JP2010015601A - Computer system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a computer system for dynamically switching security policies of terminals comprising a system. <P>SOLUTION: The computer system connects a plurality of user terminals having a function to perform filtering of data transmitted/received via a connected network and a network security management terminal for managing security countermeasure situations of the plurality of user terminals via a network. The user terminals dynamically change policy information about the filtering function of their own terminals. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a computer system having a defense against computer viruses, and more particularly to a computer system capable of dynamically switching security policies.

  In recent years, damage caused by computer viruses and worms (hereinafter simply referred to as computer viruses) has frequently occurred, and the amount of damage caused by these has also become enormous.

  For this reason, there is an increasing need for a computer system having a defense against computer viruses.

As a defense against computer viruses, a system using a client firewall function (client filter function) has been put into practical use.
The client filter function is a function for permitting or denying access to a network from a computer terminal and access from a network to a computer terminal in consideration of a transmission source, a destination IP address, and a port number. It is.

  The computer system using the client filter function currently in practical use has the following problems.

There are many client filter products, but there are many products that cannot change the filter policy dynamically.
-Even if the product can change the policy, it operates in synchronization with the anti-virus software, so the policy cannot be changed dynamically in an environment using anti-virus software from a different vendor.
-Since it cannot be operated in cooperation with an IDS (Intrusion Detection System) product, even if a user terminal infected with an unknown virus is connected to the network, communication from that terminal cannot be rejected.
-When constructing a PC quarantine system, the products that constitute the quarantine network and the products that manage the security countermeasure status are limited, and the system cannot be constructed easily.
When constructing a PC quarantine system, a special network terminal for restricting the access destination of the user terminal 10 is required according to the security check result, and the system cannot be easily constructed.

  The conventional client filter function can restrict access to the network for each program installed in the user terminal, but cannot perform access control in consideration of the security state of the user terminal. As for the client filter function provided by antivirus software vendors, there are products that can control the access destination dynamically by checking the version of the virus data file of the antivirus software. If you are infected with an unknown computer virus, you cannot deal with it.

  Moreover, as a prior art regarding the security of a computer system, there is an “intrusion detection management system” disclosed in Patent Document 1.

JP 2003-85139 A

The invention disclosed in Patent Document 1 uses a firewall function as a device for monitoring a network.
The invention disclosed in Patent Document 1 is a computer system that takes measures against illegal intrusion into a computer terminal, that is, so-called hacking. However, a computer virus enters a computer through a normal route (for example, e-mail). Therefore, the invention disclosed in Patent Document 1 does not contribute to the improvement of security against computer viruses.
Moreover, since the countermeasure rules for intrusion detection are selected from those registered in advance, it is not possible to deal with situations outside the expected range. In other words, it cannot cope with computer viruses in which new species and variants appear one after another.
Thus, conventionally, a computer system capable of dynamically switching the security policy of terminals constituting the system has not been realized.

  The present invention has been made in view of such a problem, and an object of the present invention is to provide a computer system capable of dynamically switching the security policy of terminals constituting the system.

  A computer system of the present invention is a computer in which a user terminal having a function of filtering data transmitted and received via a connected network and a network security management terminal for managing the security measure status of the user terminal are connected via the network. In the system, the user terminal dynamically changes the policy information of the filtering function of the own terminal.

  In the computer system, it is preferable that the user terminal dynamically changes the policy information of the filtering function of the user terminal according to the policy information received from the network security management terminal.

  In the above computer system, the network security management terminal notifies the user terminal notified of the suspicious behavior from the IDS terminal that monitors the packet flowing through the network, with policy information for blocking access to the network. Is preferred.

  In the computer system, it is preferable that the user terminal requests the network security management terminal to confirm the security countermeasure status at an arbitrary timing in response to a user operation.

  In the computer system, it is preferable that the user terminal collects information representing the device-specific information and security countermeasure information of the terminal, and transmits the information to the network security management terminal as a security countermeasure status confirmation request.

