JP2012065287A - Security gateway system and method thereof - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security gateway system, by an embodiment of the invention, which enables communication between networks without registering a relay permission definition manually.SOLUTION: A security gateway system relating to an embodiment of the invention comprises a first computer and a second computer. The first computer comprises: a first relay permission definition generation function part which adds data transmission information of data received for the first time from a first network or the second computer to a registration stand-by list, adds the data transmission information to a relay permission definition when a relay permission command of the data transmission information added to the registration stand-by list is received, and determines whether or not to relay the received data based on the relay permission definition; and a security gateway processing part which converts a protocol of the data determined to be relayed by the first relay permission definition generation function part and transmits it to the second computer or the first network.

Description

  Embodiments described herein relate generally to a security gateway system and method.

  In the field of network communication technology, communication is performed using the de facto standard Internet protocol (IP), so that services for independent networks (specific groups) using a manufacturer's original communication protocol can be used. Service).

  This Internet protocol (IP) is an example of an open system interconnection system, and its specifications are open to the public and available to many people. Standard services on the Internet are provided based on hardware and software that communicate using this published technology, and these can also be obtained and used by anyone.

  The standardized situation in which anyone can obtain a means of receiving services is the risk of compromising the confidentiality of communications and the safety of corporate computer systems when applied to corporate activities. Many security methods for avoiding problems have been devised and put into practical use.

  Among them, there is a security gateway system that connects a plurality of networks using standardized protocols whose specifications are publicized.

  In this security gateway system, two sub-gateways implemented by mutually independent computers are physically completely separated, and communication between the sub-gateways is performed by a non-standard protocol whose specifications are not disclosed. Therefore, when unauthorized communication data from the network enters one of the sub-gateways, it is easy to confirm that the communication data is invalid by comparing the relay permission setting information at the stage of protocol conversion of the communication data. Then, by performing appropriate processing such as discarding the communication data, it is possible to prevent unauthorized communication data from entering the other sub-gateway.

  In addition, as an automatic configuration system for a network connection device that owns a firewall, tunnel host, and VPN server, even if a new local LAN (Local Area Network) is added, VPN (Virtual Private Network) is automatically built over the firewall There is an automatic setting system for an inter-network connection device capable of setting.

  In this automatic setting system for network connection devices, a setting device in which setting information is stored in advance is prepared separately, and necessary setting information is extracted and set by directly referring to the setting device in the network connection device. .

  In the security gateway system and the inter-network connection device described above, it is necessary to register data information, that is, a relay permission definition in advance for data that is desired to be permitted to be relayed. This relay permission definition is a complicated and multiple definition including a data protocol, a source address, a destination address, a port number, and the like. For this, it was necessary to create a definition for each piece of data that you want to allow relaying and register it manually in the security gateway system.

JP 2006-295649 A

  In the above-described security gateway system and inter-network connection device, it is necessary to register a relay permission definition in advance for data that is to be permitted to be relayed.

  An embodiment of the present invention was made to solve the above-described problem, and an object of the present invention is to provide a security gateway system that enables communication between networks without manually registering a relay permission definition. And

  The security gateway system according to the embodiment of the present invention includes a first computer and a second computer, and the first computer receives data transmission information of data received for the first time from the first network or the second computer. Add to the registration wait list, and when a relay permission command for the data transmission information added to the registration wait list is received, add the data transmission information to the relay permission definition and relay the received data based on the relay permission definition A first relay permission definition generation function unit for determining whether or not the data is determined to be relayed by the first relay permission definition generation function unit, and the second computer or the first network is converted. A security gateway processing unit for transmitting to the security gateway system.

1 is a configuration diagram showing a security gateway system 10 in a first embodiment. FIG. 6 is a flowchart showing the operation of the protocol filter function unit 50 in the relay process in the first direction in the first embodiment. 6 is a flowchart showing the operation of the standard protocol relay permission definition generating function unit 30 in the relay processing in the first direction in the first embodiment. The figure which shows an example of the waiting list for registration, black list, or relay permission definition in 1st Embodiment. 6 is a flowchart showing the operation of a non-standard protocol relay permission definition generating function unit 41 in the relay processing in the first direction in the first embodiment. 6 is a flowchart illustrating the operation of the protocol filter function unit 51 in the relay processing in the second direction in the first embodiment. 6 is a flowchart showing the operation of the standard protocol relay permission definition generating function unit 31 in the relay processing in the second direction in the first embodiment. 6 is a flowchart illustrating the operation of a relay permission definition generation function unit for non-standard protocol 40 in a second-direction relay process in the first embodiment. The block diagram which shows the security gateway system 10 in 2nd Embodiment. 9 is a flowchart showing the operation of a standard protocol relay permission definition generating function unit 60 with a timer function in relay processing in the first direction in the second embodiment.

