JP2013186787A - Network system, quarantine device and quarantine method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To suppress spread of damage to other user terminals in an intracompany/on-campus network, when a user terminal connects to the intracompany/on-campus network again after accessing a harmful site and getting damaged from a network outside a company/campus etc.SOLUTION: A user terminal 10 transmits terminal information and Web site browsing history information to a quarantine server 40 (S10). The quarantine server 40 executes quarantine processing using the received terminal information and Web site browsing history information (S20). The quarantine server 40 transmits a quarantine result obtained by the quarantine processing to an authentication switch 30 and the user terminal 10 (S30). When the quarantine result shows "having accessed a harmful site", the user terminal 10 cannot access the intracompany network 60. On the other hand, when the quarantine result shows "having not accessed a harmful site", the user terminal 10 can access the intracompany network 60 (S70).

Description

  The present invention relates to a network system, a quarantine apparatus, and a quarantine method.

  Conventionally, there are Web pages (web pages) that cause damage to users on the Internet. As an example, there are a Web page in which a user terminal is infected with a computer virus only by browsing, a Web page that steals confidential information of a user by fake other Web pages. If such a Web page is used, there is a risk that confidential information will be leaked.

  Here, a Web site that transmits a Web page that causes damage to the user is called a “harmful site”. And in order to prevent the damage from such a harmful site, the method of not using a proxy server and making a user terminal access a harmful site is generally used (for example, refer patent document 1).

JP 2008-116998 A

However, in the technique of Patent Document 1, since the proxy server is connected to a network such as in-house or on-campus, the function of the proxy server is exhibited only when the user terminal is connected to the network in-house or on-campus. .
For this reason, when the user terminal is taken out of the office or outside the school, the proxy server cannot prohibit the user terminal from accessing the harmful site. Therefore, when the user terminal is connected to an external network, the user terminal has a risk of accessing a harmful site.
When a user terminal that accesses a harmful site externally is connected to a network such as in-house or on-campus again, there is a risk that damage will spread to other user terminals connected to the same network.

  Therefore, the present invention is intended to be applied to other in-house or on-campus networks when a user terminal damaged by accessing a harmful site from an outside network such as outside or on-campus is connected to the in-house or on-campus network again. It is an object of the present invention to provide a technology capable of suppressing the spread of damage to other user terminals.

  In order to solve the above problems, a network system of the present invention is stored in a specific website information storage unit that stores in advance specific website information for identifying a specific website and the specific website information storage unit. Based on the determination result by the determination unit, the determination unit that determines whether or not the specific website information that is present and the website browsing history information that is the history information of the website browsed by the user terminal match A network system includes a connection availability determination unit that determines whether or not a user terminal is permitted to connect to a predetermined network.

  The quarantine apparatus according to the present invention includes a specific website information storage unit that stores in advance specific website information for identifying a specific website, and the specific website information stored in the specific website information storage unit. And a determination unit that determines whether or not the website browsing history information that is the history information of the website browsed by the user terminal matches, and the user terminal is a predetermined network based on the determination result by the determination unit The quarantine apparatus includes: a transmission unit that transmits a determination result of the determination unit to an external device that includes a connection availability determination unit that determines whether or not to permit connection to the network.

  Furthermore, in the quarantine method of the present invention, the specific website information for identifying a specific website stored in advance matches the website browsing history information that is the history information of the website browsed by the user terminal. A quarantine method comprising: a determination step for determining whether or not to perform connection; and a connection permission determination step for determining whether or not to permit the user terminal to connect to a predetermined network based on a determination result of the determination step It is.

  According to the present invention, when a user terminal damaged by accessing a harmful site from an external network such as outside or outside of the university is connected to a network such as in-house or on-campus again, It is possible to suppress the damage from spreading to other user terminals.

1 is a diagram illustrating a network system 100 according to an embodiment. 2 is a block diagram showing a configuration of an authentication switch 30. FIG. 3 is a block diagram schematically showing the configuration of a quarantine server 40. FIG. 2 is a block diagram schematically showing a configuration of a proxy server 50. FIG. FIG. 6 is a sequence diagram showing a flow of a quarantine process in the network system 100. FIG. 6 is a sequence diagram illustrating a flow of a quarantine process in the quarantine server 40. It is a figure which shows the relationship between the group information memorize | stored in the database 46, and Web site information. It is a sequence diagram which shows the flow of a process of registration and change of Web site information.

