanying drawings.
Referring to FIG. 1, the network access management system according to the first embodiment of the present invention includes a firewall function unit 10 and a state evaluation unit 20.

  The firewall function unit 10 has a firewall function equivalent to a general firewall. A firewall monitors data flowing on the boundary with the outside, and detects and blocks unauthorized access. The state evaluation unit 20 evaluates the management state of the destination server when accessing the network. The partner server is a communication device on the network that can communicate with the network access management system. As an example of the partner server, a Web server that provides a public Web site can be considered. However, actually, it is not limited to this example.

  The firewall function unit 10 includes an access control unit 11, an access control policy DB (database) 12, and a packet transfer unit 13.

  The access control unit 11 controls network access. The access control policy DB 12 is a database that describes a policy related to an access control method. The packet transfer unit 13 transmits a packet by a designated method.

  Each of these means generally operates as follows.

  The access control unit 11 determines whether communication is possible according to the policy defined in the access control policy DB 12.

  The packet transfer unit 13 performs address conversion or the like as necessary, and transfers the packet onto the network.

  When receiving the transmission request packet from the transmission source, the state evaluation unit 20 performs communication for evaluating the management state of the destination server from the packet information without transmitting the transmission request packet, and obtains the result. After that, the original transmission request packet is passed to the access control unit 11. The state evaluation unit 20 may receive a transmission request packet from the transmission source via the network.

  Here, a relay device is assumed as an example of the network access management system. Examples of the relay device include a router, a switch, a gateway, a firewall, a proxy, an access point, an ISP (Internet Services Provider) server, or a computer that functions as a router. The network access management system is not limited to a relay device, but may be a terminal, a server, or a peripheral device. In this case, a computer such as a PC (personal computer), a thin client / server, a workstation, a mainframe, and a supercomputer can be considered as an example of the network access management system. The network access management system may be an expansion board or software installed in the computer. Further, the network access management system may be a virtual machine (Virtual Machine (VM)) environment. Note that the source of the transmission request packet and the example of the destination server are the same as in the network access management system.

  Examples of the access control unit 11 and the state evaluation unit 20 include a processing device such as a CPU (Central Processing Unit) and a microprocessor, or a semiconductor integrated circuit (Integrated Circuit (IC)) having a similar function. .

  Examples of the access control policy DB 12 include a semiconductor storage device such as a memory, an external storage device (storage) such as a hard disk, or a storage medium (media).

  Examples of the packet transfer unit 13 include a network adapter such as a NIC (Network Interface Card), a communication device such as an antenna, a communication port such as a connection port (connector), and the like.

  Examples of the network include the Internet, a LAN (Local Area Network), a wireless LAN (Wireless LAN), a mobile phone network, WiMAX, 3G (3rd generation mobile phone), a dedicated line, IrDA (Infrared Data Association), Bluetooth (registered trademark). ), Serial communication lines, etc. are conceivable.

  However, actually, it is not limited to these examples.

Next, the overall operation of this embodiment will be described in detail with reference to the flowchart of FIG.
(1) Step S101
When accessing the network, the transmission request packet of the transmission source user enters the state evaluation unit 20 of the network management system 1. The state evaluation unit 20 analyzes the transmission request packet and collects the IP address and port information of the transmission request packet.
(2) Step S102
Next, the state evaluation unit 20 adds a transmission request packet to the transmission queue. Here, the state evaluation unit 20 adds a transmission request packet to the transmission queue.
(3) Step S103
Further, the state evaluation unit 20 checks the management status of the destination server using the IP address and port information of the acquired transmission request packet. As an example of the management status, an unnecessary port opening in the firewall of the destination server can be considered. At this time, the state evaluation unit 20 may instruct the access control unit 11 to check the management status of the destination server. However, actually, it is not limited to these examples.
(4) Step S104
Finally, the state evaluation unit 20 stores the confirmation result of the management status, and advances the processing after the access control unit 11 of the firewall function unit 10.

  At this time, the state evaluation unit 20 may change the communication method and the protocol according to the confirmation result of the management status. For example, as a result of checking the management status of the destination server, if the destination server is compatible with secure shell (Secure Shell (SSH)) as a result of checking the management status of the destination server, the state evaluation unit 20 passes the access control unit 11 and the packet transfer unit 13. On the other hand, “SSH” may be used to instruct the destination server to transmit a transmission request packet.