  Hereinafter, an embodiment of a security gateway system according to the present invention will be described with reference to the drawings.

  Various terms used in this specification will be described.

(1) Secure network A network that provides services to a specific group in the company, etc., and is a secure network.

(2) Non-secure network A wide area network or public network that is connected to and used by an unspecified number of people, represented by the Internet.

(3) Proprietary network A network used for communication between multiple gateways (computers) that construct a security gateway system.

(4) Non-secure network gateway A non-secure network gateway is one of the gateways (computers) that make up the security gateway system. The non-secure network communicates using a standard protocol, and the original network communicates using a non-standard protocol. A sub-gateway that performs bidirectional relay between a non-secure network and a proprietary network.

(5) Secure network gateway One of the gateways (computers) that make up the security gateway system, which communicates using a secure network and a standard protocol, and communicates using a proprietary network and a non-standard protocol. And a sub-gateway that performs two-way relaying of the original network.

(6) Relay permission definition Indicates data that is recorded in the security gateway system and permitted to be relayed. Data protocol, source information, and destination information are recorded.

(7) Protocol filter function In the security gateway system, it is a function that determines whether data relay is permitted or not based on data protocol information.

[First embodiment]
[Constitution]
FIG. 1 is a configuration diagram showing the configuration of the security gateway system according to the first embodiment.

  As shown in FIG. 1, a security gateway system 10 according to this embodiment includes a non-secure network gateway 11 connected to a wide area network (non-secure network) 1 using a standard protocol and an internal network (secure network) using a standard protocol. Network) 2, the secure network gateway 12 connected to the network 2. Here, the non-secure network gateway 11 and the secure network gateway 12 are configured by independent computers.

  In the security gateway system 10 of this embodiment, the non-secure network gateway 11 includes a protocol filter function unit 50, a standard protocol relay permission definition generation function unit 30, a security gateway processing unit 20, and a non-standard protocol relay permission definition generation function unit. 40.

  The secure network gateway 12 also includes a security gateway processing unit 21, a standard protocol relay permission definition generating function unit 31, a nonstandard protocol relay permission definition generating function unit 41, and a protocol filter function unit 51.

  Details of each configuration as described above are as follows.

  A wide area network (non-secure network) 1 that uses a standard protocol is a network that uses a standard communication protocol that has been published, and is generally a network such as the Internet (hereinafter referred to as non-secure network) that can be used by many unspecified people. Called a network).

  An internal network (secure network) 2 using a standard protocol is a network intended to serve a specific group such as a company, and a network that needs to ensure security safety (hereinafter referred to as a secure network). Called).

  In the security gateway system 10 of the present embodiment, communication for connecting to the non-secure network 1 and the secure network 2 is performed using a standard protocol whose specifications are disclosed. Communication between the two sub-gateways in the security gateway system 10, that is, the non-secure network gateway 11 and the secure network gateway 12, is performed using a non-standard protocol whose specifications are not disclosed.

  In the non-secure network gateway 11, the protocol filter function unit 50 has a function of communicating with the non-secure network 1 connected to the non-secure network gateway 11 using a standard protocol, and the security gateway processing unit 20 has specifications. It has a function of communicating with the secure network gateway 12 using a non-standard protocol that is not disclosed.

  In the secure network gateway 12, the protocol filter function unit 51 has a function of communicating with the secure network 2 connected to the secure network gateway 12 using a standard protocol, and the security gateway processing unit 21 has a specification published. It has a function of communicating with the non-secure network gateway 11 using a non-standard protocol that is not used.

  The protocol filter function units 50 and 51 can always set protocol information permitting relaying by an operator. This function unit compares the set protocol information with the protocol information of the data for the packet data sent from the non-secure network 1 and the secure network 2, and each standard protocol for the data of the protocol that permits the relay. The relay permission definition generation function units 30 and 31 have a function of transferring data and discarding the data of the protocol that does not permit the relay.