Hereinafter, embodiments of a network system, a quarantine apparatus, and a quarantine method according to the present invention will be described with reference to the drawings.
FIG. 1 is a diagram illustrating a network system 100 according to an embodiment.
The network system 100 includes a user terminal 10, a network management terminal 20, an authentication switch (external device) 30, a quarantine server (quarantine device) 40, and a proxy server (connection control device) 50.

[User terminal]
The user terminal 10 is an information processing apparatus operated by a general user, and for example, a notebook personal computer can be applied. The user terminal 10 and the authentication switch 30 are connected by a communication cable, for example. In the illustrated example, only one user terminal 10 is illustrated, but actually, a plurality of user terminals 10 are connected to the authentication switch 30.

The user terminal 10 can be classified into a plurality of groups. Here, “group” is information for classifying a plurality of user terminals 10 into a plurality of affiliations, and the user terminals 10 can be classified by, for example, a company department or section. Specifically, the user terminal used in the engineering department is “Group A”, the user terminal used in the sales department is “Group B”, and the user terminal used in the accounting department is “Group C”. Or the like.
In addition, the user terminal 10 includes a storage unit (rewritable memory), and the storage unit stores website browsing history information (website browsing history information) that is information on the history of the website browsed by the user terminal 10. I remember it. The storage unit may store anti-virus software for detecting and removing computer viruses.

[Network management terminal]
The network management terminal 20 is an information processing apparatus operated by a network administrator, and for example, a desktop personal computer can be applied. The network management terminal 20 and the authentication switch 30 are connected by a communication cable, for example.

[Authentication switch]
The authentication switch 30 is a switch having a plurality of ports. The authentication switch 30 is connected to the proxy server 50 via the in-house network 60. The authentication switch 30 is connected to the quarantine server 40 via the quarantine network 70.

  The authentication switch 30 performs processing for connecting the user terminal 10 to the quarantine server 40 via the quarantine network 70 when the user terminal 10 is connected. Further, the authentication switch 30 performs the authentication process of the user terminal 10 and connects the user terminal 10 to the in-house network 60 when the quarantine result “not accessing the harmful site” is transmitted from the quarantine server 40. I do.

[Quarantine server]
The quarantine server 40 is connected to the authentication switch 30 via the quarantine network 70. The quarantine server 40 receives terminal information and website browsing history information from the user terminal 10 via the authentication switch 30 and the quarantine network 70, determines whether the user terminal 10 is accessing a harmful site, and the determination A process of returning the result (quarantine result) to the user terminal 10 via the authentication switch 30 and the quarantine network 70 is performed.

  Here, “terminal information” is information for specifying the user terminal 10, for example, when identifying the user terminal 10 such as a MAC (Media Access Control) address, an IP (Internet Protocol) address, or a computer name. Information to be used.

  Further, “Website browsing history information” is information on the history of Web sites browsed by the user terminal 10. For this reason, the past use condition regarding a website can be grasped by checking website browsing history information.

  The website browsing history information is information stored in the web browser when the website is used, such as a URL (Uniform Resource Locator), a temporary Internet file, and form input data of the visited website, and at least one of these information Contains one piece of information.

[Proxy server]
The proxy server 50 is installed between the in-house network 60 and the Internet 80. The proxy server 50 monitors access to and from the in-house network 60 and permits only a specific type of connection from the inside or blocks unauthorized access from the outside. The proxy server 50 controls connection of the user terminal 10 to a website on the Internet 80.

  The quarantine server 40 and the proxy server 50 can individually set harmful site information (Web site information) to be applied to the user terminal 10 for each group, and this information can be selected from items of the Web site browsing history information. Can be set with information.

  Further, the proxy server 50 transmits the registration information or the change information to the quarantine server 40 when executing the process of registering or changing the website information. The quarantine server 40 executes a process of registering or changing the website information based on the received registration information or change information. By performing this process, the Web site information of the quarantine server 40 and the proxy server 50 can be synchronized.

FIG. 2 is a block diagram showing a configuration of the authentication switch 30.
The authentication switch 30 includes a port 31, a switching LSI (Large Scale Integration) 32, a relay unit 33, a memory 36, and a control unit 37.

〔port〕
A plurality of ports 31 are provided according to the number of ports provided in the authentication switch 30. In the illustrated example, only three ports 31 are shown.

