JP3732672B2 - Network security rule management system and network security rule management device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network security rule management system and a network security rule management device for realizing security in a network.
[0002]
[Prior art]
Conventionally, security devices have been introduced in networks for the purpose of preventing information leakage and destruction. As this security device, a firewall device is known, and this firewall device is installed at a connection point of a network site in a network. Here, the network site is a group of computers such as server computers and client computers installed corresponding to the head office, each branch office, etc. in the company.
[0003]
The firewall device controls passage / non-passage of information to be transmitted according to characteristics such as whether a network site at a connection point to be installed is a head office or a branch office. In this case, it is necessary to set network security rule information (hereinafter referred to as rule information) for determining which information is to be passed or not passed.
[0004]
[Problems to be solved by the invention]
In the past, maintenance personnel or the like went to the installation location of the firewall device and set the rule information. For this reason, there has been a problem that appropriate rule information cannot be set due to an input error at the time of setting, or a long time is required for setting.
[0005]
The present invention has been made in view of the problems of the conventional network security as described above, and an object of the present invention is to make it possible to appropriately set rule information and reduce the time required for setting. To provide a security rule management system and a network security rule management device.
[0006]
[Means for Solving the Problems]
  A network security rule management system according to the present invention is provided in a network, and controls the passage / non-passage of information transmitted through the network, and passes or does not pass information to / from the security device. A network security rule management system comprising a network security rule management device that provides network security rule information for determining whether to perform security, and each of the security device and the network security rule management device includes all security A common rule information storage unit that stores common rule information common to the devices, and an individual rule information storage unit that stores individual rule information unique to each security device. Management device, in the case where the update, including a new creation of each rule informationThe rule information updated by the updateAn update rule information storage unit for storing;When storing update rule information in the update rule information storage unit, a memory table for storing storage information of common rule information, a memory table for storing storage information of individual rule information, and storage destination information in the memory table Is stored, the updated rule information is stored in the updated rule information storage unit, and the updated rule information is transferred to the security device. Deleting storage location informationAnd a transfer means. As a result, only the updated rule information is transferred and distributed, and no unnecessary distribution is performed.
[0007]
  The network security rule management device according to the present invention determines whether information is allowed to pass or not passed to a security device that is provided in a network and controls passage / non-passage of information transmitted through the network. A network security rule management device for providing network security rule information, wherein the network security rule management device is a common rule information storage unit for storing common rule information common to all security devices, and a security rule unique to each security device. When an individual rule information storage unit for storing individual rule information and an update including new creation of each rule informationThe rule information updated by the updateAn update rule information storage unit for storing;When storing update rule information in the update rule information storage unit, a memory table for storing storage information of common rule information, a memory table for storing storage information of individual rule information, and storage destination information in the memory table Is stored, the updated rule information is stored in the updated rule information storage unit, and the updated rule information is transferred to the security device. Deleting storage location informationAnd a transfer means. As a result, only the updated rule information is transferred and distributed, and no unnecessary distribution is performed.
[0008]
  In the network security rule management device,When the transfer means detects and transfers the updated rule information stored in the update rule information storage unit, the transfer means stores the rule information stored in the update rule information storage unit in the common rule information storage of its own device. Or the individual rule information storage unit.
[0011]
Further, in the network security rule management device, the network security rule management device is provided with a backup storage unit for storing the rule information transferred when each rule information is transferred, and the transfer means stores the transferred rule information in the above-described manner. The data is stored in a backup storage unit. As a result, the transferred rule information is backed up, and it is possible to prepare for the occurrence of a transfer failure or the like.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, a network security rule management system and a network security rule management device according to embodiments of the present invention will be described with reference to the accompanying drawings. In the drawings, the same components are denoted by the same reference numerals, and redundant description is omitted. FIG. 1 shows a network security rule management system and a network security rule management apparatus according to an embodiment of the present invention. In FIG. 1, an NSR management device (network security rule management device) 2 is connected to a network 1, and firewall devices 3-1 and 3-2, which are security devices, are connected.