  In the above computer system, it is preferable that the network security management terminal notifies the policy information for restricting access to the network to the user terminal determined that the security countermeasure status is not the latest status.

  In the computer system, when communication with a terminal other than the communication partner permitted by the policy information of the filtering function of the own terminal occurs, the user terminal preferably notifies the user of the occurrence of the communication.

  In the above computer system, the user terminal requests the user to input information indicating whether or not the communication notified of the occurrence is the communication intended by the user, and when information indicating unintended communication is input, It is preferable to change the policy information to block access.

  ADVANTAGE OF THE INVENTION According to this invention, the computer system which can change the security policy of the terminal which comprises a system dynamically can be provided.

It is a figure which shows the structure of the computer system concerning 1st Embodiment which implemented this invention suitably. It is a figure which shows the flow of operation | movement of the security countermeasure status management center terminal concerning 1st Embodiment. It is a figure which shows the flow of operation | movement of the computer system concerning 1st Embodiment. It is a figure which shows the flow of operation | movement of the computer system concerning 1st Embodiment. It is a figure which shows the flow of operation | movement of the computer system concerning 2nd Embodiment which implemented this invention suitably. It is a figure which shows the flow of operation | movement of the computer system concerning 2nd Embodiment. It is a figure which shows the structure of the computer system concerning 3rd Embodiment which implemented this invention suitably. It is a figure which shows the flow of operation | movement of the computer system concerning 3rd Embodiment. It is a figure which shows the flow of operation | movement of the computer system concerning 3rd Embodiment. It is a figure which shows the structure of the computer system concerning 4th Embodiment which implemented this invention suitably. It is a figure which shows the flow of operation | movement of the computer system concerning 4th Embodiment.

In the present invention, the access to the network is controlled by installing a client filter function unrelated to the antivirus software in the user terminal in the computer terminal. Therefore, the present invention can be applied to a computer system that has already introduced a defense against computer viruses.
In addition, it is possible to link with products having various functions by publishing an interface for the client filter function unit to link with external products. This allows for a wider range of usage.

There are two main types of defense against computer viruses:
-Ensure that security measures are in place to prevent infection by computer viruses (proactive measures).
When a user terminal infected with a computer virus is connected to the system, in order to prevent secondary infection, the user terminal infected with the virus is isolated from other user terminals (reactive countermeasures).
In the present invention, both of the above two measures can be taken, or only one of them can be taken. Therefore, it is possible to construct a computer system with security measures taken as necessary.

[First Embodiment]
A first embodiment in which the present invention is suitably implemented will be described.
FIG. 1 shows a configuration of a computer system according to the present embodiment. In the computer system according to the present embodiment, a plurality of user terminals 10 in which the client filter function 20 is implemented, a security countermeasure status management center terminal 30, and an IDS center terminal 40 are mutually connected via a network 100 (such as an intranet). It is a connected configuration.

  The user terminal 10 is an information processing apparatus such as a computer terminal, and has a function of accessing the network 100 (a function of transmitting and receiving information via the network 100).

The client filter function unit 20 is mounted on the user terminal 10 and monitors all data sent from the user terminal 10 to the network 100 and all data received from the network 100, and passes these data. Is controlled for each program and each communication partner.
The client filter function unit 20 has a function of dynamically switching a filter function policy (rules on what data is allowed to pass and what data is blocked). Further, the client filter function unit 20 is an interface for changing the policy of the client filter function in response to a request from another terminal (security countermeasure status management center terminal 30 in this embodiment) connected to the network 100. Is provided.

  In addition, the client filter function unit 20 includes an interface for notifying the user of the user terminal 10 when communication with a terminal other than the communication partner permitted by the policy occurs. The client filter function unit 20 has a function of communicating with the security countermeasure status management center terminal 30 and dynamically changes the policy of the client filter function in response to a request from the security countermeasure status management center terminal 30.

