JP3806915B2 - Network system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network system in which a large number of terminals such as personal computers are connected to a network, and in particular, an access evaluation / control unit that sets and evaluates an access matrix in a form separated from the terminal is provided. The present invention relates to a network system that can solve the problems of falsification and information leakage.
[0002]
[Prior art]
In recent years, wide-area networks such as the Internet have been established, and data transmission using them has become common, and image-related communications such as FAX communication can also be performed actively via the Internet. ing.
[0003]
[Problems to be solved by the invention]
However, in the above network, when two or more independent and secure systems are connected, assets of other systems may propagate, and the systems may not necessarily be secure from each other. That is, as a security problem from the viewpoint of information flow, there is a cover channel problem described below.
The covered channel is a problem that causes information leakage or information falsification due to an indirect information flow. FIG. 4 shows a conceptual diagram of the covered channel problem in a digital signature. In FIG. 4, A is a subject who signs a message, and the signature text is verified (approved) by the subject C. At this time, due to the security condition of the digital signature, (1) the signature text cannot be forged by a third party,
(2) The signature cannot be forged by the recipient,
Is satisfied.
Here, as shown in FIG. 4, subject A is writing a paper, subject B and subject A are in a competitive relationship, and subject A wants to claim its intellectual property right to subject B. Suppose subject C is reviewing a paper written by subject A, and subjects C and B are in a very friendly relationship. In this case, the security (1) and (2) of the digital signature is established between the subjects A and C as described above. However, the subject C removes the signature from the subject A's paper, cuts out the content of the paper, and copies it. If it is sent to B as a separate file, A's intellectual property (paper) is sent to B without permission. As described above, the problem of data tampering with the covered channel cannot be prevented even with a digital signature.
[0004]
Next, the problem of the covered channel will be described using another example.
The access matrix shown in FIG. 5 is a matrix in which an object is a row, a subject is a column, and matrix elements are R and W (R is read and W is write). When there is an object Oi that is prohibited from being read by the user Sd and another object Ok that can be read by the user Sd, if there is a path toward the object Ok, this path causes the confidentiality of the object to be lost. Indirect route.
For example, a company employee Sx belongs to the personnel department, Sd belongs to the technical department, Oi is a collection of data files that are not sent from the department of Sx to other departments, such as a personnel examination file, and Ok is Sk and Sd. Assume that it is a collection of email files between each of the departments. In FIG. 5, Sd cannot read the object Oi of the personnel department (-R). However, if the employee Sx collaborates with Sd and reads an arbitrary data file in the object Oi, it becomes an e-mail object Ok. If it is written, Sd can indirectly obtain an arbitrary data file in the object Oi of the personnel department by reading the object Ok of the e-mail.
That is, in the description in the access matrix, Oi row Sd column is -R, that is, Sd does not permit the object Oi to be read, but the access control mechanism does not discriminate the object Oi from the object Ok. Oi can be read indirectly, causing inconsistencies. Such an information flow path is a covered channel.
[0005]
If the above-described series of information flows is represented by a graph with nodes at Oi, Ok, Sx, and Sd, it is shown as in FIG. A covered channel is obtained by such a graph expression. That is, in FIG. 6, the information flow is Oi → Sx → Ok → Sd, which is one direction. Nevertheless, an indirect information leak occurs because there is a condition that the user Sd does not permit the object Oi to be read. Regarding the method of obtaining a covered channel, reference documents (Tetsuya MORIZUMI, Hiroshi NAGASE, Toyofumi TAKENAKA, Kouichi YAMASHITA: “An Evaluation of Security EquitiesB. 8, AUG., 1991).
FIG. 7 shows a conventional access control mechanism. In FIG. 7, the terminal A has an access control unit 1, a CPU 3, and another functional unit (other) 5. The access control unit 1 includes an access matrix, a covered channel detection function based on the access matrix, and an access. A matrix change support function and an information flow control function are incorporated. And the access control part 1 is implemented with the form included by the terminal function.
The CPU 3 in FIG. 7 controls terminal control, control of the access control unit 1, and other functional units (screen control and the like) 5 indicated as other. Coverage channel evaluation is not possible with just one terminal. Multiple users make access matrix requests, for example, the center collects them and creates an access matrix for all users, and then covers it. Channel detection is performed, and the access matrix is corrected based on the detected covered channel to prevent information leakage due to the covered channel.
[0006]
Now, since the access control unit 1 is generally configured by software, if the access control unit 1 of the terminal A is copied and pasted to another terminal X as shown in FIG. Can be created, or the access matrix written in the access control unit 1 can be changed. Therefore, the conventional apparatus has a problem that the “mechanism for detecting and preventing the covered channel” can be easily broken. That is, in the example of the access matrix shown in FIG. 5, for example, even if the employee Sd prevents the object Ok from being read and prevents the cover channel, the access control unit of the employee Sx terminal is copied and the employee Sd's terminal is copied. If pasted on the terminal, the employee Sd can read the object Oi, and if the employee Sd can read the object Oi by changing the access matrix of his terminal, the employee Sd can read the object Oi. You can lead.
In addition, it is a big problem that there is no guarantee that the access control unit of each of a plurality of terminals connected to the network is not falsified and operates safely. This becomes an increasingly serious problem as the network, such as the Internet, becomes more global.
The present invention was made to eliminate the above-mentioned conventional drawbacks, and by providing an access evaluation / control unit for setting and evaluating an access matrix in a form separated from the terminal, the access control unit is altered. An object of the present invention is to provide a network system that can solve the problem of information leakage.
[0007]
[Means for Solving the Problems]
