JP3541872B2 - Network access verification system - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an internal network configured by connecting a plurality of terminals of a specific organization such as a corporation or a company and an external network configured by connecting a plurality of terminals other than the organization via a gateway terminal. When an organization user connects to a server terminal on the external network to collect information from a client terminal on the internal network and collects information in an environment where the information is acquired, the administrator of the organization can specify the user who acquired the information The present invention relates to a network access verification system.
[0002]
[Prior art]
As a gateway terminal product, "Cyberguard firewall" of Cyberguard of the United States and "Firewall-1" of Checkpoint of Israel perform user identification according to the following procedure.
[0003]
(1) User information that only the user who can access the external network has or cannot be created is registered in the gateway terminal.
[0004]
(2) When a user accesses an external network, the gateway terminal requests user information from the user.
[0005]
(3) The user inputs user information at the client terminal and transmits it to the gateway terminal.
[0006]
(4) The gateway terminal compares the received user information with the registered user information.
[0007]
(5) If they match, access is from a registered user. If they do not match, the access is from an unauthorized user.
[0008]
Here, there is a possibility that the information provided on the external network includes information that has a possibility of causing a problem in management of a company or a corporation.
[0009]
For example, downloading cryptographic algorithms from other countries that have not yet been approved for export may be subject to export restrictions.In such cases, not only access but also downloading of the unlicensed program itself Companies and corporations where the registered user is enrolled are subject to punishment and may be legally pursued, so network administrators in the corporations and corporations can access and download from anyone in the organization, from which machine and from where. It is necessary to know if it is.
[0010]
[Problems to be solved by the invention]
However, the conventional technique described above has the following problems.
[0011]
(1) Eavesdropping on the internal network, obtaining the user information of the authorized user registered in the gateway terminal, and determining whether the unauthorized user who accesses the external network is the authorized user or the unauthorized user. Unable to identify users with the correct rights.
[0012]
(2) Since the administrator must individually register and manage users accessing the external network in the gateway terminal, the client of the internal network must be physically or geographically distant from the location of the administrator. It is difficult to manage users who use the terminal.
[0013]
(3) The user must receive user authentication from the client terminal when using the client terminal, and then receive user authentication from the gateway terminal when accessing the external network again.
[0014]
An object of the present invention is to provide a network access verification system capable of specifying a specific access point to specify a user connected to the access point.
[0015]
Another object of the present invention is to perform user management at a client terminal, so that deletion and setting of a user can be performed quickly, and once user authentication is performed at a client terminal, user authentication is newly performed thereafter. It is an object of the present invention to provide a network access verification system that can access an external network without performing the operation.
[0016]
Still another object of the present invention is to provide a method in which, of the access information recorded in the access information recording table, the network address recorded in the access information whose time is not recorded in the user's usage record in the user information recording table is a user address. An object of the present invention is to provide a network access verification system capable of easily identifying an unregistered unauthorized client terminal by detecting the unauthorized terminal that does not record information.
[0017]
[Means for Solving the Problems]
In order to achieve the above object, according to the present invention, a user authentication function is provided in which only a user permitted to a client terminal can use the client terminal, and a user history function in which each user records a terminal use time is provided.
[0018]
Further, the gateway terminal is provided with a function of recording an information acquisition request from each client terminal as access history information.
[0019]
A user accessing a specific server terminal is identified based on the user history information of the client terminal and the access history information of the gateway terminal.
[0020]
Specifically, when the administrator specifies a specific information acquisition request, the client terminal that has issued the information acquisition request is specified from the access information, and the user information of the client terminal specified based on the time at which the information acquisition request was issued is specified. Identify the user who issued the information acquisition request.
[0021]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a system configuration diagram showing an embodiment of the present invention. In FIG. 1, an internal network 101 and an external network 102 are connected to communication terminals such as PCs and workstations and various communication devices such as bridges, routers, and switches by coaxial cables or optical cables. Is a computer network where exchanges are taking place.
The external network 102 includes a plurality of server terminals such as personal computers (hereinafter, PCs) and workstations corresponding to information requests from an information collection program on a client terminal 103 on the internal network 101.
The gateway terminal 104 is a PC or a workstation that starts a relay program or the like that relays communication data communicated between the internal network 101 and the external network 102.
The client terminal 103 in the internal network 101 is a PC or a workstation that starts an information acquisition program for collecting information by connecting to a server terminal in the external network 102. A plurality of client terminals 103 exist in the internal network 101.
