JP2010219803A - Quarantine system, quarantine management device, quarantine method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a quarantine system that suppresses the occurrence of a delay in a period from the time when security policies of a network are updated to the time when the update is reflected in a client computer, and to provide a quarantine management device, a quarantine method, and a program that are used for the quarantine system. <P>SOLUTION: The quarantine management device 2 includes a security policy-setting part 204 that sets or updates security policies by an external instruction in order to execute quarantine of a network connected with a client computer 1, an auditing execution control part 205 that issues an auditing execution instruction, which makes the client computer 1 execute auditing based on the security policies, whenever the security policies are set or updated, and a communication part 203 that establishes a connection with the client computer 1, at least at the time when the auditing execution instruction is issued, so as to transmit the auditing execution instruction and data for specifying the security policies to the client computer 1. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a quarantine system, a quarantine management apparatus, a quarantine method, and a program used therefor.

  In recent years, a quarantine system has attracted attention as one of the technologies for countermeasures against information leakage in network systems of companies and the like. The quarantine system first applies a security patch provided by an OS vendor to a client computer (hereinafter referred to as “client”) connected to a network such as an in-house LAN, and anti-virus software. Check the update status of the pattern file. The quarantine system isolates a client that does not conform to the security policy from the network work and forcibly prompts the application of a patch to improve the security level in the enterprise.

  An example of such a quarantine system is disclosed in Patent Document 1. The quarantine system disclosed in Patent Document 1 includes a client, a policy server that holds a quarantine security policy, and a quarantine server.

  In the quarantine system disclosed in Patent Document 1, a security policy set by a system administrator is held by a policy server, and is transmitted from there to a client and a quarantine server. An agent program is incorporated in the client, and the agent program detects the state of the client according to the received security policy, and transmits a statement list specifying the detected state to the quarantine server. Then, an audit by the quarantine server is executed, and the result is transmitted to the client agent program.

  In the quarantine system disclosed in Patent Document 1, the client agent program inquires the policy server for security policy updates at a set fixed interval, and performs a security policy update check. Further, the agent program communicates with the quarantine server every time an update check is performed, and the quarantine server performs an audit at this timing.

JP 2005-318615 A

  In general, security patches provided by OS vendors and pattern files for antivirus software are updated daily. These include files for security measures that the client wants to apply immediately.

  For this reason, the system administrator may have to change the security policy in accordance with these updates depending on the type of file for security measures. Therefore, when the system administrator changes the setting of the security policy of the quarantine system, the changed security policy is immediately sent to the agent program and auditing is required.

  However, in the quarantine system disclosed in the above-mentioned Patent Document 1, even if the security policy setting of the quarantine server is changed, the communication is not performed until the communication is performed between the policy server and the client at the set interval. Is not executed. For this reason, the quarantine system disclosed in Patent Document 1 has a problem that a delay corresponding to the communication interval occurs from when the security policy is changed until the audit is performed according to the security policy.

  For example, if the set interval is 1 day and regular communication is performed once a day, the system administrator changes the security policy until an audit based on the security policy is performed. It takes up to 1 day.

  SUMMARY OF THE INVENTION An object of the present invention is to solve the above problems and to prevent the occurrence of a delay between the time when a security policy in a network is updated and the time when the update is reflected on a client computer, and the quarantine management used in the system. To provide an apparatus, a quarantine method, and a program.

In order to achieve the above object, a quarantine system according to the present invention is a quarantine system including a client computer connected to a network and a quarantine management apparatus that executes quarantine in the network,
The quarantine management device
A security policy setting unit for setting or updating a security policy in accordance with an instruction from the outside;
An audit execution control unit that issues an audit execution instruction for causing the client computer to execute an audit based on the security policy each time the security policy is set or updated;
At least before the audit execution instruction is issued, the connection is established with the client computer, and the issued audit execution instruction and the data specifying the security policy are maintained in the state where the connection is maintained. And a communication unit for transmitting to the client computer,
The client computer is
A communication unit that receives the audit execution command and the security policy transmitted from the quarantine management apparatus;
When the audit execution instruction is received, an audit unit that executes an audit of the client computer based on the received security policy,
It is characterized by that.