  Each of the standard protocol relay permission definition generating function units 30 and 31 has a protocol, transmission source information, and transmission destination information (hereinafter referred to as data transmission information) of data transmitted from the respective protocol filter function units 50 and 51. And whether to relay based on the extracted data transmission information is determined. If it is determined to relay, the data is transferred to the security gateway processing units 20 and 21.

  Each security gateway processing unit 20, 21 converts the data received from the relay permission definition generation function units 30, 31 into a non-standard protocol and passes it to each non-standard protocol relay permission definition information generation function unit 40, 41.

  Each non-standard protocol relay permission definition generating function unit 40, 41 receives data transmission information of data sent in a state converted from the security gateway processing unit 21, 20 of the other sub-gateway into a non-standard protocol. It is extracted, and it is determined whether or not to relay based on the extracted data transmission information. If it is determined to relay, the received packet data is transmitted to the secure network 2.

[Action]
Next, the operation of the security gateway system 10 configured as described above will be described.

  The security gateway system 10 according to the present embodiment includes two types of relay processing: a first-direction relay process from the non-secure network 1 to the secure network 2 and a second-direction relay process from the secure network 2 to the non-secure network 1. There is a direction.

(Relay processing in the first direction)
First, relay processing in the first direction in the security gateway system 10 will be described with reference to FIGS.

  First, the operation of the protocol filter function unit 50 will be described with reference to FIG. FIG. 2 is a flowchart showing an operation (protocol filter process) in which the protocol filter function unit 50 receives packet data from the non-secure network 1 and transmits the packet data to the standard protocol relay permission definition generation function unit 30.

  The protocol filter function unit 50 waits for packet data from the non-secure network 1 (S10). When the packet data is received (YES in S11), the protocol information of the packet data and the relay permission registered in this function unit are received. Comparison with protocol information is performed (S12). At this time, if it is determined that the protocol permits relaying (YES in S12), the data is transferred to the standard protocol relay definition generation function unit 30 of the non-secure network gateway 11 (S13). If it is determined that the protocol does not permit relaying (NO in S12), the packet data is discarded (S14).

  Next, the operation of the standard protocol relay permission definition generating function unit 30 will be described with reference to FIG. FIG. 3 is a flowchart showing an operation (gateway reception process) for receiving data from the protocol filter function unit 50 and determining whether to relay the received packet data in the standard protocol relay permission definition generation function unit 30. It is.

  The standard protocol relay permission generation function unit 30 waits for packet data from the protocol filter function unit 50 (S100). When the packet data is received (YES in S101), the data transmission information of the received packet data is included in the black list. It is determined whether or not (S102). Here, the black list is data transmission information recorded in the standard protocol relay permission definition generating function unit 30 and not relayed. When it is determined that the data transmission information of the received packet data is included in the black list (YES in S102), the packet data is discarded (S103), and the packet data is waited again (S100).

  When it is determined that it is not included in the black list (NO in S102), it is determined whether the data transmission information of the received packet data is included in the registration waiting list (S110). Here, the registration waiting list is data transmission information waiting for registration, which is recorded in the standard protocol relay permission definition generating function unit 30 and whose determination as to whether or not to permit relaying is not determined by the operator. If it is determined that the data transmission information of the received packet data is included in the registration waiting list (YES in S110), the packet data is discarded (S111) and the packet data is waited again (S100).

  When it is determined that it is not included in the registration waiting list (NO in S110), it is determined whether the data transmission information of the received packet data is included in the relay permission definition (S120). Here, the relay permission definition is data transmission information that is recorded in the security gateway processing unit 20 and permits relaying. When it is determined that the data transmission information of the received packet data is included in the relay permission definition (YES in S120), the received packet data is transferred to the security gateway processing unit 20 (S121), and the packet data is waited again (S121). S100).

  If it is determined that it is not included in the relay permission definition (NO in S120), the data transmission information of the received packet data is added to the above-described registration wait list (S130), the packet data is discarded (S131), and the packet is again transmitted. Wait for data (S100).

  Similarly, data transmission information is recorded in any of the above-described registration waiting list, black list, and relay permission definition, and an example thereof is shown in FIG. In each of them, a protocol, a port number / transmission source address as transmission source information, and a port number / transmission destination address as transmission destination information are recorded. Note that the registration waiting list, black list, and relay permission definition described below also include the protocol, source information, and destination information.