  In addition, the client filter function unit 20 has a function of transmitting the device-specific information of the user terminal 10 and the security countermeasure status to the security countermeasure status management center terminal 30 as a security countermeasure status confirmation request. The device unique information includes the MAC address of the user terminal 10 and the like. The security countermeasure status includes virus pattern file version information of the antivirus software, operating status of the antivirus software, security patch application status, and the like.

  Further, the client filter function unit 20 provides an interface for the user of the user terminal 10 to transmit a security measure status confirmation request to the security measure information management center terminal 30 at an arbitrary timing. For example, the client filter function unit 20 provides an interface by displaying a transmission button on the display of the user terminal 10.

The security countermeasure status management center terminal 30 is an information processing apparatus (workstation, server, etc.) installed in the center that manages the security countermeasure status, and the user terminal transmitted from the user terminal 10 by the client filter function unit 20 Collect 10 security countermeasure status information.
Further, the security countermeasure status management center terminal 30 holds the latest information necessary for security countermeasures, and compares the information collected from all the user terminals 10 with the latest information. Determine whether the measures are sufficient.
Further, the security countermeasure status management center terminal 30 determines the security countermeasure status based on various information transmitted from the user terminal 10 by the client filter function unit 20 and transmits the policy of the client filter function to the user terminal 10.
Furthermore, information regarding the user terminal 10 that performs suspicious behavior is received from the IDS center terminal 40, and a policy for blocking communication to the network 100 is transmitted to the client filter function unit 20 of the user terminal 10.

  The IDS center terminal 40 is an information processing device (workstation, server, or the like) or a network appliance device, monitors all packets flowing through the network 100, and detects a user terminal 10 that behaves suspiciously. Further, information related to the user terminal 10 that is performing suspicious behavior is transmitted to the security countermeasure status management center terminal 30.

The operation of the computer system will be described.
FIG. 2 shows a flow of operations of the security countermeasure status management center terminal 30.
In order to determine the security countermeasure status, the latest security countermeasure information is acquired (step A1). The security countermeasure information includes virus pattern file version information of antivirus software, security patch information, and the like.

  The security countermeasure status management center terminal 30 waits for a request from the IDS center terminal 40 or the client filter function unit 20. Upon receiving a request from the IDS center terminal 40 or the client filter function unit 20, the security countermeasure status management center terminal 30 determines the requested content. If a suspicious user terminal notification is received from the IDS center terminal 40 (step A2 / Yes), a policy for blocking communication to the network 100 is transmitted to the suspicious user terminal (step A3).

  If a security measure status confirmation request is received from the client filter function unit 20 (step A2 / No, step A4 / Yes), the client filter function unit 20 is compared with the latest security measure information acquired in advance. Is notified of the security countermeasure status check result (step A5). The notified content includes a policy (rule) to be applied to the client filter function unit 20. For example, if the security countermeasure status check result is OK, a policy that does not particularly restrict access to the network 100 is transmitted. On the other hand, if the security countermeasure status check result is NG, a policy for prohibiting access to the network 100 or restricting access is transmitted.

  Thereafter, if monitoring is continued, the process returns to step A1 (step A6).

The operation flow of the entire system is shown in FIG.
When the user activates the user terminal 10, the client filter program is executed by the CPU in the user terminal 10, and the client filter function unit 20 is installed on the user terminal 10 (step B1). In order to prevent the client filter function unit 20 from being implemented by the user's operation of the user terminal 10, the client filter program is automatically executed when the user terminal 10 is started, and the execution of the program is stopped by the user's operation. It is preferable not to do so.

  The activated client filter function unit 20 collects device-specific information and security countermeasure information of the user terminal 10 and transmits them to the security countermeasure status management center terminal 30 as a security countermeasure status confirmation request (step B2). The device specific information is information for specifying the user terminal 10 and includes a host name, an IP address, a MAC address, and the like. The security countermeasure information includes virus pattern file version information of the antivirus software, the operating status of the antivirus software, the security patch application status, and the like.

