JP2018032234A - Network security system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network security system that realizes, simply and at low cost, security capable of reliably protecting an information communication terminal including a smart phone and a personal computer against threats on the web in general households or the like.SOLUTION: A network security system includes: a cloud construction server for configuring cloud computing; a proxy server placed as physical hardware or software in the cloud construction server; and a UTM device provisioned on the proxy server. An information communication terminal connected with the cloud construction server communicates with another public server via the proxy server.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a network security system that can perform information communication with a web more securely using cloud computing.

  In recent years, there has been a remarkable spread of information communication terminals such as personal computers, multi-function mobile phones, and tablets not only in Japan but around the world.

  An information communication terminal such as a personal computer used in a general home performs information communication with the WEB, and is often performed using a dedicated telephone line or a dedicated line such as an optical fiber. Multi-function mobile phones, tablets, etc. (hereinafter also referred to as “smartphones”) use local area network connection (LAN, Wi-Fi) and third and fourth generation mobile phone systems (3G, 4G). Used.

  Conventionally, WEB threats such as access to computer viruses and harmful sites that can occur in information communication between the various information communication terminals and WEB described above are security software installed on the information communication terminal. And countermeasures have been taken individually by using a firewall or the like included in the operation system (hereinafter also referred to as “OS”) (see, for example, Patent Document 1).

  Further, as a means for further increasing security, a plurality of different security functions are integrated into one piece of hardware, and integrated threat management (hereinafter referred to as “UTM (Unified Threat Management)” in this specification) is introduced. There are many cases where high security that can comprehensively protect the network is constructed by simultaneously detecting multiple threats.

JP 2001-159975 A

  However, with security software and firewalls such as those mentioned above, the user himself / herself updates the security software and firewalls to the latest state in response to threats on the web that are constantly attacked using new means. Need to use. For this reason, the security level is not constant depending on the operation level of the user and the amount of knowledge about the computer, and it has been difficult to achieve the best performance.

  In addition, the above UTM can be countered by multiple threats on the WEB just by introducing a single hardware unit into the network, but it is highly introduced for personal use in general households due to the difficulty of cost and operation. There were barriers.

  Accordingly, an object of the present invention is to provide a network security system that can easily and inexpensively realize security capable of surely preventing a threat on the web even in an information communication terminal including a smart phone or a personal computer in a general home. For the purpose.

In order to solve the above problems, the present invention provides:
Cloud construction server that constitutes cloud computing,
A proxy server placed as physical hardware or software in the cloud building server;
A UTM device connected to the proxy server,
The information communication terminal connected to the cloud construction server communicates with other public servers via the proxy server;
A network security system is provided.

  In the network security system of the present invention having such a configuration, a cloud construction server including a proxy server and a UTM device connected to the proxy server is installed on a WEB (global network), and user information communication is performed. The terminal is connected to a public server on the global network via the proxy server of the cloud construction server. For this reason, the user's information communication terminal can indirectly perform information communication with the public server, detects multiple threats by the UTM device connected to the proxy server, and includes the user's private network and information communication terminal. (The information communication terminal connected to the network security system of the present invention uses a global IP address for information communication with the public server, but is safely protected by the UTM device). Furthermore, since the administrator of the cloud construction server appropriately operates and keeps up-to-date with the UTM device, it is not necessary for the user to individually introduce the UTM device, and it is possible to save troubles such as complicated operations and troublesome updates. .

  In the network security system of the present invention described above, it is further preferable that the cloud construction server can be connected simultaneously with the plurality of information communication terminals.

  In the network security system of the present invention having such a configuration, a plurality of information communication terminals with different users can be connected to the cloud construction server, and the plurality of information communication terminals can be connected to any public server via a proxy server. Communication can be performed.

It is a schematic diagram explaining the outline | summary of the network security system 1 in this embodiment. FIG. 2 is a system configuration diagram illustrating detailed configurations of an information communication terminal 5, a cloud construction server 3, and a public server 51 illustrated in FIG. It is a flowchart explaining the flow which the information communication terminal 5 shown in FIG. 1 transmits information to the public server 51 using the network security system 1 of this embodiment. It is a flowchart explaining the flow which the information communication terminal 5 shown in FIG. 1 receives information from the public server 51 using the network security system 1 of this embodiment. It is a flowchart figure which shows the flow of filtering using the UTM apparatus. It is a schematic diagram which shows the outline | summary of the general connection structure of the conventional information communication single terminal and WEB.