To achieve the above object, a quarantine management apparatus according to the present invention is a quarantine management apparatus that executes quarantine in a network to which a client computer is connected,
A security policy setting unit for setting or updating a security policy in accordance with an instruction from the outside;
An audit execution control unit that issues an audit execution instruction for causing the client computer to execute an audit based on the security policy each time the security policy is set or updated;
At least before the audit execution instruction is issued, the connection is established with the client computer, and the issued audit execution instruction and the data specifying the security policy are maintained in the state where the connection is maintained. A communication unit for transmitting to the client computer,
It is characterized by that.

In order to achieve the above object, a quarantine method according to the present invention is a quarantine method for executing a quarantine in a network to which a client computer is connected,
(A) setting or updating a security policy in accordance with an external instruction;
(B) issuing an audit execution instruction for causing the client computer to execute an audit based on the security policy each time the security policy is set or updated;
(C) establishing a connection with the client computer at least before the audit execution instruction is issued;
(D) transmitting the issued audit execution command and data specifying the security policy to the client computer in a state where the connection established in the step (c) is maintained. Yes,
It is characterized by that.

Furthermore, in order to achieve the above object, a program in the present invention is a program for executing quarantine in a network to which a client computer is connected by a computer,
In the computer,
(A) setting or updating a security policy in accordance with an external instruction;
(B) issuing an audit execution instruction for causing the client computer to execute an audit based on the security policy each time the security policy is set or updated;
(C) establishing a connection with the client computer at least before the audit execution instruction is issued;
(D) executing the step of transmitting the issued audit execution instruction and data specifying the security policy to the client computer in a state where the connection established in the step of (c) is maintained.
It is characterized by that.

  Due to the above features, according to the quarantine system, quarantine management apparatus, quarantine method, and program of the present invention, the delay between the time when the security policy in the network is updated and the time when the update is reflected on the client computer is prevented. Can be suppressed.

FIG. 1 is a block diagram showing a schematic configuration of a quarantine system and a quarantine management apparatus according to an embodiment of the present invention. FIG. 2 is a diagram showing an example of a security policy file updated in the quarantine management apparatus shown in FIG. FIG. 3 is a diagram illustrating an example of a data format stored in the storage unit of the quarantine management apparatus illustrated in FIG. FIG. 4 is a diagram illustrating the audit result of each client computer stored in the storage unit of the quarantine management apparatus illustrated in FIG. FIG. 5 is a diagram showing an example of a data format stored in the storage unit of the client computer shown in FIG. FIG. 6 is a flowchart showing the operation of the quarantine management apparatus in the embodiment of the present invention. FIG. 7 is a sequence diagram showing an operation flow of the entire quarantine system in the embodiment of the present invention.

(Embodiment)
Hereinafter, a quarantine system, a quarantine management apparatus, a quarantine method, and a program according to an embodiment of the present invention will be described with reference to FIGS. First, configurations of the quarantine system and the quarantine management apparatus according to the present embodiment will be described with reference to FIGS. FIG. 1 is a block diagram showing a schematic configuration of a quarantine system and a quarantine management apparatus according to an embodiment of the present invention.

  As shown in FIG. 1, the quarantine system 3 according to the present embodiment includes a client computer 1 connected to a network 4 and a quarantine management apparatus 2 that executes quarantine in the network 4. The network 4 is a LAN laid by, for example, a company or a public office. FIG. 1 shows only a single client computer 1, but the number thereof is not limited. In fact, in many cases, the number of client computers 1 is plural.

  As shown in FIG. 1, the quarantine management apparatus 2 includes a security policy setting unit 204, an audit execution control unit 205, and a communication unit 203. The security policy setting unit 204 sets or updates the security policy in the network system according to an instruction from the outside.