[Switching LSI]
The switching LSI 32 performs processing such as encoding or decoding, and transmits a frame from the port 31 to the relay unit 33 or from the relay unit 33 to the port 31.

[Relay part]
The relay unit 33 is in charge of the function of the MAC layer in cooperation with the memory 36 and the control unit 37.
The relay unit 33 is configured by, for example, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or the like. The relay unit 33 includes an input processing unit 34 and an output processing unit 35.

〔memory〕
The memory 36 is a readable / writable storage device, and stores, for example, an FDB (Forwarding Data Base). In the FDB, the port 31 number and the MAC address are registered in association with each other.

[Input processing unit]
The input processing unit 34 performs processing for setting the output destination port 31 and transmitting the frame to the output processing unit 35 while referring to the FDB and the like of the memory 36 based on the destination MAC address in the frame. Further, the input processing unit 34 performs processing for registering the source MAC address in the frame received from the switching LSI 32 in the FDB of the memory 36 in association with the number of the port 31 that has received the frame.

[Output processing unit]
The output processing unit 35 transmits the frame received from the input processing unit 34 to the switching LSI 32.

(Control part)
The control unit 37 includes a CPU (Central Processing Unit) and controls the authentication switch 30. The control unit 37 includes an authentication unit 38 and a connection availability determination unit 39.

[Authentication Department]
The authentication unit 38 executes processing for authenticating the user terminal 10. Specifically, it is determined whether to authenticate the user terminal 10 based on user authentication information (user name, password, etc.) transmitted from the user terminal 10.

[Connectability determination unit]
Based on the quarantine result (determination result) from the quarantine server 40, the connectability determination unit 39 determines whether to permit the user terminal 10 to connect to the in-house network 60.
Specifically, the connectability determining unit 39 permits the user terminal 10 to connect to the in-house network 60 when a quarantine result “not accessing a harmful site” is transmitted from the quarantine server 40. On the other hand, when the quarantine result “accessing a harmful site” is transmitted from the quarantine server 40, the connectability determination unit 39 does not permit the user terminal 10 to connect to the in-house network 60.

FIG. 3 is a block diagram schematically showing the configuration of the quarantine server 40.
The quarantine server 40 includes a communication unit 41, a control unit 42, and a database 46.
The communication unit 41 is an interface that transmits and receives data to and from the authentication switch 30. In addition, the communication unit 41 functions as a transmission unit and a reception unit that transmit and receive a quarantine processing result (determination result) to the network switch 30.
The control unit 42 is an element that functions as a computer, and is incorporated in the quarantine server 40 in the form of an electronic circuit board on which a processor (CPU) and a memory (ROM, RAM, etc.) are mounted. The control unit 42 has a function of controlling various processes and operations performed by the quarantine server 40.

The control unit 42 includes a transmission / reception control unit 43, a determination unit 44, and a synchronization unit 45.
The transmission / reception control unit 43 executes control processing related to terminal information and website browsing history information transmitted from the user terminal 10.

  The determination unit 44 executes processing for determining whether or not the website browsing history information transmitted from the user terminal 10 matches the website information stored in the database 46.

  The synchronization unit 45 executes processing for synchronizing the website information stored in the database 46 of the quarantine server 40 and the website information stored in the proxy server 50.

  The database 46 is a storage device that accumulates various data, and stores in advance Web site information (specific website information) for identifying a specific website (harmful site) (specific website information storage unit). . The database 46 stores in advance group information to which the user terminal 10 belongs. Further, the database 46 also stores a quarantine result by the quarantine server 40.

FIG. 4 is a block diagram schematically showing the configuration of the proxy server 50.
The proxy server 50 includes a communication unit 51, a control unit 52, and a database 56.
The communication unit 51 is an interface that transmits and receives data to and from the authentication switch 30, the in-house network 60, and the Internet 80.
The control unit 52 is an element that functions as a computer, and is incorporated in the proxy server 50 in the form of an electronic circuit board on which a processor (CPU) and a memory (ROM, RAM, etc.) are mounted, for example. The control unit 52 has a function of controlling various processes and operations performed by the proxy server 50.

The control unit 52 includes a transmission / reception control unit 53, a synchronization unit 54, and an editing unit 55.
When the user terminal 10 tries to access a website on the Internet 80 via the authentication switch 30 and the in-house network 60, the transmission / reception control unit 53 determines whether the website is a harmful site and accesses the harmful site. If so, a process for prohibiting access is performed.

