JP3521188B2 - Network device setting content deriving method and device, and recording medium recording program thereof - Google Patents

Description

Detailed Description of the Invention

[0001]

TECHNICAL FIELD The present invention relates to a virtual closed network (VP).
N: Virtual Private Network) A logical closed network created by using a network device such as a product to perform communication through the network, and particularly requires no knowledge of the network configuration environment, and the setting items of the network device. The present invention relates to a technique effectively applied to a method of constructing a logical closed network without directly inputting a set value.

[0002]

2. Description of the Related Art Conventionally, a logical closed network which does not depend on a physical network configuration is constructed on a network.
Set up a number of network devices such as packet filtering and VPN. The setting items for network devices are
It is composed of an IP (Internet Protcol) address, a protocol number, a port number, etc., and concrete values such as numerical values are used as set values. On the other hand, the logical closed network configuration conditions include user names and host names belonging to the logical closed network, service names and data resource names used in the logical closed network, and the security level of the logical closed network. Generally, the setting item domain does not always match the setting item of the network device and the configuration condition of the logical closed network. For this reason, the network device setter must "determine the installation location of the network device that needs to be set based on the logical closed network configuration conditions requested by the network user," and "request from the network user. It is necessary to convert the above-mentioned logical closed network configuration conditions into the settings of the network device.

Many network devices can be set up by aliases such as a host name for an IP address and a service name for a port number. The setting method using an alias is such that a specific numerical value and a character string are made to correspond one-to-one and changed to an expression that is easy for a network device setting person to understand, and the setting value domain remains the same. That is, the alias function cannot realize the setting of the network device with the setting values of different domains.

[0004]

SUMMARY OF THE INVENTION In the above conventional technique,
When constructing the logical closed network, the network device setting person needs two kinds of work. One of them is: to judge "where and what kind of network device is installed" from the configuration conditions of the logical closed network. The other is to obtain the setting value of the network device from the value of the configuration condition of the logical closed network. For example, consider a case where a network user requests a logical closed network whose configuration condition is “an environment in which the user A and the user B can use the service S of the host X”.

In order for the network device setting person to judge that "the setting for the packet filtering apparatus P is necessary" in the above work, the network device setting person must have knowledge of the network configuration environment. . Next, the network device setter changes the value of “user A” from the value of “user A” to the host side Ha
In order to determine "using the IP address of", it is necessary to have the knowledge of the relationship between items of different domains such as "user" and "source side IP address".

In the above-mentioned conventional technique, these two operations cannot be automated, and the network device setter bears a burden. Increased knowledge of the network configuration environment required for network equipment setters,
It has been difficult to increase the scale of the network because the burden on the person who set up the network equipment is heavy. Further, since the knowledge about the relationship between the setting items required by the network device setter increases, and the burden on the network device setter increases, it is difficult to increase the abstraction degree of the logical closed network configuration conditions.

An object of the present invention is that the network device setter does not need to have knowledge of the network configuration in order to configure the logical closed network, and the logical closed network configuration conditions can be set without being aware of the setting items of the network device. It is to provide the technology that can describe the.

Another object of the present invention is to reduce the burden of setting on the network equipment setter, and to easily increase the scale of the network and increase the degree of abstraction of the logical closed network configuration conditions. To provide.

The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

[0010]

The outline of the invention disclosed in the present application will be briefly described as follows.

(1) Information on network resources, information defining relationships between network resource information, information defining relationships between the network resource information and network resource information, and relationships between network equipment setting items Information defining rules is stored in a relational database of a computer system, and information defining the relation between the network resource information and network resource information and information defining the relation rule with the setting item of the network device are stored. This is a method for deriving the network device setting contents, which is based on the configuration conditions of the logical closed network and derives the setting items of the network device.

(2) A computer-readable recording medium in which a program for causing a computer to execute the processing procedure of the method for deriving the setting contents of network equipment is recorded, and the information on network resources and the relation between the information on the network resources are defined. Stored information, information defining the relationship between the network resource information and the network resource information, and information defining the association rules for the setting items of the network equipment in a database associated with the computer system, and the network. Procedure for deriving network device setting items from logical closed network configuration conditions based on information that defines the relationship between resource information and network resource information, and information that defines the association rules for the network device setting items The computer A computer-readable recording medium recording a program to be executed by.

