JP4321375B2 - Access control system, access control method, and access control program - Google Patents

Description

  The present invention relates to an access control system, an access control method, and an access control program, and is suitably applied to, for example, a case where a firewall and IDS (unauthorized intrusion detection system) are linked.

  Conventional techniques related to firewalls and computer viruses include those described in Patent Documents 1 and 2 below.

  In the technology of Patent Document 1, a plurality of firewall function units are mounted on one firewall device, and a different firewall function unit is provided for each combination of user networks, so that processing between a large number of user networks can be performed by one firewall. Configure to run on the device. As a result, the number of necessary firewall devices is reduced, so that it is possible to reduce the cost of the devices related to the firewall devices and save labor in management.

The technique of Patent Document 2 is a switch that is a relay device in a LAN and has a function of detecting illegal packets. As a result, whether a packet exchanged between computers in the LAN or a packet exchanged between a computer in the LAN and a computer on the WAN side is an illegal packet when relayed by the switch. Since the illegal packet is inspected and discarded, it is possible to prevent the infection from spreading within the LAN or spreading the infection range from the LAN to the WAN side due to the illegal packet transmitted by a computer virus or the like.
JP 2001-306421 A JP 2003-348113 A

  By the way, in the technique of the above-mentioned patent document 1, since the said firewall function part cannot change the rule (blocking rule) for blocking a packet etc. dynamically, there exists a surface lacking in convenience.

  For example, if you try to use pattern matching vaccine software that is often used to remove a computer virus from a computer infected with a computer virus (including narrowly defined viruses, worms, Trojan horses, etc.) It is necessary to update the virus definition file installed on the computer, or to install the vaccine software if the vaccine software itself is not installed on the computer. The computer must be allowed to communicate with the server that provides the virus definition file or vaccine software.

  However, when the blocking rule is fixed, in order to realize such permission, it is necessary for an administrator to perform work for changing the setting of the blocking rule, and the management burden is changed. Increased and low convenience. Alternatively, a virus definition file or vaccine software is downloaded by accessing the server on another computer that is not infected with a computer virus, and the file is stored in an external storage medium such as a floppy (registered trademark) disk or CD. It is possible to insert the external storage medium into the external storage device of the infected computer and read it into the infected computer. It takes a lot of work and is not convenient.

  On the other hand, in the technique of Patent Document 2, when a computer (for example, a notebook personal computer) already infected with a computer virus is brought into the LAN and connected to the switch, a packet containing a virus pattern is transmitted. The switch shuts off the port, discards the packet, or notifies a predetermined computer of virus detection. If the port is blocked, packets containing virus patterns (self-replicated) will not be relayed by the switch, preventing the spread of computer virus infection and preventing the spread of virus damage that may occur thereafter, but blocking the port. In this case, a computer infected with a computer virus or the like may not be able to communicate with the server of the provider, which is not convenient.

  Moreover, even if a packet containing a virus pattern is simply discarded by a switch, even if the spread of a computer virus can be prevented, the spread of virus damage cannot necessarily be prevented, and the security is not sufficiently high. This is because a packet transmitted to a computer infected with a computer virus or the like is not necessarily a packet including the virus pattern, and damage may be caused by a packet not including the virus pattern.

  Furthermore, it is not possible to prevent the spread of infection and the spread of damage simply by notifying a predetermined computer of detection of a virus, so that the security is not sufficiently high.

  In order to solve such a problem, in the first aspect of the present invention, an access control system that relays a normal protocol data unit and blocks a protocol data unit transmitted from a communication device infected with an infectious malicious program having an infection function. (1) In order to specify the source or destination of the protocol data unit, whether the predetermined entity identifier accommodated in the protocol data unit matches the content of the blocking identifier setting supplied in advance An identifier-corresponding access control unit that relays the protocol data unit if it does not match and blocks it if it matches, and (2) the infectious malicious program is executed using the protocol data unit The access pattern for unauthorized access conforms to the contents of the unauthorized access pattern setting received in advance. An access control unit corresponding to an access pattern that relays the protocol data unit if it does not match and blocks the block if it matches, (3) the protocol data unit includes the block If the content does not match the content of the identifier setting for use and conforms to the content of the unauthorized access pattern setting, the content of the setting for blocking identifier is changed, and the communication device that is the transmission source of the protocol data unit transmits The protocol data unit is characterized in that when the contained entity identifier designates a predetermined security server, it does not conform to the contents of the setting of the blocking identifier.

  According to a second aspect of the present invention, there is provided an access control method for relaying a normal protocol data unit and blocking a protocol data unit transmitted from a communication device infected with an infectious malicious program having an infecting function. In order for the corresponding access control unit to specify the source or destination of the protocol data unit, whether the predetermined entity identifier accommodated in the protocol data unit matches the contents of the blocking identifier setting supplied in advance If it does not match, the protocol data unit is relayed, and if it matches, it is blocked. (2) The access control unit corresponding to the access pattern uses the protocol data unit by the infectious malicious program. The access pattern for unauthorized access executed by the If the protocol data unit is determined to be suitable, the protocol data unit is relayed, and if it is compatible, the protocol data unit is blocked. (3) The protocol data unit is the content of the blocking identifier setting. If the content of the unauthorized access pattern setting conforms to the content of the unauthorized access pattern setting, the content of the blocking identifier setting is changed, and the protocol data unit transmitted by the communication device that is the transmission source of the protocol data unit is: In the case where the stored entity identifier designates a predetermined security server, the entity identifier is not adapted to the contents of the setting of the blocking identifier.