  When the security countermeasure status management center terminal 30 receives the security countermeasure status confirmation request transmitted from the user terminal 10 by the client filter function 20, the latest security countermeasure information already obtained and the client filter function section 20 transmit the security countermeasure status confirmation request. The security countermeasure information of the user terminal 10 that has been received is compared (step B3). The method for obtaining the latest security countermeasure status is not particularly limited, and a known method such as obtaining from a specific Web site via a network can be applied.

  If the security countermeasure status check result is NG (step B3 / NG), the security countermeasure status management advanced terminal 30 sets the policy for restricting access to the network 100 to the client that is the transmission source of the security countermeasure status confirmation request. It transmits to the filter function part 20 (step B4). If the security countermeasure status check result is OK (step B3 / OK), the security countermeasure status management center terminal 30 sends a policy that does not restrict access to the network 100 to the client that is the source of the security countermeasure status confirmation request. It transmits to the filter function part 20 (step B5).

  When the client filter function unit 20 receives the policy of the client filter function from the security countermeasure status management center terminal 30, it applies it (step B6). Then, the contents of the applied policy are displayed on the screen of the user terminal 10 (step B7), thereby notifying the user of the state of the client filter function. If the security check result is NG, the cause is also displayed on the screen of the user terminal 10.

  By applying the policy received from the security countermeasure status management center 30, if the security check result is OK, the user of the user terminal 10 can access the network 100 without being restricted. On the other hand, if the security check result is NG, it becomes possible to access a limited range of resources.

Next, the operation of the system when the IDS center terminal 40 detects the user terminal 10 behaving suspiciously will be described. FIG. 4 shows the flow of operation of the system in this case.
The IDS center terminal 40 monitors all packets flowing through the network 100 to detect a user terminal having a suspicious behavior (step C1). Suspicious behavior here refers to behavior often seen when a user's terminal is infected with a computer virus (communication to a partner that is unthinkable in normal operations, simultaneous communication to a large number of partners, etc.) Point to.

  If the IDS center terminal 40 detects a user terminal 10 that is suspicious (step C2 / Yes), the IDS center terminal 40 sends a suspicious user terminal notification including device-specific information for identifying the user terminal 10 as a security measure. It is transmitted to the status management center terminal 30 (step C3).

  When the security countermeasure status management center terminal 30 receives the suspicious user terminal notification, the security countermeasure status management center terminal 30 identifies the suspicious user terminal based on the device specific information, and accesses the network filter 100 to the client filter function unit 20 on the user terminal 10. A policy for restricting is transmitted (step C4).

When the client filter function unit 20 receives the policy of the client filter function from the security countermeasure status management center terminal 30, it applies it (step C5). And the state of the applied policy is displayed on the screen of the user terminal 10 (step C6). Thereby, the user of the user terminal 10 can notify the state of the client filter function unit 20 and the cause thereof.
In this way, the user of the user terminal 10 can know that the access to the network 100 is restricted because the user terminal 10 is suspected of being infected with a computer virus.

  As the IDS center terminal 40, it is conceivable to use a commercially available IDS product. However, when an IDS product that is commercially available generally finds a suspicious terminal, the information is transmitted using the SNMP protocol. It often has a notification function. In this embodiment, since the security countermeasure status management center terminal 30 receives the suspicious user terminal notification of the IDS product by the SNMP protocol, a commercially available IDS product can be applied as the IDS center terminal 40.

  As described above, when the computer system according to the present embodiment allows the user terminal to access the network, the computer system dynamically determines the security countermeasure status of the user terminal used by the user, and according to the result. Since the access to the network is dynamically switched, the network itself can be kept secure.

  Further, by providing an IDS center terminal, it is possible to cope with an unknown computer virus, and even if a user terminal infected with a computer virus is connected to the network, it can be detected and eliminated quickly.