(3) A relational database, a network information management unit that receives network information from a network manager and updates the relational database, and a relational definition management unit that receives relational definitions from the network manager and updates the relational database. A setting rule definition management unit that receives a related rule definition from a network administrator and updates the related database; and a related processing engine that receives a logical closed network configuration condition from a network device setter and derives a network device setting item. It is a network device setting content deriving device comprising.

The point of the present invention is to provide information regarding network resources, information defining relationships between the network resource information, information defining relationships between the network resource information and network resource information, and network device settings. Information that defines related rules with items is stored in the related database of the computer system, respectively, based on the setting rules of the managed network devices and the relationship between the setting items of different domains,
Knowledge of the network configuration environment is not required, and the setting items of the network device are derived from the configuration conditions of the logical closed network using the setting items of the domain different from the setting items of the network device.

In other words, the computer system registers the information necessary for the above-mentioned work performed by the network device setting person in the related art in the related database in advance so that the computer system can obtain the information described above. It is to realize the work.

According to the above-mentioned means, the network device setter does not need to have knowledge of the network configuration in order to configure the logical closed network, and the configuration of the logical closed network does not need to be aware of the setting items of the network device. It is possible to describe the conditions. Further, the burden of setting on the network device setter is reduced, and it is possible to easily increase the scale of the network and increase the degree of abstraction of the configuration conditions of the logical closed network.

Hereinafter, the present invention will be described in detail with reference to the drawings together with embodiments (examples) according to the present invention.

To explain the embodiment of the present invention,
The definitions or meanings of the terms used in
It ・ Network users: Computers for communication
Etc. to the network and connect the computer etc.
The person to use. -Network device: A network through which computers communicate
Devices and software connected to the work. -Network administrator: Can be used by network users
Computers and network devices such as service decisions
Is the person who creates the management policy for. ・ Network device configurator: Network administrator management
A person who configures network devices based on the policy.
is there. ・ Network resources: Network devices, users, servers
Network-related entities such as services and IP addresses
Information. ・ Logical closed network: Gateways, firewalls, etc.
A physical network that is physically separated from other networks.
Network without being restricted to a specific computer
Give a specific identifier to the information so that only
Or by encrypting with a specific key.
Network. ・ Update: By adding, changing or deleting information or data
is there. -Domain: The domain of information and data. Finite or nothing
A set consisting of a limited number of elements. Projective operation: One of the operations in relational algebra. Relay show
R (A₁, A₂... A_n) All attribute set {A₁, A₂...
A_n}, A subset x of x = {A_i1, A_i2・ ・ ・, A _ik},
However, if 1 ≦ i1 <i2 <, ..., <ik ≦ n
Relation R (A₁, A₂・ ・ ・, A_n) On x
Shadow, R [A_i1, A_i2・ ・ ・, A_ik], Or R [X]
Write. -Join operation: One of the operations in relational algebra.
Relation R (A₁, A₂... A_n) And relation S
(B₁, B₂, ..., B_n) A_iAnd B_jThe above θ-bond is R
[A_iθB_j] Write S. Where θ is =, <,>, ≠
Which comparison operator is R [A_iθB_j] S = {(t,
u) | t∈R∧u∈S∧t [A_i] Θu [B_j]}.

[0019]

BEST MODE FOR CARRYING OUT THE INVENTION First, embodiments of a security policy management method and apparatus according to the present invention will be described.

FIG. 2 is a schematic diagram showing a schematic configuration of a security policy management device including a computer system according to an embodiment of the present invention. In FIG. 2, 11 is a first interface that receives a communication request from a network user, 12 is a second interface in which a network administrator manages a security policy, and 13 is set from a security policy management device to a network device or the like. A third interface, 14 is a security policy connection unit for registering a security policy with another security policy management device, 21 is a communication request check unit for checking a communication request from a network user, and 22 is for realizing a communication request. A logical closed network generating means searching unit 23 for searching a usable means, and a logical closed network generating means searching unit 23.
The logical closed network generating means selecting mechanism section 24 selects one means when a plurality of results are retrieved in step 2, and the current closed loop network generating means selecting mechanism section 23 selects the current network equipment, software, etc. based on the result. The security protection tool setting check unit (network device setting check unit) checks the set state.