  The audit execution control unit 205 issues an audit execution command for causing the client computer 1 to execute an audit based on the security policy every time a security policy is set or updated. The communication unit 203 establishes a connection with the client computer 1 at least before an audit execution command is issued. Then, the communication unit 203 transmits the issued audit execution command and data (policy file) specifying the security policy to the client computer 1 while maintaining this connection.

  As shown in FIG. 1, the client computer 1 includes a communication unit 103 and an audit unit 105. The communication unit 103 receives the audit execution command and the security policy (policy file) transmitted from the quarantine management apparatus 2. When the audit execution command is received, the auditing unit 105 performs an audit of the client computer 1 based on the received security policy.

  Thus, in the present embodiment, the inspection management device 2 issues an audit execution instruction each time the security policy is changed by updating. The inspection management apparatus 2 establishes a connection with the client computer 1 immediately or already when issuing the audit execution command. Accordingly, the audit execution command is immediately transmitted to the client computer 1. As a result, the occurrence of a delay from when the security policy in the network is updated until the update is reflected on the client computer is suppressed.

  Here, the configuration of the quarantine system 3 in the present embodiment will be described more specifically. As shown in FIG. 1, in this embodiment, the quarantine management apparatus 2 includes a management unit 202 and a storage unit 201 in addition to a security policy setting unit 204, an audit execution control unit 205, and a communication unit 203. I have. The storage unit 201 stores a policy file 206 and an audit result 207.

  In this embodiment, the storage unit 201, the management unit 202, the communication unit 203, the security policy setting unit 204, and the audit execution control unit 205 are incorporated into the server computer by incorporating program modules that exhibit these functions. It has been realized. In FIG. 1, 20 indicated by a broken line conceptually indicates a program module. The quarantine management apparatus 2 functions as a quarantine server.

  The management unit 202 manages operations of the storage unit 201, the communication unit 203, the security policy setting unit 204, and the audit execution control unit 205 in the program module 20. The operation of each unit is performed in response to a command notification from the management unit 202.

  The security policy setting unit 204 receives data of a security policy that is newly set or data for updating an existing security policy from the outside. The data is input by, for example, an input device such as a keyboard or another computer used by the system administrator.

  Then, the security policy setting unit 204 generates a policy file according to the input data. As a result, a new security policy is set, and the existing security policy is updated as shown in FIG. FIG. 2 is a diagram showing an example of a security policy file updated in the quarantine management apparatus shown in FIG. The generated policy file is sent to the management unit 202.

  In this embodiment, when the management unit 202 receives the policy file, the management unit 202 stores the policy file in the storage unit 201 and further instructs the audit execution control unit 205 to issue an audit execution command. In other words, the management unit 202 sends data necessary for the audit execution control unit 205 to issue an audit execution command to the audit execution control unit 205 in response to the policy file.

  When the audit execution control unit 205 issues an audit execution command, it sends it to the communication unit 203. The communication unit 203 transmits an audit execution command and a policy file to the client computer 1 in accordance with an instruction from the management unit 202. Further, the communication unit 203 receives the audit result transmitted from the client computer 1 and sends the received audit result to the management unit 202, as will be described later. The audit result is then stored in the storage unit 201. All data received by the communication unit 203 from the client computer 1 is sent to the management unit 202.

  FIG. 3 is a diagram illustrating an example of a data format stored in the storage unit of the quarantine management apparatus illustrated in FIG. As shown in FIG. 3, in the storage unit 201, audit results and policy files are managed for each client computer. FIG. 4 is a diagram showing the audit result of each client computer stored in the storage unit of the quarantine management apparatus shown in FIG. 3 and 4, “Agent ID” is an ID for identifying a program module incorporated in each client computer 1. The program module incorporated in the client computer 1 will be described later.