In order to achieve the above object, the present invention provides a network system in which information is communicated via a network by a number of terminals, and an access matrix that defines an access path of each terminal in a form separated from each terminal. An access evaluation / control unit connected between each of the terminals and the network, and the access evaluation / control unit includes a plurality of access evaluations connected to the network when the access right is changed. / The control unit collects the access matrix with each other, detects the covered channel, and if the access right needs to be changed, notifies the user of the change and changes it.
Another feature of the present invention is that the access evaluation / control unit further verifies a covered channel of the modified access matrix and matches all of the plurality of access evaluation / control units connected to the network for the determined access matrix. By confirming the above, it is possible to obtain a guarantee that the network operates safely.
[0008]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described based on illustrated embodiments. FIG. 1 is a schematic configuration diagram of an embodiment of a network system according to the present invention.
As shown in FIG. 1, this network system has a number of access evaluation / control units 9 connected to a network 7 and a terminal 11 connected to each of the access evaluation / control units 9.
In other words, the greatest feature of this network system is that it is possible to solve the problem of information leakage caused by falsification of the access control unit by providing an access evaluation / control unit that sets and evaluates the access matrix in a form separated from the terminal. It is. As shown in FIG. 2, each access evaluation / control unit 9 includes an access control unit 13, a personal identification unit 15, and a CPU 17, and the access evaluation / control unit 9 and the terminal 11 (A). , A transmission / reception signal to the network, an access matrix change request, and an access matrix display signal are exchanged. The personal identification unit is configured to identify individuals at power-on and at regular intervals, learns the secular change of personal information, and increases the personal identification rate. Here, the voice identification, fingerprint, etc. which are conventionally used can be applied to the personal identification function.
The access control unit 13 incorporates an access matrix, a covered channel detection function based on the access matrix, an access matrix change support function, and an information flow control function.
The CPU unit 17 is configured to control the access control unit 13 and the personal identification unit 15.
The user registration is performed by the access evaluation / control unit 9 using personal information, and all access evaluation / control units 9 connected to the network 7 are shared via the network 7.
Further, the access evaluation / control unit 9 has a structure that is difficult to enter into the hardware. As this structure, a generally used sealed structure or a conventional method such as program encryption can be applied.
[0009]
Next, an access matrix evaluation method by the access evaluation / control unit 9 in the network system will be described with reference to an operation flowchart of FIG.
By evaluating this access matrix, it is possible to guarantee a safe operation in the network.
First, in step 101 of FIG. 3, when an access right is changed, a plurality of access evaluation / control units 9 connected to the network 7 collect access matrices from each other, and the access evaluation / control units 9 cover each other. A channel is detected (step 103). Next, in step 104, it is determined whether or not the access right needs to be changed. Next, in step 105, each access evaluation / control unit 9 notifies the user when the access right needs to be changed, and the access right is changed. In step 107, each access evaluation / control. Part 9 verifies the covered channel of the modified access matrix.
Next, in step 109, the access evaluation / control unit 3 determines an access matrix, and confirms that all the access evaluation / control units 9 connected to the network 7 match. This confirmation method uses a conventional method such as majority voting.
Next, in step 111, it is determined whether or not a further access right change is presented by the user. If the access right change is not presented by the user, in step 113, the information flow is determined based on the access matrix. Is limited.
If the change of the access right is presented by the user in step 111, the process returns to step 101.
As described above, the access evaluation / control unit 9 has an access matrix evaluated in common via the network 7, and the access evaluation / control unit 9 is different from the terminal 11 on the user side in terms of access evaluation / control functions. Therefore, the access control unit is not falsified and a guarantee of safe operation can be obtained.
[0010]
【The invention's effect】
Since the present invention is configured as described above, it is possible to prevent unauthorized information leakage due to the dummy of the access evaluation / control unit and to ensure that the network operates safely.
[Brief description of the drawings]
FIG. 1 is a schematic configuration diagram of an embodiment of a network system according to the present invention.
FIG. 2 is a diagram illustrating an internal configuration of an access evaluation / control unit illustrated in FIG. 1;
FIG. 3 is a flowchart of an access matrix evaluation method in the network system shown in FIG. 1;
FIG. 4 is a conceptual diagram of a covered channel problem in a network.
FIG. 5 is a diagram illustrating an example of an access matrix and an object for illustrating a covered channel problem in a network.
6 is a diagram showing an information flow in which the confidentiality of an object cannot be maintained in the access matrix shown in FIG.
FIG. 7 is a conceptual diagram illustrating an access control mechanism in a conventional terminal.
FIG. 8 is an explanatory diagram showing a drawback of an access control mechanism in a conventional terminal.
[Explanation of symbols]
1, 13 ... access control unit, 3, 17 ... CPU,
5 ... Other functional parts, 7 ... Network,
9 ... Access evaluation / control unit, 11 ... Terminal,
15 ... personal identification part,

Claims (2)

A network system for communicating information via a network by a large number of terminals, wherein each terminal and the network are used to set and evaluate an access matrix that defines an access path of each terminal in a form separated from each terminal. And an access evaluation / control unit connected between
In the access evaluation / control unit, when an access right is changed, a plurality of access evaluation / control units connected to the network collect access matrices from each other, detect a covered channel, and if the access right needs to be changed, A network system characterized by changing the information.   The access evaluation / control unit further verifies the covered channel of the modified access matrix and confirms the match of all the plurality of access evaluation / control units connected to the network for the determined access matrix. The network system according to claim 1, wherein a guarantee to operate is obtained.

Images