  Next, when the data transmission information of the packet data received from the protocol filter function unit 50 by the standard protocol relay permission definition generation function unit 30 is not included in (1) the black list, the registration waiting list, and the relay permission definition That is, when the received packet data is the first packet data, (2) when it is included in the black list, (3) when it is included in the registration waiting list, and (4) in the relay permission definition This will be explained separately for the case where it is included.

(1) In case of first packet data Waiting for packet data (S100) When the standard protocol relay permission definition generating function unit 30 receives packet data (YES in S101), data transmission of the received packet data is performed. It is determined whether the information is included in the black list (S102). As a result, it is determined that the data transmission information of the received packet data is not included in the black list (NO in S102).

  Next, it is determined whether or not the data transmission information of the received packet data is included in the registration waiting list (S110). As a result, it is determined that the data transmission information of the received packet data is not included in the registration waiting list (NO in S110).

  Next, it is determined whether or not the data transmission information of the received packet data is included in the relay permission definition (S120). As a result, it is determined that the data transmission information of the received packet data is not included in the relay permission definition (NO in S120), the data transmission information is added to the registration waiting list (S130), and the packet data is discarded ( S131), the packet data is waited again.

(2) When included in the black list When the data transmission information of the received packet data is included in the black list, the operation up to the determination that the packet data has been received (YES in S101) is as follows: Since it is the same as the case where the packet data is received, the description is omitted.

  If it is determined that the packet data has been received (YES in S101), whether or not the data transmission information of the received packet data is included in the black list recorded in the standard protocol relay permission definition generation function unit 30 is determined. Determine (S102). As a result, it is determined that it is included in the black list (YES in S102), the packet data is discarded (S103), and the packet data is waited again (S100).

(3) When included in the registration wait list When the data transmission information of the received packet data is included in the registration wait list, the operation up to the determination of reception of packet data (YES in S101) is (1) ) Since this is the same as when the first packet data is received, the description is omitted.

  If it is determined that the packet data has been received (YES in S101), whether or not the data transmission information of the received packet data is included in the black list recorded in the standard protocol relay permission definition generation function unit 30 is determined. Determine (S102). As a result, it is determined that it is not included in the black list (NO in S102).

  Further, it is determined whether or not the data transmission information of the received packet data is included in the registration waiting list recorded in the standard protocol relay permission definition generating function unit 30 (S110). As a result, it is determined that it is included in the registration waiting list (YES in S110), the packet data is discarded (S111), and the packet data waiting (S100) is performed again.

(4) When included in relay permission definition Operation until determining that data transmission information is not included in blacklist when data transmission information of received packet data is included in relay permission definition (NO in S102) Since (3) is the same as that included in the registration waiting list, description thereof is omitted.

  If it is determined that the data transmission information is not included in the black list (NO in S102), the data transmission information of the received packet data is stored in the registration waiting list recorded in the standard protocol relay permission definition generating function unit 30. It is determined whether it is included (S110). As a result, it is determined that it is not included in the registration waiting list (NO in S110).

  Furthermore, it is determined whether the data transmission information of the received packet data includes the relay permission definition recorded in the security gateway processing unit 20. As a result, it is determined that it is included in the relay permission definition (YES in S120), and the received packet data is transferred to the security gateway processing unit 20 (S121).

  The operation when the standard protocol relay permission definition generating function unit 30 receives various packet data has been described above.

  Next, an operation in which the standard protocol relay permission definition generation function unit 30 registers the data transmission information recorded in the registration waiting list as a black list or a relay permission definition will be described.

  First, when the data transmission information of the received packet data is added to the registration wait list by the operation of the standard protocol relay permission definition generating function unit 30 when the first packet data is received (S130). The data transmission information in the registration waiting list is displayed on a monitor (not shown). If a relay prohibition command for registering as a black list is input from an input unit (not shown) such as a keyboard or a mouse operated by the operator to the data transmission information of the registration waiting list displayed on the monitor, the registration waiting list is displayed. The data transmission information of the list is registered as a black list. Further, when a relay permission command to be registered as a relay permission definition is input from the input unit, it is recorded in the security gateway processing unit 20 as a relay permission definition.