  Further, since communication between the IDS center terminal 40 and the security countermeasure status management center terminal 30 can be realized by a generally used protocol, it is not necessary to use a special device for the IDS center terminal 40.

  In addition, it dynamically determines the status of security measures on user terminals connected to the network. If it is illegal, only security measures such as installing security software, upgrading data files of security software, and applying security patches. The effect of being able to access the network for treatment that can be performed is obtained.

  Further, since the access restriction to the network is realized by the client filter function, it can be dealt with without performing the network connection form of the user terminal (for example, replacement of the network cable in the case of wired connection).

  Further, since access restriction to the network is realized by the client filter function, access control can be realized regardless of whether the IP address of the user terminal is set statically or dynamically from the DHCP server.

  In addition, since no special network device is required, the present invention can be applied to a wide variety of network forms from intranet connection to remote connection.

[Second Embodiment]
A second embodiment in which the present invention is suitably implemented will be described.
The configuration of the computer system according to this embodiment is the same as that of the first embodiment.
This embodiment is different from the first embodiment in that the security countermeasure status center terminal 30 does not manage the security countermeasure status of all user terminals.

FIG. 5 shows an operation flow of the computer system according to the present embodiment.
When the user activates the user terminal 10, the client filter program is executed by the CPU in the user terminal 10, and the client filter function unit 20 is installed on the user terminal 10 (step D1). In order to prevent the client filter function unit 20 from being implemented by the user's operation of the user terminal 10, the client filter program is automatically executed when the user terminal 10 is started, and the execution of the program is stopped by the user's operation. It is preferable not to do so.

  The activated client filter function unit 20 applies a policy that does not restrict access to the network 100 (step D2).

  The IDS center terminal 40 monitors all packets flowing through the network 100, thereby detecting a user terminal having a suspicious behavior (step D3). Suspicious behavior here refers to behavior often seen when a user's terminal is infected with a computer virus (communication to a partner that is unthinkable in normal operations, simultaneous communication to a large number of partners, etc.) Point to.

  When the IDS center terminal 40 detects the user terminal 10 that is suspiciously behaved (step D4 / Yes), the IDS center terminal 40 sends a suspicious user terminal notification including device-specific information for identifying the user terminal 10 to the security measure The data is transmitted to the status management center terminal 30 (step D5).

  When the security countermeasure status management center terminal 30 receives the suspicious user terminal notification, the security countermeasure status management center terminal 30 identifies the suspicious user terminal based on the device specific information, and accesses the network filter 100 to the client filter function unit 20 on the user terminal 10. A policy for restricting is transmitted (step D6).

When the client filter function unit 20 receives the policy of the client filter function from the security countermeasure status management center terminal 30, it applies it (step D7). Then, the state of the applied policy is displayed on the screen of the user terminal 10 (step D8). Thereby, the user of the user terminal 10 can notify the state of the client filter function unit 20 and the cause thereof.
In this way, the user of the user terminal 10 can know that access to the network 100 is restricted because the terminal 10 used by the user terminal 10 is suspected of being infected with a computer virus.

Next, the operation after removing the computer virus of the user terminal 10 will be described.
FIG. 6 shows the flow of operation.
After the infected computer virus is removed, when an operation for transmitting an access restriction release request to the security countermeasure status management center terminal 30 is performed, the client filter function unit 20 sends the access restriction release request to the security countermeasure status. It transmits to the management center terminal 30 (step E1).

  The security countermeasure status management center terminal 30 that has received the access restriction release request transmits a policy for releasing the access restriction to the network 100 to the client filter function unit 20 of the user terminal 10 that is the transmission source (step E2).

  The client filter function unit 20 that has received the policy transmitted from the security countermeasure status management center terminal 30 applies it (step E3). Then, the state of the applied policy is displayed on the screen of the user terminal 10 (step E4). Thereby, the user of the user terminal 10 can grasp the state of the client filter function.

  As the access restriction to the network 100 is released, the user terminal 10 can freely access the network 100.

