JP4389853B2 - Security policy inconsistency resolution support system, method and program - Google Patents

Description

  The present invention relates to a security policy inconsistency resolution support system, method, and program for supporting inconsistency resolution of setting contents (security policies) of a plurality of types of security functions in an information system.

  An automatic security setting device that automatically sets security devices has been proposed (see, for example, Patent Document 1). An automatic security setting device (hereinafter referred to as an automatic setting device) described in Patent Document 1 includes a setting change control unit, a central processing unit, a database, a signature control unit, and a data update control unit. . Then, the setting of the intrusion detection system is updated so as to prevent the security function from being missed. The automatic setting device described in Patent Document 1 operates as follows.

  First, the automatic setting device described in Patent Document 1 acquires firewall setting information, and then acquires all signatures from a database. Then, for each port number, the automatic setting device takes the AND of the firewall setting information and whether or not the intrusion detection system is supported as the contents to be set in the intrusion detection system. Further, the current setting state of the intrusion detection system is acquired, and XOR is performed between the current setting of the intrusion detection system and the contents to be set in the intrusion detection system. When the result of XOR is true (that is, when the current setting of the intrusion detection system is different from the content to be set), the current setting of the intrusion detection system is changed. This operation allows the intrusion detection system to monitor the ports that are open in the firewall and can be monitored by the intrusion detection system. Ports that are closed by a firewall can be set so that unnecessary monitoring is not performed by the intrusion detection system.

JP 2004-274654 A (page 5-12, FIG. 1, FIG. 7, FIG. 8)

  However, the automatic setting device described in Patent Document 1 operates based on the premise that the firewall setting is correct, and does not take into account the case where there is an error in the firewall setting. Therefore, when the setting of the intrusion detection system is correct and there is an error in the firewall setting, the automatic setting device described in Patent Document 1 cannot cope. In addition, since the automatic setting device described in Patent Document 1 is configured to change the setting of the intrusion detection system based on the firewall setting, only the setting of the intrusion detection system can be changed.

  When multiple security functions are applied to the network system to be managed, it is preferable that the security administrator can support the inconsistency of the settings appropriately even if there is an error in the settings of any of the security functions. . In addition, when changing settings related to security functions (setting inconsistency resolution), only the settings that have inconsistencies are changed, so that network users can perform operations stably using the network system. It is preferable to do.

  A person who performs security management of a network system of an organization such as a company is called a “security manager”. In addition, a person who performs a task or work using a network system that is a security management target is referred to as a “network user”.

  In addition, a large-scale network system used by companies and the like includes many security devices in both number and type, and setting information (setting contents) of these security devices is complicated. It is not practical to manually detect such inconsistencies in the settings of many security devices because it takes a great deal of time and money. Even if a setting inconsistency is detected, it is a heavy burden on the security administrator to derive a setting correction method for eliminating the inconsistency.

  In view of the above, an object of the present invention is to make it possible to resolve inconsistency even when there is an error in the setting of any security function when a plurality of security functions are applied to a network system to be managed. And In particular, when a firewall and an intrusion detection system are applied to a network system, the purpose is to be able to resolve inconsistencies regardless of whether there is an error in the firewall settings or the intrusion detection system settings. .

  It is another object of the present invention to provide correction support related to setting of a plurality of security functions, not just correction support related to setting of specific security functions. In particular, an object is to enable both correction support relating to firewall settings and correction support relating to intrusion detection system settings.

  In addition, if there is a port mismatch in the firewall and intrusion detection system settings, it is possible to generate a correction method that changes only the settings related to the port where the mismatch occurred as a method for correcting the firewall settings. With the goal.

  Another object is to reduce the burden on the security administrator.

The security policy inconsistency resolving support system according to the present invention stores a setting information analysis rule, which is a rule for deriving a type of inconsistency between setting information of a plurality of security functions of a security device included in a network system, for each combination of setting information. To read the setting information analysis rule corresponding to the combination of a plurality of setting information to be inconsistent detection, and to compare a plurality of setting information according to the setting information analysis rule The setting information analysis unit that detects inconsistencies between multiple setting information, and when the setting information analysis unit detects an inconsistency, the setting information of each security function is subject to correction individually, and the correction target Under the assumption that the setting information is incorrect and the setting information that is not subject to correction is correct. Characterized by comprising a correction method generating means for deriving a correction method with the setting information.

  According to such a configuration, for each security function setting information, the correction method generation unit is configured to resolve inconsistencies under the assumption that the setting information is incorrect and other setting information is correct. Deriving information correction method. Therefore, by referring to the correction method generated for each setting information, the security administrator can select an appropriate correction method in comparison with his / her experience and knowledge or the setting situation intended by himself / herself. . As a result, inconsistency can be resolved even if there is an error in the setting of any security function. In addition, since a plurality of types of correction methods are derived, correction support regarding setting of a plurality of security functions can be performed. As a result, the administrator only has to select a correction method and correct the setting information by the method, thereby reducing the burden on the administrator.

  A setting information storage means for storing setting information of each security function is provided, and the setting information analysis means detects inconsistencies between the setting information by comparing the setting information of each security function stored in the setting information storage means. It may be configured to.

  The configuration may include a setting information acquisition unit that acquires setting information of each security function, and a setting information registration unit that stores the setting information acquired by the setting information acquisition unit in the setting information storage unit.

  A setting information acquiring unit that acquires setting information of each security function is provided, and the setting information analyzing unit detects inconsistencies between the setting information by comparing the setting information of each security function acquired by the setting information acquiring unit. It may be a configuration.

  The configuration may be such that the setting information acquisition means acquires the setting information by inputting the setting information by an administrator.

  The configuration may be such that the setting information acquisition means acquires the setting information by collecting the setting information held by the security device from the security device. According to such a configuration, the administrator himself / herself does not need to input the setting information, thereby reducing the burden on the administrator.

  A configuration may be provided that includes a device that is a collection target of setting information, and the device includes setting information transmission means that extracts the setting information of the security function of the device and transmits the setting information to the setting information acquisition means. According to such a configuration, the administrator himself / herself does not need to input the setting information, thereby reducing the burden on the administrator.

  Correction method selection means for displaying each correction method derived for each setting information by the correction method generation means to prompt the administrator to select a correction method, and setting information corresponding to the correction method selected by the administrator. In addition, a configuration may be provided that includes setting information correction means for correcting the setting information held in the security device according to the correction method. According to such a configuration, since the setting information correcting means corrects the setting information, the administrator only needs to select the correction method and the correction itself is not required. Therefore, the burden on the administrator is reduced.

Deriving a countermeasure that describes the setting information correction pattern based on the assumption that the setting information for each security function is subject to correction individually, and the setting information targeted for correction is incorrect and the setting information that is not the correction target is correct A countermeasure generation rule storage means for storing a countermeasure generation rule that is a rule to be performed for each combination of a plurality of setting information and setting information analysis rules, and the correction method generation means includes a plurality of inconsistency detection targets. The countermeasure generation rule corresponding to the combination of the setting information and the setting information analysis rule read by the setting information analysis means is read, and inconsistency detection is performed according to the type of inconsistency detected according to the countermeasure generation rule. Identify the countermeasure that includes the correction pattern for each setting information that is subject to the correction, and respond to each correction pattern according to each correction pattern included in the countermeasure It may be configured to derive a correction method of the constant information.

  According to such a configuration, by newly storing a new setting information analysis rule and a new countermeasure proposal generation rule in the analysis rule storage means and the countermeasure proposal generation rule storage means, a security device newly added to the network system As for the security function setting, it is possible to detect inconsistencies and derive a correction method.