  In the present embodiment, the communication unit 203 is connected to the communication unit 103 of the client computer 1 through a TCP connection. Further, the communication unit 203 continues to maintain this connection while the corresponding client computer is in an operating state. That is, in this embodiment, the communication unit 203 does not establish a connection with the client computer 1 as necessary, but always establishes a connection so that an audit execution command can be transmitted immediately. .

  On the other hand, as shown in FIG. 1, in the present embodiment, the client computer 1 includes a management unit 102, a trigger generation unit 104, and a storage unit 101 in addition to the communication unit 103 and the audit unit 105. ing. The storage unit 101 stores a policy file 106 and an audit result 107 of the client computer 1 including the storage unit 101.

In this embodiment, the storage unit 101, the management unit 102, the communication unit 103, the trigger generation unit 104, and the audit unit 105 are realized by incorporating program modules that exhibit these functions into the client computer. Yes. In FIG. 1, 10 indicated by a broken line conceptually indicates a program module.

  In the present embodiment, the program module 10 of the client computer 1 functions as an agent of the quarantine management apparatus 2 because it performs an audit in response to an instruction from the quarantine management apparatus (quarantine server) 2. Therefore, in the following description, “agent” is added to the head of the name of each part realized by the program module 10. That is, the agent storage unit 101, the agent management unit 102, the agent communication unit 103, the agent trigger generation unit 104, and the agent audit unit 105 are used. The program module 10 is “agent 10”.

  The agent management unit 102 manages the operations of the agent storage unit 101, the agent communication unit 103, the agent trigger generation unit 104, and the agent audit unit 105 in the agent 10. The operation of each unit is performed in response to a command notification from the agent management unit 102.

  Specifically, when the agent communication unit 103 receives an audit execution command, the agent management unit 102 sends an audit execution command to the agent trigger generation unit 104 to instruct execution of the audit. Upon receiving the audit execution instruction, the agent trigger generation unit 104 generates a trigger for the agent audit unit 105 to execute the audit, and sends this to the agent audit unit 105. The agent management unit 102 sends data necessary for the agent auditing unit 105 to perform an audit as an audit execution command to the agent trigger generating unit 104.

  Further, the agent management unit 102 stores the policy file received by the agent communication unit 103 in the agent storage unit 101 and also sends it to the agent audit unit 105.

  When the agent auditing unit 105 receives the trigger generated by the agent trigger generating unit 104 and the policy file, the agent auditing unit 105 performs auditing according to the security policy specified by the policy file. Further, the agent auditing unit 105 inputs the audit result to the agent storage unit 101. The agent storage unit 101 stores the input audit result.

  In this embodiment, the agent audit unit 105 receives a trigger from the agent trigger generation unit 104 and executes an audit. However, the present embodiment is not limited to this. For example, the audit execution control unit 205 of the quarantine management apparatus 2 may generate a trigger, and the trigger may be input to the agent auditing unit 105 via the agent communication unit 103 and the agent management unit 102.

  Further, in the present embodiment, the agent auditing unit 105 is not limited to the case where the audit effective command is transmitted from the quarantine management apparatus 2 but also performs regular auditing. Specifically, the agent management unit 102 periodically instructs the agent trigger generation unit to execute an audit. Also in this case, the agent trigger trigger generation unit 104 generates a trigger and sends it to the agent audit unit 105. Thereby, periodic auditing by the agent auditing unit 105 is also executed.

  The agent storage unit 101 stores the policy file 106 and the audit result 107 as described above, and these are managed by a table as shown in FIG. FIG. 5 is a diagram showing an example of a data format stored in the storage unit of the client computer shown in FIG.

  In this embodiment, the agent communication unit 103 transmits the audit result 107 and other necessary data to the communication unit 203 of the quarantine management apparatus 2 in accordance with an instruction from the agent management unit 102. Note that all data received from the outside by the agent communication unit 103 is once sent to the agent management unit 102. Further, all the data transmitted by the agent communication unit 103 to the outside is received from the agent management unit 102.