  Furthermore, in the third aspect of the present invention, in an access control program that relays a normal protocol data unit and blocks a protocol data unit transmitted from a communication device infected with an infectious malicious program having an infecting function, 1) In order to specify the source or destination of the protocol data unit, whether or not a predetermined entity identifier accommodated in the protocol data unit matches the contents of the blocking identifier setting supplied in advance. If it does not match, the protocol data unit is relayed if it does not match, and if it matches, the identifier corresponding access control function is blocked, and (2) unauthorized access executed by the infectious malicious program using the protocol data unit The access pattern matches the contents of the unauthorized access pattern setting received in advance. An access control function corresponding to an access pattern that relays the protocol data unit if it does not match and blocks it if it matches, and (3) the protocol data unit If it does not match the contents of the blocking identifier setting, but matches the contents of the unauthorized access pattern setting, the setting of the blocking identifier setting is changed, and the communication device that is the transmission source of the protocol data unit transmits The protocol data unit to be used is characterized in that when the contained entity identifier designates a predetermined security server, the protocol data unit does not conform to the contents of the setting of the blocking identifier.

  According to the present invention, convenience can be enhanced while maintaining high security.

(A) Embodiments Hereinafter, embodiments of an access control system, an access control method, and an access control program according to the present invention will be described.

(A-1) Configuration of the First Embodiment FIG. 2 shows an overall configuration example of the communication system 10 according to the present embodiment. Of course, servers (not shown) (such as a DNS server) may exist in the communication system 10.

  In FIG. 2, the communication system 10 includes a firewall (FW) device 11, networks 12 to 16, a user terminal 18, a recovery server 19, and a normal server 20.

  Among these, the networks 12 to 16 are networks connected via the FW device 11. Among these networks 12 to 16, a network that is a constituent element of a LAN (local area network) may be included, and the Internet may be included. As an example, the networks 12, 14, 15, and 16 may constitute one LAN, and the network 13 may be the Internet (ISP network).

  The FW device 11 of this embodiment is equipped with three virtual firewall function units 17A to 17C. Each virtual firewall function unit (for example, 17A) is a component that can correspond to the firewall function unit of Patent Document 1 described above. However, in this embodiment, the method of using this component is different from that of Patent Document 1.

  Among the networks 12 to 16, the networks 12 and 14 are connected via the virtual firewall function unit 17A, and the networks 13 and 15 are connected via the virtual firewall function unit 17B. In the state shown in FIG. 2, the network 16 is not connected to any network, but the isolation virtual firewall function unit (isolation virtual firewall function unit) 17 </ b> C appropriately selects one of the networks 16. Network (for example, 15). Details thereof will be described later.

  The user terminal 18 accommodated in the network 15 is an information processing apparatus used by the user U1. Specifically, the user terminal 18 may be a normal personal computer (for example, a notebook personal computer) having a network function. In the present embodiment, the description will proceed mainly assuming a case where the user terminal 18 is infected with the virus VR1. The term computer virus (virus) may be used in the narrow sense to distinguish it from worms and Trojan horses, but here it covers broadly defined viruses (not only narrowly defined viruses but also worms and Trojan horses). Can be used).

  Although the user terminal 18 is equipped with the pattern matching type vaccine software VC1, the virus definition file has not been updated to the latest version, so that the virus VR1 is allowed to be infected and cannot be detected. Suppose.

  The normal server 20 accommodated in the network 13 is a server that communicates with a corresponding client function (not shown) that is normally installed in the user terminal 18. Specifically, the normal server 20 may be, for example, a Web server, a mail server, an FTP server, or the like.

  The network 16 is an isolation network (isolation network). The network 16 for isolation is not particularly different from other networks (for example, 14) in terms of network configuration and specifications, but is used to isolate a computer (for example, 18) infected with a virus. Is different. The isolation network 16 includes a recovery server 19.

  The recovery server 19 is a server that supports execution of detection and removal of the virus VR1. Specifically, for example, the latest virus definition file VF1 for detecting and removing the virus VR1 is accumulated, and when there is a request from the user terminal (here, 18), the virus definition file VF1 is stored. It has a function to be provided to the user terminal 18. When the virus definition file VF1 is delivered to the user terminal 18, the vaccine software VC1 can detect or remove the virus VR1 using the virus definition file VF1.

  If the user terminal 18 does not include the vaccine software VC1 itself, the vaccine software VC1 may be provided from the recovery server 19 to the user terminal 18.

  In addition, the virus VR1 (or a new virus other than VR1) is a type of virus that infects through a security hole in software (for example, an OS (operating system) or a web browser) installed in the user terminal 18. In such a case, it is also effective to be able to provide a modified version program (security patch) for correcting the security hole from the recovery server 18 to the user terminal 18.

  In the state of FIG. 2, it is assumed that the user terminal 18 is assigned an IP address IPA8, the normal server 20 is assigned an IP address IPA2, and the recovery server 19 is assigned an IP address IPA9.

  Of course, communication devices other than those shown in the network 13, 15, 16 may be accommodated. The networks 12 and 14 also accommodate communication devices (not shown). These communication devices may include network devices such as switches and routers in addition to user terminals and servers.