  The analysis rule storage means is a setting information analysis rule corresponding to a combination of firewall setting information and intrusion detection system setting information, and in the firewall setting information, packets that are allowed to pass are intrusion detection system setting information. In the intrusion detection system, packets that are not monitored are not monitored for packets that are not allowed to be monitored, and packets that are not allowed to pass in the firewall configuration information are set in the intrusion detection system. When the information is a monitoring target, the setting information analysis rule that determines that there is an over-monitoring inconsistency in which a packet that is prohibited from passing is monitored is stored, and the setting information analysis means Read configuration information analysis rules, and configure firewall configuration information and intrusion detection system configuration information. On the other hand, if a packet that is allowed to pass through the firewall configuration information is not monitored by the configuration information of the intrusion detection system in accordance with the configuration information analysis rule, a monitoring omission mismatch is detected. Identify the location of the firewall configuration information and intrusion detection system configuration information that causes inconsistencies, and packets that are prohibited from passing in the firewall configuration information are monitored by the intrusion detection system configuration information In this case, an over-monitoring inconsistency is detected, the location of the firewall configuration information and the intrusion detection system configuration information that causes the over-monitoring inconsistency is specified, and the action plan generation rule storage unit is configured with the firewall configuration information. And countermeasure proposals corresponding to the combination of setting information and setting information analysis rules It is a rule that defines a modification pattern for each of firewall configuration information and intrusion detection system configuration information corresponding to monitoring omission inconsistencies, and for each firewall configuration information and intrusion detection system configuration information corresponding to overmonitoring inconsistencies. A countermeasure generation rule that defines a correction pattern is stored, and the correction method generation means reads the countermeasure generation rule, and if a monitoring omission mismatch is detected, the firewall setting information corresponding to the monitoring omission mismatch And intrusion detection system configuration information Based on the description of the firewall configuration information and intrusion detection system configuration information that cause monitoring omission inconsistencies according to the respective correction patterns, the firewall configuration information and the intrusion detection system configuration information Generate each correction method and over-monitoring irregularities If a detection error is detected, the firewall configuration information and intrusion detection system configuration information and intrusion detection system that cause overmonitoring inconsistency are corrected according to the respective modification patterns of the firewall configuration information and intrusion detection system configuration information corresponding to overmonitoring inconsistency. Based on the description location of the setting information, the configuration may be such that a correction method for each of the firewall setting information and the intrusion detection system setting information is generated.

  According to such a configuration, a firewall setting information correction method and an intrusion detection system setting information correction method are generated. Therefore, the administrator can resolve the inconsistency even if there is an error in the setting information of either the firewall or the intrusion detection system by referring to and selecting the correction method generated for each setting information. . Further, it is possible to perform both correction support related to the firewall setting and correction support related to the setting of the intrusion detection system to the administrator.

  The action plan generation rule storage means has a description that has a higher priority than the description part of the firewall setting information that caused the inconsistency as a correction pattern of the firewall setting information corresponding to the monitoring omission inconsistency, and that passes the packet. A correction pattern that inserts the prohibited description is defined, and the firewall setting information corresponding to overmonitoring inconsistency has a higher priority than the description of the firewall setting information that caused the inconsistency. The countermeasure generation rule that defines the correction pattern that inserts the description that allows the packet to pass is stored, and the correction method generation means responds to the monitoring leak mismatch when the monitoring leak mismatch is detected. In accordance with the correction pattern to be used, it is superior to the description of the firewall configuration information identified as the cause of the monitoring omission inconsistency. If a high-order description and a correction method that inserts a description that prohibits the passage of a packet having a port number of a packet that is not monitored by the intrusion detection system is generated. According to the correction pattern corresponding to overmonitoring inconsistency, the port number of the packet that has a higher priority than the description location of the firewall configuration information identified as the cause of overmonitoring inconsistency and that is monitored by the intrusion detection system The configuration may be such that a correction method is inserted in which a description permitting passage of a packet is inserted.

  According to such a configuration, when there is inconsistency regarding the port in the firewall and intrusion detection system settings, as a method for correcting the firewall setting, there is a correction method for changing only the settings related to the port where the inconsistency has occurred. Can be generated. As a result, since the settings related to the ports where no inconsistency has occurred are not corrected, there is no possibility that a new inconsistency will occur or the operation of the network system will be hindered as a result of the correction.

The security policy inconsistency elimination support method according to the present invention includes a setting information analysis rule in which the analysis rule storage means derives a type of inconsistency between setting information of a plurality of security functions of a security device included in the network system. Stored for each combination of setting information, and the setting information analysis means reads the setting information analysis rule corresponding to the combination of a plurality of setting information to be inconsistent detection from the analysis rule storage means, and follows the setting information analysis rule By comparing the plurality of setting information, the inconsistency between the plurality of setting information is detected, and when the inconsistency is detected by the setting method analyzing unit, the setting information of each security function is The setting information that is individually targeted for correction and the setting information that is targeted for correction is incorrect, and the setting information that is not targeted for correction is correct. Under the assumption, characterized by deriving a correction method setting information targeted for correction.

The setting information storage means stores the setting information of each security function, and the setting information analysis means detects the inconsistency between the setting information by comparing the setting information of each security function stored in the setting information storage means. It may be a method to do.
.

  In addition, the setting information acquisition unit acquires the setting information of each security function, and the setting information analysis unit compares the setting information of each security function acquired by the setting information acquisition unit, so that inconsistencies between the setting information are obtained. A detection method may be used.

The security policy inconsistency resolving support program according to the present invention includes a setting information storage unit that stores setting information of each security function that defines settings of a plurality of types of security functions of a security device included in the network system, and a plurality of security functions A computer having an analysis rule storage means for storing, for each combination of setting information, a setting information analysis rule that is a rule for deriving a type of setting information inconsistency is stored in a computer . By reading the setting information analysis rule corresponding to the combination from the analysis rule storage unit, and comparing the setting information of the plurality of security functions stored in the setting information storage unit according to the setting information analysis rule , Inconsistency in the setting information analysis process that detects inconsistencies and the setting information analysis process Setting but when it is detected, the individual correction target setting information for each security function, under the assumption that the setting information setting information and the correction target is not a correction target if wrong correct, that the correction object A correction method generation process for deriving an information correction method is executed.

In addition, the security policy inconsistency resolution support program according to the present invention provides a setting information analysis rule, which is a rule for deriving a type of inconsistency in setting information of a plurality of security functions of a security device provided in a network system, for each combination of setting information. In the computer having the analysis rule storage means for storing the setting information analysis rule corresponding to the combination of the plurality of setting information to be inconsistent detection is read from the analysis rule storage means, and according to the setting information analysis rule, a plurality of setting information analysis rules are read. Setting information analysis processing that detects inconsistencies between multiple setting information by comparing the setting information, and when inconsistencies are detected by the setting information analysis means, the setting information for each security function is subject to correction individually If the setting information targeted for correction is incorrect, Under the assumption that Shii, characterized in that to execute the correction method generating process of deriving the correction method setting information targeted for correction.

  According to the present invention, when a plurality of security functions are applied to a network system to be managed, inconsistency can be resolved even if there is an error in the setting of any security function. In addition, it is possible not only to provide support for correction regarding the setting of a specific security function but also to support correction regarding the setting of a plurality of security functions. In addition, the burden on the administrator can be reduced.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a first embodiment of a security policy inconsistency resolution support system according to the present invention. The security policy inconsistency resolution support system shown in FIG. 1 includes a data processing device 100 that is a computer that operates according to a program, and an input / output device 200 that inputs and outputs information. The input / output device 200 includes, for example, an input device such as a keyboard and a mouse and an output device such as a display device.

  The data processing apparatus 100 includes a setting information analysis unit 110, an analysis method database (hereinafter referred to as an analysis method DB) 120, a countermeasure generation unit 130, a countermeasure generation method database (hereinafter referred to as a countermeasure generation method DB). 140). The setting information analysis unit 110 and the countermeasure generation unit 130 are realized by a CPU that operates according to a program, for example.

  The input / output device 200 receives a plurality of security function setting information. For example, setting information of a plurality of security devices (not shown in FIG. 1) is input. The setting information is information indicating setting contents related to the security function. For example, as an example of setting information, there is firewall setting information indicating what packets are allowed to pass and what packets are not allowed to pass. In addition, for example, setting information of an intrusion detection system indicating which port is to be monitored can be given. The setting information consists of a plurality of rules, for example.

  The security device is, for example, a device having a security function among devices constituting a network system (not shown) used by a certain organization. This network system is a management target of the security administrator. Hereinafter, in order to simplify the description, it is assumed that the network system to be managed includes two or more security devices, and the setting information of the security devices is input to the input / output device 200, respectively.

  The analysis method DB 120 stores a setting information analysis algorithm (setting information analysis rule). The setting information analysis algorithm is a rule for deriving a type of inconsistency in setting information of a plurality of security functions. For example, the setting information analysis algorithm is described as information indicating a combination of a condition and a type of mismatch when the condition is satisfied. As the condition, for example, a relationship between setting contents indicated by a plurality of setting information is described. In the case of such a setting information analysis algorithm, when each piece of input setting information satisfies a condition, the type of inconsistency described as a conclusion paired with the condition is derived. A specific example of the setting information analysis algorithm will be described later with reference to FIG. The setting information analysis algorithm is read from the analysis method DB 120 when the setting information analysis unit 110 performs analysis. The analysis method DB 120 stores a setting information analysis algorithm corresponding to the combination of setting information. For example, the analysis method DB 120 stores setting information analysis algorithms according to combinations of firewall setting information and intrusion detection system setting information, and various setting information analysis algorithms according to combinations of other setting information.