[0013]
The NSR management device 2 includes a common rule information storage unit 4 that stores common rule information common to all firewall devices, and an individual rule information storage unit 5 that stores individual rule information unique to each firewall device. Yes. The firewall devices 3-1 and 3-2 also have common rule information storage units 6-1 and 6-2 that store common rule information common to all the firewall devices, and individual devices unique to the firewall device. Individual rule information storage units 7-1 and 7-2 for storing rule information are provided. The firewall devices 3-1 and 3-2 are set at connection points between the network 1 and the network sites 8-1 and 8-2 as described above, and the network 1 and the network sites 8-1 and 8-2 are connected. Controls pass / fail of information transmitted between them. For this control, the rule information stored in the common rule information storage units 6-1 and 6-2 and the individual rule information storage units 7-1 and 7-2 is used. The common rule information storage unit and the individual rule information storage unit do not necessarily need to be physically separated.
[0014]
The common rule information common to all firewall devices includes general rule information such as “Do not allow file transfer protocol (ftp) to pass”, “Allow packets for a specific common server”, and so on. The individual rule information unique to each includes the network information of the server computer group and the client computer group included in the network sites 8-1 and 8-2, or rule information such as outgoing or incoming call restrictions for a specific computer. .
[0015]
The NSR management device 2 includes an editing / storage unit 2a, a management information storage unit 2b, and a distribution unit 2c. The editing / storage means 2a edits the rule information and stores it as a file in the common rule information storage unit 4 and the individual rule information storage unit 5. The management information storage unit 2b is a table in which information such as the location of rule information (storage address, directory, etc.), the last update date / time of rule information, the last distribution date / time of rule information, and the like are stored. The distribution unit 2c extracts the rule information from the common rule information storage unit 4 and the individual rule information storage unit 5 when necessary, distributes the rule information to the firewall devices 3-1, 3-2, and the firewall devices 3-1, 3 -2 are transferred to the common rule information storage units 6-1 and 6-2 and the individual rule information storage units 7-1 and 7-2.
[0016]
The NSR management device 2 including the common rule information storage unit 4 and the individual rule information storage unit 5 is not necessarily required to include all components, but is configured as shown in FIG. 2, for example. That is, the CPU 10 is configured to control each unit and process data using the program and data stored in the main memory 11.
[0017]
A keyboard control unit 13, display control unit 14, mouse control unit 15, printer control unit 16, magnetic disk control unit 17, and communication interface 18 are connected to the CPU 10 via the bus 12. A keyboard input device 19 is connected to the keyboard control unit 13, and an operator of each node can input information using the keyboard input device 19. For example, a CRT display device 20 having a CRT is connected to the display control unit 14 so that necessary information is displayed. A mouse 21 which is a pointing device is connected to the mouse control unit 15 so that position information can be input when necessary.
[0018]
A printer device 22 is connected to the printer control unit 16 so that information can be printed out. A magnetic disk device 23 is connected to the magnetic disk controller 17, and programs and data are stored in the magnetic disk device 23, and are read / written by the CPU 10 as necessary. A communication processing unit 24 is connected to the communication interface 18 so that data is transmitted to and received from the network 1.
[0019]
The management information storage unit 2b shown in FIG. 1 is provided as a memory table in the main memory 11, for example, and the common rule information storage unit 4 and the individual rule information storage unit 5 correspond to the magnetic disk device 23. The editing / storage means 2a and distribution means 2c shown in FIG. 1 are realized by the CPU 10 executing a program in the main memory 11. The firewall devices 3-1 and 3-2 do not have the printer device 22, the keyboard input device 19, the CRT display device 20, the mouse 21, and their control units in the configuration of FIG. And a configuration for performing control related to passage / non-passage of information transmitted through the network.
[0020]
The management information storage unit 2b shown in FIG. 1 includes memory tables M1 and M2 as shown in FIG. The memory table M1 is a table in which the location (path name) of a file of common rule information (common rule file) is stored, and the memory table M2 is a file of individual rule information for each of the firewall devices 3-1, 3-2. It is a table in which the location (path name) of (individual rule file) is stored. Here, the security system names of the firewall devices 3-1 and 3-2 are security system A and security system B, respectively.