  In the present embodiment, since the transmission request packet passes through the state evaluation unit 20 before communicating with the counterpart server, the management state of the counterpart server can be confirmed before transmission.

  Note that the state evaluation unit 20 may determine whether or not to check the management state of the destination server according to the transmission source user. For example, the state evaluation unit 20 sets in advance the IP address of a transmission source user who needs to check the management status of the destination server, identifies the transmission source user by the transmission source IP address of the transmission request packet, If the IP address of the transmission request packet matches the preset IP address, the firewall function unit 10 is instructed to check the management status of the destination server.

  Further, the state evaluation unit 20 may determine whether or not to confirm the management state of the partner server according to the partner server. For example, the state evaluation unit 20 presets the IP address of a reliable destination server, identifies the destination server by the destination IP address of the transmission request packet, and sets the destination IP address of the transmission request packet in advance. If it matches the IP address, the firewall function unit 10 is instructed to omit confirmation of the management status of the destination server. In this case, the state evaluation unit 20 can also instruct the firewall function unit 10 to change the contents of the management status to be confirmed according to the partner server.

  Further, the state evaluation unit 20 may check the management status for all communication devices existing on the network path to the partner server, not limited to the partner server. For example, based on the destination IP address of the transmission request packet, the state evaluation unit 20 recognizes communication devices existing on the network path by a command for displaying a list of network paths such as “traceroute” and “tracert”, and The firewall function unit 10 is instructed to confirm the management status for all communication devices existing on the route. By checking the management status for all communication devices existing on the network path, there is a high possibility that dangers such as snooping, interception, tampering, destruction, and unauthorized access can be avoided. At this time, the state evaluation unit 20 may instruct the firewall function unit 10 to exclude communication devices on the network under its management from being checked.

  Further, the state evaluation unit 20 may ask the partner server for permission to check the management state when checking the management state of the partner server. For example, when the state evaluation unit 20 transmits a confirmation request packet for requesting permission for confirmation of the management state to the partner server and receives a response to permit confirmation of the management state from the partner server, the state evaluation unit 20 manages the partner server. The firewall function unit 10 is instructed to check the status. At this time, the state evaluation unit 20 instructs the firewall function unit 10 to restrict transmission of the transmission request packet to the destination server that does not permit confirmation of the management state.

  Here, the security state has been particularly described as an example of the management state of the destination server. However, the management state is not limited to the security state in practice. In addition, as an example of the management status of the destination server, a processing status such as a reduction in processing speed due to concentration of processing on the destination server, a communication status such as a communication line failure or congestion, and the like can be considered.

  At this time, the state evaluation unit 20 may analyze the transmission request packet and identify the type of the transmission request packet. For example, the state evaluation unit 20 specifies the type of application corresponding to the transmission request packet, and instructs the firewall function unit 10 to check whether the counterpart server supports the application. If the destination server does not support the application, the state evaluation unit 20 instructs the firewall function unit 10 not to discard the transmission request packet and transmit it. Thereby, the network access management system of the present invention can prevent an inappropriate transmission request packet from being transmitted to the destination server.

Next, a second embodiment of the present invention will be described in detail with reference to the drawings.
Referring to FIG. 3, the network access management system according to the second exemplary embodiment of the present invention includes a firewall function unit 10, a state evaluation unit 20, and an evaluation result processing unit 30.

  The firewall function unit 10 has the same function as in FIG. 1 and operates in the same manner.

  On the other hand, when receiving the transmission request packet from the network, the state evaluation unit 20 does not transmit the transmission request packet, performs communication for evaluating the management state of the destination server from the packet information, and obtains the result. After the processing is performed by the evaluation result processing unit 30 corresponding to the evaluation result, a transmission request packet is passed to the access control unit 11 as necessary.

  The evaluation result processing unit 30 performs processing related to the evaluation result.

  As an example of the evaluation result processing unit 30, a processing device such as a CPU or a microprocessor, or a semiconductor integrated circuit (IC) having a similar function can be considered. However, actually, it is not limited to these examples.