  The countermeasure generation method DB 140 stores a countermeasure generation algorithm (countermeasure generation rule). The countermeasure generation algorithm is a rule for deriving a countermeasure for resolving inconsistencies in setting information of a plurality of security functions. For example, the countermeasure generation algorithm is described as information indicating a combination of a condition and a countermeasure when the condition is satisfied. As the condition, for example, the type of setting information mismatch is described. In the case of such a countermeasure generation algorithm, when the type of inconsistency in the derived setting information matches a condition, a countermeasure described as a conclusion that is paired with the condition is derived. The “coping plan” is information describing how to deal with the detected inconsistency in order to eliminate the inconsistency. The countermeasure described in the countermeasure generation algorithm includes a description of a setting information correction pattern (hereinafter referred to as a correction pattern) for each setting information input to the input / output device 200. A specific example of the countermeasure generation algorithm will be described later with reference to FIG. In the example shown in FIG. 7, the description following “then” corresponds to the countermeasure (including the description of the correction pattern). As an example of the correction pattern, there is, for example, “correction so as to monitor the intrusion detection system rule causing the inconsistency”. The countermeasure generation algorithm is read from the countermeasure generation method DB 140 when the countermeasure generation unit 130 generates a countermeasure. Further, the countermeasure generation method DB 140 stores a countermeasure generation algorithm corresponding to the combination of each input setting information and setting information analysis algorithm. For example, the countermeasure generation method DB 140 may include a countermeasure generation algorithm corresponding to a combination of firewall setting information, intrusion detection system setting information, and a setting information analysis algorithm illustrated in FIG. 5, and countermeasures corresponding to other combinations. Store the generation algorithm.

  The correction pattern does not include specific information such as port numbers and rule identification information. A specific method for correcting the setting information so as to eliminate the inconsistency will be referred to as a “correction method”. The correction method is generated by the countermeasure generation unit 130 based on the correction pattern. Then, a countermeasure including a correction method for each setting information is displayed on the input / output device 200.

  The correction pattern and correction method of the setting information are correction patterns and correction methods when it is assumed that the setting information is incorrect. For example, it is assumed that the countermeasure proposal includes a correction pattern for the setting information of the firewall and a correction pattern for the setting information of the intrusion detection system. The firewall setting information correction pattern is a correction pattern when it is assumed that there is an error in the firewall setting information. The specific correction method generated based on the correction pattern is also a correction method when it is assumed that there is an error in the firewall setting information. Similarly, the correction pattern of the setting information of the intrusion detection system is a correction pattern when it is assumed that there is an error in the setting information of the intrusion detection system. The specific correction method generated based on the correction pattern is also a correction method when it is assumed that there is an error in the setting information of the intrusion detection system.

  The setting information analysis unit 110 receives the setting information input from the input / output device 200, and executes analysis processing according to the setting information. The setting information analysis unit 110 performs analysis processing using setting information of a certain security function and setting information of another security function (for example, setting information of a certain security device and setting information of another security device). “Analysis” will be described later.

  The input / output device 200 receives different security function setting information (here, different security device setting information). When receiving the setting information from the input / output device 200, the setting information analyzing unit 110 receives the setting information of the different security devices. For example, the setting information analysis unit 110 receives firewall setting information and intrusion detection system setting information. The setting information analysis unit 110 reads a setting information analysis algorithm corresponding to the combination of setting information received from the input / output device 200 from the analysis method DB 120, and performs an analysis process according to the setting information analysis algorithm. For example, as described above, when the firewall setting information and the intrusion detection system setting information are received, the setting information analysis algorithm corresponding to the combination of the firewall setting information and the intrusion detection system setting information is read. Perform analytical processing.

  In the present invention, “analysis” refers to detection of inconsistencies in settings between different security functions, which cannot be detected simply by referring to the setting information of different security functions and referring to the setting information of the security functions individually. Is to do.

  A specific example will be described. Considering the firewall settings as a reference, it is desirable to monitor the ports that allow packet passage in the firewall settings with an intrusion detection system. On the other hand, considering the setting of the intrusion detection system as a reference, it is considered that the port that is monitored by the intrusion detection system needs to be allowed to pass packets by the firewall. Considering the firewall settings as a reference, it is not necessary to monitor the intrusion detection system for ports that are prohibited from passing packets in the firewall settings. On the other hand, considering the setting of the intrusion detection system as a standard, it is considered necessary to prohibit passage of ports that are not monitored by the intrusion detection system by the firewall. By performing the above “analysis”, the setting information analysis unit 110 performs, for example, inconsistency (monitoring omission) that the intrusion detection system does not monitor a port that allows passage of a packet by the firewall, or by a firewall. Detect inconsistencies such as inconsistencies (overmonitoring) where the intrusion detection system monitors ports that prohibit packet passage.

  The analysis is performed according to a predetermined analysis method. For example, the setting information analysis algorithm is described in advance and specified in the analysis method DB 120 so as to specify the type of inconsistency according to the condition when each piece of input setting information satisfies a certain condition. The setting information analysis means 110 performs an analysis process according to the setting information analysis algorithm. As an example of the analysis method, for example, an analysis method such as “check whether there is a mismatch in the port number setting between the setting information of the firewall and the setting information of the intrusion detection system” can be cited. According to the setting information analysis algorithm created in advance according to such an analysis method, the setting information analysis means 110 “does not monitor the port that is allowed to pass by the firewall by the intrusion detection system”, “passes by the firewall Detects inconsistencies such as "The port that prohibits monitoring is monitored by an intrusion detection system."

  The countermeasure generation unit 130 reads the countermeasure generation algorithm corresponding to the combination of the setting information input to the input / output device 200 and the setting information analysis algorithm read by the setting information analysis unit 110 from the countermeasure generation method DB 140. Then, the countermeasure plan generating unit 130 specifies a countermeasure according to the type of inconsistency derived by the analysis by the setting information analyzing unit 110 from the countermeasures described in the read countermeasure plan generating algorithm. This countermeasure includes a correction pattern for each setting information input to the input / output device 200. The countermeasure plan generating unit 130 generates a specific correction method for each setting information based on the correction pattern included in the identified countermeasure, and causes the input / output device 200 to display the correction method set as a countermeasure. .

  The countermeasure generation unit 130 generates a correction method according to the description of the correction pattern. For example, according to a correction pattern such as “correction so as to monitor the intrusion detection system rule causing inconsistency”, a specific correction method such as “correction so as to monitor a packet going to 25 / tcp” is generated. The generation method of the correction method differs depending on the correction pattern and which security function setting information the setting information is. A specific example of the correction method generation will be described later with an example in which the setting information is setting information of a firewall or an intrusion detection system.

Next, the operation will be described.
FIG. 2 is a flowchart showing an example of the operation of the security policy inconsistency resolution support system of the present embodiment. For example, a security administrator inputs setting information of a plurality of security devices to the data processing device 100 via the input / output device 200 (step A1). When setting information of a plurality of security functions is input in step A1, the setting information analysis unit 110 searches the analysis method DB 120 for a setting information analysis algorithm corresponding to the combination of the setting information of the plurality of security functions, and the analysis method. Read from DB 120 (step A2).

  Subsequently, the setting information analysis unit 110 analyzes the setting information of the plurality of security functions input in step A1 according to the setting information analysis algorithm searched in step A2. That is, inconsistency between setting information of a plurality of security functions is detected (step A3). In step A3, when each setting information satisfies the condition described in the setting information analysis algorithm, the setting information analyzing unit 110 indicates that an inconsistency described as a conclusion paired with the condition has occurred. Determine and detect inconsistencies. Since the type of inconsistency is described as a conclusion to be paired with the condition, the setting information analyzing unit 110 can detect what type of inconsistency occurs. If each setting information does not satisfy any of the conditions described in the setting information analysis algorithm, it may be determined that no inconsistency occurs (no inconsistency is detected).

  When inconsistency is not detected in the process of step A3 (NO in step A4), the setting information analysis unit 110 outputs a message to that effect via the input / output device 200 (for example, the input / output device 200). To display). In FIG. 2, the steps of the message output process are not shown.