Reference numeral 30 denotes a security policy database (database section) which stores security policies. The security policy database 30 includes
A logical closed network component management unit 31 that manages the state of the logical closed network, a security policy component management mechanism unit 32 that is managed by the network administrator, and a security protection tool component that manages the status of the security protection tool. It has a management unit 33.

FIG. 3 is a flow chart showing the operation procedure of the security policy management apparatus of this embodiment. First, the network administrator determines the security policy of the management target range and registers it in the security policy management device (S
31). This security policy can be added, modified, or deleted by the network administrator as needed. After this state, the communication request from the network user is accepted (S32), and by setting it in the network device or the like (S33), the communication requested by the network user is realized.

FIG. 4 is a flow chart showing a security policy management processing procedure by the network administrator, which is the first operation procedure of the security policy management apparatus shown in FIG. As shown in FIG. 4, the security policy input from the second interface (security policy management interface) 12 is added, changed, or deleted (S41, S42, S43), and the result is
It is stored in the security policy component management unit 32 (S44).

FIG. 5 shows a processing procedure relating to both the communication request processing by the network user and the device setting processing by the security policy management apparatus in the operation procedure of the security policy management apparatus (FIG. 3). These processes are performed by the communication request check unit 21 when the communication request of the network user is deleted by being input from the first interface (user request interface) 11.
Obtains information on the logical closed network existing at the time of request from the logical closed network constituent element management unit 31.

As shown in FIG. 5, the input communication request is the security policy management device 10 that has accepted the request.
00, the communication request check unit 21 checks the management target whether the request is within the management target range of 00 or communication with a device belonging to the management target range of the other security policy management apparatus 2000.
(S51). As a result, when the other security policy management device includes a communication request with a device whose security policy is managed (NG), the management device 2000 is specified, and the security policy connection unit 2001 of the specified management device 2000 is specified. The security policy connection unit 14 inquires about the security policy (S52).

Separately from this, the communication request check unit 21 determines whether the communication request is within the security policy of the security policy management apparatus 1000 by the security policy component management unit 32 (S53). The security policy management apparatus 1000 confirms that the communication request is within the security policy range, and at the same time, the security policy management apparatus 2000 also confirms that the communication request is within the security policy range (OK).
When the security policy management apparatus 1000 receives the result, a device setting process is performed (S54). Also,
If one of the security policy management devices reveals that the communication request does not meet the security policy (NG), the process for realizing the communication request is interrupted and the network that issued the communication request is interrupted. A message is sent to the user (S55), and the process ends.

In the device setting process (S54), the logical closed network generating means searching unit 2 finds network devices, software, etc., which are present in the management target range of the security policy management apparatus 1000 and are required to realize the requested communication.
2 retrieves from the security policy component management unit 32 (S56). If this search result is singular (OK)
Is used, and in a plurality of cases (OK), the logical closed network generating means selecting unit 23 uses the evaluation item of the tool assigned to each means at the time of registration, for example, the security strength. Then, the security protection tool setting check unit 24 collects the device setting information at that time in the security protection tool component management unit 33 using the result narrowed down to one type, and if there is no contradiction with the setting state, The setting information is passed from the third interface (network device control interface) 13 to the device setting agent 41 so that the device setting agent 41 performs the necessary device setting process, and the set information is stored in the logical closed network constituent element management unit 31. And the security protection tool component management unit 33.

Next, the security policy management device 200
When communication with a device belonging to the management target range of 0 is necessary (NG), the security protection tool setting check unit 24 notifies the security policy connecting unit 2001 of the device setting request from the security policy connecting unit 14 ( S57). The security policy management device 2000
Upon receiving this setting request, the security policy management device 20
The network device, software, etc. within the management range of 00 are set, and the communication request process and the device setting process are ended.