  The synchronization unit 54 executes processing for synchronizing the website information stored in the database 46 of the quarantine server 40 and the website information stored in the database 56 of the proxy server 50.

  When the editing unit 55 receives an edit request (registration information or change information) for the website information stored in the database 56 from the network management terminal 20, the editing unit 55 stores the Web stored in the database 56 based on the edit request. Edit the contents of the site information (execute new registration, change contents, etc.).

  The database 56 is a storage device that accumulates various data, and stores in advance Web site information (specific website information) for identifying a specific website (harmful site) (specific website information storage unit). .

[Website Quarantine Procedure]
FIG. 5 is a sequence diagram showing the flow of the quarantine process in the network system 100.

  Step S10: When the user terminal 10 is connected to the authentication switch 30, the user terminal 10 is connected to the quarantine server 40 by the authentication switch 30. Then, the user terminal 10 transmits terminal information and Web site browsing history information to the quarantine server 40.

  The user terminal 10 indicates that the terminal information and the website browsing history information are transmitted to the quarantine server 40 using a display unit such as a display of the user terminal 10, and a keyboard or the like is transmitted. The terminal information and the website browsing history information may be transmitted to the quarantine server 40 after obtaining the user's consent by the input unit.

  Step S20: The quarantine server 40 executes a quarantine process using the received terminal information and website browsing history information. Details of the quarantine process will be described later.

  Step S30: The quarantine server 40 transmits the quarantine result obtained by the quarantine process to the authentication switch 30 and the user terminal 10.

  The authentication switch 30 analyzes the content of the quarantine result transmitted from the quarantine server 40. The authentication switch 30 connects the user terminal 10 to the in-house network 60 by the connectability determination unit 39 when a quarantine result “accessing a harmful site” is transmitted from the quarantine server 40. Is determined not to be permitted (connection determination step), and the user terminal 10 is isolated from the in-house network 60.

  Further, the user terminal 10 analyzes the content of the quarantine result transmitted from the quarantine server 40. Then, when a quarantine result “accessing a harmful site” is transmitted from the quarantine server 40, the user terminal 10 displays the fact and a countermeasure on the display unit such as a display of the user terminal 10. .

Examples of the countermeasures include the following methods.
(1) The user terminal 10 checks whether its own device is infected with a computer virus by using anti-virus software with the latest pattern definition file. When it is determined that the computer terminal is not infected, the user terminal 10 can be connected to the in-house network 60. On the other hand, if it is determined that the computer virus is infected, the user terminal 10 can be connected to the in-house network 60 after the computer virus is removed by the antivirus software.

(2) It is assumed that anti-virus software is not installed in the user terminal 10. In this case, the authentication switch 30 is also connected to a treatment network different from the in-house network 60. When a quarantine result “accessing a harmful site” is transmitted from the quarantine server 40, the authentication switch 30 is a treatment terminal in which anti-virus software set in the treatment network is installed. The user terminal 10 is connected to.
When it is determined that the treatment terminal is not infected with a computer virus, or when the computer virus is removed even when it is determined that the treatment terminal is infected with a computer virus, the user terminal 10 receives the authentication switch 30. Can be connected to the in-house network 60.
On the other hand, when a quarantine result “not accessing a harmful site” is transmitted from the quarantine server 40, the authentication switch 30 determines to allow connection to the in-house network 60 (decision step). .

  Step S <b> 40: When a quarantine result “not accessing a harmful site” is transmitted from the quarantine server 40, the user terminal 10 transmits user authentication information to the authentication switch 30.

  Step S50: Upon receiving user authentication information from the user terminal 10, the authentication switch 30 performs user authentication processing.

Step S60: When the authentication switch 30 succeeds in the authentication of the user terminal 10, the authentication switch 30 connects the user terminal 10 to the in-house network 60 and transmits to the user terminal 10 that the authentication is successful.
On the other hand, when the authentication switch 30 fails to authenticate the user terminal 10, the authentication switch 30 disables connection of the user terminal 10 to the in-house network 60 and transmits a message indicating that the authentication has failed to the user terminal 10.

  Step S <b> 70: When the authentication switch 30 transmits an authentication message to the user terminal 10, the user terminal 10 becomes connectable to the in-house network 60.