  When inconsistency is detected in the process of step A3 (YES in step A4), the setting information analysis unit 110 sends the inconsistency detection result to the countermeasure generation unit 130, and the countermeasure generation unit 130 performs the processing after step A5. Process. The inconsistency detection result (analysis result) includes, for example, the type of inconsistency and the setting content of each setting information that is inconsistent. Also, information such as the setting information analysis algorithm name (identification information of the setting information analysis algorithm) used for the analysis and which security function setting information is the setting information to be analyzed is added to the analysis result.

  The countermeasure plan generating means 130 responds according to the combination of the setting information analysis algorithm retrieved by the setting information analyzing means 110 in step A2 and the security function setting information input via the input / output device 200 in step A1. A plan generation algorithm is searched from the countermeasure generation method DB 140 and read from the countermeasure generation method DB 140 (step A5).

  Subsequently, the countermeasure generation unit 130 uses the inconsistency detection result as input data, and according to the countermeasure generation algorithm searched in step A5, a countermeasure for eliminating the inconsistency in the security setting information detected in step A3. (A correction method for each setting information) is generated (step A6). In step A6, the countermeasure generation unit 130 identifies a condition that matches the type of inconsistency detected in step A3 among the conditions described in the read countermeasure generation algorithm, and concludes that the condition is paired with the condition. Identify the proposed action. This countermeasure includes a description of a correction pattern for each setting information. The countermeasure generation unit 130 generates a correction method according to the correction pattern, and generates a countermeasure by using the set of correction methods as a countermeasure.

  Next, the countermeasure plan generation means 130 outputs the countermeasure plan generated in step A6 from the input / output device 200 and presents it to the security administrator (step A7). For example, the countermeasure is displayed on the display device.

  Next, a specific example of countermeasure plan generation will be described. Here, as a specific example of countermeasure plan generation, a case will be described in which inconsistency detection is performed between a firewall setting and an intrusion detection system setting, and a countermeasure plan for eliminating the detected inconsistency is generated.

  A firewall is a system that prevents intrusion from the outside to a computer network in an organization, and a plurality of filtering rules are set as setting information. In each rule, several elements relating to the data packet are predefined (elements are predetermined). Further, when a data packet matching the element is transmitted, information indicating whether the data packet is allowed to pass or not is also described in the rule. The firewall determines whether to pass the transmitted data packet according to this rule. The elements include the source and destination IP addresses and ports of data packets. By setting a plurality of rules, it is possible to permit passage of a data packet sent from a certain transmission source or to refuse passage of a data packet sent from another transmission source. Each rule is ordered, and the firewall refers to a rule with a higher priority to determine whether to allow the data packet to pass. That is, when a data packet arrives, it is evaluated whether or not the element of the data packet (the transmitted data packet) and the element described in the rule match in order from the rule with the highest priority. If the elements match, it is determined whether or not the data packet is allowed to pass according to the description of the rule. If they do not match, the same evaluation is repeated using the next priority rule.

  The intrusion detection system is a system that monitors a communication line, detects an intrusion into a network, and notifies an administrator, and signature selection is set as setting information. A signature is a pattern of means often used for unauthorized access, and one pattern is generally managed as one signature. The intrusion detection system detects unauthorized access by capturing a packet flowing on the network and comparing it with a signature.

  FIG. 3 is an example of firewall setting information. In the example shown in FIG. 3, a rule is set that “a packet whose protocol is tcp and whose destination port number is any of 0 to 1023 is allowed to pass through the firewall”.

  FIG. 4 is an example of setting information of the intrusion detection system. In the example shown in FIG. 4, a rule is set that “a packet whose protocol is tcp and whose destination port number is 25 is not monitored”.

  Each rule included in the setting information is assigned rule identification information (in this example, a number).

  As shown in FIGS. 3 and 4, the setting information describes which security function (security device) the setting information is related to. For example, the setting information illustrated in FIG. 3 includes a description “firewall”. Based on this description, the data processing apparatus 100 can determine that the input setting information is firewall setting information. Similarly, the setting information illustrated in FIG. 4 includes a description “intrusion detection system”. Based on this description, the data processing apparatus 100 determines that the input setting information is the setting information of the intrusion detection system. Can do.

  In step A1 (see FIG. 2), when the setting information illustrated in FIGS. 3 and 4 is input to the setting information analyzing unit 110 of the data processing apparatus 100 via the input / output device 200, the setting information analyzing unit. 110 searches the analysis method DB 120 for a setting information analysis algorithm corresponding to the combination of input setting information, and reads it from the analysis method DB 120 (step A2). As already described, since the setting information describes which security function (security device) is related to the setting information, the setting information analysis means 110 inputs the setting information of which security function (security device). What is necessary is just to determine whether it was done. In this example, it is determined that the setting information of the firewall and the setting information of the intrusion detection system are input, and the setting information analysis unit 110 sets the setting information analysis algorithm according to the combination of the setting information of the firewall and the setting information of the intrusion detection system. Are read from the analysis method DB 120. Then, using the setting information analysis algorithm, the input setting information is analyzed (step A3).

  The analysis method DB 120 may store a plurality of types of setting information analysis algorithms according to a combination of certain setting information. Then, a plurality of setting information analysis algorithms are searched. In this case, the setting information analysis unit 110 displays the description of the plurality of setting information analysis algorithms on the input / output device 200 (for example, a display device), prompts the security administrator to select an appropriate setting information analysis algorithm, The input setting information may be analyzed using the setting information analysis algorithm selected by the security administrator.

  FIG. 5 is an explanatory diagram showing an example of the setting information analysis algorithm stored in the analysis method DB 120. In the setting information analysis algorithm, which setting information combination corresponds to which setting information analysis algorithm is described in advance. Also, identification information of the setting information analysis algorithm is described. In the example shown in FIG. 5, there is a description “(firewall, intrusion detection system)”, which indicates a setting information analysis algorithm corresponding to a combination of firewall setting information and intrusion detection system setting information. Further, “001” is described as identification information of the setting information analysis algorithm.

  Further, in the setting information analysis algorithm illustrated in FIG. 5, the condition that “the port number and the protocol that are allowed to pass through the firewall are the same as the port number and the protocol that are not monitored by the intrusion detection system”, It is described by pairing with the inconsistency type of “monitoring omission”. Similarly, the condition that “the port number and protocol prohibited by the firewall are the same as the port number and protocol monitored by the intrusion detection system” and the type of inconsistency “overmonitoring” Are described in pairs. However, the protocol is not specified in the conditions shown in FIG. When the setting information analysis unit 110 performs analysis using the setting information analysis algorithm illustrated in FIG. 5, “monitoring omission (the failure that the intrusion detection system does not appropriately monitor the packets that are allowed to pass by the firewall). Alignment) "or" Overmonitoring (inconsistency that the intrusion detection system monitors packets that are prohibited from passing by the firewall) ".

  Here, the description will be made assuming that “the same port number” means “the same destination (transmission destination) port number”. However, a condition that “the source port number is the same” may be defined as a condition in the setting information analysis algorithm.

  In this example, since the setting information of the firewall and the setting information of the intrusion detection system are input, the setting information analysis unit 110 reads the setting information analysis algorithm illustrated in FIG. 5 (step A2) and performs the analysis (step). A3). As already described, in the firewall setting information, a rule is set that “a packet whose protocol is tcp and whose destination port number is any of 0 to 1023 is allowed to pass through the firewall” (FIG. 3). Further, in the setting information of the intrusion detection system, a rule that “a packet with a protocol of tcp and a destination port number of 25 is not monitored” is set (see FIG. 4). Therefore, the setting information analyzing unit 110 determines that “the port number (25) and protocol (tcp) permitted to pass through the firewall, and the port number (25) and protocol (tcp) not monitored by the intrusion detection system”. It is determined that the condition “is the same” is satisfied, and it is determined that “monitoring omission” described in a pair with the condition has occurred. That is, the setting information analysis unit 110 detects “monitoring omission” as an inconsistency. At this time, the firewall rule number defined for the port number 25 is “No. 5”, and the intrusion detection system rule number defined for the port number 25 is “No. 26” (FIG. 3, FIG. 3). (See FIG. 4.) Therefore, the setting information analyzing unit 110 indicates that “monitoring omission” is detected for the 25 / tcp port between the rule “No. 5” of the firewall setting information and the rule “No. 26” of the setting information of the intrusion detection system. Detect when it occurs.