  Next, the operation of the security gateway processing unit 20 will be described. When the standard protocol relay permission definition generation function unit 30 determines that the data transmission information of the received packet data is included in the relay permission definition and is passed to the security gateway processing unit 20, the protocol of the received packet data Is transmitted to the non-standard protocol relay permission definition generating function unit 41. This protocol conversion is performed from a standard protocol to a non-standard protocol.

  Next, the operation of the non-standard protocol relay permission definition generating function unit 41 will be described with reference to FIG. FIG. 5 shows whether or not the non-standard protocol relay permission definition generation function unit 41 receives non-standard protocol packet data converted and transmitted by the security gateway processing unit 20 and relays the received packet data. It is the flowchart which showed the operation | movement (gateway reception process) to determine.

  The operation of the non-standard protocol relay permission definition generating function unit 41 described below is the same as the operation of the standard protocol relay permission definition generating function unit 30 shown in FIG. 3 receiving packet data from the protocol filter function unit 50. It is.

  The non-standard protocol relay permission definition generation function unit 41 waits for packet data from the security gateway processing unit 20 (S150). When packet data is received (YES in S151), the data transmission information of the received packet data is blacklisted. Is determined (S152). If it is determined that the data transmission information of the received packet data is included in the black list (YES in S152), the packet data is discarded (S153), and the packet data is waited again (S150).

  When it is determined that it is not included in the black list (NO in S152), it is determined whether the data transmission information of the received packet data is included in the registration waiting list (S160). If it is determined that the data transmission information of the received packet data is included in the registration waiting list (YES in S160), the packet data is discarded (S161), and the packet data is waited again (S150).

  If it is determined that it is not included in the registration waiting list (NO in S160), it is determined whether the data transmission information of the received packet data is included in the relay permission definition (S170). When it is determined that the data transmission information of the received packet data is included in the relay permission definition (YES in S170), the received packet data is transferred to the security gateway processing unit 21 (S171), and the packet data is waited again (S171). S150).

  When it is determined that it is not included in the relay permission definition (NO in S170), the data transmission information of the received packet data is added to the registration waiting list (S180), the packet data is discarded (S181), and again. Wait for packet data (S150).

  The operation when the non-standard protocol relay permission definition generating function unit 41 receives packet data has been described above. Regarding the operation of the non-standard protocol relay permission definition generating function unit 41 registering the data transmission information recorded in the registration waiting list as a black list or relay permission definition, the operation of the standard protocol relay permission definition generating function unit 30 is performed. Since it is the same as that, the description is omitted.

  Next, the operation of the security gateway processing unit 21 will be described. When the relay permission definition generation function unit 41 for non-standard protocol determines that the data transmission information of the received packet data is included in the relay permission definition, and is passed to the security gateway processing unit 21, The protocol is converted and transmitted to the secure network 2. This protocol conversion is performed from a non-standard protocol to a standard protocol.

  Heretofore, the relay process in the first direction in the security gateway system 10 has been described.

(Relay processing in the second direction)
Next, relay processing in the second direction in the security gateway system 10 of this embodiment will be described with reference to FIGS.

  First, the operation of the protocol filter function unit 51 will be described with reference to FIG. FIG. 6 is a flowchart showing an operation (protocol filter process) in which the protocol filter function unit 51 receives packet data from the secure network 2 and transmits it to the standard protocol relay permission definition generation function unit 31.

  The operation of the protocol filter function unit 51 described below is the same as the operation of the protocol filter function unit 50 shown in FIG.

  The protocol filter function unit 51 waits for packet data from the secure network 2 (S20). When the packet data is received (YES in S21), the protocol information of the packet data and the relay permission protocol registered in this function unit Comparison with information (S22) is performed. At this time, if it is determined that the protocol permits relaying (YES in S22), the data is transferred to the standard protocol relay definition generation function unit 31 of the secure network gateway 12 (S23). If it is determined that the protocol does not permit relaying (NO in S22), the packet data is discarded (S24).

  Next, the operation of the standard protocol relay permission definition generating function unit 31 will be described with reference to FIG. FIG. 7 is a flowchart showing an operation (gateway reception process) for receiving data from the protocol filter function unit 51 and determining whether to relay the received packet data in the standard protocol relay permission definition generation function unit 31. It is.