  Next, the operation of the quarantine management apparatus 2 shown in FIG. 1 will be described with reference to FIG. FIG. 6 is a flowchart showing the operation of the quarantine management apparatus in the embodiment of the present invention. Further, the quarantine method in the present embodiment is executed by operating the quarantine management apparatus 2 in the present embodiment. Therefore, the description of the quarantine method in the present embodiment is replaced with the following description of the operation of the quarantine management apparatus 2. In the following description, FIG. 1 is taken into consideration as appropriate.

  As shown in FIG. 6, first, the management unit 202 determines whether or not the security policy has been updated (step S1). Specifically, in step S1, the management unit 202 determines whether or not a new policy file has been sent from the security policy setting unit 204.

  If the result of determination in step S1 is that the security policy has not been updated, the management unit 202 enters a standby state. On the other hand, if the result of determination in step S1 is that the security policy has been updated, the management unit 202 stores a new policy file in the storage unit 201 (step S2), and further causes the audit execution control unit 205 to Then, issuing an audit execution command is instructed (step S3).

  Next, upon receiving an audit execution command issuance command, the audit execution control unit 205 issues an audit execution command and sends it to the communication unit 203 (step S4). Subsequently, the communication unit 203 transmits the audit execution command and the policy file stored in step S2 to the client computer 1 (step S5). In the present embodiment, the communication unit 203 is connected to the agent communication unit 103 of the client computer 1 through the TCP connection at least before execution of step S4, and the connection state is maintained.

  Auditing is performed in the client computer 1 by executing step S5. Thereafter, when an audit result is transmitted from the client computer 1, the communication unit 203 receives this and sends it to the management unit 202. Then, the management unit 202 stores the received audit result in the storage unit 201 (step S6). By executing step S6, the processing in the quarantine management apparatus 1 accompanying the update of the security policy is completed.

  Next, the operation of the entire quarantine system 3 including a client computer will be described with reference to FIG. FIG. 7 is a sequence diagram showing an operation flow of the entire quarantine system in the embodiment of the present invention. In the following, the periodic audit process in the client computer 1 will be described first, and then the audit process when the security policy is updated will be described.

  As shown in FIG. 7, the agent 10 incorporated in the client computer 1 periodically performs auditing. In this case, an audit execution command is transmitted from the agent management unit 102 of the agent 10 to the agent trigger generation unit 104, and further, an audit execution command is transmitted from the agent trigger generation unit 104 to the agent audit unit 105 (step A1).

Next, upon receiving the audit execution command, the agent auditing unit 105 executes auditing based on the policy file (step A2). When the audit execution is completed, the agent auditing unit 105 stores the result in the agent storage unit 101 (step A3).

  Further, the agent auditing unit 105 notifies the audit result to the agent managing unit 102 in order to notify the program result 20 to the program module 20 of the quarantine management apparatus 2 simultaneously with step A3 (step A4). The agent management unit 102 that has received the audit result notifies the agent communication unit 103 of the audit result.

  The agent communication unit 103 that has received the audit result transmits the audit result to the communication unit 203 in the program module 20 constituting the quarantine management apparatus 2 (step A5). In the quarantine management apparatus 2, when the communication unit 203 receives the audit result, the communication unit 203 notifies the management unit 202 that the audit result has arrived (step A6). Based on the notification, the management unit 202 stores the updated audit result in the storage unit 201 (step A7).

  Next, a case where the system administrator changes the security policy of the quarantine system 3 will be described. An audit is performed at the timing of the security policy change. In this case, the security policy setting unit 204 of the quarantine management apparatus 2 is notified to the management unit 202 that the policy file has been changed (step B1).

  Next, the management unit 202 that has received the notification of the change stores the changed policy file in the storage unit 201 (step B2). Then, simultaneously with step B2, the management unit 202 sends a policy file to the audit execution control unit 205 to instruct the agent 10 to issue an audit execution command (step B3).