  The setting information analysis unit 110 also identifies which description part of each setting information (with which rule of each setting information) the inconsistency occurs. That is, the description location of the cause of inconsistency is specified. When a packet that is permitted to pass in the firewall setting information is not monitored by the setting information of the intrusion detection system, the setting information analysis unit 110 adds a rule that describes the passage permission of the packet and the packet. The rule described as not being monitored is identified as the rule of inconsistency. Also, if a packet that is prohibited from passing in the firewall setting information is monitored by the intrusion detection system setting information, a rule that describes the prohibition of passage of the packet and a rule that states that the packet is monitored Is identified as the inconsistency cause rule.

  In this example, since “analysis missing” is detected as a result of the analysis (YES in step A4), the setting information analysis unit 110 sends the inconsistency detection result (analysis result) to the countermeasure generation unit 130, and the countermeasure The generation unit 130 performs the processing after step A5. FIG. 6 is an explanatory diagram showing an example of the analysis result. In the example shown in FIG. 6, the type of inconsistency and the setting contents of each setting information that is inconsistent (in this example, “a packet that goes to port 0: 1023 of tcp is allowed to pass”, “25 / tcp The result of the analysis is “Do not monitor packets going to”. Along with the setting contents of the setting information that are inconsistent, the number of the rule that defines the setting contents is also included in the analysis result. The port number described in common in the setting contents of the setting information that is inconsistent is the port number in which inconsistency occurs. At the time of generating the correction method, the countermeasure generation unit 130 uses the inconsistency detection result as input data and generates a correction method for eliminating the inconsistency in the port number. Also, the setting information analysis algorithm name used in the analysis (in this example, “001”) and information about which security function setting information is the setting information to be analyzed (in this example, firewall and intrusion detection) System information) is added to the analysis results.

  The countermeasure plan generating unit 130 refers to the analysis result sent from the setting information analyzing unit 110 and corresponds to the combination of the setting information analyzing algorithm searched by the setting information analyzing unit 110 and the input setting information of the security function. The countermeasure generation algorithm is retrieved from the countermeasure generation system DB 140 and read from the countermeasure generation system DB 140 (step A5). In the analysis result illustrated in FIG. 6, “001” is shown as the setting information analysis algorithm name used for the analysis, and “firewall, An “intrusion detection system” is shown. Accordingly, the countermeasure generation unit 130 reads the countermeasure generation algorithm corresponding to the combination from the countermeasure generation method DB 140.

  FIG. 7 is an explanatory diagram showing an example of a countermeasure generation algorithm stored in the countermeasure generation method DB 140. The countermeasure generation algorithm describes in advance which setting information analysis algorithm and which combination of setting information is the countermeasure generation algorithm. In the example shown in FIG. 7, there is a description “(firewall, intrusion detection system, setting information analysis algorithm 001)”, and setting information analysis with firewall setting information, intrusion detection system setting information, and identification information “001”. This indicates that the countermeasure generation algorithm corresponds to a combination of algorithms. Further, identification information of the countermeasure generation algorithm may be described. In the example shown in FIG. 7, “001” is described as identification information of the countermeasure generation algorithm (see the first line shown in FIG. 7).

  Further, in the countermeasure generation algorithm illustrated in FIG. 7, “the rule of the intrusion detection system for the inconsistency cause is monitored in combination with the condition“ missing monitoring ”(the condition that“ missing monitoring ”is detected). And a modification pattern of “insert a passage prohibition rule immediately before the firewall rule causing the inconsistency” is described. Therefore, when the condition that “monitoring omission” is detected is satisfied, the countermeasure generation unit 130 identifies these two types of correction patterns among the correction patterns described in the countermeasure generation algorithm. Then, the countermeasure generation unit 130 generates two types of correction methods according to each of the two types of correction patterns. The correction pattern “correct to monitor the rules of the intrusion detection system for inconsistencies” is a correction pattern under the assumption that the firewall rule settings are correct. The correction pattern “insert a passage prohibition rule immediately before the firewall rule causing the inconsistency” is a correction pattern under the assumption that the setting of the intrusion detection system is correct.

  In addition, in the countermeasure generation algorithm illustrated in FIG. 7, the rule “inconsistency cause intrusion detection system is not monitored” is paired with the condition “overmonitoring” (the condition that “overmonitoring” is detected). And a correction pattern of “insert a pass permission rule immediately before the firewall rule causing the inconsistency” is described. Therefore, when the condition that “overmonitoring” is detected is satisfied, the countermeasure generation unit 130 identifies these two types of correction patterns among the correction patterns described in the countermeasure generation algorithm. Then, the countermeasure generation unit 130 generates two types of correction methods according to each of the two types of correction patterns. The correction pattern “correct so that the rules of the intrusion detection system for inconsistency are not monitored” is a correction pattern under the assumption that the firewall rule setting is correct. The correction pattern “insert the pass permission rule immediately before the firewall rule causing the inconsistency” is a correction pattern under the assumption that the setting of the intrusion detection system is correct.

  Here, a generation mode of the correction method of the intrusion detection system will be described. Intrusion detection system setting information correction patterns include a correction pattern of “correction so that the rules of the intrusion detection system for inconsistencies are monitored” (in the case of “missing monitoring”), and “intrusion detection for inconsistency causes” There is a modification pattern (in the case of “overmonitoring”) that “modifies system rules so that they are not monitored”. When the countermeasure generation unit 130 generates the correction method according to the correction pattern “correct so that the rules of the intrusion detection system for inconsistency cause are monitored”, the description of the rules of the intrusion detection system for inconsistency cause is “monitored” What is necessary is just to produce | generate the correction method of correcting from "No" to "Monitor". At this time, since the rule of the intrusion detection system for the cause of inconsistency is specified by the setting information analysis unit 110, a correction method of correcting the description of the specified rule from “not monitoring” to “monitoring” is performed. It only has to be generated. Further, when the correction plan generating unit 130 generates the correction method according to the correction pattern “correct so as not to monitor the rules of the intrusion detection system of the inconsistency cause”, the countermeasure proposal generation means 130 describes the rules of the intrusion detection system of the inconsistency cause. A correction method of correcting from “monitor” to “not monitor” may be generated. At this time, since the rule of the intrusion detection system causing the inconsistency is specified by the setting information analysis unit 110, the correction method of correcting the description of the specified rule from “monitor” to “not monitor” is performed. It only has to be generated.

  Next, a generation mode of the firewall correction method will be described. When generating a correction method for firewall configuration information, the rule for inconsistency is corrected from "Allow" to "Forbidden" in the case of monitoring omission inconsistency, and the rule for inconsistency in the case of overmonitoring inconsistency In a simple correction method of correcting “prohibited” from “prohibited” to “permitted”, problems often occur after the setting information is corrected. Therefore, it is not preferable to generate such a simple correction method.

  FIG. 8 is a schematic diagram schematically showing rules included in the firewall setting information (see FIG. 3) and the intrusion detection system setting information (see FIG. 4) input in step A1. FIG. 9 is a schematic diagram schematically showing a state in which the rule is corrected by adopting the simple correction method as described above with respect to the setting information (rule) shown in FIG. 8 to 10, the horizontal axis indicates the range of rules (specifically, the range of port numbers defined by each rule). The vertical axis indicates the priority (priority order) of the rules included in the firewall setting information. It should be noted that no priority order is defined for the rules included in the setting information of the intrusion detection system. In FIG. 8 to FIG. 10, the hatched rule means a rule of the intrusion detection system that determines whether monitoring is valid (performs monitoring). Further, a rule indicated by a pattern in which a large number of points are drawn means a rule of an intrusion detection system in which monitoring is disabled (no monitoring is performed). The rule shown in white means a firewall rule that allows a packet to pass through. The rule indicated by the vertical line means a firewall rule that prohibits the passage of packets.

  The example shown in FIG. 8 shows a state in which the monitoring leakage mismatch shown in FIG. 6 occurs. That is, although the firewall rule “No. 5” permits the passage of packets, the intrusion detection system rule “No. 26” disables monitoring and causes a monitoring omission mismatch. It is shown that. At this time, based on the assumption that the setting of the intrusion detection system is correct, the rule “No. 5” of the inconsistent firewall is simply changed from “permit packet passage” to “prohibit packet passage”. Shall be corrected. FIG. 9 shows the state after this correction. With the simple modification as described above, although no inconsistency has occurred in the range of port numbers 0 to 24 and in the range of port numbers 26 to 1023, tcp packets that use ports in this range are not There is a possibility that other services that use these ports will be stopped because they are modified so that they cannot pass through the firewall. As a result, there is a risk of causing great damage to the managed network and its users. Further, as shown in FIG. 9, over-monitoring inconsistency will occur within a range where no inconsistency originally occurred.