  The internal configuration of the FW device 11 is, for example, as shown in FIG.

(A-1-1) Internal Configuration Example of FW Device In FIG. 1, the FW device 11 includes a packet receiver 30, a packet transmitter 31, a virtual firewall identification unit 32, a virtual firewall change control unit 33, The address conversion unit 34, the unauthorized intrusion detection unit 35, and the virtual firewall function units 17A to 17C are provided.

  Among these, the packet receiving unit 30 is a part that receives a packet to be relayed or blocked. This packet is a packet that is transmitted from any user terminal (for example, 18) or server (for example, 19) and is received by the FW device 11 via the corresponding network (for example, 15).

  If IEEE802.3 is used as the data link layer communication protocol of the OSI reference model and the IP protocol is used as the network layer communication protocol, the packet is an IP packet accommodated in a MAC frame. Various servers and user terminals send and receive packets. Here, the packet PK1 transmitted from the user terminal 18 is mainly noticed. There are various destinations for the packet PK1, but in any case, the packet transmitted from the user terminal 18 is PK1.

  The packet transmission unit 31 is a packet that the corresponding virtual firewall function unit (for example, 17A) and the unauthorized intrusion detection unit 35 permit relaying together (for example, PK1), or the isolation virtual firewall function unit 17C permits relaying This is a part that transmits a packet that has undergone address translation by the address translation unit 34. The packet PK1 transmitted from the packet transmission unit 31 is delivered to the destination communication device (for example, 20) via the corresponding network (for example, 13).

  The virtual firewall identifying unit 32 is a part that identifies a virtual firewall function unit that should process a packet received via the packet receiving unit 30 using the identification table TB1, and distributes the packet to the identified virtual firewall function unit. .

  The identification table TB1 has, for example, the configuration shown in FIG.

  As shown in FIG. 3, the identification table TB1 includes a transmission source IP address, a VLAN tag value, an input port number, and a virtual firewall function as data items.

  Among these, the transmission source IP address is a data item for registering the value of the transmission source IP address accommodated in the packet (for example, PK1).

  The VLAN tag value is a data item for registering the value of the VLAN tag added to the MAC frame containing the packet (for example, PK1). A VLAN (virtual LAN) is a LAN that is logically configured using VLAN technology. If VLAN is used, a LAN separate from the physical LAN configuration can be logically configured.

  The input port number is a data item for registering a port number provided to the port (input port) provided in the FW device 11 and used for inputting a packet (for example, PK1). This port may be physical or physically the same port logically distinguished. In any case, the input port is identified by the input port number.

  The virtual firewall function is a data item for registering firewall identification information (here, VFW # 1 to VFW # 3) for identifying the three firewall function units 17A to 17C installed in the FW device 11. .

  When such an identification table TB1 is used, the virtual firewall identifying unit 32 sorts the packet according to the value of the source IP address, the value of the VLAN tag, and the value of the input port number regarding the packet (for example, PK1). It is possible to uniquely identify the virtual firewall function unit that should be used.

  Each virtual firewall function unit (for example, 17A) has a function equivalent to that of an ordinary firewall device, and relays packets that are determined to be relayed, and blocks packets that are determined not to be relayed. . The blocked packet is immediately discarded in the virtual firewall function. There are various methods for determining whether or not relaying is possible. Here, it is assumed that whether or not relaying is possible is determined based on information on the network layer of the OSI reference model.

  Therefore, the configuration and contents of the rule table TB2 that summarizes the rules used when the virtual firewall function units 17A to 17C determine whether or not relaying is possible are as shown in FIG. As shown in FIG. 4, the rule table TB2 includes a transmission source IP address, a destination IP address, and an operation as data items.

  Among these, the transmission source IP address is the same as the transmission source IP address which is a data item of the identification table TB1.

  The destination IP address is a data item for registering the value of the destination IP address accommodated in the packet (for example, PK1).

  The operation is a data item for registering a value indicating whether or not the virtual firewall function unit relays the packet. If the value is permitted, it indicates that relaying is performed, and if it is rejected, it indicates that relaying is not performed (blocked).

  If such a rule table TB2 is used, each virtual firewall function unit (for example, 17A) relays the packet according to the value of the source IP address and the destination IP address for the packet (for example, PK1). It is possible to determine whether to block.

  However, as will be described later, the normal virtual firewall function unit (for example, 17B) causes the user terminal 18 to be infected with the virus VR1 regardless of whether the virus VR1 is an illegal packet transmitted to the user terminal 18. After being confirmed by the unauthorized intrusion detection unit 35, it is used to block the packet PK1, whereas the quarantine virtual firewall function unit 17C, regardless of whether it is an unauthorized packet, The difference is that it is used to relay the packet PK1. This is to allow the user terminal 18 to access the recovery server 19 for the purpose of downloading the virus definition file VF1. If this is allowed, there is a possibility that the illegal packet PK1 transmitted by the virus VR1 to the user terminal 18 is also delivered to the recovery server 19, but since the recovery server 19 side has taken sufficient defensive measures, The occurrence of damage due to the packet PK1 can be prevented.