  Next, upon receiving an instruction to issue an audit execution command, the audit execution control unit 205 sends the audit execution command to the communication unit 203 in order to cause the agent 10 to perform the audit. The communication unit 203 that has received the audit execution command transmits the audit execution command and the policy file to the agent communication unit 103 in the agent 10 (step B4).

  Subsequently, the agent communication unit 103 that has received the audit execution command and the policy file sends the audit execution command and the policy file to the agent management unit 102 (step B5). Then, the agent management unit 102 stores the policy file sent to the agent 10 in the agent storage unit 101 (step B6). Thereafter, in the agent 10, steps B7 to B10 are executed and the audit result is transmitted to the quarantine management apparatus 2. Steps B7 to B10 are the same steps as steps A2 to A4 described above.

  In addition, after execution of Step B10, in the quarantine management apparatus 2, the communication unit 203 notifies the management unit 202 that the audit result has arrived (Step B11), and the management unit 202 updates the storage unit 201. The audited result is stored (step B12). Steps B11 and B12 are the same as steps A6 and A7 described above, respectively. Further, FIG. 7 does not show the step of establishing the connection between the quarantine management apparatus 2 and the client computer 1, but it is sufficient that the connection is established at least before step A4. For example, step A1 It may be done before the execution.

  Moreover, the program in this Embodiment should just be a program which makes a computer perform step S1-S6 shown in FIG. 6, and also step A6, A7, B1-B4, B11, and B12 shown in FIG. Specifically, the program in the present embodiment may be the program module 20. If this program is installed in a computer and executed, the quarantine management apparatus 2 and the quarantine management method in the present embodiment can be realized.

In this case, the central processing unit (CPU) of the computer is connected to the management unit 20.
2. Functions as a communication unit 203, a security policy setting unit 204, and an audit execution control unit 205, and performs processing. The storage unit 201 can be realized by a storage device such as a hard disk provided in the computer.

  As described above, according to the present embodiment, the agent 10 can always use the latest security policy without a time lag in auditing. This is because, when the system administrator changes the security policy, the quarantine management apparatus 2 performs the distribution of the latest policy file and the re-audit instruction to the agent 10 triggered by this.

  Moreover, according to this Embodiment, the load of the quarantine management apparatus (quarantine server) 2 required for an audit can be reduced. Further, it is possible to shorten the time from the execution of the audit to obtaining the audit result, to improve the real-time property of the entire quarantine system 3 and to improve the resource utilization efficiency. This is because auditing for quarantine is performed by the agent 10, and even if there are a plurality of client computers 1, auditing is performed in parallel by each agent 10.

  In other words, when auditing is performed by the quarantine server, if a large number of audit commands are sent to the quarantine server at once, the load is concentrated on the quarantine server and it takes a lot of time to complete the audit. In the embodiment, such a situation is avoided. In the above case, the time for the agent to receive the audit result from the quarantine server is delayed. As a result, although the audit result is NG, the state in which the system administrator displays OK as the audit result of each agent continues. The client computer may behave differently from the intention of the system administrator. On the other hand, in this embodiment, such a problem is also avoided.

  Furthermore, according to the present embodiment, the audit result of the agent 10 and the information held by the quarantine management apparatus can be easily synchronized. As described above, since the time from the execution of the audit until the audit result is obtained is short, the audit result is stored in the quarantine management apparatus 2 after the agent 10 performs the audit. This is because the time until reflection is short.

  In addition, according to the present embodiment, since the connection is always established between the quarantine management apparatus and the agent, the policy file is transferred to all agents belonging to an organization such as a company regardless of changes in NAT and IP address. Can be sent. That is, in any of the agents, there is a possibility that the NAT or IP address has been changed with the operation of the system. Therefore, if a connection is established each time the security policy is updated, it is necessary to newly set the connection for the changed agent, and it is impossible to send the policy file to all agents at once. It becomes. On the other hand, according to the present embodiment, as described above, a policy file can be transmitted to all agents at once.