[0021]
In the system configured as described above, the CPU 10 executes the program as shown in FIG. 4 stored in the main memory 11 as described above, so that the editing / storage unit 2a and the distribution unit 2c This will be explained below. The CPU 10 monitors whether a common rule file update instruction has been input (S1). The update instruction is input using, for example, the keyboard input device 19.
[0022]
When an update instruction is input in the above, the common rule file is read from the common rule information storage unit 4 onto the main memory 11 with reference to the information in the memory table M1 (S2). Of course, the common rule information is not included in the common rule file at first. Then, the operator accepts that the common rule file is edited (including new creation) by using the keyboard input device 19 (S3). When the editing is completed, the resulting file is stored in the original location of the common rule information storage unit 4. (S4).
[0023]
Further, the CPU 10 monitors whether or not an individual rule file update instruction has been input (S5). When an update instruction is input here, the location of the specified individual rule file is obtained by referring to the information in the memory table M2, and the corresponding individual rule file is transferred from the individual rule information storage unit 5 to the main memory 11. Read (S6). Of course, individual rule information is not included in the individual rule file at first. Then, the operator accepts that the individual rule file is edited (including newly created) by using the keyboard input device 19 (S7), and when editing is completed, the resulting file is stored in the original location of the individual rule information storage unit 5. (S8).
[0024]
Further, the CPU 10 monitors whether a rule file distribution instruction has been input (S9). This instruction is performed, for example, directly using the keyboard input device 19 or indirectly by setting a timer. When a file distribution instruction is input here, the location of the file is obtained by referring to the corresponding information in the memory table M1 and the memory table M2, and the file is transmitted to the corresponding device of the firewall devices 3-1, 3-2. (S10).
[0025]
When the common rule file is distributed, the firewall devices 3-1 and 3-2 store the common rule file in the common rule information storage units 6-1 and 6-2, and when the individual rule file is distributed, It memorize | stores in the separate rule information storage part 7-1 and 7-2 to memorize | store.
[0026]
Since the common rule information and the individual rule information are managed separately as described above, it is only necessary to input the common rule information in the NSR management device 2, and the input work that has been conventionally performed for each firewall device is reduced. Input errors can be reduced. Further, since the common rule information and the individual rule information are managed separately, it is possible to edit the necessary rule information and it is efficient.
[0027]
Next, a first modification of the system and apparatus shown in FIG. 1 will be described. In this modification, the management information storage unit 2b-1 shown in FIG. 5 is provided instead of the management information storage unit 2b provided in the NSR management apparatus 2, and the management information storage unit 2b-1 includes the management information storage unit 2b-1 shown in FIG. As shown, memory tables M1-1, M2-1, M3-1 are included. The memory table M1-1 is a table that stores the location (path name) of the common rule information file (common rule file) and the last update date and time of the common rule file. The memory table M2-1 includes each firewall This table stores the location (path name) of individual rule information files (individual rule files) for the devices 3-1 and 3-2 together with the last update date and time of each individual rule file. Further, the memory table M3-1 is a table in which the last distribution date and time when the file was distributed is stored.
[0028]
In this system, as in the system shown in FIG. 1, the CPU 10 executes a program corresponding to the flowchart shown in FIG. At this time, in the update including the new creation of the rule file, the last update date and time is stored in the corresponding column of the memory table M1-1 and the memory table M2-1. And the distribution in steps S9 and S10WhenInstead of the processing, the CPU 10 executes a program corresponding to the flowchart shown in FIG.
[0029]
The CPU 10 compares the last update date and time stored in the memory table M1-1 related to the common rule file with the final distribution date and time stored in the memory table M3-1 (S11), and the last update date and time is later than the last distribution date and time. It is detected whether it exists (S12). Here, if it is detected that the last update date and time is later than the last distribution date and time, the updated file is not distributed, so the common rule file is taken out from the common rule information storage unit 4 and the firewall apparatus 3 -1, 3-2 (S13). Next, the number N of the individual rule file (N = 1 is a file corresponding to the firewall device 3-1, and N = 2 is a file corresponding to the firewall device 3-2) is set to “1” (S14). The last update date and time stored in the memory table M2-1 related to the N (= 1) individual rule file is compared with the last distribution date and time stored in the memory table M3-1 (S15), and the last update date and time is final. Whether it is later than the distribution date is detected (S16).