  Hereinafter, exemplary embodiments of a network security system according to the present invention will be described in detail with reference to FIGS. However, the present invention is not limited to what is shown in the drawings, and each drawing is for conceptual description of the present invention, and therefore, ratios and numbers are exaggerated or simplified as necessary for easy understanding. In some cases, it is expressed in a form. Further, in the following description, the same or corresponding parts are denoted by the same reference numerals, and redundant description may be omitted.

1. Overview of Network Security System 1 FIG. 1 is a schematic diagram showing an overview of a network security system 1 of the present embodiment. As shown in FIG. 1, the network security system 1 of the present embodiment includes an information communication terminal 5 on the private network 101 side, a WEB on the global network 103 side, and a cloud computing 105 constructed on the global network 103 side. Introducing the proxy server 7 and the UTM device 9 connected to the proxy server 7 to the constructed cloud computing 105, and facing various threats on the WEB Secure security.

  The network security system 1 of the present embodiment includes a user-side private network 101, a global network 103 that constructs a WEB, and a cloud computing 105 that is constructed on the global network 103 and communicates directly with the private network 101. , Is composed of a composite range.

  The “UTM device” in the present invention refers to a unified threat management device in which a plurality of different security functions are integrated into a single hardware, and an “information communication terminal” is an individual Information communication with the WEB is performed using a dedicated telephone line or a dedicated line such as an optical fiber, and includes “smartphones” such as multi-function mobile phones and tablets, and information communication terminals such as personal computers.

2. Configuration of Network Security System 1 Next, the configuration of the network security system 1 of the present embodiment will be described in detail with reference to FIG. FIG. 2 is a system configuration diagram of the network security system 1 according to the present embodiment. As shown in FIG. 2, the network security system 1 is generally connected to the cloud construction server 3 that constructs the cloud computing 105 (see FIG. 1), the router 37 that constructs the private network 101, and the router 37. The information communication terminal 5 and the public server 51 of the global network 103 are configured.

<Detailed configuration of cloud building server 3>
The cloud construction server 3 is configured with general resources, and includes at least a server communication unit 11 that connects with various terminals and devices outside, and a server central processing that performs arithmetic processing at the center. A processing device 13 (CPU), a server storage device 15 that manages various information and stores and reads the information, and a proxy server 7 that allows the information communication terminal 5 to communicate with the public server 51 on the WEB at high speed and safely. And the UTM device 9.

  Further, in the server storage device 15, a server operation system 23 (OS), communication management application software 25 that manages information communication transmitted and received via the cloud construction server 3, and the communication management application software 25. A transmission / reception log database 19 for storing acquired information communication log data and a user database 17 for managing information on users who use the network security system 1 are placed. In addition, the component of the said device does not necessarily need to be physically built in the cloud construction server 3, and one part may have several functions among the above.

  When the network security system 1 according to the present embodiment performs confirmation and management of a user who has performed information communication every transmission / reception at a predetermined interval, software is separately installed in the server storage device 15 and the above-described user This is performed in cooperation with the database 17. In addition, when the cloud construction server 3 provides a user with a cloud system other than the security described in the present embodiment, the multipurpose database 21 (including storage physically separately provided) required for the cloud system is provided. It is desirable to place it.

  The above cloud systems are SaaS (Software as a Service), PaaS (Platform as a Service), and IaaS (Infrastructure as a Service), mainly using software, middleware and hardware. System that is provided to users.

  Next, the proxy server 7 is a server for communicating the information communication terminal 5 connected to the cloud computing 105 with the public server 51 on the WEB at high speed and safely (HTTP proxy). In FIG. 2, the proxy server 7 is expressed as one resource placed in the cloud construction server 3 for easy understanding, but it is another server connected to the cloud construction server 3 externally. May be.

  The proxy server 7 is located between the plurality of information communication terminals 5 connected to the proxy server 7 and the public server 51 on the WEB, and when the information communication terminal 5 performs information communication with the public server 51, the information Act on behalf of communication. By using the proxy server 7, the information communication terminal 5 can indirectly connect and perform information communication with the public server 51 on the WEB, and thus can receive various merits relating to security improvement.

  Further, since the proxy server 7 has a cache function implemented, the proxy server 7 temporarily caches information received from the public server 51 in the past, and transmits an HTTP request from the information communication terminal 5 to the proxy server 7. Information communication can be speeded up using the cache information.

  The proxy server 7 can also perform user authentication for proxying information communication only for the authenticated information communication terminal 5, centralized management of traffic for each information communication terminal 5, and the like. All log information related to information communication is stored and managed in a storage device or transmission / reception log database 19 placed in the proxy server 7.