  The operation of the standard protocol relay permission definition generating function unit 31 described below is the same as the operation of the standard protocol relay permission definition generating function unit 30 shown in FIG. 3 receiving packet data from the protocol filter function unit 50. is there.

  The standard protocol relay permission generation function unit 31 waits for packet data from the protocol filter function unit 51 (S200). When the packet data is received (YES in S201), the data transmission information of the received packet data is included in the black list. It is determined whether or not (S202). If it is determined that the data transmission information of the received packet data is included in the black list (YES in S202), the packet data is discarded (S203), and the packet data is waited again (S200).

  When it is determined that it is not included in the black list (NO in S202), it is determined whether the data transmission information of the received packet data is included in the registration waiting list (S210). If it is determined that the data transmission information of the received packet data is included in the registration waiting list (YES in S210), the packet data is discarded (S211), and the packet data is waited again (S200).

  When it is determined that it is not included in the registration waiting list (NO in S210), it is determined whether the data transmission information of the received packet data is included in the relay permission definition (S220). When it is determined that the data transmission information of the received packet data is included in the relay permission definition (YES in S220), the received packet data is transferred to the security gateway processing unit 21 (S221), and the packet data is waited again (S221). S200).

  If it is determined that it is not included in the relay permission definition (NO in S220), the data transmission information of the received packet data is added to the above-described registration waiting list (S230), the packet data is discarded (S231), and the packet is again transmitted. Wait for data (S200).

  The operation when the standard protocol relay permission definition generating function unit 31 receives packet data has been described above. The operation for the standard protocol relay permission definition generating function unit 31 to register the data transmission information recorded in the registration waiting list as a black list or relay permission definition is the same as the operation of the standard protocol relay permission definition generating function unit 30. The description is omitted because it is similar.

  Next, the operation of the security gateway processing unit 21 will be described. When the relay permission definition generation function unit 31 for standard protocol determines that the data transmission information of the received packet data is included in the relay permission definition and is passed to the security gateway processing unit 21, the protocol of the passed packet data And is transmitted to the non-standard protocol relay permission definition generating function unit 40. This protocol conversion is performed from a standard protocol to a non-standard protocol.

  Next, the operation of the non-standard protocol relay permission definition generation function unit 40 will be described with reference to FIG. FIG. 8 shows whether or not the non-standard protocol relay permission definition generation function unit 40 receives non-standard protocol packet data converted and transmitted by the security gateway processing unit 21 and relays the received packet data. It is the flowchart which showed the operation | movement (gateway reception process) to determine.

  The operation of the non-standard protocol relay permission definition generating function unit 40 described below is the same as the operation of the standard protocol relay permission definition generating function unit 30 shown in FIG. 3 receiving packet data from the protocol filter function unit 50. It is.

  The non-standard protocol relay permission definition generation function unit 40 waits for packet data from the security gateway processing unit 21 (S250). When packet data is received (YES in S251), the data transmission information of the received packet data is blacklisted. (S252). If it is determined that the data transmission information of the received packet data is included in the black list (YES in S252), the packet data is discarded (S153), and the packet data is waited again (S150).

  When it is determined that it is not included in the black list (NO in S152), it is determined whether the data transmission information of the received packet data is included in the registration waiting list (S160). If it is determined that the data transmission information of the received packet data is included in the registration wait list (YES in S260), the packet data is discarded (S261), and the packet data is waited again (S250).

  If it is determined that it is not included in the registration waiting list (NO in S260), it is determined whether the data transmission information of the received packet data is included in the relay permission definition (S270). When it is determined that the data transmission information of the received packet data is included in the relay permission definition (YES in S270), the received packet data is transferred to the security gateway processing unit 20 (S271), and the packet data is waited again (S271). S250).

  If it is determined that it is not included in the relay permission definition (NO in S270), the data transmission information of the received packet data is added to the registration waiting list (S280), the packet data is discarded (S281), and again Waiting for packet data (S250).

  The operation when the non-standard protocol relay permission definition generating function unit 40 receives packet data has been described above. The operation of the non-standard protocol relay permission definition generating function unit 40 for registering the data transmission information recorded in the registration waiting list as a black list or relay permission definition is the operation of the standard protocol relay permission definition generating function unit 30. Since it is the same as that, the description is omitted.