[0030]
Here, if it is detected that the last update date and time is later than the last distribution date and time, the updated file is not distributed, so the individual rule information storage unit 5 and the individual corresponding to the firewall device 3-1. The rule file is taken out and transmitted to the firewall device 3-1 (S17). Next, N is incremented by “1”, the number N of the individual rule file is set to “2” (S18), and it is detected whether the N (= 2) individual rule file exists (S19). Since it exists here, the last update date and time stored in the memory table M2-1 for the N (= 2) individual rule files is compared with the last distribution date and time stored in the memory table M3-1 (S15), and the final It is detected whether the update date is after the last distribution date (S16).
[0031]
Here, if it is detected that the last update date and time is later than the last distribution date and time, the updated file is not distributed, so the individual rule information storage unit 5 and the individual corresponding to the firewall device 3-2. The rule file is taken out and transmitted to the firewall device 3-2 (S17). Next, N is incremented by “1”, the number N of the individual rule file is set to “3” (S18), and it is detected whether or not the N (= 3) individual rule file exists (S19). Here, since the firewall device 3-3 does not exist and the corresponding individual rule file does not exist, the final distribution date and time of the memory table M3-1 is updated according to the current date and time (S20), and the process is terminated.
[0032]
According to the first modification, only the updated rule information file is distributed, so that data transfer without waste can be performed. In this modification, one file has the last distribution date and time in common, but the distribution management may be performed by giving the file the last distribution date and time corresponding to the file.
[0033]
Next, a second modification of the system and apparatus shown in FIG. 1 will be described. As shown in FIG. 8, the NSR management device 2 of this modification includes an update rule information storage unit 9 that stores information when each rule information is updated. The update rule information storage unit 9 does not need to be physically separated from other storage units. Further, in the system according to this modified example, the management information storage unit 2b-2 shown in FIG. 6 is provided instead of the management information storage unit 2b provided in the NSR management apparatus 2, and the management information storage unit 2b-2 includes the management information storage unit 2b-2. As shown in FIG. 6, memory tables M1-2 and M2-2 are included.
[0034]
The memory table M1-2 includes the location (path name) of the common rule information file (common rule file) and the storage location of the updated common rule file (for example, the directory in the updated rule information storage unit 9). The memory table M2-2 is a stored table, and the individual rule file is stored together with the location (path name) of the individual rule information file (individual rule file) for each firewall device 3-1, 3-2. This is a table in which storage locations of updated files (for example, directories in the update rule information storage unit 9) are stored.
[0035]
  In this system, as in the system shown in FIG. 1, the CPU 10 executes a program corresponding to the flowchart shown in FIG. At this time, the storage location in the update rule information storage unit 9 is stored in the corresponding fields of the memory table M1-2 and the memory table M2-2 at the time of updating including the creation of a new rule file. And in steps S9 and S10Instead of processing at the time of distributionThe CPU 10 executes a program corresponding to the flowchart shown in FIG.
[0036]
The CPU 10 detects whether the storage destination is stored in the memory table M1-2 regarding the common rule file (S21), and determines whether the storage destination is stored (S22). Here, when the storage destination is stored, the common rule file related to the update is extracted from the update rule information storage unit 9 based on the storage destination, and the file is transmitted to the firewall devices 3-1 and 3-2. The common rule file related to the update is stored in the common rule information storage unit 4, and the storage location stored in the memory table M1-2 is deleted (S23). Next, the number N of the individual rule file (N = 1 is a file corresponding to the firewall device 3-1, and N = 2 is a file corresponding to the firewall device 3-2) is set to “1” (S14). It is detected whether the storage destination is stored in the memory table M2-2 regarding the N (= 1) individual rule file (S25), and it is determined whether the storage destination information is stored (S26).