  Each virtual firewall function unit 17A to 17C may have a rule table having the same configuration (same data items) as in FIG. 4 and different contents (values of each data item in each row). Here, it is assumed that the same rule table TB2 is searched by the three virtual firewall function units 17A to 17C. As is clear from the configuration and contents of the identification table TB1, since the source IP address that can be processed for each virtual firewall function unit is determined at a certain point in time when the FW device 11 is operating, If the firewall function units are different, the same rule table TB2 can be searched for all the virtual firewall function units 17A to 17B only by changing the row to be used. Here, a row is a horizontal arrangement other than data items in the table. For example, in the case of the rule table TB2 shown in FIG. 4, “A B permission” is one row.

  Also, if necessary, data items for registration such as values of port numbers (destination port number, source port number) contained in the transport layer header included in the packet (for example, PK1) are shown in FIG. You may prepare. In this case, not only the transmission source IP address and the destination IP address, but also the destination port number and the value of the transmission source port number can be reflected in the rule for determining whether or not to relay.

  The unauthorized intrusion detection unit 35 constitutes a so-called IDS (Unauthorized Intrusion Detection System), and is a part that detects unauthorized intrusion based on an unauthorized intrusion pattern (signature) registered in advance. A packet determined to be relayed by any virtual firewall function (for example, 17A) other than the quarantine virtual firewall function unit 17C is supplied to the unauthorized intrusion detection unit 35, and the unauthorized intrusion detection unit 35 again It is determined whether or not relaying is possible. The unauthorized intrusion detection unit 35 uses a packet (for example, PK1) determined to be relayed by a virtual firewall function unit (for example, 17A) because the determination rule is completely different from the virtual firewall function unit 17A to 17C. Even in such a case, the unauthorized intrusion detection unit 35 may determine that it should be blocked.

  A packet that is determined to be blocked by the unauthorized intrusion detection unit 35 is immediately discarded after the source IP address or the like is extracted by the unauthorized intrusion detection unit 35. The unauthorized intrusion detection unit 35 supplies the extracted source IP address and the like to the virtual firewall change control unit 33.

  Based on the source IP address supplied from the unauthorized intrusion detection unit 35, the virtual firewall change control unit 33 includes the identification table TB1 of the virtual firewall identification unit 32 and the isolation virtual firewall function unit 17C. This is a part for changing the contents of the rule table TB2 (the corresponding row of TB2).

  The change of the contents of the identification table TB1 is a subsequent packet (for example, PK1) transmitted from the transmission source (for example, 18) of the packet (for example, PK1) determined to be an unauthorized packet by the unauthorized intrusion detection unit 35. Is distributed to the virtual firewall function unit 17C for isolation.

  Also, the change in the contents of the corresponding row of the rule table TB2 is sent to the quarantine virtual firewall function unit 17C from the transmission source (for example, PK1) of the packet (for example, PK1) determined by the unauthorized intrusion detection unit 35 as an unauthorized packet. For example, the subsequent packet (for example, PK1) transmitted from 18) is relayed and delivered to the recovery server 19.

  The address conversion unit 34 is a part for converting the source IP address (private IP address) accommodated in the packet (for example, PK1) relayed by the isolation virtual firewall function unit 17C. Normally, in a network (for example, 12, 14) connected to each other via a virtual firewall function unit (for example, 17A), the uniqueness of the IP address is ensured if appropriate network management is performed. However, since the network (for example, 15) connected to the isolation network 16 via the isolation virtual firewall function unit 17C and the isolation network 16 are not normally connected, the uniqueness is ensured. In this case, the uniqueness of the source IP address of the packet (for example, PK1) in the quarantine network 16 is secured using the address conversion unit 34.

  In other words, if there is the address conversion unit 34, the assignment of an IP address (private IP address) to each communication device (not shown in the drawing except for the recovery server 19) in the isolation network 16 can be performed by any other network. This can be done freely without being constrained by the assignment of IP addresses within 12-15.

  However, since any user terminal (for example, 18) in each network 12-15 needs to deliver a packet (for example, PK1) to the recovery server 19, at least the packet in each network 12-15. Must be uniquely specified (or at least specified not addressed to another communication device in the network). There are various methods for ensuring this uniqueness. For example, the IP address IPA 9 assigned to the recovery server 19 is set as a private IP address unique within the networks 12 to 16 or as a global IP address. Therefore, this uniqueness can be ensured.

  The operation of the present embodiment having the above configuration will be described below with reference to the flowchart of FIG.

  The flowchart of FIG. 5 is a flowchart showing the operation of the FW device 11, and includes steps S10 to S21. Here, attention is also paid to the packet PK1 transmitted by the user terminal 18.

(A-2) Operation of the First Embodiment In FIG. 5, when the packet receiver 30 in the FW device 11 receives the packet PK1 transmitted from the user terminal 18 via the network 15 (S10), the packet PK1 Is transmitted from a terminal accommodated in the quarantine network 16 (S11). This inspection is performed by the virtual firewall identification unit 32 based on the identification table TB1. While the unauthorized intrusion detection unit 35 does not detect a packet related to unauthorized intrusion, no network 12 to 15 is connected to the quarantine network 16, so step S11 is set to No. Branch.

  For example, if the user terminal 18 is not infected with the virus VR1, even if it is infected, the packet PK1 is not the packet that the virus VR1 sent to the user terminal 18, but the user U1 sends it for a legitimate purpose. Even if the packet is already infected or the packet transmitted by the virus VR1 to the user terminal 18 (because the unauthorized intrusion detection unit 35 has not detected the unauthorized intrusion pattern by the virus VR1). B) If the fact of infection is not reflected in the identification table TB1, the step S11 branches to the No side, and the packet PK1 is distributed to the virtual firewall function unit 17B by the virtual firewall identification unit 32.