As shown in FIG. 6, the process of the communication request check unit 21 first checks whether the type of communication request is a change or deletion of the logical closed network (S60). As a result, when the type of the communication request is the change or deletion of the logical closed network, the logical closed network information is acquired from the logical closed network component management unit 31 (S61). Next, the communication request range included in the communication request is checked (S62). As a result of the check, if the communication request is within the management range of the own device, the security policy of the own device is searched (S6).
3) If the communication request extends beyond the management range of the own device, the security policy connection process is performed (S64), and the process proceeds to the next step S65. In step S65, it is checked whether the communication request is within the security policy range,
If the communication request is within the security policy range (OK), device setting processing is performed (S66), and if the communication request is outside the security policy range (NG), the user is notified of the rejection of the communication request. (S67), the communication request check process ends.

As shown in FIG. 7, the security policy connection processing is performed by another security policy management device 20.
00 is specified (S71), and the content of the communication request is notified to the other security policy management device 2000 (S72). Next, the security policy check result is received (S7
3), the security policy concatenation process ends.

The device setting process is as shown in FIG.
The logical closed network generating means is searched (S81), a predetermined logical closed network generating means is selected from the searched logical closed network generating means (S82), and the selected logical closed network generating means is set. Check if there is a contradiction (S8
3). If the settings do not conflict (OK), the device setting agent sets the device (S84), and the device setting information is saved (S85). The settings are inconsistent (N
At the time of G), a message of occurrence of inconsistency is displayed (S88),
The device setting process ends.

In the next step S86, the communication request range is checked, and if the communication request is outside the control range of the own device, a device setting request is sent to another device (S87), and the device setting information indicates the own device. If it is within the management target range, the device setting process ends.

In the search processing of the logical closed network generating means, as shown in FIG. 9, the terminal included in the communication request is derived (S).
91), the means permitted by the derived terminal is searched (S92), and the search processing of the logical closed network generating means ends.

In the selection process of the logical closed network generating means, as shown in FIG. 10, the logical closed network generating means is selected (S1).
01), it is checked whether the selected logical closed network generating means is plural (S102), and if there is plural (Yes), the best means is selected from the evaluation items registered for each logical closed network generating means. (S103), a logical closed network generating means is selected (S104). A logical closed network can be constructed based on the selected logical closed network generating means. In other words, it is possible to create a logical closed network that maintains the security policy as usual.

FIG. 1 is a block diagram showing the schematic arrangement of a network device setting item related processing device according to an embodiment of the present invention. In FIG. 1, reference numeral 100 is a network device setting item related processing device including a computer system, 201 is network information, 202 is related definition information (hereinafter, simply referred to as related definition), 203 is related rule definition information (hereinafter, simply related rule). Called definition), 3
01 is a logical closed network configuration condition, 401 is a network device setting item, 101 is a related processing engine which receives the logical closed network configuration condition 301 from the network device setting person and derives the network device setting item 401, 102 is network information 201, A related database that stores the related definition 202 and the related rule definition 203, 121 is a network information management unit that receives the network information 201 from the network administrator and updates the related database 102, and 122 is the related definition 202 from the network administrator.
Is a related definition management unit that receives the related rule definition 203 from the network administrator and updates the related database 102.

As shown in FIG. 1, the network device setting item related processing apparatus 100 of this embodiment includes a related database 102, a network information management unit 121 which receives network information 201 from a network administrator and updates the related database 102. A related definition management unit 122 that receives a related definition 202 from a network administrator and updates the related database 102, and receives a related rule definition 203 from a network administrator and related database 10
2, and a related processing engine 101 that receives a logical closed network configuration condition 301 from a network device setter and derives a network device setting item 401.

Network information 201, relation definition 2
02, the related rule definition 203, and the logical closed network configuration condition 301 are information input to the network device setting item related processing device 100, and the network device setting item 401 is output from the network device setting item related processing device 100. This is the information to be provided.

Network information 201, relation definition 2
02, the logical closed network configuration condition 301, and the network device setting item 401 are expressed as a relation table. After that,
The relational table Relation shown in Table 1 is expressed as an expression of Equation 1 (relational algebraic expression of the relational table Relation).