  The server communication unit 11 is a device placed on the cloud building server, and performs information communication between the cloud building server 3 and the external public server 51.

  The UTM device 9 is an integrated threat management device that generally performs security including WEB filtering, e-mail filtering, anti-virus, anti-spam, anti-phishing, sandbox, and firewall. Basically, it is desirable to be placed in the cloud construction server 3. The UTM device 9 is similar to general UTM hardware, and can update information necessary for the latest threat management automatically or manually, and can take constant measures against threats on various WEBs. It can be taken.

<Detailed Configuration of Information Communication Terminal 5>
The information communication terminal 5 is a personal computer, a smartphone, a tablet terminal, a WEB camera, or the like capable of information communication with the WEB, and at least a terminal communication unit 27 that performs connection with various external terminals and devices, A terminal central processing unit 29 (CPU) that performs arithmetic processing at the center and a terminal storage device 31 that manages various information and stores and reads the information.

  In the terminal storage device 31, a terminal operation system (OS) 33 and terminal application software 35 necessary for information communication with the public server 51 on the WEB via the cloud construction server 3 are placed. Yes. In addition, the component of the said device does not necessarily need to be physically built in the information communication terminal 5, and one part may have several functions among the above.

  For example, the information communication terminal 5 is preferably connected to the private network 101 constructed by the router 37 by connecting to the router 37 provided outside by wired or wireless LAN.

  By connecting the work 103, the information communication terminal 5 under the private network 101 is connected to the public server 51 on the WEB. In the network security system 1 of the present embodiment, the information communication terminal 5 under the private network 101 is connected. The information communication terminal 5 is not directly connected from the router 37 to the public server 51 on the WEB, but is connected from the router 37 to the public server 51 via the cloud construction server 3.

  The information communication terminal 5 via the router 37 and the cloud construction server 3 are connected using, for example, VPN, and both connections are made into a substantially virtual private network (the connection means is limited to VPN). However, it is desirable to decide appropriately in view of safety in information communication, communication speed, etc.). VPN is a high-security communication method using a high-security communication network using protocols such as IPsec (Security Architecture for Internet Protocol), PPTP (Point to Point Tunneling Protocol), and TLS (Transport Layer Security). It is a communication means that can protect information communication with a cloud construction server by encapsulation or tunneling.

3. Information Communication Using Network Security System 1 Information communication between the information communication terminal 5 and the public server 51 on the web using the network security system 1 of the present embodiment will be described in detail below. In order to facilitate understanding of the information communication, information transmitted from the information communication terminal 5 to the public server 51 is transmitted information data, and information transmitted from the public server 51 to the information communication terminal 5 is received information data. Describe.

<Information transmission from the information communication terminal 5 to the public server 51>
First, a flow in which the information communication terminal 5 transmits information to the public server 51 using the network security system 1 of the present embodiment will be described with reference to FIG. FIG. 3 is a flowchart showing a flow of information transmission using the network security system 1 of the present embodiment.

  The information communication terminal 5 receives an input of transmission information data desired by the user, and enters a standby state in which the transmission information data can be transmitted to the cloud construction server 3. The transmission information data is e-mail data, WEB search request data, or the like, for example.

  Next, the information communication terminal 5 transmits the transmission information data to the cloud construction server 3 connected according to a user instruction. The cloud construction server 3 that has received the transmission information data transmits the transmission information data to the proxy server 7 while temporarily storing the transmission information data in the server storage device 15 or the like. When authentication of a user who uses the network security system 1 is performed every time information is transmitted, it may be executed in parallel at this time. Note that individual user information used for user authentication is stored in a user database 17 placed on the server storage device 15, and user authentication is executed by collating the information.

  Subsequently, the proxy server 7 that has received the transmission information data acquires the transmission log data by the communication management application software 25 and stores it in the transmission / reception log database 19 placed in the server storage device 15 (transmission log data The storage may be performed in a storage device on which the proxy server 7 is placed.), And is transmitted to the public server 51 that is the transmission destination of the transmission information data. At this time, when the UTM device 9 filters the transmission information data and the public server 51 (for example, a server storing inappropriate WEB page information) set in advance to prohibit the connection on the user side is the transmission destination Stop transmission. Further, when there is another information communication terminal that is illegally connected to the private network 101 or the cloud construction server 3 to which the information communication terminal 5 is connected, the transmission information data of the other information communication terminal is recognized as an illegal packet, Transmission can also be forcibly stopped.