  An example of a correction method that does not cause such a problem is shown in FIG. As shown in FIG. 10, when the firewall setting information (rule) is modified, the rule is modified so that a rule having a higher priority than the rule causing the inconsistency is added. In the rule to be added, only the port number where the inconsistency has occurred is specified. In the example illustrated in FIG. 10, a rule that is one priority higher than the rule (“No. 5”) that caused the inconsistency is added. To this rule, “No. 5-1” is newly assigned as the rule number. In the added rule “No. 5-1”, only the number 25 in which inconsistency has occurred is specified, and the setting content “Prohibit passage of packets destined for port 25 of tcp” is defined. By adding a new rule having a high priority, inconsistency between the rule “No. 5” of the firewall before correction and the rule “No. 26” of the intrusion detection system is eliminated. In addition, since the added rule specifies only the port number where the inconsistency has occurred, the firewall rule “No. 5” and the intrusion detection system in the range of the port number where the inconsistency has not occurred are specified. The relationship with the rules “No. 1 to 25” and “No. 27 to 1024” (the relationship that no inconsistency occurs) is maintained. In addition, since packets other than the 25th port, which is a mismatched location, are allowed to pass from the 0th port to the 24th port and from the 26th port to the 1023 port, other services are not affected. .

  In order to generate such a correction method, as a correction pattern of the firewall, a correction pattern of “insert a passage prohibition rule immediately before the firewall rule causing the inconsistency” and “passing immediately before the firewall rule causing the inconsistency” A correction pattern of “insert permission rule” is described in the countermeasure generation algorithm illustrated in FIG. When the correction plan generation unit 130 generates the correction method according to the correction pattern of “insert the passage prohibition rule immediately before the firewall rule causing inconsistency”, the priority is higher than the firewall rule causing the inconsistency. What is necessary is just to produce | generate the correction method which adds the rule which is a rule and prohibits a packet passage about the port which has inconsistency. At this time, since the firewall rule causing the inconsistency is specified by the setting information analysis unit 110, the rule has one priority higher than the specified rule, and the inconsistent port is generated. What is necessary is just to produce the correction method of adding the rule which prohibits passage of a packet. For example, as shown in FIG. 10, a rule that prohibits the passage of a packet is added to the 25th port having a higher priority than the firewall rule “No. A correction method may be generated. Further, when generating the correction method according to the correction pattern “insert pass permission rule immediately before the firewall rule causing inconsistency”, the countermeasure proposal generating unit 130 has one priority over the firewall rule causing the inconsistency. It is sufficient to generate a correction method that adds a rule that allows a packet to pass through a port that has a high inconsistency and that has a mismatch. At this time, since the firewall rule causing the inconsistency is specified by the setting information analysis unit 110, the rule has one priority higher than the specified rule, and the inconsistent port is generated. What is necessary is just to produce the correction method of adding the rule which permits passage of a packet.

  In step A6, the countermeasure generation unit 130 generates a correction method under the assumption that the firewall setting is correct and a correction method under the assumption that the intrusion detection system setting is correct. A set of correction methods is taken as a countermeasure, and the countermeasure is output (for example, displayed) to the input / output device 200 (step A7). FIG. 11 is an explanatory diagram illustrating an example of information that the countermeasure generation unit 130 outputs (displays) to the input / output device 200. As shown in FIG. 11, along with the type of inconsistency, the rule number and the content of the rule are displayed for the firewall rule and intrusion detection system rule causing the inconsistency. Further, as a countermeasure for eliminating the inconsistency, a method for correcting the rules of the firewall and a method for correcting the rules of the intrusion detection system are displayed. The firewall rule correction method is a correction method based on the assumption that the firewall settings are incorrect and the intrusion detection system settings are correct. In FIG. 11, “No. The rule no. 5-1. A correction method of “Inhibit the passage of a packet toward the 25 port of tcp” is added. In addition, the rule correction method of the intrusion detection system is a correction method under the assumption that the settings of the intrusion detection system are incorrect and the firewall settings are correct. This example shows a correction method that “changes the setting related to the packet going to 25 / tcp from“ not monitoring ”to“ monitoring ””.

  The security administrator checks the displayed countermeasures and corrects the firewall configuration information against the service operation status on the managed network, or his / her experience and knowledge, and the setting status intended by the administrator. Whether to correct the setting information of the intrusion detection system. Thereafter, the security manager can make the selected correction according to the countermeasure, and the inconsistency can be resolved.

Next, the effect of this embodiment will be described.
In the present embodiment, a mismatch existing between a plurality of different security function setting information is detected, and a setting information correction method for eliminating the detected mismatch is generated for each security function. Therefore, it is possible to generate a correction method for all setting information without assuming that only one of the settings is always correct. In other words, even if there is an error in the setting of any security function, it is possible to make a countermeasure for eliminating the inconsistency. In addition, it is possible to generate a countermeasure including a correction method related to setting of a plurality of security functions. For example, if an inconsistency is detected between the firewall setting information and the intrusion detection system setting information, a firewall setting information correction method and an intrusion detection system setting information correction method are generated to eliminate the inconsistency. can do.

  In the present embodiment, the security administrator automatically derives and presents a setting information correction method for detecting inconsistencies in the setting information and resolving the detected inconsistencies. Appropriate ones can be selected. Inconsistencies can be resolved simply by applying the selected correction method, which greatly reduces the burden on the security administrator.

  Further, in the present embodiment, when generating a correction method for firewall setting information, a correction method for adding a new rule for correcting only inconsistent portions is generated. Therefore, it is possible to generate a correction method that does not affect other than the inconsistent portion.

  In this embodiment, the security administrator can operate a network system with a high security level, and the network user can use a stable network system.

  In the present embodiment, the analysis is performed using the setting information analysis algorithm stored in the analysis method DB 120, and the countermeasure is generated using the countermeasure generation algorithm stored in the countermeasure generation DB 140. Therefore, by newly storing a new setting information analysis algorithm in the analysis method DB 120 and additionally storing a new countermeasure generation algorithm in the countermeasure generation method DB 140, setting information (for example, new In addition, it is possible to identify inconsistent points and generate countermeasures for the security device setting information added to (1).

  In the present embodiment, the setting information acquisition unit is realized by the input / output device 200. The analysis rule storage means is realized by the analysis method DB 120. The countermeasure generation rule storage means is realized by the countermeasure generation method DB 140.

Embodiment 2. FIG.
FIG. 12 is a block diagram showing a second embodiment of the security policy inconsistency resolution support system according to the present invention. Components similar to those in the first embodiment are denoted by the same reference numerals as those in FIG. In addition, the operation of the same components as in the first embodiment is the same as that in the first embodiment.

  In the second embodiment, the data processing apparatus 100 extracts setting information in addition to the setting information analysis unit 110, the analysis method DB 120, the countermeasure generation unit 130, and the countermeasure generation method DB 140 described in the first embodiment. Means 150 is included. The setting information extraction unit 150 is realized by a CPU that operates according to a program, for example.

  The setting information extraction unit 150 extracts and collects setting information from at least two security devices 400 among the security devices 400 connected to the communication network 300. Also in this embodiment, to simplify the description, it is assumed that the network system to be managed includes two or more security devices. The setting information extraction unit 150 extracts and collects setting information from at least two security devices 400.

  The security device 400 is a device having a security function among devices that are components of a network system (not shown) used by a certain organization, for example. This network system is a management target of the security administrator. Each device that is a component of the network system is connected via a communication network 300. The network system includes at least two security devices 400, and at least two security devices 400 are connected to the communication network 300. The data processing apparatus 100 is connected to the security device 400 via the communication network 300. Each security device 400 holds setting information that defines settings related to the security function of the device. For example, the setting information may be a collection of settings related to security functions realized by hardware. The setting information that defines the settings related to the security function realized by the software installed in the security device 400 is also the setting information of the security device 400. The setting information held by the security device 400 is the same information as the setting information input to the input / output device 200 in the first embodiment.

