JP2010262677A - Device and method for managing security - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security management device, a security management method, a security management program, and a security management system, in which the security management performs access control of a terminal according to the security level of the terminal to urge security setting, whereby a desired level of security is ensured while saving the power for security management. <P>SOLUTION: The security level of the terminal is detected by an access pattern, whether the security level reaches a predetermined level is checked, and when it is determined that the security level of the terminal does not reach the predetermined level, the access permitting range of the terminal is changed. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a security management method and a security management program for restricting access of a terminal according to the security state of each terminal connected to a network.

  Conventionally, as a method for improving security in a network such as a LAN, a specific address is assigned by a gateway (including a firewall), a router, or a layer 3 switch so as to prevent unauthorized access from each terminal. A method of controlling communication of a terminal having the same is used (see Patent Documents 1 to 6).

JP 2002-33756 A JP 2001-256136 A JP-A-8-316963 JP 2000-148276 A JP-A-6-6347 Japanese Patent Laid-Open No. 10-171863

Nikkei Sangyo Shimbun September 27, 2002, 10 pages Advanced Technology / Techno Trend Line 8 to Line 12 from the 6th row

  In recent years, computers have become widespread, and if it is a company, it is common practice to configure a network so that each employee has a dedicated terminal and each terminal can use e-mail, printers, etc. ing.

  For this reason, there are increasing opportunities to change the terminal connected to the network, such as the movement and expansion of the terminal as the personnel move and increase.

  Also, if you use a mobile device (such as a laptop) outside the office for presentations and use it while connected to the network, or if you take the mobile device home and work, For example, when the terminal is reconnected to the in-house network and the work is continued, work for connecting the terminal to the network is routinely performed.

  In this way, if a user can freely connect to a terminal, if the terminal infected with the virus is connected to the network because the security level is low, such as an old virus definition file, the terminal is illegally connected outside the corporate network, for example. Network access could be compromised by accessing or destroying data by accessing other computers in the company network.

  However, when using a terminal connected to a network at the user level, it is not practical for the network manager to check the security status of each terminal each time because it takes too much time for security management.

  The present invention has been made in view of such problems of the conventional technology. That is, an object of the present invention is to provide a technology for ensuring a desired security while saving labor in security management by a security management device performing access control of a terminal according to the security level of the terminal and prompting security setting. It is to provide.

  The present invention employs the following means in order to solve the above problems. The security management device, security management method, security management program, and security management system of the present invention detect a security level of a terminal, compare and determine the security level of the terminal and a predetermined level, and determine the security level of the terminal. When it is determined that the predetermined level has not been reached, the access permission range of the terminal is limited.

  As a result, the present invention performs access control of the terminal according to the security level of the terminal, enables the terminal to access a specific device such as a security setting guidance server, and prompts the security setting, thereby saving the security management. The desired security can be ensured while achieving the above.

<Computer-readable recording medium>
The present invention may be a recording medium on which the above program is recorded so as to be readable by a computer. The function can be provided by causing the computer to read and execute the program of the recording medium.

  Here, the computer-readable recording medium refers to a recording medium in which information such as data and programs is accumulated by electrical, magnetic, optical, mechanical, or chemical action and can be read from a computer. Examples of such a recording medium that can be removed from the computer include a flexible disk, a magneto-optical disk, a CD-ROM, a CD-R / W, a DVD, a DAT, an 8 mm tape, and a memory card.

  Further, there are a hard disk, a ROM (read only memory), and the like as a recording medium fixed to the computer.

  According to the present invention, there is provided a technique for ensuring desired security while saving labor for security management by a security management device performing access control of a terminal according to the security level of the terminal and prompting a security setting. be able to.

The figure which shows the example of a network structure provided with the security management apparatus Block diagram showing the configuration of the security management device Explanatory diagram showing security management procedures Display example of setting guide The block diagram which shows the structure of the security management apparatus of the modification 1. FIG. 3 is a block diagram illustrating a configuration of a security management device according to a second embodiment. Network configuration diagram of Embodiment 2

Embodiment 1
Hereinafter, a security management apparatus according to Embodiment 1 of the present invention will be described with reference to FIGS. 1 to 5.

<Outline configuration>
FIG. 1 is a diagram illustrating an example of a network configuration including a security management apparatus according to the present embodiment.