  In this case, the virtual firewall function unit 17B determines whether the packet PK1 can be relayed based on the contents of the rule table TB2 (S16).

  When it is determined that the packet PK1 is a packet to be blocked based on the rule table TB2, step S16 branches to the No side, and the virtual firewall function unit 17B immediately discards the packet PK1 (S17). If it is determined that the packet is to be relayed, step S16 branches to Yes, so that the packet PK1 is transferred from the virtual firewall function unit 17B to the unauthorized intrusion detection unit 35, and the process proceeds to step S18. .

  In step S18, the unauthorized intrusion detection unit 35 determines whether or not the packet PK1 is related to unauthorized intrusion based on an unauthorized intrusion pattern (signature) registered in advance (relayability). If it is determined that the packet is not related to unauthorized intrusion, the packet PK1 is transferred to the packet transmitter 31 for transfer.

  As described above, when it is determined that both the virtual firewall function unit 17B and the unauthorized intrusion detection unit 35 should relay, the packet PK1 is transmitted to the network 13 by the packet transmission unit 31, and the packet PK1 is transmitted. To the destination communication device (for example, the normal server 20) in the network 13 specified by the destination IP address (S19).

  On the other hand, if the unauthorized intrusion detection unit 35 determines in step S18 that the packet PK1 is a packet related to unauthorized intrusion, it should be blocked and step S18 branches to Yes and the process proceeds to step S20.

  The step S18 branches to the Yes side specifically, for example, the packet PK1 first transmitted by the virus VR1 infecting the user terminal 18 (or a predetermined number (the pattern of unauthorized intrusion) transmitted first). Is the number of packets PK1) necessary to identify the unauthorized intrusion detection unit 35. When the virus VR1 causes the user terminal 18 to transmit the packet PK1 depends on the function of the virus VR1. For example, a virus that transmits a packet PK1 immediately after the user terminal 18 is connected to the network 15, a virus that transmits a packet PK1 at a predetermined time determined in advance in the virus VR1, a predetermined that is determined in advance in the virus VR1. There is a virus that causes the packet PK1 to be transmitted when this event occurs.

  In any case, when the unauthorized intrusion detection unit 35 determines that the packet PK1 is related to unauthorized intrusion, the unauthorized intrusion detection unit 35 determines the source IP address (in this case, IPA8) from the packet PK1. Immediately after the packet is extracted (S21). The extracted transmission source IP address IPA8 is supplied from the unauthorized intrusion detection unit 35 to the virtual firewall change control unit 33. At this time, if necessary, together with the IP address IPA8, the value of the VLAN tag and the value of the input port number related to the packet PK1 can be supplied. However, for that purpose, it is necessary to store the VLAN tag value, the input port number value, and the like related to the packet PK1 in association with the packet PK1 in the FW device 11 until the processing in the unauthorized intrusion detection unit 35 is completed. There is.

  The virtual firewall change control unit 33 changes the contents of the identification table TB1 and the contents of the rule table TB2 by using the received source IP address IPA8 or the like (S20), and thereafter the user terminal 18 The packet PK1 transmitted from the virtual firewall identifying unit 32 distributes the packet PK1 to the isolation virtual firewall function unit 17C, and from the packet transmission unit 31 to the network 16 via the isolation virtual firewall function unit 17C and the address conversion unit 34. To be sent to.

  Note that either step S20 or S21 may be executed first.

  Further, when the step S18 branches to the Yes side and the content of the identification table TB1 is changed so as to distribute the packet PK1 transmitted from the user terminal 18 to the isolation virtual firewall function unit 17C, the user terminal 18 It can be said that it was accommodated in the network 16.

  In this case, packets transmitted by other user terminals (not shown) accommodated in the same network 15 as the user terminal 18 are continuously distributed to the virtual firewall storage unit 17B by the virtual firewall identification unit 32 thereafter. Is natural. If the physical network in which the user terminal is accommodated is the same, the physical input port number for the packet transmitted from the user terminal will be the same, but the assigned IP address and the value of the VLAN tag Can be different from the user terminal 18, the result of the virtual firewall identifying unit 32 searching the identification table TB1 using the source IP address, VLAN tag value, and input port number for the packet as a search key is the source for the packet PK1. This is because it is different from the search result (firewall identification information) searched using the IP address IPA8, VLAN tag value, and input port number as search keys.

  When the contents of the identification table TB1 are changed in step S20 and the user terminal 18 is accommodated in the isolation network 16, the packet PK8 transmitted from the user terminal 18 is received by the FW device 11 (S10). Step S11 branches to the Yes side.

  At this time, since the virtual firewall identifying unit 32 distributes the packet PK1 to the quarantine virtual firewall function unit 17C, the quarantine virtual firewall function unit 17C that has received the packet PK1 uses the rule table TB2 to store the packet PK1. It is determined whether or not relaying is possible (S12). If it is determined that the packet should not be relayed, step S12 branches to No and discards the packet PK1 (S13). In this case, the rule table TB2 has already been isolated in step S20. Since the firewall function unit 17C has been changed to relay the packet PK1, step S12 branches to the Yes side. As shown in FIG. 4, the rule table TB2 permits (relays) only when the values of the source IP address and the destination IP address are both registered, so the packet PK1 transmitted by the user terminal 18 is used. Even if the destination IP address is not appropriate, it is discarded in the isolation virtual firewall function unit 17C.