[0037]
Here, when it is detected that the storage location is stored, the relevant individual rule file related to the update is extracted from the update rule information storage unit 9 based on the storage location, and the file is transmitted to the firewall device 3-1, The individual rule file related to the update is stored in the individual rule information storage unit 5, and the storage location stored in the memory table M2-2 is deleted (S27). Next, N is incremented by “1”, the number N of the individual rule file is set to “2” (S28), and it is detected whether the individual rule file of the N (= 2) exists (S29). Since it exists here, it is detected whether the storage destination is stored in the memory table M2-2 regarding the N (= 2) individual rule files (S25), and it is determined whether the storage destination is stored (S26).
[0038]
Here, when it is detected that the storage destination is stored, the corresponding individual rule file related to the update is taken out from the update rule information storage unit 9 based on the storage destination, and the file is transmitted to the firewall device 3-2. The individual rule file related to the update is stored in the individual rule information storage unit 5, and the storage location stored in the memory table M2-2 is deleted (S27). Next, N is incremented by “1”, the number N of the individual rule file is set to “3” (S28), and it is detected whether or not the N (= 3) individual rule file exists (S29). Here, the firewall apparatus 3-3 does not exist, and the corresponding individual rule file does not exist, so the processing ends. As described above, according to the second modification, when the rule information file is updated, the storage location is stored, and by detecting this and distributing the file, only the file is distributed. Data transfer without waste can be performed.
[0039]
Next, a third modification of the system and apparatus shown in FIG. 1 will be described. As shown in FIG. 8, the NSR management device 2 of this modification is the same as the second modification in that it includes an update rule information storage unit 9 that stores information when each rule information is updated. It has a configuration. The update rule information storage unit 9 does not need to be physically separated from other storage units. Further, in the system according to this modification, the management information storage unit 2b-3 shown in FIG. 10 is provided instead of the management information storage unit 2b provided in the NSR management apparatus 2, and the management information storage unit 2b-3 includes the management information storage unit 2b-3. As shown in FIG. 10, memory tables M1-3, M2-3, and M3-3 are included.
[0040]
The memory table M1-3 includes the location (path name) of the common rule information file (common rule file), the last update date and time of the common rule file, and the storage location of the updated file of the common rule file (for example, update The directory in the rule information storage unit 9 is stored, and the memory table M2-3 is the location (path) of the individual rule information file (individual rule file) for each firewall device 3-1, 3-2. This is a table in which the last update date and time of each individual rule file and the storage location of the updated file of each individual rule file (for example, a directory in the update rule information storage unit 9) are stored. Furthermore, the memory table M3-3 is a table in which the last distribution date and time when the file was distributed is stored.
[0041]
In this system, as in the system shown in FIG. 1, the CPU 10 executes a program corresponding to the flowchart shown in FIG. At this time, in the update process including the new creation of the rule file, the last update date and the storage location in the update rule information storage unit 9 are stored in the corresponding columns of the memory table M1-3 and the memory table M2-3. And at the time of distribution in steps S9 and S10ProcessingInstead of the flow chart shown in FIG.
CPU 10 executes a program corresponding to the route.
[0042]
The CPU 10 compares the last update date and time stored in the memory table M1-3 regarding the common rule file with the final distribution date and time stored in the memory table M3-3 (S11), and the last update date and time is later than the last distribution date and time. It is detected whether it exists (S12). Here, if it is detected that the last update date and time is later than the last distribution date and time, the updated file is not distributed, so the common rule file is updated from the update rule information storage unit 9 based on the update file name. Retrieving and transmitting the file to the firewall devices 3-1 and 3-2, storing the common rule file related to the update in the common rule information storage unit 4, and deleting the storage location stored in the memory table M 1-3 (S23). Next, the number N of the individual rule file (N = 1 is a file corresponding to the firewall device 3-1, and N = 2 is a file corresponding to the firewall device 3-2) is set to “1” (S14). The last update date and time stored in the memory table M2-3 related to the N (= 1) individual rule file is compared with the final distribution date and time stored in the memory table M3-3 (S15), and the last update date and time is the last. Whether it is later than the distribution date is detected (S16).