  The security management device 1 according to the present embodiment is a so-called router that connects a plurality of terminals 2 and performs routing of data transmitted from each terminal. For example, when the security management device 1 receives an access request from the terminal 2 to a server on the Internet, the security management device 1 transmits the access request to a server (not shown) on the Internet 4 through the firewall 3. When the response from the server is received, the security management device 1 transfers this response to the terminal. In the present embodiment, a plurality of security management devices 1 are provided for each domain.

  The security management device 1 may be a dedicated electronic device configured by an electronic circuit (hardware) designed exclusively for a security detection unit, a determination unit, and an access control unit, which will be described in detail later, or a CPU An apparatus that implements the functions of the above units by software by executing the security management program of the present invention in an arithmetic processing unit including a memory and a memory.

  Further, the network of the present embodiment includes a virus information server 5 having a virus definition file for identifying a computer virus, and a security setting guide server 6 for guiding the terminal to reach a predetermined security level. .

  The security management device 1 detects the security information of the terminal 2, determines whether or not the security level of the terminal 2 has reached a predetermined level, and if there is an access request from a terminal that has not reached this level, The terminal 2 is connected to the security setting guidance server 6.

  In response to this, the security setting guide server 6 guides the terminal 2 so as to satisfy a predetermined security level. For example, when it is determined that the virus definition file of the terminal 2 is old and the security level is low, the security setting guide server 6 accesses the virus information server 5 to the terminal 2 and acquires the latest virus definition file. invite.

  As described above, in the present embodiment, the access permission range of the terminal 2 determined to have a low security level is limited to the security setting guide server 6 and the virus information server 5, and access to other computers until the predetermined security level is satisfied. Since access is not permitted, even if the terminal 2 with a low security level is infected with a virus, the damage can be prevented from spreading. Further, in this embodiment, the terminal 2 having a low security level is urged to improve the security level. When the terminal accesses another computer, the terminal always reaches a predetermined level. The desired security can be ensured without checking the security level one by one.

<Security management device>
FIG. 2 is a block diagram showing the configuration of the security management device 1.

  As shown in the figure, the security management device 1 includes a security detection unit 11, a determination unit 12, and an access control unit 13.

The security detection unit 11 detects the security level of the terminal 2 based on the access pattern. For example, it is detected as an access pattern whether or not the terminal 2 has accessed the server 5 having a virus definition file at a predetermined interval. The security detection unit 11 includes a storage unit (memory) and stores the detection result.

  The determination unit 12 refers to the memory and determines whether or not the security level detected by the security detection unit 11 has reached a predetermined level.

  The access control unit 13 has a function of selecting a communication path of the terminal 2, and when the determination unit 12 determines that the security level of the terminal 2 has not reached a predetermined level, the access control unit 13 accesses Change the permission range. For example, the access destination of the terminal 2 is changed to a specific server.

<Security management procedure>
A security management procedure (security management method) by the security management apparatus will be described next.

FIG. 3 is an explanatory diagram showing this security management procedure.
When the security management device 1 is activated, it first deletes (initializes) all detection results in the memory of the security detection unit 11 (step 1, hereinafter abbreviated as S1).

  Next, the security detection unit 11 of the security management device 1 detects the security level of the connected terminal 2, that is, whether or not the virus information server 5 has been accessed at a predetermined interval, and stores it in the memory (S2). For this detection, the log stored in each terminal 2 (recording when and where it was accessed) and the update time of the virus definition file may be read, or the log stored in the virus information server 5 (which terminal (A record of when was accessed) may be read.

  When there is an access from the terminal 2, the determination unit 12 refers to the memory and determines whether or not the terminal 2 has reached a predetermined security level, that is, whether or not the terminal 2 is an access permission target ( S3, S4).

  When it is determined that the terminal 2 is an access permission target, the access control unit 3 sets the access permission range of the terminal 2 as all computers, and performs routing for any computer access (S5).