  As described above, the computer system according to the present embodiment does not check the security countermeasure status of all user terminals 10 in the security countermeasure status management center terminal 30, but has a defense against computer viruses.

  Generally, since a large amount of money is required to construct a system for managing the security countermeasure status of all user terminals, it cannot be easily introduced. The computer system according to the present embodiment can detect a user terminal actually infected with a computer virus and block network access without using an apparatus for checking the security countermeasure status of all user terminals. Therefore, a computer system with computer virus countermeasures can be constructed at a low cost.

[Third Embodiment]
A third embodiment in which the present invention is preferably implemented will be described.
FIG. 7 shows a configuration of a computer system according to the present embodiment.
The computer system according to this embodiment is different from the second embodiment in that the computer system does not include the security countermeasure status management center terminal 30. The functions provided by the security countermeasure status management center terminal 30 in the second embodiment are realized by the IDS center terminal 40.

FIG. 8 shows an operation flow of the computer system according to the present embodiment.
When the user activates the user terminal 10, the client filter program is executed by the CPU in the user terminal 10, and the client filter function unit 20 is mounted on the user terminal 10 (step F1). In order to prevent the client filter function unit 20 from being implemented by the user's operation of the user terminal 10, the client filter program is automatically executed when the user terminal 10 is started, and the execution of the program is stopped by the user's operation. It is preferable not to do so.

  The activated client filter function unit 20 applies a policy that does not restrict access to the network 100 (step F2).

  The IDS center terminal 40 monitors all packets flowing through the network 100, thereby detecting a user terminal having a suspicious behavior (step F3). Suspicious behavior here refers to behavior often seen when a user's terminal is infected with a computer virus (communication to a partner that is unthinkable in normal operations, simultaneous communication to a large number of partners, etc.) Point to.

  When the IDS center terminal 40 detects the user terminal 10 behaving suspiciously (step F4 / Yes), the IDS center terminal 40 identifies the user terminal 10 and, with respect to the client filter function unit 20 on the user terminal 10, A policy for restricting access to the network 100 is transmitted (step F5).

Upon receiving the client filter function policy from the IDS center terminal 40, the client filter function unit 20 applies it (step F6). Then, the state of the applied policy is displayed on the screen of the user terminal 10 (step F7). Thereby, the user of the user terminal 10 can notify the state of the client filter function unit 20 and the cause thereof.
In this way, the user of the user terminal 10 can know that access to the network 100 is restricted because the terminal used by the user terminal 10 is suspected of being infected with a computer virus.

Next, an operation after deleting a computer virus that has infected the user terminal 10 will be described.
FIG. 9 shows the operation flow of the system.

  After an infected computer virus is removed, when an operation for transmitting an access restriction release request to the IDS center terminal 40 is performed, the client filter function unit 20 transmits an access restriction release request to the IDS center terminal 40. (Step G1).

  The IDS center terminal 40 that has received the access restriction release request transmits a policy for releasing the access restriction to the network 100 to the client filter function unit 20 of the user terminal 10 that is the transmission source of the access restriction release request (step). G2).

  The client filter function unit 20 that has received the policy transmitted from the IDS center terminal 40 applies it (step G3). Then, the state of the applied policy is displayed on the screen of the user terminal 10 (step G4). Thereby, the user of the user terminal 10 can grasp the state of the client filter function.

  As the access restriction to the network 100 is released, the user terminal 10 can freely access the network 100.

As described above, the computer system according to the present embodiment is configured not to include the security countermeasure status management center terminal, but has a defense against computer viruses.
Generally, since a large amount of money is required to construct a system for managing the security countermeasure status of all user terminals, it cannot be easily introduced. The computer system according to the present embodiment can detect a user terminal actually infected with a computer virus and block network access without using an apparatus for managing the security countermeasure status of all user terminals. Therefore, a computer system with computer virus countermeasures can be constructed at a low cost.

  Further, the system configuration can be simplified as compared with the computer system according to the second embodiment.