  Next, the operation of the security gateway processing unit 20 will be described. When the relay permission definition generation function unit 40 for non-standard protocol determines that the data transmission information of the received packet data is included in the relay permission definition and is passed to the security gateway processing unit 20, the received packet data The protocol is converted and transmitted to the non-secure network 1. This protocol conversion is performed from a non-standard protocol to a standard protocol.

  Heretofore, the relay process in the second direction in the security gateway system 10 has been described.

[effect]
According to the present embodiment, the gateway transmission processing can be performed by including the standard protocol relay permission definition generating function units 30 and 31 and the nonstandard protocol relay permission definition generating function units 40 and 41. Therefore, data transmission information is recorded from the received packet data as a blacklist, a registration waiting list, or a relay permission definition, and the data recorded in the registration waiting list according to a relay prohibition command or relay permission command from the operator. Transmission information can be registered in a blacklist or relay permission definition.

  In other words, the operator can complete the setting work by visually checking the data transmission information recorded in the registration waiting list and selecting whether or not to permit relaying. It is possible to greatly simplify the setting work without inputting the permission definition.

  Further, by providing a function unit that performs two types of gateway transmission processing, that is, a standard protocol relay permission definition generation function unit 30, 31 and a non-standard protocol relay permission definition generation function unit 40, 41, further improve the security performance. Can be achieved.

  In the present embodiment, the data transmission information recorded in the registration waiting list is displayed on the monitor visible to the operator, but the data transmission information recorded in the black list and the relay permission definition is displayed. The operator can reset the data transmission information by inputting a relay prohibition command or a relay permission command for the data transmission information.

(Second Embodiment)
Next, a second embodiment will be described with reference to FIGS. In addition, the same code | symbol is attached | subjected to the same structure as 1st Embodiment, and the overlapping description is abbreviate | omitted.

[Constitution]
The configuration of the second embodiment will be described with reference to FIG. The difference from the first embodiment is that a timer function is added to the standard protocol relay permission definition generating function units 30 and 31 and the non-standard protocol relay permission definition generating function units 40 and 41 of the security gateways 11 and 12. The function includes standard protocol relay permission definition generation function units 60 and 61 for functions and non-standard protocol relay permission definition generation function units 70 and 71 for timer functions.

  That is, in the first embodiment, the standard protocol relay permission definition generating function units 30 and 31 and the nonstandard protocol relay permission definition generating function units 40 and 41 in the security gateways 11 and 12 receive the data of the received packet data. Although it has always been determined whether the transmission information is included in the black list, the registration waiting list, and the relay permission definition, in this embodiment, the determination is performed only for the time specified by using the timer function. Yes.

  The following is the time (time specified by the timer function) for determining whether or not the data transmission information of the received packet data is included in the black list, registration waiting list, and relay permission definition. Call it.

[Action]
Next, the operation of the present embodiment having the configuration will be described with reference to FIG. FIG. 10 is a flowchart showing the operation of the standard protocol relay permission definition generating function unit 60 with a timer function in the relay process in the first direction from the non-secure network 1 to the secure network 2.

  The standard protocol relay permission generation function unit 60 with a timer function waits for packet data from the protocol filter function unit 50 (S100). When packet data is received (YES in S101), it is determined whether data capture is in progress. Is performed (S101-1). If it is determined that data is not being captured (NO in S101-1), the packet data is transferred to the security gateway processing unit 20 (S101-2), and the packet data is waited again (S100).

  If it is determined that data capture is in progress (YES in S101-1), it is determined whether the data transmission information of the received packet data is included in the black list (S102). The following operation is the same as the operation of the standard protocol relay permission definition generating function unit 30 shown in FIG.

  The operation of the non-standard protocol relay permission definition generating function unit 71 with timer function in the first direction relay processing, the standard protocol relay permission definition generating function unit 61 with timer function in the second direction relay processing, and the timer function Since the operation of the non-standard protocol relay permission definition generation function unit 70 is the same as the operation of the above-described standard protocol relay permission definition generation function unit 60 with a timer function, description thereof will be omitted.

[effect]
According to the present embodiment, in addition to the effects of the first embodiment, is the data transmission information of the received packet data included in the black list, the registration waiting list, and the relay permission definition only for the time specified by the timer function. By determining whether or not, the processing load on the security gateway system 10 can be reduced.