  On the other hand, when it is determined in step 4 that the access is not permitted, the access control unit 13 restricts the access permission range of the terminal 2 to the security setting guide server 6 and the virus information server 5, and first connects the terminal 2 to the server 6. Access is made (S6). The security setting guidance server 6 causes the connected terminal 2 to display a screen (such as a web page by HTML) that guides security-related settings. FIG. 4 is a display example of a screen for guiding this setting. According to the screen, the user selects the button 99 of the virus definition file necessary for the terminal 2 being used. When the button 99 is selected, the terminal 2 connects to the virus information server 5 to which the button 99 is linked, and acquires the selected virus definition file. Thus, when the anti-virus software is executed, the terminal 2 can refer to the latest virus definition file to identify the virus, perform the removal, etc., and can deal with a virus that has recently occurred. That is, the security level is improved.

  When it is detected that the terminal 2 has accessed the virus information server 5, the security detection unit 11 adds the terminal 2 as a permission target to the memory (S7).

  Then, it returns to step 3 and waits until there is access.

  If there is a terminal 2 disconnected from the network during this standby, the security detection unit 11 deletes the information of this terminal 2 from the memory (S8, S10). In addition, the security detection unit 11 deletes information that has been stored for more than a predetermined time (24 hours in this example) from the memory (S9, S10).

  As described above, according to the present embodiment, when the security level of the terminal 2 does not reach the predetermined level, the access permission range of the terminal 2 is changed and the security setting guide server 6 and the virus information server 5 are accessed. Since the improvement of the security level can be promoted, the desired security can be ensured without the network administrator confirming the security level of the terminal 2 connected to the network.

  The security level determination is not limited to the access interval to the virus information server, but a program or script such as JAVA (registered trademark) or ActiveX (registered trademark) is downloaded to check whether unnecessary ports are closed. It may be determined based on whether or not it can be executed, whether or not to respond to a specific command such as Ping.

  The setting guidance server 6 is not limited to guidance to the virus information server 5, and may perform security settings. A security setting applet is transmitted to the terminal 2, and this applet is executed by the terminal 2 for security. May be set. This security setting includes updating of virus definition files and anti-virus software, whether or not to close a predetermined port, whether or not to download and execute a predetermined program or script, and Ping etc. This is a setting for whether or not to respond to the command.

  The security level may be detected by executing an audit program on the terminal 2 and storing the detection result in the storage unit. The storage unit for storing the detection result may be in the security management device 1 or in a device accessible from the security management device 1, such as the terminal 2, the security setting guide server 6, and the virus information server 5. Also good.

<< Modification 1 >>
FIG. 5 shows an example in which the security management apparatus is realized by a general-purpose computer.

As shown in the figure, the security management device 10 stores an arithmetic processing unit 22 including a CPU (central processing unit) and a main memory, data and software (security management device, etc.) for arithmetic processing in a main body 21. Storage device 23, input / output unit 24, communication control unit (CCU: Communication Control Un)
it) A general computer having 25 or the like.

  The security management apparatus 10 implements the functions of the security detection unit 11, the determination unit 12, and the access control unit 13 by reading and executing a security management program stored in the storage device 23. At this time, the security management apparatus 10 executes the steps shown in FIG. 3 as in the above-described embodiment.

  As a result, the security management apparatus 10 of the present example can ensure desired security while saving the security management by the network administrator as in the above-described embodiment.

<< Embodiment 2 >>
FIG. 6 is a block diagram showing the configuration of the second embodiment of the present invention, and FIG. 7 is a network configuration diagram including the security management device of the present embodiment. The mail server (security management apparatus) 20 of the present embodiment is different from the first modification described above in that it has a mail server function, and other configurations are substantially the same. Note that the same elements are denoted by the same reference numerals and the description thereof is omitted.

  The mail server 20 receives an e-mail addressed to each terminal 2 via the Internet 4 by the function of the mail receiving unit 14 and provides the e-mail to the connected terminal 2.

  Further, the mail server 20 receives a transmission mail from each terminal 2 by the function of the mail transmission unit 15 and transmits it to each destination computer.

  The mail server 20 according to the present embodiment transmits or receives mail if it is within a predetermined time after the terminal 2 accesses the virus information server 5, and if the predetermined time is exceeded, the terminal 2 secures the terminal 2. Connect to the setting guide server 6.

  As a result, the mail server 20 of this example can secure desired security while saving the security management by the network administrator as in the above-described embodiment, and even if the terminal 2 with a low security level is connected, a new virus can be obtained. If you do not get the definition file, you will not be able to send or receive emails, so there will be no virus damage via emails.

  In the present embodiment, an example of a mail server has been shown. However, the security management apparatus of the present invention is not limited to this, and can include a proxy server, NFS, and home gateway as long as it includes a security detection unit, a determination unit, and an access control unit. Etc.

<< Other Embodiments >>
The present invention is not limited to the illustrated examples described above, and various modifications can be made without departing from the scope of the present invention.

  For example, as an embodiment of the security management device 10, the initial setting of the access permission range is set to all ranges, and when the security level of the terminal does not reach a predetermined level, the access permission range is set to the security setting guide server 6, virus information. Shown to change to server 5.

  However, the embodiment of the present invention is not limited to this, and the initial setting of the access permission range is set to the security setting guide server 6 and the virus information server 5, and the access permission range is set when the security level of the terminal reaches a predetermined level. It is good also as an embodiment changed to the whole range. That is, in order to realize this embodiment, the security management device 10 may be configured as follows.

  First, the method in which the security detection unit 11 of the security management device 10 detects the security level of the terminal 2 is the same as in the previous embodiment.

  When there is an access from the terminal 2, the determination unit 12 determines whether or not the security level of the terminal 2 has reached a predetermined security level. This determination method is also the same as in the previous embodiment.

  When the determination unit 12 determines that the security level of the terminal 2 has reached a predetermined security level, that is, when the access control unit 3 determines that access is permitted, the access control unit 3 sets the access permission range to the initial security. The setting guide server 6 and the virus information server 5 are changed to all ranges (all computers), and routing is performed so that the terminal 2 can access any computer.

  On the other hand, when the determination unit 12 determines that the security level of the terminal 2 has not reached the predetermined security level, that is, when it is determined that the terminal 2 is not an access permission target, the access control unit 3 sets the access permission range as an initial setting. The security setting guide server 6 and the virus information server 5 remain unchanged. The subsequent process of changing the security level of the terminal 2 by the access control unit 3 is the same as in the previous embodiment.

  In the above embodiment, the security detection unit 11 detects whether or not the terminal 2 has accessed the server 5 at a predetermined interval (access pattern) as a security level detection method. The device 1 may record the access history of the terminal 2 and detect the security level of the terminal 2 using the access history.

  For example, when the terminal 2 accesses another computer, the security management apparatus 1 receives the data packet transmitted from the terminal 2, and the destination address and the transmission source address (address of the terminal 2) included in the data packet The date and time information when the data packet is received is recorded as an access history.

  Then, when there is an access request from the terminal 2 to another computer, the latest date and time when the terminal 2 accessed the virus information server 5 is obtained from the access history, and the latest accessed date and time is before the predetermined date and time. If there is, the security level may be detected such that the security level is low, or if the latest access date and time is after a predetermined date and time, the security level is high.

  Moreover, even if it is the structure added below, the effect similar to the above-mentioned embodiment can be acquired.

(Appendix 1)
A security detector that detects the security level of the terminal;
A determination unit that compares and determines the security level of the terminal and a predetermined level;
When the determination unit determines that the security level of the terminal has not reached a predetermined level, an access control unit that limits the access permission range of the terminal;
Security management device with

(Appendix 2)
The access control unit, when the determination unit determines that the security level of the terminal has reached a predetermined level, the security management according to appendix 1, wherein a wider range than the restriction range is set as the access permission range of the terminal. apparatus.

(Appendix 3)
The access control unit has a function of selecting a communication path of the terminal, and when the determination unit determines that the security level of the terminal has not reached a predetermined level, specifies the communication destination of the terminal The security management device according to appendix 1, which is changed to a device.

(Appendix 4)
The security management device according to attachment 3, wherein the specific device sets a security level of the terminal or provides setting guidance to the terminal.

(Appendix 5)
Computer
Detecting the security level of the device;
Comparing and determining the security level of the terminal and a predetermined level;
If it is determined that the security level of the terminal has not reached a predetermined level, limiting the access permission range of the terminal;
Security management method to execute.

(Appendix 6)
6. The security management method according to appendix 5, including a step of setting a wider range than the restriction range as an access permission range of the terminal when it is determined that the security level of the terminal has reached a predetermined level.