[Fourth Embodiment]
A fourth embodiment in which the present invention is preferably implemented will be described.
FIG. 10 shows a configuration of a computer system according to the present embodiment.
The computer system according to the present embodiment has a configuration in which a plurality of user terminals 10 are connected via a network 100.

An operation of the computer system according to the present embodiment will be described.
FIG. 11 shows a flow of system operation.
When the user activates the user terminal 10, the client filter program is executed by the CPU in the user terminal 10, and the client filter function unit 20 is installed on the user terminal 10 (step H1). In order to prevent the client filter function unit 20 from being implemented by the user's operation of the user terminal 10, the client filter program is automatically executed when the user terminal 10 is started, and the execution of the program is stopped by the user's operation. It is preferable not to do so.

  The client filter function unit 20 installed in the user terminal 10 applies a policy limited to a predetermined access destination (step H2).

  When a computer virus that infects the user terminal 10 is activated, access from the user terminal 10 to the network 100 occurs (step H3).

  The client filter function unit 20 detects that there is communication with the other party not set in the policy, and notifies the user of the user terminal 10 to that effect (step H4). At the same time, the client filter function unit 20 requests the user to input information as to whether or not the notified communication is communication intended by the user (step H5).

  When information indicating that the communication was not intended is input from the user (step H6 / No), the client filter function unit 20 determines that the access is due to virus infection and blocks access to the network 100. The policy to be applied is applied (step H7). Then, the applied policy is displayed on the screen of the user terminal 10, and the state of the client filter function and the cause thereof are notified to the user (step H8).

As described above, the computer system according to the present embodiment is configured not to include the security countermeasure status management center terminal and the IDS center terminal, but has a defense against computer viruses.
Generally, since a large amount of money is required to construct a system for managing the security countermeasure status of all user terminals, it cannot be easily introduced. The computer system according to the present embodiment can detect a user terminal actually infected with a computer virus and block network access without using an apparatus for managing the security countermeasure status of all user terminals. Therefore, it is possible to construct a computer system with computer virus countermeasures at a low cost.

  Further, the system configuration can be simplified as compared with the computer system according to the third embodiment.

  Each of the above embodiments is an example of a preferred embodiment of the present invention, and the present invention is not limited to these and can be modified.

DESCRIPTION OF SYMBOLS 10 User terminal 20 Client filter function part 30 Security countermeasure status management center terminal 40 IDS terminal

Claims (8)

A computer system in which a user terminal having a function of filtering data transmitted / received via a connected network and a network security management terminal for managing the security countermeasure status of the user terminal are connected via the network,
The computer system according to claim 1, wherein the user terminal dynamically changes policy information of a filtering function of the own terminal.   The computer system according to claim 1, wherein the user terminal dynamically changes the policy information of the filtering function of the own terminal according to the policy information received from the network security management terminal.   The network security management terminal notifies policy information for blocking access to the network to a user terminal notified of suspicious behavior from an IDS terminal that monitors packets flowing through the network. The computer system according to claim 2.   The computer system according to claim 2, wherein the user terminal requests the network security management terminal to confirm a security countermeasure status at an arbitrary timing in response to a user operation.   5. The computer system according to claim 4, wherein the user terminal collects information representing device-specific information and security countermeasure information of the terminal, and transmits the collected information to the network security management terminal as a security countermeasure status confirmation request. .   The said network security management terminal notifies the policy information which restrict | limits the access to the said network with respect to the user terminal judged that the security countermeasure status is not the newest status. Computer system.   The user terminal, when communication with a terminal other than the communication partner permitted by the policy information of the filtering function of the own terminal occurs, notifies the user of the occurrence of the communication. The computer system according to any one of the above.   The user terminal requests the user to input information indicating whether or not the communication notified of the occurrence is the communication intended by the user, and accesses the network when information indicating unintended communication is input. The computer system according to claim 7, wherein the policy information is changed to policy information to be blocked.

Images