[0039]

[Table 1]

[0040]

[Equation 1] The network information 201 is composed of information about network resources. These are the host name, IP address (: IP address corresponding to each host name), user name, user ID (: user I assigned to each user name).
D), network device type name, host name (: type of installed network device and installation location), and the like.

The related definition 202 is composed of definitions in which the network information 201 are associated with each other. These are the host name, user name (: which user is using which host), source IP address, d
destination IP address, host name (: which communication combination requires the setting of the network device installed therein), and the like.

The related rule definition 203 is composed of related rule definitions for deriving the network device setting item 401 from the logical closed network configuration condition 301. These are the attributes Q ₁ , Q ₂ of the network device setting item 401,
..., for each attribute Q _q of Q _Q , logical closed network construction condition 3
Attribute Ff included in 01 and the network information 20.
1 and the related rule definition with the related definition 202. The related rule definition 203 is composed of setting rule definitions for deriving the network device setting item 401. These are realized by determining the calculation target and the calculation procedure of the connection calculation and the projection calculation for the network device setting item 401. The definition of the calculation target is realized by determining specific values of i, j, k, and NR for each t of 1, 2, ... Here, NRt (N
Ct ₁ , NCt ₂ , ..., NCt _m ) are relation tables included in the network information 201 or relation tables included in the relation definition 202, or relation tables Vt (Ct ₁ , Ct ₂ ,.
Ct _m ).

[0043]

[Equation 2] The logical closed network configuration condition 301 is composed of configuration conditions specified when requesting the configuration of the logical closed network. These are composed of a user name, a server host name, a security level (: which user is a logical closed network which server can use the service of what server).

The network device setting item 401 is
It consists of setting items required for each type of network lateral device. These are the host name, network device type name, source IP address, and destination.
on IP address, port number (: where it is installed, what kind of network combination, which communication combination, and which port is set to be allowed to be used).

Network device setting item related processing device 1
A state transition diagram of 00 is shown in FIG. FIG. 12 is a flowchart showing a processing procedure of the network device setting item related processing device 100.

Network device setting item related processing device 1
As shown in FIG. 12, in the processing of 00, first, in the initial state, the network administrator sets the network information 20
1, the related definition 202, and the related rule definition 203 are defined, and the network information management unit 121 and the related definition management unit 1
22 and from the setting rule definition management unit 123 to the network device setting item related processing apparatus 100 to newly add to the related database 102 (S10).
1). After this state, the network administrator defines the network information 201, the related definition 202, or the related rule definition 203 (S102), and the network information management unit 121, the related definition management unit 122, or the setting rule definition management unit 123 sets the network. Related database 1 by inputting to device setting item related processing device 100
02 (S103, S104) and the derivation process of the network device setting item 401 by the network lateral device setting person defining the logical closed network configuration condition 301 and inputting it to the related processing engine 101. (S105).

When the network administrator deletes all the related databases 102 by instructing the network device setting item related processing device 100 from the network information managing unit 121, the related definition managing unit 122, and the setting rule definition managing unit 123. Then, the network device setting item related processing device 100 cannot accept the logical closed network configuration condition 301.

FIG. 13 shows the network information management unit 1
21 is a flowchart showing a processing procedure of No. 21.

As shown in FIG. 13, the network information management unit 121 first accepts the input of the network information 201 from the network administrator (S201), and determines the content of the processing type of the accepted network information 201 (S202). ), And related database 10 based on its contents
2 is added (S203), changed (S204), or deleted (S205).

FIG. 14 is a flow chart showing the processing procedure of the relation definition management unit 122.

As shown in FIG. 14, the relation definition management unit 122 first receives the relation definition 20 from the network administrator.
The input of 2 is accepted (S301), and the accepted definition 20
The contents of the processing type 2 are determined (S302), and the related database 102 is added (S303), changed (S304), or deleted based on the contents (S405).

FIG. 15 shows the setting rule definition managing unit 12
It is a flow chart showing a processing procedure of No. 3.