[Details of quarantine processing]
FIG. 6 is a sequence diagram showing the flow of the quarantine process in the quarantine server 40.
Step S21: The user terminal 10 transmits terminal information and Web site browsing history information, and the transmission / reception control unit 43 receives the terminal information and Web site browsing history information.
Step S22: The transmission / reception control unit 43 makes an inquiry to the database 46 using the received terminal information and searches for a group to which the user terminal 10 belongs.

  Step S23: When a group to which the user terminal 10 belongs is searched, group information is returned from the database 46 to the transmission / reception control unit 43.

  Step S24: The transmission / reception control unit 43 specifies the group to which the user terminal 10 belongs, and then makes an inquiry to the database 46 using the group information to search for Web site information. The search for the website information is executed based on the group information, and the website information to be applied to the group to which the user terminal 10 belongs is extracted.

  Step S25: When the Web site information to be applied to the group to which the user terminal 10 belongs is searched, the Web site information is returned from the database 46 to the transmission / reception control unit 43.

  Step S26: The transmission / reception control unit 43 transmits the Web site browsing history information received from the user terminal 10 in Step S21 and the Web site information returned in Step S25 to the determination unit 44.

  Step S27: The determination unit 44 determines whether or not the website browsing history information matches the website information (determination step). If the two information matches, the quarantine result is “Accessing a harmful site”, and if both information does not match, the quarantine result is “No access to a harmful site”. Then, the determination unit 44 returns a determination result (quarantine result) to the transmission / reception control unit 43.

  Step S28: The transmission / reception control unit 43 transmits the determination result (quarantine result) to the database 46, and the database 46 stores the determination result (quarantine result).

  Step S29: The transmission / reception control unit 43 transmits a determination result (quarantine result) to an authentication switch (not shown) and the user terminal 10.

FIG. 7 is a diagram showing the relationship between the group information stored in the database 46 and the Web site information.
In the left column of the figure, group information to be applied in the present embodiment is shown, and there are items of “common group”, “group A”, “group B”, and “group C”.
In the right column of the figure, Web site information indicating harmful site information is shown, and a specific URL is registered in each item.

The user terminal 10 can be classified into a plurality of groups (group A, group B, group C), and the database 46 stores Web site information having different contents depending on the plurality of groups.
In the illustrated example, the “Web site information” corresponding to the “common group” is “http: //www.xxx.˜.com”, “http: //www.yyy.˜.com”, “http: //Www.zzz.-.com "and the like.

“Web site information” corresponding to “Group A” is information such as “http: //www.aaa.˜.com”.
“Web site information” corresponding to “Group B” is information such as “http: //www.bbb.˜.com”.
“Web site information” corresponding to “Group C” is information such as “http: //www.ccc.˜.com”.

Here, the “common group” is Web site information that is applied regardless of which group the user terminal 10 belongs to.
On the other hand, “Group A” is Web site information applied when the user terminal 10 belongs to Group A. “Group B” is Web site information applied when the user terminal 10 belongs to the group B. Further, “group C” is Web site information applied when the user terminal 10 belongs to the group C.

For this reason, when the user terminal 10 does not belong to any group, the applied website information is the “common group” website information.
On the other hand, when the user terminal 10 belongs to the group A, the applied website information is the “common group” website information and the “group A” website information.

[Registration and synchronization procedure of Web site information]
FIG. 8 is a sequence diagram showing a flow of processing for registering and changing Web site information.
The network management terminal 20 can register and change Web site information. The network administrator can input information on a harmful site to be registered (registration information) or information on a harmful site to be changed (change information) by operating an input unit such as a keyboard of the network management terminal 20.

  Step S100: When the registration information or change information is input by the network administrator, the network management terminal 20 transmits the registration information or change information to the proxy server 50.

  Step S110: When the proxy server 50 receives the registration information from the network management terminal 20, the proxy server 50 registers the information on the harmful site in the database 56 of the proxy server 50 as the website information. Further, when the proxy server 50 receives the change information from the network management terminal 20, the proxy server 50 changes the Web site information already existing in the database 56 in the proxy server 50.

  Step S120: The synchronization unit 54 of the proxy server 50 transmits registration information or change information to the quarantine server 40 via the authentication switch 30.