Communication terminals and communication devices connected to the internal network 1 and the external network 102, such as the gateway terminal 104, the client terminal 103, and the server terminal, each have a network address as a unique identification number on the internal network 101 and the external network 102. have.
FIG. 2 is a diagram showing the internal configuration of the gateway terminal 104. The gateway terminal 104 includes a communication network interface 201 for exchanging data with a communication network, a display 202 for displaying a message or the like to a user, a keyboard 203 for the user to input data or the like, , A memory 205, a communication control program 207, a communication relay program 208, an access information record table 209, a storage device 206 in which a history data transmission program 210 and the like are recorded. Interconnected.
[0022]
The communication control program 207 is a program for controlling data exchange with another communication terminal.
The communication relay program 208 has a function of transferring an information request from the client terminal 103 to the server terminal from the internal network 101 to the external network 102, a function of transferring a response from the server terminal from the external network 102 to the internal network 101, It is a program that has the function of recording such transfer information.
[0023]
FIG. 3 shows the configuration of the access information record table 209 for storing information recorded by the communication relay program 208. 301 stores the time at which the access information was recorded. 302 stores a network address. An access point 303 of a terminal of the connected external network 102 is stored in 303. A flag 304 indicates success / failure of information acquisition.
The access point indicates the position of the information requested by the user. The location is represented by an identifier of the server, a path of a file in which information is stored, an information retrieval request command from a database, and the like. As an example of the access point, there is a URL (Uniform Resource Locators) of RFC (Request For Comment) 1738 issued by the Internet Activities Board (IAB).
The history data transmission program 210 is a program having a function of periodically transmitting the information of the access information record table 209 to the history data collection program of the server terminal.
[0024]
FIG. 4 shows the internal configuration of the client terminal 103. The client terminal 103 includes a communication network interface 401 for exchanging data with a communication network, a display 402 for displaying a message or the like to a user, a keyboard 403 for a user to input data or the like, The communication control program 407, the login program 408, the information browsing program 409, the history data transmission program 410, the login information recording table 411, and the user information registration table 412 stored in the CPU 404, the memory 405, and the storage device 406. . They are interconnected by a bus 400.
The login program 408 acquires a user identifier and a password from the user, identifies the user by comparing the user identifier and the password registered in the user information registration table 412 in advance, and provides a function of giving permission to use the client terminal 103. This is a program having a function of recording user information to which use permission has been given, use time, and the like in the login information record table 411.
The information browsing program 409 is a program having a function of transmitting an access point requested by a user to the communication relay program 208 of the gateway terminal 104, receiving a response to the request, and displaying the response.
The history data transmission program 410 is a program having a function of periodically transmitting the information of the login information record table 411 to the history data collection program of the server terminal.
[0025]
FIG. 5 shows the configuration of the user information registration table 412 in which information used for the login program 408 is stored. 501 stores a user identifier, and 502 stores a password. These pieces of information are registered in advance by the user.
[0026]
FIG. 6 shows the configuration of the login information record table 411 that stores information recorded by the login program 408 . 601 stores the time when the information was recorded, and 602 stores the input user identifier. 603 stores an action performed by the user, and 604 stores a flag indicating success / failure of the action.
The actions include a log-in state in which the client terminal 103 can be used and a log-out state in which the client terminal 103 can be released.
The action 603 holds an event that may occur as a definition table. For an action that has occurred that is not stored in the definition table, the information browsing program 409 of the client 103 determines whether the action can be newly stored in the definition file, and stores it in the event definition file as appropriate. .
[0027]
FIG. 7 shows the internal configuration of the management terminal 105. The management terminal 105 includes a communication network interface 701 for exchanging data with a communication network, a display 702 for displaying a message or the like to a user, a keyboard 703 for the user to input data or the like, and The storage device 706 includes a communication control program 707, a login program 708, a history data collection program 709, a history data analysis program 710, a user information record table 711, and access information. A recording table 712 and a login information recording table 713 are stored. These devices are interconnected by a bus 700.
[0028]
The history data collection program 709 has a function of registering login information transmitted from the client terminal 103 as user information in the user information recording table 711 and an access information transmitted from the gateway terminal 104 into an access information recording table of the management terminal 105. 712 is a program having a function of recording.
The history data analysis program 710 is a program having a function of matching the user information in the user information recording table 711 with the access information in the access information recording table 712, acquiring information from the server terminal of the external network 102, and specifying the user. .
[0029]
FIG. 8 is a diagram showing a user information recording table 711 for storing information recorded by the history data collection program 709.