The setting rule definition management unit 123 is shown in FIG.
5, the input of the related rule definition 203 is received from the network administrator (S401), and the content of the processing type of the received related rule definition 203 is determined (S40).
2) Based on the contents, the related database 102 is added (S403), changed (S404), or deleted (S405).

FIG. 16 is a flow chart showing the processing procedure of the related processing engine 101. In FIG. 16, a diamond-shaped frame represents “condition determination”, and “<>” in the loop represents the end of the loop.

In the processing of the related processing engine 101, as shown in FIG. 16, first, the input of the logical closed network configuration condition 301 is accepted from the network equipment setting person (S50).
1), a loop is set for each setting item (S502) (step S502 to be described later for all setting items)
509) and the initial relation table is acquired (S503). Next, it is checked whether all the setting rules are completed (S504), and the loop from step S502 is repeated until all the loops for each setting item are completed, and when all the setting items of the loop for each setting item are completed ( Yes) (S509), the network device setting item 401 is derived (network device setting item 40).
1) (S510).

When it is checked in step S504 whether all the setting rules have been completed (No), the setting rules of the related rule definition 203 are applied (S505), and the setting rule calculation type ( According to the type of calculation of the setting rule) (S5
06), the logical closed network configuration condition 301, the network information 201, and the association definition 202 (S50)
7) or projection calculation (S508) is performed, the loop from step S502 is repeated for all setting items,
When all the setting items of the loop for each setting item are completed (S509), the network device setting item 401 is derived (the network device setting item 401 is obtained).
(S510).

Next, the related processing engine 101 returns the contents of the network device setting item 401 to the network device setting person. (Example of each main part) Network information 201 A (A1, A2): (IP address, host name) B (B1, B2): (User ID, user name) C (C1, C2): (Port No, Service name) D (D1, D2): (Network device type name, host name) Related definition 202 REL1 (R11, R12): (Host name, user name) REL2 (R21, R22, R23): (srcip,
dstip, host name) REL3 (R31, R32): (service name, service level) Related rule definition 203 Q4: F [F2 = A2] A → V41 V41 [A1] → {Q4} Q3: F [F1 = R12] REL1 → V31 V31 [R11 = A2] A → V32 V32 [A1] → {Q3} Q2: V32 [A1 = R21] REL2 → V21 V21 [R22 = A1] V41 → V22 V22 [R23 = D2] D → V23 V23 [D1] → {Q2} Q1: V22 [R23 = A2] A → V11 V11 [A1] → {Q1} Q5: F [F3> = R32] REL3 → V51 V51 [R31 = C2] C → V52 V52 [C1 ] → {Q5} Logical closed network configuration condition 301 FCUG (F1, F2, F3): (user name, server host name, security level) Network Network device setting item 401 EQUIPMENT (Q1, Q2, Q3, Q4, Q
5): (Installed host name, network device type name, so
urceIP address, destinationIP address, port number) Note that the “computer system” here is the OS
And peripheral equipment and other hardware.

The "computer-readable recording medium" means a portable medium such as a floppy (registered trademark) disk, a magneto-optical disk, a ROM, a CD-ROM, or a recording device such as a hard disk built in a computer system. Say.

Table 2 shows a domain list in the embodiment.

[0060]

[Table 2] Although the invention made by the present inventor has been specifically described based on the above-described embodiment, the present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the scope of the invention. Of course.

[0061]

As described above, according to the present invention,
A network administrator defines information about network resources, information that defines the relationship between network resource information, information that defines the relationship between network resource information and network resource information, and the relationship between network device setting items. By registering the information defining the rules in the computer system in advance, the network device setting person does not need to have knowledge about the network configuration to configure the logical closed network, and he is aware of the setting items of the network device. It is possible to describe the constituent conditions of a logical closed network without any need. As a result, the burden of setting on the network device setter is reduced, and it is possible to easily increase the scale of the network and increase the degree of abstraction of the logical closed network configuration conditions.

[Brief description of drawings]

FIG. 1 is a block configuration diagram showing a schematic configuration of a network device setting item related processing device according to an embodiment of the present invention.