Step S130: Upon receiving the registration information, the synchronization unit 45 of the quarantine server 40 registers the information on the harmful site in the database 46 of the quarantine server 40 as Web site information. Further, when receiving the change information, the synchronization unit 45 of the quarantine server 40 changes the Web site information already existing in the database 46 in the quarantine server 40.
By the above steps S120 and S130, the website information individually stored by the proxy server 50 and the quarantine server 40 (a plurality of devices) can be synchronized (synchronization step).

  Step S <b> 140: The quarantine server 40 updates the contents of the database 46, and then transmits a completion notification regarding registration or change to the proxy server 50 via the authentication switch 30.

  Step S150: When the proxy server 50 receives the completion notification from the quarantine server 40, the proxy server 50 transmits to the network management terminal 20 that the registration or change has been completed, and the fact is displayed on a display unit such as a display of the network management terminal 20. The Thereby, the network administrator can know that registration or change in the quarantine server 40 is completed.

Thus, according to this embodiment, there are the following effects.
(1) Since the network system 100 uses website browsing history information that is a website browsing history, the network system 100 can recognize what website the user terminal 10 has connected to other than the in-house network 60. it can. In the network system 100, in order to determine whether or not to connect to the in-house network 60 based on the website browsing history information, the user terminal 10 damaged by accessing a harmful site externally connects to the in-house network 60 again. In this case, it is possible to suppress the damage from spreading to other terminals in the in-house network 60.

(2) Since the quarantine server 40 is connected to the authentication switch 30 via the quarantine network 70 different from the in-house network 60, the quarantine server 40 can be isolated from the in-house network 60. For this reason, when the quarantine process is executed by the quarantine server 40, the user terminal 10 does not need to be connected to the in-house network 60, and the quarantine process is executed until the safety of the user terminal 10 is confirmed. The security of the network 60 can be maintained.

(3) When the database 56 of the proxy server 50 is updated using the network management terminal 20, the contents of the database 56 of the proxy server 50 and the contents of the database 46 of the quarantine server 40 are synchronized. It is possible to reduce the work at the time and at the time of change, and to reduce the burden on the network administrator.

(4) Since the contents of the database 56 of the proxy server 50 can be edited as appropriate by operating the network management terminal 20, it is possible to flexibly cope with harmful sites that appear and disappear. Further, by allowing a harmful site to be registered in accordance with a predetermined format, it is possible to register or change a harmful site with a keyword used when searching a Web site, etc., thereby reducing the burden on the network administrator.

(5) The determination unit 44 determines whether or not connection is possible for each group using the concept of group in order to determine whether or not the Web site information of the group to which the user terminal 10 belongs and the Web site browsing history information match. It is possible to make flexible settings for Web site information.

(6) When a harmful site is found, the harmful site can be registered in the user terminal 10 using the URL of the harmful site, and access to the harmful site can be prohibited. However, there is a problem that registration of harmful sites is difficult without knowledge of the network. In addition, harmful site registration has a problem that it is difficult to cover a wide range of harmful sites, and the number of harmful sites registered increases. In this respect, in the present embodiment, since the harmful site can be registered by using information such as the URL of the Web site, the temporary Internet file, and form input data, such a problem can be solved.

(7) Rather than registering a harmful site for website information, it is also possible to confirm whether a website that is not related to business is accessed by registering a site that is not related to business. it can.

  The present invention can be implemented with various modifications and substitutions without being limited to the above-described embodiment.

  The proxy server 50 may not be a proxy server as long as the device has the above-described function.

  The website information registered in the quarantine server 40 and the proxy server 50 may register information on a website that permits access, instead of information on a website that prohibits access. In this case, the quarantine server 40 may determine whether a website other than the registered website has been accessed.

  When the user terminal 10 is connected to the authentication switch 30, the authentication switch 30 does not necessarily connect the user terminal 10 to the quarantine server 40. For example, the authentication switch 30 may connect the user terminal 10 to the in-house network 60 without connecting the user terminal 10 to the quarantine server 40 within a certain time after the quarantine of the user terminal 10 is completed.

  The processing procedure from when the quarantine server 40 receives the website browsing history information from the user terminal 10 to returning the quarantine result may not be in the order shown in the above-described embodiment. For example, it may be determined first whether a specific site is accessed from the Web website browsing history information, and then it may be determined whether the specific site is applied to a group to which the user terminal 10 belongs.