Reference numeral 801 denotes the identifier of the client terminal 103 that sent the user information, 802 denotes the network address of the client terminal 103, 803 denotes the time when the information was recorded, 804 denotes the input user identifier, and 805 denotes the input user identifier. The action executed by the user is stored in a flag 806 indicating the success or failure of the action.
[0030]
FIG. 9 is a flowchart showing the entire operation procedure.
The administrator enters a user identifier and a password into the login program 708 at the management terminal 105 to search for a user who has accessed a specific access point, and makes the management terminal 105 usable (step 901).
Next, a specific access point is input to the history data analysis program 710 and activated (step 902).
The identifier of the user who has accessed the access point input in step 902 is obtained (step 903).
A use termination request of the management terminal 105 is input to the login program 708 (step 904).
[0031]
FIG. 10 is a flowchart showing the processing of the login program 708 of the management terminal 105.
First, an identifier and a password of a user who intends to use the terminal on which the login program 708 has been activated are requested (step 1001).
A user identifier and a password are obtained from the user (step 1002).
The registered password is acquired based on the user identifier acquired from the user information recording table 711 in the storage device 706 (step 1003).
The password acquired in step 1002 is compared with the password acquired in step 1003. If the passwords are the same, proceed to step 1005. If the password is different, the process proceeds to step 1006 (step 1004).
If the password comparison results are the same in step 1004, the login information record table 713 in the storage device 706 stores the current time, the user identifier acquired in step 1002, "login" indicating the use permission process, and a flag "SUCCESSED" indicating success. Is recorded (step 1005).
[0032]
If the password comparison results are different at step 1005, the login information record table 713 in the storage device 706 stores the current time, the user identifier acquired at step 1002, "login" indicating the use permission process, and the failure flag "FAILED". Is recorded (step 1006), and a request for a user identifier and a password is again made to the user.
If the user identifier at the time of login matches the password in step 1004, access permission is given to the user (step 1007). At this time, the user can activate and use various programs stored in the terminal.
Next, after the user has finished using the various programs, the user makes an access end request to the terminal, and the management terminal 105 receives a terminal use end request from the user (step 1008).
The log-in information record table 713 in the storage device 706 records the current time, the user identifier acquired in step 1002, “logout” indicating the use termination process, and a flag “SUCCESSED” indicating success. The process proceeds to step 1001 (step 1009).
[0033]
FIG. 11 is a flowchart showing the operation processing of the history data analysis program 710.
The history data analysis program 710 inputs an access point that wants to investigate that someone has accessed.
The first record of the access information record table 712 in the storage device 706 of the management terminal 105 is extracted and used as current access information (step 1101).
[0034]
First, it is checked whether the current access information in the access information record table 712 is included. If nothing is entered, the process ends. If it is not empty, the process proceeds to step 1103 (step 1102).
The first input access point is compared with the access point of the current access information, and if they are the same, the process proceeds to step 1105. If not, the process proceeds to step 1104 (step 1103).
The next record is taken out from the access information record table 712 in the storage device 706 of the management terminal 105, is set as current access information, and the process proceeds to step 1101 (step 1104).
The first record of the user information record table 711 in the external storage device 706 of the management terminal 105 is extracted and set as current user information (step 1105).
[0035]
Checks whether the current user information is empty. If empty, proceed to step 1104. If not empty, the process proceeds to step 1107 (step 1106).
The network addresses of the current user information and the current access information are compared, and if they are the same, the process proceeds to step 1109. If not, the process proceeds to step 1108 (step 1107).
The next record is extracted from the user information record table 711 and is set as current user information. Proceed to step 1106 (step 1108).
Next, it is checked whether the action of the current user information is “login”. If "login", the process proceeds to step 1110. Otherwise, the process proceeds to step 1108 (step 1109).
The times of the current user information and the current access information are compared. If the time of the current user information is older than the time of the current access information, the process proceeds to step 1111. If it is larger, the process proceeds to step 1114 (step 1110).
The next record is extracted from the user information record table 711 and is set as current user information (step 1111).
[0036]
The times of the current user information and the current access information are compared. If the time of the current user information is the same or newer than the time of the current access information, the process proceeds to step 1113. If smaller, the process proceeds to step 1108 (step 1112).
[0037]
The time of the current user information, the user ID, and the flag of the current access information are output. Proceed to step 1104 (step 1113).
It outputs the current user information time, network address, and current access information flag. Proceed to step 1108 (step 1114).
[0038]
FIG. 12 is a flowchart showing the processing operation of the history data collection program.