Next, the overall operation of this embodiment will be described in detail with reference to the flowchart of FIG.
(1) Step S201
First, similarly to the first embodiment of the present invention, processing up to the state evaluation unit 20 is performed. Thereafter, the process is passed to the evaluation result processing unit 30. The evaluation result processing unit 30 sends the confirmation result of the management state of the destination server to the transmission source user or network administrator, and obtains transmission permission from the transmission source user or network administrator.
(2) Step S202
The evaluation result processing unit 30 confirms the transmission permission from the transmission source user or the network administrator, and proceeds the processing after the access control unit 11 of the firewall function unit 10 in the case of transmission OK.
(3) Step S203
The evaluation result processing unit 30 deletes the transmission request packet from the transmission queue when the transmission is not OK. Here, the evaluation result processing unit 30 deletes the transmission request packet added by the state evaluation unit 20 from the transmission queue.
(4) Step S204
The evaluation result processing unit 30 ends the process after deleting the transmission request packet from the transmission queue.

  In this embodiment, after confirming the management status of the destination server, the destination is passed through the evaluation result processing unit 30 that determines whether or not to continue transmission based on the confirmation result. Transmission can be permitted after checking the management status of the server.

  As described above, the present invention relates to a network access management system, an access management method, and an access management program for communication in an IP network such as the Internet / intranet, and in particular, when accessing a network, the firewall at the access destination site correctly manages The present invention relates to a network access management system, an access management method, and an access management program capable of confirming in advance.

  The first network access management system of the present invention includes a management status evaluation unit and a firewall unit of a destination server, and if the management state is appropriate, for example, an inappropriate port of the firewall of the destination server is not open. It works to go to the firewall means.

  The second network access management system according to the present invention includes a management status evaluation unit of the destination server, an evaluation result processing unit, and a firewall unit. When the management state of the destination server is not appropriate, the transmission source user and the transmission The former network manager is notified of the result, receives the result of whether or not to continue communication obtained from the sender user and the sender network manager, and proceeds to the firewall means as necessary.

Next, the effect of the present invention will be described.
The first effect is that the management status of the destination server can be confirmed when accessing the network. The reason for this is that if the site management state is inappropriate, there is a danger that malware or other phishing sites may be introduced to the site, but there is a danger of being guided to the phishing site. This is because such a risk can be confirmed by confirming the management status of the system.

  The second effect is that it is possible to determine whether or not access is possible according to the management state of the destination server when accessing. The reason for this is that if the server management state is inappropriate, there is a risk of malware or other phishing sites being introduced to the phishing site. This is because such a risk can be avoided by stopping the originally scheduled network access when an appropriate management state is confirmed.

  The present invention can be applied to a system that controls access to a network such as a firewall or a router.

  For example, the present invention can be applied to applications such as an information search device that searches for synonyms from a database and a program for realizing the information search device on a computer. In addition, it can be applied to uses such as a Kana-Kanji conversion device or a Kana-Kanji conversion function installed in a personal computer or a word processor.

FIG. 1 is a block diagram showing a configuration example of the first embodiment of the present invention. FIG. 2 is a flowchart showing the operation in the first embodiment of the present invention. FIG. 3 is a block diagram showing a configuration example of the second embodiment of the present invention. FIG. 4 is a flowchart showing the operation in the second embodiment of the present invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Firewall function part 11 ... Access control part 12 ... Access control policy DB (database)
13 ... Packet transfer unit 20 ... State evaluation unit

Claims (18)