[0043]
Here, if it is detected that the last update date / time is later than the last distribution date / time, the updated file is not distributed, so that the firewall device 3 is updated from the update rule information storage unit 9 based on the update file name. 1 is extracted, the file is transmitted to the firewall device 3-1, and the individual rule file related to the update is stored in the individual rule information storage unit 5 and stored in the memory table M2-3. The destination is deleted (S27). Next, N is incremented by “1”, the number N of the individual rule file is set to “2” (S18), and it is detected whether the N (= 2) individual rule file exists (S19). Since it exists here, the last update date and time stored in the memory table M2-3 for the N (= 2) individual rule files is compared with the last distribution date and time stored in the memory table M3-3 (S15), and the final It is detected whether the update date is after the last distribution date (S16).
[0044]
Here, if it is detected that the last update date / time is later than the last distribution date / time, the updated file is not distributed, so that the firewall device 3 is updated from the update rule information storage unit 9 based on the update file name. 2 is extracted, the file is transmitted to the firewall device 3-2, and the individual rule file related to the update is stored in the individual rule information storage unit 5, and stored in the memory table M2-3. The destination is deleted (S27).
[0045]
Next, N is incremented by “1”, the number N of the individual rule file is set to “3” (S18), and it is detected whether or not the N (= 3) individual rule file exists (S19). Here, since the firewall device 3-3 does not exist and the corresponding individual rule file does not exist, the final distribution date and time of the memory table M3-3 is updated according to the current date and time (S20), and the process is terminated.
[0046]
According to the third modification, only the updated rule information file is distributed, so that data transfer without waste can be performed. In this modification, one file has the last distribution date and time in common, but the distribution management may be performed by giving the file the last distribution date and time corresponding to the file.
[0047]
Next, a fourth modification of the system and apparatus shown in FIG. 1 will be described. In addition to the configuration shown in FIG. 8, the NSR management device 2 of this modification includes a backup storage unit 9A that stores a backup file when each rule information is distributed, as shown in FIG. . In addition, the system according to this modification includes management information storage means 2b-4 shown in FIG. 11 instead of the management information storage means 2b-3 shown in FIG. The means 2b-3 includes memory tables M1-3, M2-3, and M3-4 as shown in FIG. The stored contents in the memory tables M1-3 and M2-3 are equal to the third modification. The memory table M3-4 stores the file name of the backup file together with the final distribution date and time when the file was distributed. The file name of the backup file is based on the nature of the backup file created each time it is distributed, such as the serial number, date, common rule file, and individual rule file.WithIt is set as additional information (the one shown in FIG. 11 is given a serial number).
[0048]
In this modified example, the operation corresponding to the flowchart shown in FIG. 14 which is substantially the same as the third modified example is basically executed. However, the third modification is different from the flowchart of FIG. 13 in that the backup file is stored in the backup storage unit 9A in step S23A and step S27A, and the file is distributed in the memory table M3-4. The file name of the backup file is stored together with the final distribution date and time.
[0049]
According to the fourth modification, since a backup of the file related to distribution is created, if distribution is not properly executed, it corresponds based on the file name of the memory table M3-4 and its additional information Searching for a file, taking it out from the backup storage unit 9A, distributing it again, etc., enables processing after the passage of time. Note that the configuration of the modified example relating to backup can also be applied to the second modified example. Further, in each example including the embodiment shown in FIG. 1, the number of firewall devices is two, but it goes without saying that it can be three or more according to the system configuration.
[0050]
【The invention's effect】
  As described above, according to the network security rule management system and the network security rule management apparatus according to the present invention, rule information is divided into common rule information and individual rule information and distributed by creation, editing, and transfer. Therefore, it is not necessary to go to the place where each individual security device is installed, the rule information can be set appropriately, and the time required for setting can be shortened.When the rule information file is updated, by detecting this and distributing the file, only the file is distributed, so that data transfer without waste can be performed.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of a network security rule management system and apparatus according to an embodiment of the present invention.
FIG. 2 is a block diagram of the network security rule management apparatus according to the embodiment of the present invention.