[0039]
It waits for reception from the history data transmission program 410 of the client terminal 103 and the history data transmission program 210 of the gateway terminal 104 (step 1201). The transmitted data is received (step 1202).
It is determined where the received data is transmitted from (step 1203). If the data is from the client terminal 103, the process proceeds to step 1204. If the data is from the gateway terminal 104, the process proceeds to step 1205.
[0040]
The data received in step 1202 is recorded in the user information record table 711 of the storage device 206. If information has already been recorded in the user information recording table 711, the received information is added. At this time, the identifier and the network address of the client terminal 103 of the transmission destination are also recorded together (step 1204), and the mode is switched to data reception.
The data received in step 1202 is recorded in the access information record table 712 of the storage device 206 of the management terminal 105. If information has already been recorded in the access information record table 712, the received information is added (step 1205), and the mode is switched to data reception.
[0041]
【The invention's effect】
As described above, according to the present invention, by specifying a specific access point, the user who has connected to the access point can be specified, and furthermore, information for user authentication does not flow on the internal network. However, even if an illegal act such as eavesdropping is performed, the authentication information of the user is not illegally acquired by a third party.
In addition, since user management is performed at the client terminal, user deletion and settings can be performed quickly. Once user authentication has been performed at the client terminal, access to the external network can be performed without newly performing user authentication. can do.
[0042]
Further, among the access information recorded in the access information recording table, the network address recorded in the access information whose time is not recorded in the user's usage record in the user information recording table is an unauthorized address in which the user information is not recorded. Since the client terminal can be found as a simple terminal, an unauthorized client terminal that is not registered can be easily found.
[Brief description of the drawings]
FIG. 1 is a system configuration diagram showing an embodiment of the present invention.
FIG. 2 is a system configuration diagram showing a configuration of a gateway terminal.
FIG. 3 is a configuration diagram showing a configuration of an access information recording table.
FIG. 4 is a system configuration diagram showing a configuration of a client terminal.
FIG. 5 is a configuration diagram showing a configuration of a user information registration table.
FIG. 6 is a configuration diagram showing a configuration of a login information recording table.
FIG. 7 is a system configuration diagram showing a configuration of a management terminal.
FIG. 8 is a configuration diagram showing a configuration of a user information recording table.
FIG. 9 is a flowchart illustrating the overall processing operation.
FIG. 10 is a flowchart illustrating the operation of a login program.
FIG. 11 is a flowchart illustrating the operation of a history data analysis program.
FIG. 12 is a flowchart illustrating the operation of a history data collection program.
[Description of sign]
101 internal network, 102 external network, 103 client terminal, 104 gateway terminal, 105 management terminal, 201, 401, 701 communication network interface, 202, 402, 702 display, 203, 403, 703 keyboard , 204, 404, 704 CPU, 205, 405, 705 memory, 206, 406, 706 storage device, 207, 407, 707 communication control program, 208 communication relay program, 209, 712 access information record table , 210, 410: history data transmission program, 408, 708: login program, 409: information browsing program, 411, 712: login information record table, 412: user information registration table, 709: history data collection program , 710 ... historical data analysis program 711 ... user information recording table, 713 ... login information recording table.

Claims (1)

An internal network composed of a plurality of interconnected communication terminals and a management terminal, and an external network composed of a plurality of interconnected communication terminals, wherein the internal network and the external network are gateway terminals. Connected, in a communication system in which the communication terminal of the external network responds to data in response to a request from the communication terminal of the internal network,
User history recording means for identifying a terminal user based on authentication information, identifying access permission, and recording user information such as a user identifier and a user's terminal usage time;
A client terminal having history data transmitting means for transmitting the recorded user information to the management terminal,
The information acquisition request sent from the internal network communication terminal is transferred to the requested external network communication terminal, the response from the external network communication terminal is transferred to the requesting internal network communication terminal, and the transferred internal Communication relay means for recording access information such as a communication terminal of the network and an information acquisition request;
A gateway terminal having history data transmission means for transmitting the recorded access information to the management terminal,
History data collection means on a management terminal that receives the user information and the access information from the communication terminal and the gateway terminal of the internal network,
A management terminal having history data analysis means for identifying a user corresponding to the user information and the access information collected by the history data collection means and an information acquisition request specified by a manager;
By specifying a specific information acquisition request at the management terminal, referring to the data from the user history recording unit and the history data collection unit, the user who issued the information acquisition request by the history data analysis unit and the client used by the user A network access verification system for identifying a terminal.

Images