<Reception of information from the public server 51 to the information communication terminal 5>
Next, a flow in which the information communication terminal 5 receives information from the public server 51 via the network security system 1 of the present embodiment will be described using FIG. FIG. 4 is a flowchart showing a flow of information reception using the network security system 1 of the present embodiment.

  First, the public server 51 transmits the received information data to the cloud construction server 3 on which the proxy server 7 is placed. The received information data is, for example, response data for various requests to e-mail or the public server 51.

  Next, the cloud construction server 3 that has received the reception information data uses the proxy server 7 and the communication management application software 25 to receive the reception log together with information such as the IP address of the public server 51 that is the transmission source of the reception information data. Data is acquired and stored in the transmission / reception log database 19 placed in the server storage device 15 (reception log data may be stored in a storage device placed on the proxy server 7).

  At this time, the UTM device 9 filters the received information data and compares it with internal security information (data such as WEB filtering, e-mail filtering, anti-virus, anti-spam, anti-phishing, sandbox, and firewall). Check the safety of the received information data. After the filtering of the reception information data by the UTM device 9 is completed, the reception information data is transmitted to the information communication terminal 5 through the VPN connection.

  The information communication terminal 5 that has completed the reception of the reception information data is stored in the terminal storage device 31 placed therein, and the user can expand the reception information data.

4). Flow of Filtering by UTM Device 9 Next, the flow of filtering at the time of information reception using the UTM device 9 will be described in detail with reference to FIG. FIG. 5 is a flowchart showing the flow of filtering at the time of information reception using the UTM device 9. Note that the flow from when the cloud construction server 3 receives the reception information data transmitted by the public server 51 until the reception log data is acquired and stored is as described above.

  The UTM device 9 checks the security of the received information data by comparing the received information data with a plurality of security information provided therein. As shown in FIG. 5, the received information data is first subjected to WEB filtering and e-mail filtering, and the relevance between the information set in advance by the user or the administrator of the cloud construction server 3 and the received information data is confirmed. For example, when the user or the administrator of the cloud construction server 3 sets information such as a WEB page inappropriate for browsing in the UTM device 9, the relevance between the received information data and the set WEB page is confirmed. If the relevance is high, transmission to the information communication terminal 5 is stopped, and if the relevance is low, the process proceeds to collation with the next security information.

  Whether the received information data is information including virus, spam and phishing is confirmed by filtering (in this process, the received data is actually expanded inside the UTM device 9 using a sandbox, and the received data is actually Also check for adverse effects, so even data that contains unknown viruses can be handled.) If the received information data includes a virus, spam, or phishing, the virus, spam, or phishing included in the received information data is removed. If removal is impossible, transmission to the information communication terminal 5 is stopped, and if removal is possible, all filtering by the UTM device 9 is completed, and a transition is made to a standby state in which received information data is transmitted to the corresponding information communication terminal 5.

  The embodiments of the present invention have been described above with reference to the drawings. However, the present invention is not limited to these embodiments, and other embodiments may be used without departing from the spirit and teaching of the claims. There are improvements and modifications. Those skilled in the art will readily understand that all such improvements and modifications are included in the technical scope of the present invention.

  For example, the flow in the filtering of the UTM device 9 described with reference to FIG. 5 is executed in the order of WEB filtering, e-mail filtering, virus, spam, and phishing, but the order may be changed. Further, the security information provided in the UTM device 9 is not limited to the above, and may further include a plurality of filtering items.

  The network security system 1 according to the present embodiment realizes security that can reliably prevent various WEB threats at a simple and low cost even in an information communication terminal 5 including a smartphone, a personal computer, etc. in a general home. It is.

DESCRIPTION OF SYMBOLS 1 Network security system 3 Cloud construction server 5 Information communication terminal 7 Proxy server 9 UTM apparatus 11 Server communication part 13 Server central processing unit 15 Server storage device 17 User database 19 Transmission / reception log database 21 Multipurpose database 23 Server operation system 25 Communication supervision application Software 27 Terminal communication unit 29 Terminal central processing unit 31 Terminal storage device 33 Terminal operation system 35 Terminal application software 37 Router 51 Public server 101 Private network 103 Global network 105 Cloud computing

Claims (2)

Cloud construction server that constitutes cloud computing,
A proxy server placed as physical hardware or software in the cloud building server;
A UTM device connected to the proxy server,
The information communication terminal connected to the cloud construction server communicates with other public servers via the proxy server;
A network security system characterized by Enabling the cloud construction server to connect simultaneously with a plurality of the information communication terminals;
The network security system according to claim 1.