  As described above, the present invention is useful for a computer network system in which information of each client is investigated and collected and managed on the server side in accordance with settings centrally managed by the server, as represented by a quarantine network system. It is. The present invention has industrial applicability.

DESCRIPTION OF SYMBOLS 1 Client computer 2 Quarantine management apparatus 3 Quarantine system 4 Network 10 Agent 20 Program module 101 Memory | storage part (agent memory | storage part)
102 Management Department (Agent Management Department)
103 Communication Department (Agent Communication Department)
104 Trigger generator (agent trigger generator)
105 Audit Department (Agent Audit Department)
106 Policy file (Agent policy file)
107 Audit result (agent audit result)
201 Storage Unit 202 Management Unit 203 Communication Unit 204 Trigger Generation Unit 205 Auditing Unit 206 Policy File 207 Audit Result

Claims (9)

A quarantine system comprising a client computer connected to a network and a quarantine management apparatus for executing quarantine in the network,
The quarantine management device
A security policy setting unit for setting or updating a security policy in accordance with an instruction from the outside;
An audit execution control unit that issues an audit execution instruction for causing the client computer to execute an audit based on the security policy each time the security policy is set or updated;
At least before the audit execution instruction is issued, the connection is established with the client computer, and the issued audit execution instruction and the data specifying the security policy are maintained in the state where the connection is maintained. And a communication unit for transmitting to the client computer,
The client computer is
A communication unit that receives the audit execution instruction and the security policy transmitted from the quarantine management apparatus;
When the audit execution command is received, an audit unit that executes an audit of the client computer based on the received security policy,
Quarantine system characterized by that.   The quarantine system according to claim 1, wherein a communication unit of the quarantine management apparatus is connected to a communication unit of the client computer through a TCP connection and maintains the connection while the client computer is in an operating state.   The quarantine system according to claim 1 or 2, wherein a communication unit of the client computer transmits an audit result of the audit unit to the quarantine management apparatus. A quarantine management device that performs quarantine in a network to which a client computer is connected,
A security policy setting unit for setting or updating a security policy in accordance with an instruction from the outside;
An audit execution control unit that issues an audit execution instruction for causing the client computer to execute an audit based on the security policy each time the security policy is set or updated;
At least before the audit execution instruction is issued, the connection is established with the client computer, and the issued audit execution instruction and the data specifying the security policy are maintained in the state where the connection is maintained. A communication unit for transmitting to the client computer,
Quarantine management device characterized by that.   The quarantine management apparatus according to claim 4, wherein the communication unit is connected to the client computer via a TCP connection and maintains the connection while the client computer is in an operating state. A quarantine method for performing quarantine in a network to which a client computer is connected,
(A) setting or updating a security policy in accordance with an external instruction;
(B) issuing an audit execution instruction for causing the client computer to execute an audit based on the security policy each time the security policy is set or updated;
(C) establishing a connection with the client computer at least before the audit execution instruction is issued;
(D) transmitting the issued audit execution command and data specifying the security policy to the client computer in a state where the connection established in the step (c) is maintained. Yes,
A quarantine method characterized by that.   The quarantine method according to claim 6, wherein in the step (c), the client computer is connected with a TCP connection, and the connection is maintained while the client computer is in an operating state. A program for executing quarantine in a network to which a client computer is connected by a computer,
In the computer,
(A) setting or updating a security policy in accordance with an external instruction;
(B) issuing an audit execution instruction for causing the client computer to execute an audit based on the security policy each time the security policy is set or updated;
(C) establishing a connection with the client computer at least before the audit execution instruction is issued;
(D) executing the step of transmitting the issued audit execution instruction and data specifying the security policy to the client computer in a state where the connection established in the step of (c) is maintained.
A program characterized by that.   The program according to claim 6, wherein in the step (c), a connection is made with the client computer by a TCP connection, and the connection is maintained while the client computer is in an operating state.

Images