FIG. 2 is a block configuration diagram showing a schematic configuration of a security policy management device including a computer system according to an embodiment of the present invention.

FIG. 3 is a flowchart showing a processing procedure of security policy management shown in FIG.

FIG. 4 is a flowchart showing a processing procedure of device setting processing shown in FIG.

5 is a flowchart showing a processing procedure of the communication request shown in FIG.

FIG. 6 is a flowchart showing a processing procedure of a communication request check unit of this embodiment.

FIG. 7 is a flowchart showing a processing procedure for security policy connection according to the present embodiment.

FIG. 8 is a flowchart showing a procedure of device setting processing according to the present embodiment.

FIG. 9 is a flowchart showing a search processing procedure of the logical closed network generation means of the present exemplary embodiment.

FIG. 10 is a flow chart showing a selection processing procedure of the logical closed network generation means of the present exemplary embodiment.

FIG. 11 is a state transition diagram of the network device setting item related processing device of this embodiment.

FIG. 12 is a flowchart showing a processing procedure of the network device setting item related processing device of the embodiment.

FIG. 13 is a flowchart showing a processing procedure of a network information management unit of this embodiment.

FIG. 14 is a flowchart showing a processing procedure of a relation definition management unit of the present embodiment.

FIG. 15 is a flowchart showing a processing procedure of a setting rule definition management unit of this embodiment.

FIG. 16 is a flowchart showing a processing procedure of a related processing engine of the present embodiment.

[Explanation of symbols]

11 ... First interface 12 ... Second interface 13 ... Third interface 14 ... Security policy connection part 21 ... Communication request check unit 22 ... Logical closed network generating means searching unit 23 ... Logical closed network generation means selection unit 24 ... Security protection tool setting check section 30 ... Security policy database 31 ... Logical closed network component management unit 32 ... Security policy component management unit 33 ... Security protection tool component management unit 41 ... Device setting agent 1000 ... Security policy management device 2000 ... Security policy management device 2001 ... Security policy connection unit 100 ... Network device setting item related processing device 101 ... Related processing engine 102 ... Related database 121 ... Network Information Management Department 122 ... Related Definition Management Department 123 ... Setting rule definition management unit 201 ... Network information 202 ... Related definition information (related definition) 203 ... Related rule definition information (related rule definition) 301 ... Logical closed network configuration condition 401 ... Network device setting item

─────────────────────────────────────────────────── ─── Continuation of front page (56) Reference JP 2000-216780 (JP, A) JP 11-346224 (JP, A) JP 7-129628 (JP, A) JP 11-313073 (JP, A) JP 5-150988 (JP, A) JP 6-230971 (JP, A) (58) Fields investigated (Int.Cl. ⁷ , DB name) H04L 12/56 H04L 12 / 24 H04L 12/26

Claims (3)

(57) [Claims] 1. A rule relating to information about network resources, information defining relationships between network resource information, information defining relationships between network resource information and network resource information, and network device setting items. Is stored in a relational database of the computer system, and based on information defining the relation between the network resource information and the network resource information, and information defining the relation rule with the setting item of the network device. A method for deriving network device setting contents, which comprises deriving network device setting items from the logical closed network configuration conditions. 2. A computer-readable recording medium in which a program for causing a computer to execute the processing procedure of the method for deriving the setting contents of a network device is recorded, wherein information on network resources and a relation between the information on the network resources are defined. A procedure for storing information, information defining the relation between the network resources and information of the network resources, and information defining the association rules for the setting items of the network equipment in the association database of the computer system; A procedure for deriving the setting items of the network device from the configuration conditions of the logical closed network, based on the information defining the relationship between the information on the network resource information and the information on the network resources, and the information defining the association rules for the setting items of the network device. , On the computer A computer-readable recording medium in which a program to be executed is recorded. 3. A related database, a network information management unit that receives network information from a network manager and updates the related database, and a related definition management unit that receives related definitions from the network manager and updates the related database. A setting rule definition management unit that receives a related rule definition from a network administrator and updates the related database; and a related processing engine that receives a logical closed network configuration condition from the network device setter and derives a network device setting item. A network device setting content derivation device characterized by: