JP4125690B2 - Security vulnerability enhancement system and method - Google Patents

Description

  The present invention relates to a security vulnerability strengthening system and method for strengthening the security vulnerability of a terminal connected to the Internet via a local area network (LAN).

  Conventionally, security measures for each terminal are largely based on the user's security awareness, and when security awareness is low, no measures have been taken to reinforce security vulnerabilities. Therefore, when connecting to the Internet without taking security measures, damages such as computer virus infection and illegal acts by third parties aiming at security vulnerabilities occurred frequently.

  Specifically, when connecting to the Internet via a local area network (LAN) as shown in FIG. 1, in order to maintain a certain level of security, measures to prevent computer virus infection and security vulnerabilities Measures such as measures to resolve it are necessary. If you are connected to a network and infected with a computer virus without taking the above measures, not only will the terminal connected to the network be damaged, but it will also infect other terminals on the LAN. To do. Therefore, in order to maintain a certain level of security, each terminal needs to take security measures. Normally, information on security measures is communicated from the administrator of the LAN to the user of each terminal, and the user of each terminal executes security measures based on the information.

  In Patent Document 1, the user of the client device does not individually take anti-virus measures, but the management system automatically executes anti-virus measures for all the client devices to be managed on the network almost simultaneously. We are proposing a system and program for detecting and deleting viruses on the network that can be implemented without depending on policy, awareness, skills, etc.

Patent Document 2 discloses a security level that can quickly provide security information that can be understood even by a person who does not have sufficient knowledge about security, such as a manager, reflecting work taken by a system administrator. An information providing method and system are proposed.
JP 2002-222094 A Japanese Patent Laid-Open No. 2003-216577

  However, the above-described invention has the following problems.

  For example, if the user of the device is not aware of the security measures, the security measures will be implemented even if the administrator notifies the device users of the security measures information related to preventing new computer viruses. There is a problem that it is infected with a computer virus because it is connected to the Internet before doing.

  In the invention described in Patent Document 1, each time a computer virus is detected, regardless of whether there is a request for connection to the network from the user of the terminal, information regarding computer virus countermeasures is automatically sent to each client terminal from the server. Since it is transmitted, there is a problem that the burden on the network increases.

  The invention described in Patent Document 2 is effective when measures against computer viruses are executed based on information on security measures from the vulnerability monitoring system when the terminal user is highly aware of security. However, if the terminal user connects to the Internet before taking measures against a computer virus, the user will be infected with a computer virus.

  In the present invention, when the terminal user connects to the Internet, the terminal management system (FIG. 2) that manages the terminal connected to the Internet via the LAN is used to manage the implementation status of the security countermeasure measures by the user. At the same time, it is intended to prevent the terminal on the same LAN from being infected with a computer virus by controlling whether or not connection to the Internet is possible.

The invention described in claim 1 is a security vulnerability strengthening system in which a client terminal and a server connected to the Internet are connected via a network. The client terminal requests the server to connect to the Internet. a request unit, wherein the server, upon receiving a request for a connection from the client terminal to the Internet, a determination unit configured security measures related to prevention of infection computer virus the client terminal determines whether the run, Rejecting means for rejecting connection to the Internet when the client terminal is not executing the security measure, and permission for permitting connection to the Internet when the client terminal is executing the security measure and means, the cough An action database storing a security measure, an ID for specifying the security measure, and a predetermined condition for permitting connection to the Internet, a terminal identifier for identifying the client terminal, and each client that has executed the security measure possess a management number database which stores in association with a management number to be delivered to the terminal, wherein the server, when a new security is registered in the treatment database, it is necessary to perform the additional security measures And when the client terminal receives the notification and executes the new security measure, the new security measure ID, the terminal identifier, and the execution result of the new security measure Japanese to be sent to the server device To.

According to a second aspect of the invention, the enhancement system of security vulnerabilities of claim 1, wherein the server determines whether the execution result satisfies the predetermined condition that corresponds to the treatment numbers of the new security measures Determining, when the execution result does not satisfy the predetermined condition, notifying the client terminal that the predetermined condition is not satisfied, prohibiting connection to the Internet from the client terminal, and When the predetermined condition is satisfied, the management number in the management number database is updated, and the updated management number is transmitted to the client terminal. The client terminal adds the management number received from the server to the management number. It is characterized by updating.

According to a third aspect of the invention, the enhancement system of claim 1 or 2 security vulnerabilities, wherein said request means, when connecting request to the Internet, said management and identify terminal identifier the client terminal The number is transmitted to the server.

According to a fourth aspect of the present invention, in the security vulnerability strengthening system according to any one of the first to third aspects, the determination means includes the terminal identifier and the management number received from the client terminal, and the server. It is determined whether the security countermeasure has been taken by comparing the stored terminal identifier and the management number.

According to a fifth aspect of the present invention, in the security vulnerability enhancement system according to any one of the first to fourth aspects, the refusal means includes the terminal identifier and the management number received from the client terminal, and the server. When the stored terminal identifier and the management number do not match, the connection to the Internet is rejected.

According to a sixth aspect of the present invention, in the security vulnerability strengthening system according to any one of the first to fifth aspects, the permission means includes the terminal identifier and the management number received from the client terminal, and the server. When the stored terminal identifier and the management number match, connection to the Internet is permitted.

In the invention according to claim 7 , a client terminal and a server connected to the Internet are connected via a network, and the client terminal stores the security measures, a terminal identifier for identifying the own terminal, and a management number, The server is configured to store the security measure, the security measure ID, and a treatment database that stores predetermined conditions for permitting connection to the Internet, a terminal identifier that identifies the client terminal, and the security measures that have been executed. a management number database for storing the management number to be delivered to the client terminal, in reinforced how security vulnerability with enhanced system connection security vulnerabilities in the Internet with, at the client terminal, said server device Against Has a request step of requesting a connection to Netto, at the server, when from the client terminal has received a request for connection to the Internet, the security measures regarding prevention of infection computer virus the client terminal by running A determination step of determining whether the client terminal has not executed the security measure, a refusal step of rejecting connection to the Internet, and a case in which the client terminal has executed the security measure, the Internet anda permission step of permitting a connection to, at the server, when a new security is registered in the treatment database, notifying that there is a need to perform the new security to the client terminal And the client terminal There are, when executing said new security measures receiving the notification, and transmits the new ID of the security, the terminal identifier, and the execution result of the new security measures to the server.

The invention according to claim 8 is the security vulnerability strengthening method according to claim 7 , wherein in the server , the execution result satisfies the predetermined condition corresponding to the action number of the new security measure. determining, when the execution result does not satisfy the predetermined condition, a fact that does not satisfy the predetermined condition notifies the client terminal, prohibit connection to the Internet from the client terminal, the execution result When the predetermined condition is satisfied, the management number in the management number database is updated, and the updated management number is transmitted to the client terminal . In the client terminal , the management number received from the server is updated. and wherein the update to Turkey.

According to a ninth aspect of the present invention, in the security vulnerability strengthening method according to the seventh or eighth aspect , the requesting step includes a terminal identifier for identifying the client terminal and the management when the connection request to the Internet is requested. And transmitting the number to the server.

A tenth aspect of the present invention is the security vulnerability strengthening method according to any one of the seventh to ninth aspects, wherein the determination step includes the terminal identifier and the management number received from the client terminal, and the server. It is determined whether the security countermeasure has been taken by comparing the stored terminal identifier and the management number.

The invention according to claim 11 is the security vulnerability strengthening method according to any one of claims 7 to 10 , wherein the refusal step includes the terminal identifier and the management number received from the client terminal and the server. When the stored terminal identifier and the management number do not match, a step of rejecting connection to the Internet is provided.

A twelfth aspect of the invention is the security vulnerability strengthening method according to any one of the seventh to eleventh aspects, wherein the permission step includes the terminal identifier and the management number received from the client terminal, and the server. When the stored terminal identifier and the management number coincide with each other, there is a step of permitting connection to the Internet.

  According to the present invention, it is possible to minimize damage caused by infection of a terminal on the LAN with a computer virus by restricting the connection of the terminal on the LAN to which security measures are not implemented to the Internet.

  In the present invention, when the user understands the security information notified from the terminal management system and does not execute the security measures, by restricting the connection to the Internet, the user can raise the LAN's security awareness, Infection with computer viruses can be prevented.

  In the present invention, after notifying the terminal user of security information related to prevention of infection with the latest computer virus newly stored in the terminal management system, connection to the Internet is performed when the user executes security measures on the terminal. If no security measures are taken, connection to the Internet is refused. With the above configuration, a terminal that is not implementing security measures is restricted from connecting to the Internet, and the terminal is prevented from being infected with a computer virus.

  The configuration of the security vulnerability enhancement system to which the present invention is applied is shown in FIG. The security vulnerability strengthening system includes the Internet 10, LAN 20, terminal 30, terminal 31, terminal 32, and terminal management system (server) 40.

  The terminal management system 40 that controls connection of the terminal 30, the terminal 31, and the terminal 32 to the Internet includes a treatment management unit 41, a connection determination unit 42, a treatment database 43, and a management number database 44.

  The action management unit 41 registers the action contents 432 relating to security measures by the administrator of the security vulnerability strengthening system and the predetermined condition 433 permitting connection to the Internet into the action database 43, and the management stored in the management number database 44. Update of number 442, reception of action occurrence notification consisting of ID 431 of security countermeasure action taken at terminal 30 and action contents 432, action 431 consisting of ID 431 of security countermeasure taken at terminal 30, terminal identifier 441, and action execution result The completion notification is received, the execution result is determined, and the management number 442 is notified to each terminal. The connection determination unit 42 receives a connection request to the Internet 10 from a terminal, determines whether or not to connect to the Internet using the management database 44, and notifies whether or not Internet connection is possible. In the treatment database 43, as shown in FIG. 4, an ID 431, a treatment content 432, and a predetermined condition 433 are stored. As shown in FIG. 5, the management number database 44 stores a terminal identifier 441, a management number 442, and a completed action number 443 that is the number of an executed action. Information stored in the treatment database 43 and the management number database 44 is used by the treatment management unit 41 or the connection determination unit 42.

  The terminal 30 includes a communication management unit 301, a treatment management unit 302, management number data 303, and a terminal identifier 304. The communication management unit 301 detects a connection request to the Internet 10 from an arbitrary program that the terminal 30 has, a connection request to the Internet using the management number data 303 and the terminal identifier 304 to the connection determination unit 42, and a connection determination unit The determination result made at 42 is received, and connection permission or connection refusal to the program requesting connection to the Internet 10 is performed. The treatment management unit 302 receives the management number 442 from the treatment management unit 41, displays treatment occurrence using the display unit of the terminal 30, detection of treatment completion, ID 431 to the treatment management unit 41, and terminal identifier 441. , And an action completion notification including the execution result is transmitted. The management number data 303 stores the management number 442 notified from the treatment management unit 41 by the treatment management unit 301. The terminal identifier 304 is unique on the LAN 20 and is given to each terminal from the terminal management system (server) 40 in order to identify a terminal that uses the LAN 20.

  When the execution result is normal, the latest management number 442 stored in the management database 44 is notified to the treatment management unit 302. The treatment management unit 302 updates the notified management number data 303 to the latest management number 442. Therefore, the management number 442 stored in the management database 44 matches the management number data 303. On the other hand, when the execution result is abnormal, the notification of the latest management number 442 stored in the management database 44 and the update of the management number data 303 are not executed. Therefore, the latest management number 442 stored in the management database 44 does not match the management number data 303.

  The specific operation of the security vulnerability enhancement system will be described. FIG. 6 shows the operation of the system under each condition. In the initial state (a state in which no new security measure action is registered in the action database 43 shown in FIG. 7), when a connection request to the Internet 10 is generated from a program in the terminal 30, the communication management unit 301 detects this and connects. Hold the request. The communication management unit 301 requests the connection determination unit 42 to connect to the Internet 10 together with information including terminal identifier 304: terminal A and management number data 303: 2002. The connection determination unit 42 uses the terminal identifier 304: terminal A received from the communication management unit 301 to acquire the terminal identifier 441: terminal A and management number 442: 2002 stored in the management number database 44. The management number data 303: 2002 received from the communication management unit 301 is compared with the management number 442: 2002 of the terminal A acquired from the management number database 44. Since the management number 442: 2002 and the management number data 303: 2002 match in the data received from the communication management unit 301, a connection permission notification to the Internet 10 is transmitted from the connection determination unit 42 to the communication management unit 301. The The communication management unit 301 that has received the notification of permission to connect to the Internet 10 releases the hold for the connection request to the Internet 10 received from the program in the terminal 30.

  Next, the operation when the system administrator registers the latest security countermeasure action in the action database 43 will be described. When the administrator registers a new treatment of ID: 2 shown in FIG. 8 that includes the ID 431, the treatment content 432, and the predetermined condition 433 from the treatment management unit 41, the treatment management unit 41 manages the management number of the management database 44. 442 is updated. Simultaneously with the update of the management number 442, the treatment management unit 41 notifies the communication management unit 301 that the latest security countermeasure treatment has been registered. The communication management unit 301 that has been notified by the treatment management unit 41 that the latest security countermeasure measure has been registered displays the fact that the latest security measure measure has been registered on the display unit or the like of the terminal 30, and provides security to the user. Encourage implementation of countermeasures.

  When the user of the terminal 30 makes a connection request from the terminal 30 to the Internet 10 without executing the latest security countermeasure action (ID: 2, shown in FIG. 8, action content 432: security enhanced Web test), the communication management unit 301 detects the connection request and holds it. The communication management unit 301 transmits data including terminal identifier 304: terminal A and management number data 303: 2002, and simultaneously requests the connection determination unit 42 to determine whether or not connection is possible. The connection determination unit 42 uses the terminal identifier 304: terminal A received from the communication management unit 301 to acquire the terminal identifier 441: terminal A and management number 442: 3009 stored in the management number database 44. Next, the terminal identifier 441 received from the communication management unit 301: terminal A and management number data 303: 2002 is compared with the terminal identifier 441: terminal A and management number 442: 3009 acquired from the management number database 44. In this condition, the management number 442 does not match. Therefore, it is determined that the terminal 30 has not completed the latest security countermeasure processing, and a notification of rejection of connection to the Internet 10 is transmitted to the communication management unit 301. The communication management unit 301 cancels the connection request to the Internet 10 from the program in the terminal 30 that has been put on hold. Therefore, the user cannot connect to the Internet 10 under these conditions.

  The operation when the user of the terminal 30 executes the latest security countermeasure process (ID 431: 2, process content 432: security enhanced Web test shown in FIG. 8) and the execution result is 80 points will be described. When the user of the terminal 30 executes the security countermeasure action (ID 431: 2, action content 432: security enhanced Web test), the action management unit 302 starts from the terminal identifier 304: terminal A, ID 431: 2, and the execution result: 80 points. A treatment completion notification is transmitted to the treatment management unit 41 together with the data. The treatment management unit 41 compares the ID 431: 2 and update result: 80 points notified from the treatment management unit 302 with the ID 431: 2 stored in the treatment database 43 and the predetermined condition 433: 100 points. Since the data received from the treatment management unit 302 does not satisfy the ID 431: 2 and the predetermined condition 433: 100 points, the treatment management unit 302 is notified that the security countermeasure treatment is insufficient. In the above security measure countermeasure, the terminal identifier 441 stored in the management number database 44: the management number 442: 3009 of the terminal A and the management number data 303: 2002 of the terminal 30 do not match. Therefore, similarly to the case where the user of the terminal 30 is not executing the latest security countermeasure measures, the terminal 30 cannot connect to the Internet 10.

  The operation when the user of the terminal 30 executes the latest security countermeasure action (ID 431: 2, action content 432: security enhanced Web test shown in FIG. 8) and the execution result is 100 points will be described. When the latest security countermeasure treatment is executed, the treatment management unit 302 transmits a treatment completion notification to the treatment management unit 41 together with data including the terminal identifier 304: terminal A, ID 431: 2, and the predetermined condition 433: 100 points. The treatment management unit 41 compares the received data with the ID 431: 2 stored in the treatment database 43 and the predetermined condition 433: 100 points. Since the data received from the treatment management unit 302 satisfies the ID 431: 2 and the predetermined condition 433: 100 points, the terminal identifier 304 received from the communication management unit 301: the terminal of the management number database 44 using the terminal A Identifier 441: Terminal A is searched. Then, the completed treatment number 443 completed by the terminal A is updated to 2, and the management number 442: 3009 is transmitted to the treatment management unit 302. The treatment management unit 302 updates the management number data 303 with the received management number 442: 3009. As a result of the above processing, the terminal identifier 441 of the management number database 44: the management number 442: 3009 of the terminal A and the terminal identifier 304: management number data 2003: 3009 of the terminal A coincide with each other. Can be connected to.

It is a figure which shows the structure of the whole system which detects and deletes the virus on the conventional network. It is a figure which shows the structure of the whole security vulnerability reinforcement | strengthening system to which this invention is applied. It is a figure which shows the structure of the whole security vulnerability reinforcement | strengthening system to which this invention is applied. It is a figure which shows the content of the data stored in the treatment database. It is a figure which shows the content of the data stored in the management number database. It is a figure which shows the state of this system on each condition. It is a figure which shows the content of the data stored in the treatment database. It is a figure which shows the content of the data stored in the treatment database.

Explanation of symbols

10 Internet 20 LAN
30 Terminal A
31 Terminal B
32 Terminal C
40 terminal management system 41 treatment management unit 42 connection determination unit 43 treatment database 44 management number database 301, 311, 321 communication management unit 302, 312, 322 treatment management unit 303, 313, 323 management number data 304, 314, 324, 441 Terminal identifier 431 ID
432 Treatment details 433 Predetermined condition 442 Management number 443 Completed treatment number

Claims (12)

In a security vulnerability enhancement system in which a client terminal and a server connected to the Internet are connected via a network,
The client terminal is
Request means for requesting the server to connect to the Internet;
The server
When receiving the request for connection from the client terminal to the Internet, a determination unit configured security measures related to prevention of infection computer virus the client terminal determines whether the run,
Refusal means for refusing connection to the Internet when the client terminal has not executed the security measure;
Permission means for permitting connection to the Internet when the client terminal is executing the security measure ;
A treatment database that stores the security measures, an ID for identifying the security measures, and a predetermined condition for permitting connection to the Internet;
A management number database that stores a terminal identifier that identifies the client terminal and a management number that is distributed to each client terminal that has executed the security measures in association with each other;
I have a,
The server notifies the client terminal that the new security measure needs to be executed when a new security measure is registered in the treatment database;
When the client terminal receives the notification and executes the new security measure, the client terminal transmits the new security measure ID, the terminal identifier, and the execution result of the new security measure to the server device. A system for strengthening security vulnerabilities. The server
Determining whether the execution result satisfies the predetermined condition corresponding to the action number of the new security measure;
When the execution result does not satisfy the predetermined condition, notifies the client terminal that the predetermined condition is not satisfied, prohibits connection to the Internet from the client terminal,
When the execution result satisfies the predetermined condition, the management number in the management number database is updated, and the updated management number is transmitted to the client terminal,
The security vulnerability strengthening system according to claim 1 , wherein the client terminal updates the management number received from the server. Said request unit, when the request for a connection to the Internet, enhancement system of claim 1 or 2 security vulnerabilities according to the previous SL end end identifier and the management number and transmits to the server . The determination means determines whether the security measure has been taken by comparing the terminal identifier and the management number received from the client terminal with the terminal identifier and the management number stored in the server. The security vulnerability strengthening system according to any one of claims 1 to 3 . The rejection means rejects connection to the Internet when the terminal identifier and the management number received from the client terminal do not match the terminal identifier and the management number stored in the server. The security vulnerability strengthening system according to any one of claims 1 to 4 , wherein: The permission means permits the connection to the Internet when the terminal identifier and the management number received from the client terminal match the terminal identifier and the management number stored in the server. The security vulnerability strengthening system according to any one of claims 1 to 5 . A client terminal and a server connected to the Internet are connected via a network, the client terminal stores the security countermeasure, a terminal identifier for identifying the terminal itself, and a management number, and the server includes the security countermeasure, ID of the security measures, and the treatment database for storing predetermined conditions are allowed to connect to the Internet, the management to be distributed to each client terminal running the terminal identifier and the security measures to identify the client terminal a management number database storing numbered, in the enhancement method of security vulnerabilities with enhanced system connection security vulnerabilities in the Internet with,
In the client terminal,
A requesting step for requesting the server device to connect to the Internet;
In the server,
When receiving the request for connection from the client terminal to the Internet, a determination step of the security relating to prevent infection of a computer virus the client terminal determines whether the run,
When the client terminal has not executed the security measure, a refusal step of refusing the connection to the Internet;
When the client terminal is executing the security measures, a permission step for permitting connection to the Internet ;
Have
In the server, when a new security measure is registered in the treatment database, the client terminal is notified that the new security measure needs to be executed,
When the client terminal receives the notification and executes the new security countermeasure, the client terminal transmits the new security countermeasure ID, the terminal identifier, and the execution result of the new security countermeasure to the server. How to strengthen security vulnerabilities. In the server,
The execution result is judged whether it meets the predetermined conditions corresponding to the treatment numbers of the new security measures,
When the execution result does not satisfy the predetermined condition, a fact that does not satisfy the predetermined condition notifies the client terminal, prohibit connection to the Internet from the client terminal,
When the execution result satisfies the predetermined condition, the management number in the management number database is updated, and the updated management number is transmitted to the client terminal,
Wherein the client terminal, the method enhanced security vulnerability of claim 7 wherein the benzalkonium updates to the management number received from the server. Said request step, when the request for a connection to the Internet, according to claim 7 or 8, wherein the security features and Turkey to send the terminal identifier and the management number for identifying the client terminal to the server How to strengthen the vulnerability. The determination step determines whether the security measure has been taken by comparing the terminal identifier and the management number received from the client terminal with the terminal identifier and the management number stored in the server. The method for strengthening a security vulnerability according to any one of claims 7 to 9 , characterized in that: The rejecting step is a step of rejecting connection to the Internet when the terminal identifier and the management number received from the client terminal do not match the terminal identifier and the management number stored in the server. The security vulnerability strengthening method according to claim 7 , wherein the security vulnerability is strengthened. The permission step includes a step of permitting connection to the Internet when the terminal identifier and the management number received from the client terminal match the terminal identifier and the management number stored in the server. The method for strengthening a security vulnerability according to any one of claims 7 to 11 , wherein:

Images