Next, the operation will be described.
FIG. 13 is a flowchart illustrating an example of the operation of the security policy inconsistency resolution support system according to this embodiment. First, the data processing apparatus 100 is designated by the security administrator via the input / output device 200, for example, a security device to be extracted and collected setting information (step B1). In step B1, the setting information extraction unit 150 displays, for example, a screen prompting the designation of a security device on the input / output device 200, and extracts and collects the setting information for the security device designated via the input / output device 200. It is determined as the security device to be subject to Alternatively, topology information of the network system including the security device 400 (information indicating a connection relationship between the devices) is stored in advance, and each security device described in the topology information is displayed as a selection candidate to display a system administrator. The security device designated through the input / output device 200 may be determined as the security device to be extracted and collected of the setting information. The setting information extraction unit 150 may search for the security device 400 connected to the communication network 300 and determine the searched security device as a security device to be extracted and collected of setting information. When searching for the security device 400, SNMP (Simple Network Management Protocol) may be used. Further, when searching for a security device equipped with software for realizing the security function, the search may be performed using a command of an OS installed in the security device.

  Next, the setting information extraction unit 150 extracts and acquires setting information set in the security device determined in step B1 (designated in step B1) (step B2). The setting information extraction unit 150 extracts and collects setting information by using SNMP or by executing a setting information acquisition command provided in a security device determined as a setting information collection target. At this time, it is not always necessary for the setting information extraction unit 150 to extract all the setting information to be analyzed, and the setting information of some security devices is obtained from the input / output device 200 as in the first embodiment. You may make it input.

  After step B2, the setting information analysis means 110 searches the analysis method DB 120 for a setting information analysis algorithm corresponding to the combination of the setting information of the plurality of security devices extracted and collected in step B2, and reads it (step B3). Next, the setting information analysis unit 110 analyzes the setting information of the plurality of security devices extracted and collected in step B2 according to the setting information analysis algorithm searched in step B3, and there is a mismatch between the setting information. Detection is performed (step B4).

  If no inconsistency is detected in the process of step B4 (NO in step B5), the setting information analysis unit 110 outputs a message to that effect via the input / output device 200 and ends the process. In FIG. 13, the steps of the message output process are not shown. When inconsistency is detected in the process of step B4 (YES in step B5), the setting information analysis unit 110 sends the inconsistency detection result to the countermeasure generation unit 130, and the countermeasure generation unit 130 performs the processing after step B6. Process.

  The countermeasure generation unit 130 handles the countermeasure generation algorithm according to the combination of the setting information analysis algorithm retrieved by the setting information analysis unit 110 in step B3 and the security device setting information extracted and collected in step B2. A search is made from the plan generation method DB 140 and read from the countermeasure generation method DB 140 (step B6). Subsequently, the countermeasure generation unit 130 generates a countermeasure (a method for correcting each setting information) for resolving the inconsistency of the security setting information detected in step B4 according to the countermeasure generation algorithm searched in step B6. Generate (step B7). Next, the countermeasure plan generation means 130 outputs the countermeasure plan generated in step B7 from the input / output device 200 and presents it to the security administrator (step B8). For example, the countermeasure is displayed on the display device.

  Each process of said step B3-B8 is a process similar to each process of step A2-A7 in 1st Embodiment.

Next, the effect of this embodiment will be described.
Also in this embodiment, the same effect as in the first embodiment can be obtained. In this embodiment, when the security administrator designates a security device, the setting information extraction unit 150 extracts and collects setting information from the security device. Thereafter, as in the first embodiment, setting information is analyzed and a countermeasure is generated. Therefore, it is possible to generate the countermeasures with little human intervention. Further, when the setting information extraction unit 150 is configured to search the security device 400 without receiving a designation from the security administrator, the setting information extraction, collection, setting information analysis, and action plan generation are performed without human intervention. Can be done.

  In the second embodiment, the setting information acquisition unit is realized by the setting information extraction unit 150. The analysis rule storage means is realized by the analysis method DB 120. The countermeasure generation rule storage means is realized by the countermeasure generation method DB 140.

Embodiment 3 FIG.
FIG. 14 is a block diagram showing a third embodiment of the security policy inconsistency resolution support system according to the present invention. The same components as those in the second embodiment are denoted by the same reference numerals as those in FIG. In addition, the operation of the same configuration unit as that of the second embodiment is the same as that of the second embodiment.

  In the third embodiment, the data processing apparatus 100 includes the setting information analysis unit 110, the analysis method DB 120, the countermeasure generation unit 130, the countermeasure generation method DB 140, and the setting information extraction unit 150 described in the second embodiment. In addition, setting information updating means 160 is included. The setting information update unit 160 is realized by a CPU that operates according to a program, for example.

  The setting information update unit 160 updates setting information of at least one security device 400 among the security devices 400 connected to the communication network 300. Further, in the present embodiment, the countermeasure generation unit 130 displays, for example, a correction method for each setting information, and causes the security administrator to select which correction method to employ. Then, the setting information update unit 160 updates the setting information of the security device corresponding to the correction method according to the correction method selected by the security administrator.

  Also in this embodiment, to simplify the description, it is assumed that the network system to be managed includes two or more security devices. The setting information extraction unit 150 extracts and collects setting information from at least two security devices 400.

Next, the operation will be described.
FIG. 15 is a flowchart showing an example of the operation of the security policy inconsistency resolution support system of the present embodiment. First, the data processing apparatus 100 is designated by the security administrator via the input / output device 200, for example, as a security device to be extracted and collected setting information (step C1). Next, the setting information extraction unit 150 extracts and acquires setting information set in the security device determined in step C1 (designated in step C1) (step C2). Subsequently, the setting information analysis unit 110 searches the analysis method DB 120 for a setting information analysis algorithm corresponding to a combination of setting information of a plurality of security devices extracted and collected in step C2, and reads the setting information analysis algorithm (step C3). Next, the setting information analysis unit 110 analyzes the setting information of the plurality of security devices extracted and collected in step C2 according to the setting information analysis algorithm searched in step C3, and there is a mismatch between the setting information. Detection is performed (step C4).

  If no inconsistency is detected in the process of step C4 (NO in step C5), the setting information analysis unit 110 outputs a message to that effect via the input / output device 200 and ends the process. In FIG. 15, illustration of the steps of the message output process is omitted. When inconsistency is detected in the process of step C4 (YES in step C5), the setting information analysis unit 110 sends the inconsistency detection result to the countermeasure generation unit 130, and the countermeasure generation unit 130 performs step C6 and subsequent steps. Perform the process.

  The countermeasure generation unit 130 handles the countermeasure generation algorithm corresponding to the combination of the setting information analysis algorithm searched by the setting information analysis unit 110 in step C3 and the security device setting information extracted and collected in step C2. The search is made from the plan generation method DB 140 and read from the countermeasure generation method DB 140 (step C6). Subsequently, the countermeasure generation unit 130 generates a countermeasure (a method for correcting each setting information) for eliminating the inconsistency of the security setting information detected in step C4 according to the countermeasure generation algorithm searched in step C6. Generate (step C7). Next, the countermeasure plan generation unit 130 outputs the countermeasure plan generated in Step C7 from the input / output device 200 and presents it to the security administrator (Step C8). For example, the countermeasure is displayed on the display device.

  Each process of said step C1-C8 is a process similar to each process of step B1-B8 in 2nd Embodiment.

  Following step C8, the countermeasure generation unit 130 displays, for example, the correction method for each setting information, generates a screen that prompts the user to select the correction method, and causes the input / output device 200 to display the screen. Then, the countermeasure generation unit 130 determines the correction method selected by the security administrator via the input / output device 200 as the correction method for eliminating the detected inconsistency (step C9).

  Next, the setting information update unit 160 corrects and updates the setting information of the security device 400 connected via the communication network 300 according to the correction method selected in Step C9 (Step C10).

  FIG. 16 is an explanatory diagram illustrating an example of a screen (screen prompting selection of a correction method) displayed on the input / output device 200 by the countermeasure generation unit 130 in Step C9. Here, a case will be described as an example in which firewall setting information and intrusion detection system setting information are collected, and either one of the correction methods of the setting information is prompted to be selected.

  The countermeasure generation unit 130 generates a screen including a selection area 601 in which a plurality of correction methods are arranged as illustrated in FIG. 16 and the correction method is selected by a radio button, for example. In FIG. 16, in the selection area 601, the countermeasure generation unit 130 sets the intrusion detection system setting information together with the type of inconsistency, the setting of the firewall that is the cause of inconsistency, and the setting of the intrusion detection system that is the cause of inconsistency. (Rule) correction method and firewall setting information (rule) correction method are displayed.