  The information specifying the group to which the user terminal 10 belongs may not be the terminal information. For example, the user information of the user who uses the user terminal 10 may be used and the database 46 in the quarantine server 40 may be inquired about the website information to be applied to the user terminal 10.

When the website information is applied to the user terminal 10, the same website information may be applied to all the user terminals 10 without using a group.
The common group may be positioned as a group applied to user terminals that do not belong to any group such as group A, group B, and group C.

  Prior to the quarantine process in the quarantine server 40, the authentication process in the authentication switch 30 may be performed. In this case, after executing the authentication process, the quarantine process is executed.

  The authentication process in the authentication switch 30 may not be performed. In this case, the authentication switch 30 may not be an authentication switch as long as it is a device having a function of switching the network to which the user terminal 10 is connected based on the quarantine result in the quarantine server 40.

  Web site registration may be performed by the quarantine server 40. In this case, after the website information is registered by the quarantine server 40, the registration information is transmitted to the proxy server 50, and the website information is registered by the proxy server 50.

  When synchronizing the Web site information between the quarantine server 40 and the proxy server 50, the synchronization process may be executed after a predetermined interval or a predetermined time without executing the synchronization process as needed.

  Web site information can be deleted. Even when deleting, the Web site information of the quarantine server 40 and the proxy server 50 can be synchronized in the same procedure as when registering or changing.

  The quarantine process described above may be executed in an environment (local network) that is not connected to the Internet 80. In this case, it is not necessary to prepare the proxy server 50, and it is not necessary to synchronize the Web site information of the quarantine server 40 and the proxy server 50.

DESCRIPTION OF SYMBOLS 10 User terminal 20 Network management terminal 30 Authentication switch 37 Control part 38 Authentication part 39 Connection availability determination part 40 Quarantine server 43 Transmission / reception control part 44 Determination part 45 Synchronization part 46 Database 50 Proxy server 53 Transmission / reception control part 54 Synchronization part 55 Editing part 56 Database 60 Internal network 70 Quarantine network 100 Network system

Claims (9)

A specific website information storage unit for storing in advance specific website information for identifying a specific website;
A determination unit that determines whether or not the specific website information stored in the specific website information storage unit and the website browsing history information that is the history information of the website browsed by the user terminal match;
A network system comprising: a connection availability determination unit that determines whether to allow the user terminal to connect to a predetermined network based on a determination result by the determination unit. The network system according to claim 1,
While connecting the user terminal to the predetermined network, the authentication switch having the connection availability determination unit,
A network system further comprising: a quarantine apparatus connected to the authentication switch via a different network different from the predetermined network and having the specific website information storage unit and the determination unit. The network system according to claim 2,
While controlling the connection of the user terminal to the website, the connection control device having the specific website information storage unit,
A network system further comprising: a synchronization unit that synchronizes the content of the specific website information storage unit of the connection control device and the content of the specific website information storage unit of the quarantine device. The network system according to any one of claims 1 to 3,
A network system further comprising an editing unit for editing the stored contents of the specific website information storage unit. In the network system according to any one of claims 1 to 4,
The user terminals can be classified into a plurality of groups,
The specific website information storage unit stores the specific website information having different contents according to the plurality of groups,
The determination unit is a network system that determines whether or not the specific website information of a group to which the user terminal belongs and the website browsing history information match. A specific website information storage unit for storing in advance specific website information for identifying a specific website;
A determination unit that determines whether or not the specific website information stored in the specific website information storage unit and the website browsing history information that is the history information of the website browsed by the user terminal match;
A transmission unit that transmits the determination result of the determination unit to an external device having a connection permission determination unit that determines whether to allow the user terminal to connect to a predetermined network based on a determination result by the determination unit A quarantine device. The quarantine apparatus according to claim 6,
Controls the connection of the user terminal to the website and synchronizes the content of the specific website information storage unit of the connection control device having the specific website information storage unit with the content of the specific website information storage unit of the own device A quarantine apparatus further comprising a synchronizing unit. Determination step of determining whether or not the specific website information for identifying a specific website stored in advance matches the website browsing history information that is the history information of the website browsed by the user terminal When,
A quarantine method including a connection permission determination step of determining whether to permit the user terminal to connect to a predetermined network based on a determination result of the determination step. The quarantine method according to claim 8,
The specific website information is individually stored by a plurality of devices,
A quarantine method further comprising a synchronization step of synchronizing the specific website information individually stored by the plurality of devices.

Images