A firewall connected to a network and transmitting a transmission request packet from a transmission source to the network;
The transmission request packet is acquired from the transmission source, and the transmission request packet is stored in a transmission queue before transmitting the transmission request packet to the transmission destination on the network through the firewall. An access management system comprising: a state evaluation unit that evaluates a management state and extracts the transmission request packet from the transmission queue and passes it to the firewall when the management state of the counterpart is appropriate. The access management system according to claim 1,
When the management state of the other party is not appropriate, the transmission source is notified of the result, the communication continuation result obtained from the transmission source is received, and when the transmission source is permitted to continue communication, the transmission waiting state is received. An access management system further comprising: an evaluation result processing unit that extracts the transmission request packet from the queue, passes the packet to the firewall, and deletes the transmission request packet from the transmission queue when the transmission source refuses to continue communication. The access management system according to claim 1 or 2,
The firewall is
According to the access control policy, an access control means for determining whether communication is possible,
Packet transfer means for transmitting the transmission request packet to the network in a designated manner,
The state evaluation means instructs the access control means to confirm the management state of the counterpart, and sends the transmission request packet to the packet transfer means in a predetermined manner according to the confirmation result of the management state of the counterpart. An access management system that directs you to send. The access management system according to any one of claims 1 to 3,
The state evaluation means refers to an address included in the transmission request packet, and checks the management state of the destination when the address included in the transmission request packet matches a preset address. An access management system for instructing the firewall. The access management system according to any one of claims 1 to 4,
The state evaluation means grasps a communication device existing on the network route to the destination based on the destination address of the transmission request packet, and manages the communication device existing on the network route to the destination An access management system that instructs the firewall to confirm. The access management system according to any one of claims 1 to 5,
The state evaluation means inquires of the other party about permission to confirm the management state, and if there is a response from the other party that the confirmation of the management state is permitted, confirms the management state of the other party. And an access management system that instructs the firewall to restrict transmission of the transmission request packet to the other party if there is no response from the other party to permit confirmation of the management state. Obtaining a transmission request packet from a transmission source;
Before sending the transmission request packet to the other party on the network through a firewall connected to the network, the transmission request packet from the transmission source is stored in a transmission queue, and the management state of the other party is set. An evaluation step;
An access management method including: taking out the transmission request packet from the transmission queue and passing it to the firewall when the management state of the counterpart is appropriate. The access management method according to claim 7,
If the management state of the other party is not appropriate, notifying the transmission source of the result and accepting the communication continuation result obtained from the transmission source; and
If communication from the sender is permitted, the step of taking out the transmission request packet from the transmission queue and passing it to the firewall;
And a step of deleting the transmission request packet from the transmission queue when communication from the transmission source is refused. The access management method according to claim 7 or 8,
An access management method further comprising: instructing the firewall to transmit the transmission request packet by a predetermined method according to a confirmation result of the management state of the counterpart. The access management method according to any one of claims 7 to 9,
Referring to an address included in the transmission request packet, and instructing the firewall to perform confirmation of a management state of the destination when the address included in the transmission request packet matches a preset address. An access management method. The access management method according to any one of claims 7 to 10,
Based on the destination address of the transmission request packet, the communication device existing on the network route to the partner is grasped, and the management status of the communication device existing on the network route to the partner is confirmed. An access management method further comprising the step of instructing a firewall. The access management method according to any one of claims 7 to 11,
The state evaluation means inquires of the other party about permission to confirm the management state, and if there is a response from the other party that the confirmation of the management state is permitted, confirms the management state of the other party. And a method of instructing the firewall to restrict transmission of the transmission request packet to the partner if there is no response from the partner to confirm the management state. Obtaining a transmission request packet from a transmission source;
Before sending the transmission request packet to the other party on the network through a firewall connected to the network, the transmission request packet from the transmission source is stored in a transmission queue, and the management state of the other party is set. An evaluation step;
An access management program for causing a computer to execute the step of taking out the transmission request packet from the transmission queue and passing it to the firewall when the management state of the counterpart is appropriate. The access management program according to claim 13,
If the management state of the other party is not appropriate, notifying the transmission source of the result and accepting the communication continuation result obtained from the transmission source; and
If communication from the sender is permitted, the step of taking out the transmission request packet from the transmission queue and passing it to the firewall;
An access management program for causing a computer to further execute a step of deleting the transmission request packet from the transmission queue when continuation of communication is refused by the transmission source. The access management program according to claim 13 or 14,
An access management program for causing a computer to further execute a step of instructing the firewall to transmit the transmission request packet by a predetermined method according to a confirmation result of a management state of the counterpart. The access management program according to any one of claims 13 to 15,
Referring to an address included in the transmission request packet, and instructing the firewall to perform confirmation of a management state of the destination when the address included in the transmission request packet matches a preset address. Management program for causing a computer to further execute The access management program according to any one of claims 13 to 16,
Based on the destination address of the transmission request packet, the communication device existing on the network route to the partner is grasped, and the management status of the communication device existing on the network route to the partner is confirmed. An access management program for causing a computer to further execute a step of instructing a firewall. An access management program according to any one of claims 13 to 17,
The state evaluation means inquires of the other party about permission to confirm the management state, and if there is a response from the other party that the confirmation of the management state is permitted, confirms the management state of the other party. And, if there is no response from the other party to permit confirmation of the management status, further causing the computer to execute a step of instructing the firewall to restrict transmission of the transmission request packet to the other party. Access management program.

Images