FIG. 3 is a diagram showing the contents of management information storage means employed in the network security rule management system and the apparatus according to the embodiment of the present invention.
FIG. 4 is a flowchart showing the operation of the network security rule management system and apparatus according to the embodiment of the present invention.
FIG. 5 is a view showing the contents of management information storage means employed in the first modification of the network security rule management system and the device according to the embodiment of the present invention;
FIG. 6 is a view showing the contents of management information storage means employed in the second modification of the network security rule management system and apparatus according to the embodiment of the present invention.
FIG. 7 is a flowchart showing the operation of the first modification of the network security rule management system and apparatus according to the embodiment of the present invention;
FIG. 8 is a configuration diagram of a second modification of the network security rule management system and the device according to the embodiment of the invention.
FIG. 9 is a flowchart showing the operation of the second modification of the network security rule management system and apparatus according to the embodiment of the present invention.
FIG. 10 is a view showing the contents of management information storage means employed in a third modification of the network security rule management system and apparatus according to the embodiment of the present invention.
FIG. 11 is a diagram showing the contents of management information storage means employed in the fourth modification of the network security rule management system and apparatus according to the embodiment of the present invention.
FIG. 12 is a flowchart showing the operation of the third modification example of the network security rule management system and the device according to the embodiment of the present invention;
FIG. 13 is a configuration diagram of a fourth modification example of the network security rule management system and the device according to the embodiment of the invention.
FIG. 14 is a flowchart showing the operation of the fourth modification example of the network security rule management system and device according to the embodiment of the present invention;
[Explanation of symbols]
1 network
2 NSR management device
3-1, 3-2 Firewall device
4, 6-1, 6-2 common rule information storage unit
5, 7-, 7-2 Individual rule information storage unit
8-1, 8-2 Network site
9 Update rule information storage
9A Backup storage unit
2a Editing / storage means
2b, 2b-1-4 Management information storage means
2c Distribution means

Claims (4)

A security device that is provided in a network and controls passage / non-passage of information transmitted through the network, and network security rule information for determining whether information is allowed to pass or not pass through the security device A network security rule management system comprising a network security rule management device for providing
The security device and the network security rule management device each include a common rule information storage unit that stores common rule information common to all security devices, and an individual rule that stores individual rule information unique to each security device. And an information storage unit,
The network security rule management device includes:
An update rule information storage unit that stores rule information updated by the update when the update includes new creation of each rule information;
When storing update rule information in the update rule information storage unit, a memory table that stores storage destination information of common rule information and a memory table that stores storage destination information of individual rule information;
When storage location information is stored in the memory table, it is detected that updated rule information is stored in the updated rule information storage unit, and the updated rule information is transferred to the security device, A network security rule management system comprising: transfer means for deleting storage location information of the memory table after the transfer. Network security rule management that provides network security rule information for deciding whether to pass or not pass information to a security device that is provided in the network and that controls passage / non-passage of information transmitted through the network A device,
The network security rule management device includes:
A common rule information storage unit for storing common rule information common to all security devices;
An individual rule information storage unit for storing individual rule information unique to each security device;
An update rule information storage unit that stores rule information updated by the update when the update includes new creation of each rule information;
When storing update rule information in the update rule information storage unit, a memory table that stores storage destination information of common rule information and a memory table that stores storage destination information of individual rule information;
When storage location information is stored in the memory table, it is detected that updated rule information is stored in the updated rule information storage unit, and the updated rule information is transferred to the security device, A network security rule management device comprising: transfer means for deleting storage location information of the memory table after the transfer.   When the transfer means detects and transfers that the updated rule information is stored in the update rule information storage unit, the transfer means stores the rule information stored in the update rule information storage unit in the common rule of the own device. The network security rule management device according to claim 2, wherein the network security rule management device is stored in an information storage unit or an individual rule information storage unit. Network security rule management device includes
A backup storage unit is provided for storing the transferred rule information when each rule information is transferred,
3. The network security rule management apparatus according to claim 2, wherein the transfer unit stores the transferred rule information in the backup storage unit .

Images