  Here, since the user terminal 18 only needs to be allowed to communicate with the recovery server 19 among the communication devices on the network 16, it relays only the packet PK1 whose source IP address is IPA8 and whose destination IP address is IPA9. It will be.

  If the IP address described as the destination IP address of the packet PK1 is not appropriate, even if the packet PK1 is sent to the network 16, it does not reach the original destination, but the user U1 uses a DNS system or the like. If the recovery server 19 can be specified correctly, the packet PK1 describing the IPA 9 that is the IP address of the recovery server 19 can be transmitted as the destination IP address. Is sent from the FW device 11 (S14, S15) and delivered to the recovery server 19.

  Similarly, by following the same route in the reverse direction, the packet PK2 transmitted from the recovery server 19 to the user terminal 18 is also delivered to the user terminal 18.

  If such exchange of packets PK1 and PK2 is used, the user terminal 18 requests the recovery server 19 to provide the virus definition file VF1, and in response to the request, the recovery server 19 sends a virus definition to the user terminal 18. It is possible to provide the file VF1. That is, since the user terminal 18 infected with the virus VR1 can be used as it is for communication for acquiring the virus definition file VF1, it is more convenient than before. At this time, as usual, the administrator M1 manually changes the setting of the FW device, or accesses the recovery server 19 with another user terminal (not shown) that is not infected with the virus VR1 to define the virus. Download a file or vaccine software, store the file in an external storage medium such as a floppy disk or CD, insert the external storage medium into the external storage device of the infected user terminal 18 and read it The fact that it is no longer necessary contributes to the improvement of convenience.

  Moreover, in this embodiment, even if such communication is performed, the virus VF1 is not spread to other communication devices (for example, the normal server 20) in the communication system 10, so that the security can be maintained sufficiently high. .

  This means that, for example, when the network 13 is in the same LAN as the network 15, it is possible to prevent the spread of infection in the LAN, and when the network 13 is the Internet (ISP network), to the WAN side. It can prevent the spread of infection.

  What can be provided from the recovery server 19 to the user terminal 18 is not limited to the virus definition file. For example, the security patch or vaccine software may be provided. In addition, in order for the packet PK2 transmitted from the recovery server 19 to be accurately delivered to the corresponding port of the FW device 11 within the network 16, the address conversion executed by the address conversion unit 34 in step S14 is required.

  In order for the user terminal 18 to receive provision of the virus definition file VF1 and the like from the recovery server 19 by exchanging the packets PK1 and PK2, the user terminal 18 should be able to perform such communication even in a state infected with the virus VR1. Naturally, it is assumed that the functions of

(A-3) Effect of First Embodiment According to the present embodiment, convenience can be improved and security can be maintained sufficiently high.

  Moreover, in this embodiment, since the function equivalent to three FW apparatuses can be exhibited by one FW apparatus (11), it is possible to reduce apparatus costs and work load for management. It is.

  It can be said that the FW device of this embodiment is suitable for use in an environment where a large number of networks (12 to 16) exist.

(B) Second Embodiment Hereinafter, only differences between the present embodiment and the first embodiment will be described.

  This difference is that the FW device 11 of the first embodiment has three virtual firewall function units, whereas the FW device of the present embodiment has one firewall function unit. Limited to parts related to a point.

(B-1) Configuration and Operation of Second Embodiment FIG. 7 shows an overall configuration example of the communication system 40 according to the present embodiment.

  In FIG. 7, the communication system 40 includes a firewall (FW) device 41, networks 42 and 43, a user terminal 44, a recovery server 45, and a normal server 46.

  Among them, the FW device 41 corresponds to the FW device 11, the network 42 corresponds to the network 15, the normal server 46 corresponds to the normal server 20, and the recovery server 45 corresponds to the recovery server 19. Detailed description is omitted.

  The network 43 is a network connected to the network 42 via the FW device 41. The network 43 corresponds to the network 13 in that the normal server 46 is accommodated, and corresponds to the network 16 in that the recovery server 45 is accommodated.

  Also, in FIG. 7, the functions of the constituent elements to which the same symbols PK1, PK2, VR1, VC1, and VF1 as those in FIG. 2 are assigned are the same as those in the first embodiment, and detailed description thereof is omitted.

  Note that IPA 4 in FIG. 7 is an IP address assigned to the user terminal 44, IPA 5 is an IP address assigned to the recovery server 45, and IPA 6 is an IP address assigned to the normal server 46.

  The internal configuration of the FW device 41 is, for example, as shown in FIG.

  In FIG. 6, the FW device 41 includes a packet reception unit 50, a packet transmission unit 51, a firewall function unit 52, a rule control unit 53, and an unauthorized intrusion detection unit 54.

  Of these, the packet receiving unit 50 corresponds to the packet receiving unit 30, the packet transmitting unit 51 corresponds to the packet transmitting unit 31, the firewall function unit 52 corresponds to the virtual firewall function units 17A to 17C, and the rule control unit. Since 53 corresponds to the virtual firewall change control unit 33 and the unauthorized intrusion detection unit 54 corresponds to the unauthorized intrusion detection unit 35, detailed description thereof is omitted.