  Furthermore, since the data transmission information added to the registration waiting list is limited to the packet data received by the security gateway system 10 at the specified time, the number of data transmission information in the registration waiting list displayed on the monitor is enormous. In addition, the operator's setting work can be simplified.

  In the first and second embodiments described above, the non-secure network gateway 11 and the secure network gateway 12 are configured by computers that are independent from each other. May be used as virtualized. At this time, since the security gateway system 10 can be constructed as one computer, the configuration can be simplified.

  A standard protocol is used for communication between the non-secure network 1 and the security gateway system 10 and communication between the secure network 2 and the security gateway system 10, and communication between the non-secure network gateway 11 and the secure network gateway 12 is not performed. Although a standard protocol is used, the same effect can be obtained if the protocol is different regardless of whether the protocol is standard or non-standard.

  Furthermore, even if the security gateway system 10 is configured without using the protocol filter function units 50 and 51, the same effect can be obtained. The standard protocol relay permission definition generating function unit 30 and the non-standard protocol relay permission definition generating function unit 40 can obtain the same effect in either case, and similarly, the standard protocol relay permission definition generating function unit 40 The generation function unit 31 and the non-standard protocol relay permission definition generation function unit 41 can obtain the same effect in either one.

  An object of the present invention is to provide a security gateway system that enables communication between networks without manually registering a relay permission definition.

  As mentioned above, although some embodiment of this invention was described, these embodiment was shown as an example and is not intending limiting the range of invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

1 ... Wide area network (non-secure network) using standard protocol
2 ... Internal network using standard protocol (secure network)
DESCRIPTION OF SYMBOLS 10 ... Security gateway system 11 ... Non-secure network gateway 12 ... Secure network gateway 20, 21 ... Security gateway processing part 30, 31 ... Relay permission definition generation function part 40, 41 for standard protocols ... Non-standard protocol relay permission definition generating function units 50, 51 ... Protocol filter function units 60, 61 ... Standard protocol relay permission definition generating function units 70, 71 ... With timer function Non-standard protocol relay permission definition generation function

Claims (8)

In a security gateway system that includes a first computer and a second computer, is connected to the first network and the second network, and determines whether to relay data transmitted and received between the networks.
The first calculator is
When data transmission information of data received for the first time from the first network or the second computer is added to the registration waiting list, and when the relay permission instruction for the data transmission information added to the registration waiting list is received, the data A first relay permission definition generating function unit for adding transmission information to the relay permission definition and determining whether to relay data received based on the relay permission definition;
A security gateway system comprising: a security gateway processing unit that converts a protocol of data determined to be relayed by the first relay permission definition generation function unit and transmits the protocol to the second computer or the first network. The first calculator is:
The security gateway system according to claim 1, further comprising a first protocol filter function unit that relays data having a preset protocol among the received data.   The first relay permission definition generating function unit has a timer function, and waits for registration of data transmission information of data received for the first time from the first network or the second computer at a time designated by the timer function. The security gateway system according to claim 1 or 2, which is added to the list. The second calculator is
When data transmission information of data received for the first time from the second network or the first computer is added to the registration waiting list, and when the relay permission instruction for the data transmission information added to the registration waiting list is received, the data A second relay permission definition generating function unit for adding transmission information to the relay permission definition and determining whether to relay data received based on the relay permission definition;
The security gateway processing unit according to claim 1, further comprising: a security gateway processing unit that converts a protocol of data determined to be relayed by the second relay permission definition generation function unit and transmits the data to the first computer or the second network. Gateway system. The second calculator is
5. The security gateway system according to claim 4, further comprising a second protocol filter function unit that relays data having a preset protocol among received data.   The second relay permission definition generation function unit has a timer function, and waits for registration of data transmission information of data received for the first time from the second network or the first computer at a time designated by the timer function. The security gateway system according to claim 4 or 5, which is added to the list.   The security gateway system according to any one of claims 1 to 6, wherein the first computer and the second computer are configured to be virtualized in a single computer. In a security gateway method for determining whether to relay data transmitted and received between a first network and a second network,
Add the data transmission information of the data received for the first time from the first network to the registration waiting list, and define the relay permission of the data transmission information when receiving the relay permission command for the data transmission information added to the registration waiting list To determine whether to relay the received data based on the relay permission definition,
A security gateway method for converting a protocol of data determined to be relayed by the relay permission definition generating function unit and transmitting the data to the second computer or the first network.

Images