(Appendix 7)
When the determination unit determines that the security level of the terminal has not reached a predetermined level, in the step of limiting the access permission range of the terminal,
The security management method according to appendix 5, wherein a communication path of the terminal is selected and a communication destination is changed to a specific device.

(Appendix 8)
The security management method according to appendix 7, wherein the specific device sets a security level of the terminal or provides setting guidance to the terminal.

(Appendix 9)
Detecting the security level of the device;
Comparing and determining the security level of the terminal and a predetermined level;
If it is determined that the security level of the terminal has not reached a predetermined level, limiting the access permission range of the terminal;
A security management program that can be executed by a computer.

(Appendix 10)
The security management program according to appendix 9, comprising a step of setting a wider range than the restricted range as an access permission range of the terminal when it is determined that the security level of the terminal has reached a predetermined level.

(Appendix 11)
When the determination unit determines that the security level of the terminal has not reached a predetermined level, in the step of limiting the access permission range of the terminal,
The security management program according to appendix 9, wherein the communication path of the terminal is selected and the communication destination is changed to a specific device.

(Appendix 12)
The security management program according to appendix 11, wherein the specific device sets the security level of the terminal or provides setting guidance to the terminal.

(Appendix 13)
A security management system in which a security management device, a user terminal, and a security setting guide device are connected via a network,
A security level detection unit for detecting the security level of the terminal;
A determination unit that compares and determines the security level of the terminal and a predetermined level;
When the determination unit determines that the security level of the terminal has not reached a predetermined level, an access control unit that limits the access permission range of the terminal;
A security management system characterized by comprising:

(Appendix 14)
14. The security management system according to appendix 13, wherein the access control unit connects the terminal to the security setting guide device when the determination unit determines that the security level of the terminal has not reached a predetermined level.

In the present invention, the above components can be combined as much as possible.

DESCRIPTION OF SYMBOLS 1 Security management apparatus 2 Terminal 3 Firewall 4 Internet 5 Virus information server 6 Security setting guidance server 10 Security management apparatus 11 Security detection part 12 Judgment part 13 Access control part 14 Mail reception part 15 Mail transmission part 20 Mail server 21 Main body 22 Arithmetic processing Unit 23 Storage device 24 Input / output unit 25 CCU (communication control unit)
99 buttons

Claims (10)

A security detector that detects the security level of the terminal;
A determination unit that compares and determines the security level of the terminal and a predetermined level;
When the determination unit determines that the security level of the terminal has not reached a predetermined level, an access control unit that limits the access permission range of the terminal;
Security management device with 2. The security according to claim 1, wherein when the determination unit determines that the security level of the terminal has reached a predetermined level, the access control unit sets a wider range than the restriction range as the access permission range of the terminal. Management device. The access control unit has a function of selecting a communication path of the terminal, and when the determination unit determines that the security level of the terminal has not reached a predetermined level, specifies the communication destination of the terminal The security management device according to claim 1, wherein the security management device is changed to a device. The security management apparatus according to claim 3, wherein the specific apparatus sets a security level of the terminal or provides setting guidance to the terminal. Computer
Detecting the security level of the device;
Comparing and determining a security level of the terminal and a predetermined level;
If it is determined that the security level of the terminal has not reached a predetermined level, limiting the access permission range of the terminal;
Security management method to execute. Detecting the security level of the device;
Comparing and determining the security level of the terminal and a predetermined level; and when determining that the security level of the terminal has not reached a predetermined level, limiting the access permission range of the terminal;
A security management program that can be executed by a computer. The security management program according to claim 6, comprising a step of setting a wider range than the limit range as an access permission range of the terminal when it is determined that the security level of the terminal has reached a predetermined level. When the determination unit determines that the security level of the terminal has not reached a predetermined level, in the step of limiting the access permission range of the terminal,
The security management program according to claim 6, wherein a communication path of the terminal is selected and a communication destination is changed to a specific device. The security management program according to claim 8, wherein the specific device sets a security level of the terminal or provides setting guidance to the terminal. A security management system in which a security management device, a user terminal, and a security setting guide device are connected via a network,
A security level detection unit for detecting the security level of the terminal;
A determination unit that compares and determines the security level of the terminal and a predetermined level;
When the determination unit determines that the security level of the terminal has not reached a predetermined level, an access control unit that limits the access permission range of the terminal;
A security management system characterized by comprising:

Images