  The firewall function unit 52 determines whether relaying is possible, supplies a packet (for example, PK1) determined to be relayed to the unauthorized intrusion detection unit 54, and immediately discards the packet determined to be blocked. In this respect, although it is the same as the virtual firewall function unit (for example, 17B, 17C, etc.), it has one function corresponding to the virtual firewall function unit 17B and a function corresponding to the isolating virtual firewall function unit 17C. The point that will be demonstrated is different.

  The rule table TB3 possessed by the firewall function unit 52 may be formally the same as the rule table TB2 shown in FIG. 4, but the roles played are different. It can be considered that the rule table TB3 plays a role corresponding to the role played by the identification table TB1 and the rule table TB2 in the first embodiment.

  The operation of the FW device 41 of the present embodiment is as shown in the flowchart of FIG.

  The flowchart of FIG. 8 includes steps S30 to S35.

  Of these, Step S30 corresponds to Step S10, Step S31 corresponds to Step S16, Step S32 corresponds to Step S17, Step S33 corresponds to Step S18, and Step S34 corresponds to Step S20. Since step S35 corresponds to step S19, detailed description thereof is omitted.

  In FIG. 8, since there is no step corresponding to step S11 of FIG. 5, step S31 is processed following step S30.

  Step S31 branches to the Yes side, and if the packet PK1 supplied from the firewall function unit 52 is determined by the unauthorized intrusion detection unit 54 to be a packet related to unauthorized intrusion, the step S33 branches to the Yes side Then, the unauthorized intrusion detection unit 54 extracts the source IP address IPA4 and the like from the packet PK1, and supplies the extracted source IP address IPA4 and the like to the rule control unit 53.

  Receiving this, the rule control unit 53 changes the contents of the rule table TB3 of the firewall function unit 52 based on the transmission source IP address IPA4 or the like (S34).

  Up to now, it has been determined that the packet PK1 accommodating the IPA 4 as the source IP address can basically be relayed regardless of the value of the destination IP address. In this case, it is determined that relaying is performed only when the destination IP address is the IPA 5 that is the IP address of the recovery server 45, and in other cases, the IP address is blocked.

  As a result, most of the packets PK1 transmitted to any communication device (for example, the normal server 46) accommodated in the network 46 in order to spread the infection by the virus VR1 are blocked by the firewall function unit 52. The The packet PK1 transmitted by the virus VR1 to the recovery server 45 in an attempt to expand infection is not blocked by the firewall function unit 52, but is likely to be blocked by the unauthorized intrusion detection unit 54. Even if the unauthorized intrusion detection unit 54 cannot reach the recovery server 45 and is delivered to the recovery server 45, the occurrence of damage can be prevented if the recovery server 45 is provided with sufficient protective measures.

  Further, when the user U1 transmits the packet PK1 in order to receive the provision of the virus definition file VF1, the packet PK1 is relayed by the firewall function unit 52 and the unauthorized intrusion detection unit 54, and is restored via the network 43. 45. In response to this, the packet PK2 transmitted from the recovery server 19 to provide the virus definition file VF1 is delivered to the user terminal 44 by following this path in reverse.

  Therefore, similarly to the first embodiment, the present embodiment can use the user terminal 44 infected with the virus VR1 as it is to perform communication for acquiring the virus definition file VF1, and thus is more convenient than before. high.

  Note that after the step S33 branches to Yes and the source IP address IPA4 and the like are extracted from the packet PK1, the packet PK1 is immediately discarded in the unauthorized intrusion detection unit 54 (S32). This is the same as the first embodiment.

(B-2) Effects of Second Embodiment According to the present embodiment, convenience can be improved and security can be maintained sufficiently high.

  Moreover, in this embodiment, since the scale of FW apparatus (41) itself is smaller than FW apparatus (11) of 1st Embodiment, it is possible to reduce apparatus cost rather than 1st Embodiment.

  It can be said that the FW device of this embodiment is suitable for use in an environment where a small number of networks (42, 43) exist.

(C) Other Embodiments In the first embodiment, three virtual firewall function units are mounted on the FW device 11, but the number of virtual firewall function units mounted on one FW device is limited to three. Of course you don't have to.

  Further, the components in the FW device (for example, 11) in the first and second embodiments may be provided in a device separate from the FW device 11, for example, an unauthorized intrusion detection unit (IDS). May be mounted on a separate device from the FW device 11.

  Furthermore, in the first and second embodiments, the virus VR1 has lost the ability to realize the spread of infection and the spread of damage, such as the completion of the removal of the virus VR1 at the user terminal (for example, 18). When confirmed, it is also desirable to automatically return the contents of the identification table TB1 and rule table TB2 (or TB3) to the state before the change. Thereby, the management burden regarding the FW device 11 (or 41) can be further reduced, and convenience is improved.

  Note that the communication protocol used by the present invention is not necessarily limited to that used in the first and second embodiments. For example, the network layer protocol of the OSI reference model is not necessarily the IP protocol. As an example, the IPX protocol may be used.

  Further, the configuration of the table shown in FIGS. 3 and 4 is not necessarily limited to the illustrated configuration. For example, as described above, when a data item for registration such as the value of a port number (destination port number, source port number) contained in a transport layer header included in a packet (for example, PK1) is prepared The structure of the table also changes.

  Further, the unauthorized intrusion detection unit (for example, 35) in the first and second embodiments detects a packet related to unauthorized intrusion by a method different from that of the virtual firewall function unit (for example, 17B) and the firewall function unit 52. If you can, you can replace it with anything. For example, there is a possibility that it can be replaced with an application layer type firewall (application level gateway). The application layer type firewall determines whether or not relaying is possible based on the information of the application layer of the OSI reference model.

  In the above description, most of the functions realized in hardware can be realized in software, and some functions realized in software can be realized in hardware.

It is the schematic which shows the structural example of the firewall apparatus (FW apparatus) used by 1st Embodiment. It is the schematic which shows the structural example of the communication system concerning 1st Embodiment. It is the schematic which shows the structural example of the identification table used in 1st Embodiment. It is the schematic which shows the structural example of the rule table used in 1st Embodiment. It is a flowchart which shows the operation example of 1st Embodiment. It is the schematic which shows the structural example of the FW apparatus used by 2nd Embodiment. It is the schematic which shows the structural example of the communication system concerning 2nd Embodiment. It is a flowchart which shows the operation example of 2nd Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Communication system, 12-16 ... Network, 17A-17C ... Virtual firewall function part, 18, 44 ... User terminal, 19, 45 ... Recovery server, 20, 46 ... Normal server, 30, 50 ... Packet receiving part, 31 , 51 ... Packet transmission unit, 32 ... Virtual firewall identification unit, 33 ... Virtual firewall change control unit, 35, 54 ... Unauthorized intrusion detection unit, 52 ... Firewall function unit, 53 ... Rule control unit, TB1 ... Identification table, TB2 ... Rule table, PK1, PK2 ... packet, VR1 ... virus, VC1 ... vaccine software, VF1 ... virus definition file, IPA2, IPA8, IPA9 ... IP address.

Claims (4)

In an access control system that relays normal protocol data units and blocks protocol data units transmitted from communication devices infected with infectious malicious programs with infectious functions.
In order to specify the source or destination of the protocol data unit, it is determined whether or not a predetermined entity identifier accommodated in the protocol data unit matches the content of the blocking identifier setting supplied in advance. An identifier corresponding access control unit that relays the protocol data unit when it does not conform, and blocks it when it conforms;
It is determined whether or not an access pattern of unauthorized access executed by the infectious unauthorized program using a protocol data unit conforms to the contents of the unauthorized access pattern setting supplied in advance. It has an access control unit corresponding to the access pattern that relays the data unit and blocks it if it fits,
If the protocol data unit does not conform to the content of the blocking identifier setting and conforms to the content of the unauthorized access pattern setting, the content of the blocking identifier setting is changed and transmission of the protocol data unit is performed. The protocol data unit transmitted by the original communication device does not conform to the content of the blocking identifier setting when the contained entity identifier specifies a predetermined security server. And access control system. The access control system of claim 1,
A plurality of identifier-corresponding access control units are provided for each network set to which the communication device belongs, and at least one of them is an isolation corresponding to a set of an isolation network on which the security server is installed and another arbitrary network. If it is an identifier-compatible access control unit,
An identifier-corresponding access control unit to process the protocol data unit is specified based on the content of a predetermined distribution setting, and a distribution control unit that distributes the protocol data unit to the corresponding identifier-corresponding access control unit An access control system characterized by In an access control method for relaying a normal protocol data unit and blocking a protocol data unit transmitted from a communication device infected with an infectious malicious program having an infection function,
Since the identifier-corresponding access control unit designates the source or destination of the protocol data unit, the predetermined entity identifier accommodated in the protocol data unit conforms to the content of the blocking identifier setting supplied in advance. If it does not match, the protocol data unit is relayed.
The access pattern-corresponding access control unit determines whether or not the unauthorized access pattern executed by the infectious unauthorized program using the protocol data unit matches the content of the unauthorized access pattern setting supplied in advance. When the protocol data unit is relayed when it does not conform, and when it conforms,
If the protocol data unit does not conform to the content of the blocking identifier setting and conforms to the content of the unauthorized access pattern setting, the content of the blocking identifier setting is changed and transmission of the protocol data unit is performed. The protocol data unit transmitted by the original communication device does not conform to the content of the blocking identifier setting when the contained entity identifier specifies a predetermined security server. Access control method. In an access control program that relays normal protocol data units and blocks protocol data units transmitted from communication devices infected with infectious malicious programs with infectious functions,
In order to specify the source or destination of the protocol data unit, it is determined whether or not a predetermined entity identifier accommodated in the protocol data unit matches the content of the blocking identifier setting supplied in advance. An identifier-corresponding access control function that relays the protocol data unit when it does not conform, and blocks it when it conforms;
It is determined whether or not an access pattern of unauthorized access executed by the infectious unauthorized program using a protocol data unit conforms to the contents of the unauthorized access pattern setting supplied in advance. Realize access control function corresponding to access pattern that relays data unit and blocks if it fits,
If the protocol data unit does not conform to the content of the blocking identifier setting and conforms to the content of the unauthorized access pattern setting, the content of the blocking identifier setting is changed and transmission of the protocol data unit is performed. The protocol data unit transmitted by the original communication device does not conform to the content of the blocking identifier setting when the contained entity identifier specifies a predetermined security server. An access control program.

Images