  In the example shown in FIG. 16, “monitoring omission” is displayed as the type of inconsistency. Then, the content of the rule “No. 5” illustrated in FIG. 3 is displayed as the firewall setting that causes “monitoring omission”. Further, as the setting of the intrusion detection system that is the cause of “monitoring omission”, the content of the rule “No. 26” illustrated in FIG. 4 is displayed. In addition to the radio button 602a, a method of correcting the setting information (rule) of the intrusion detection system (a method of correcting “monitor” in rule “No. 26” to “not monitor”) is displayed. In addition to the radio button 602b, a firewall setting information (rule) correction method (a correction method of inserting a rule prohibiting the passage of tcp to the 25th port immediately before the rule “No. 5”) is provided. It is displayed.

  The security administrator determines which settings of multiple security devices (in this example, firewalls and intrusion detection systems) should be modified based on the service operation status on the managed network or their own experience and knowledge. to decide. Then, the radio button corresponding to the setting information correction method to be corrected is clicked.

  As shown in FIG. 16, a scroll bar may be displayed in the selection area 601, and another inconsistency correction method may be displayed in accordance with the scroll bar operation by the security administrator.

  Further, as shown in FIG. 16, the countermeasure generation unit 130 generates a screen so as to display a “correction execution” button and a “cancel” button. When the radio button is clicked, a correction method is selected, and when the “correction execution” button is clicked, the setting information update unit 160 determines the security device corresponding to the correction method according to the selected correction method. Correct the setting information and reset the corrected setting information in the security device. For example, as shown in FIG. 16, when the “correction execution” button is clicked after the radio button 601a is clicked, the setting information update unit 160 “monitors” in the rule “No. 26” of the intrusion detection system. "To" Do not monitor ". When the “Cancel” button is clicked, the click of the radio button performed so far is invalidated.

  Further, as shown in FIG. 16, the countermeasure proposal generating unit 130 includes the name of the analysis target device (such as “firewall-01” or “IDS-A”), and identification information of the setting information analysis algorithm read from the analysis method DB 120. And a security device corresponding to the setting information analysis algorithm may be displayed.

Next, the effect of this embodiment will be described.
Also in this embodiment, the same effect as in the second embodiment can be obtained. In the present embodiment, the setting information updating unit 160 corrects the setting information of the security device corresponding to the correction method according to the correction method selected by the security administrator, and the corrected setting information is stored in the security device. Reset it. Accordingly, not only the extraction and collection of setting information, the analysis of setting information, and the generation of countermeasures, but also the setting information that has been corrected can be reset. In addition, since the data processing apparatus 100 performs the resetting of the corrected setting information, the burden on the security administrator can be further reduced.

  In the third embodiment, the setting information acquisition unit is realized by the setting information extraction unit 150. The analysis rule storage means is realized by the analysis method DB 120. The countermeasure generation rule storage means is realized by the countermeasure generation method DB 140. The correction method selection unit is realized by the countermeasure generation unit 130 and the input / output device 200. Setting information correction means is realized by setting information update means 160.

  In the first embodiment, the data processing apparatus 100 may include the setting information update unit 160 as in the third embodiment, and the setting information update unit 160 may correct the setting information of the security device.

  In the second embodiment and the third embodiment, the case where the data processing apparatus 100 includes the setting information extraction unit 150 and the setting information extraction unit 150 extracts and collects setting information from the security device 400 has been described. The security device 400 includes setting information extraction means 150, and the setting information extraction means 150 provided in the security device 400 extracts setting information from the security device 400 itself and transmits the setting information to the data processing apparatus 100. May be. FIG. 17 is a block diagram showing a configuration example in this case. The security device 400 includes setting information extraction means 150. The setting information extraction unit 150 is realized by a CPU provided in the security device 400.

  In addition, the data processing device 100 stores communication software for communicating with the security device 400 in a storage device (not shown) in advance. The data processing apparatus 100 also includes setting information receiving means 170 that operates according to communication software. The setting information receiving unit 170 is realized by a CPU, for example. The setting information receiving unit 170 requests setting information from the security device 400. Upon receiving this request, the setting information extraction unit 150 extracts setting information held by the security device 400. Subsequently, the setting information extraction unit 150 transmits the extracted setting information to the data processing apparatus 100. The setting information receiving means 170 receives this setting information. The setting information analysis unit 110 and the countermeasure generation unit 130 may perform operations after step B3 (or after C3) using this setting information.

  In this case, the setting information transmitting unit is realized by the setting information extracting unit 150 provided in the security device 400. The setting information acquisition unit is realized by the setting information receiving unit 170 included in the data processing apparatus 100.

  17 does not show the setting information update unit 160, the data processing apparatus 100 shown in FIG. 17 may include the setting information update unit 160.

  In the first to third embodiments, the data processing apparatus 100 stores the setting information of the external security device 400 in advance, and the setting information stored in the data processing apparatus 100 in advance is set. Information analysis, countermeasure generation, and resetting of the corrected setting information may be performed. FIG. 18 is a block diagram illustrating a configuration example when the data processing apparatus 100 stores setting information in advance. The setting information storage unit 180 stores setting information of the external security device 400 (not shown in FIG. 18) in advance. The operations of the setting information analysis unit 110 and the countermeasure generation unit 130 are the same as the operations in the first to third embodiments. However, the setting information analysis unit 110 and the countermeasure generation unit 130 in this example perform setting information analysis and countermeasure generation using the setting information stored in the setting information storage unit 180 in advance. 18 does not show the setting information update unit 160, the data processing apparatus 100 shown in FIG. 18 may include the setting information update unit 160.

  In the case of the configuration shown in FIG. 18, since the setting information storage unit 180 stores setting information in advance, the setting information extracting unit 150 (see FIG. 12) and the setting information receiving unit 170 (see FIG. 17) are not provided. May be. In the configuration shown in FIG. 18, the setting information extracting unit 150 or the setting information receiving unit 170 is provided, and the setting information extracted by the setting information extracting unit 150 (or the setting information received by the setting information receiving unit 170 or the input / output device). The setting information registration unit (not shown) may store the setting information input from 200) in the setting information storage unit 180. The setting information analysis unit 110 and the countermeasure generation unit 130 may analyze the setting information and generate a countermeasure using the setting information stored in the setting information storage unit 180. The setting information registration unit is realized by the CPU of the data processing apparatus 100, for example.

  In the first to third embodiments, the network system to be managed includes two or more security devices, and the setting information of the security device is input, or It was explained as collecting configuration information from two or more security devices. When one security device has two or more security functions and the security device has setting information about each security function, there is one such security device in the network system to be managed. May only be included. In the first embodiment, a plurality of types of setting information held by the one security device may be input. In the second and third embodiments, a plurality of types of setting information held by the one security device may be extracted and collected.

  FIG. 19 is a block diagram showing a specific configuration example of the security policy inconsistency resolution support system according to the present invention. An input device 200a such as a keyboard and a mouse and an output device 200b such as a display device are connected to the data processing device 100 as input / output devices. In addition, the data processing apparatus 100 includes a CPU 501, a storage device 502, and a network interface unit 503. The storage device 502 stores a setting information analysis algorithm and a countermeasure solution generation algorithm. In the case of the configuration shown in FIG. 18, setting information is also stored. The storage device 502 also stores a security policy inconsistency resolution support program. The CPU 501 reads a security policy inconsistency resolution support program from the storage device 502 and operates according to the program. As a result, the CPU 501 operates as the setting information analysis unit 110 and the countermeasure solution generation unit 130. Further, the CPU 501 reads the setting information analysis algorithm and the countermeasure generation algorithm from the storage device 502 when performing operations (analysis and countermeasure generation) as the setting information analysis unit 110 and the countermeasure generation unit 130. In the case of the second embodiment, the CPU 501 also performs an operation as the setting information extraction unit 150, and in the case of the third embodiment, also performs an operation as the setting information update unit 160. In the case of the configuration shown in FIG. 17, the setting information receiving unit 170 also operates. The network interface unit 503 is an interface with the communication network 300. The CPU 501 extracts setting information from the security device via the network interface unit 503.

  The present invention can be applied to uses such as detection of inconsistencies in setting information related to different security functions and generation of a method for correcting setting information for eliminating the inconsistency.

It is a block diagram which shows 1st Embodiment of the security policy inconsistency cancellation assistance system by this invention. It is a flowchart which shows the example of operation | movement of the security policy inconsistency cancellation assistance system of 1st Embodiment. It is explanatory drawing which shows an example of the setting information of a firewall. It is explanatory drawing which shows an example of the setting information of an intrusion detection system. It is explanatory drawing which shows an example of a setting information analysis algorithm. It is explanatory drawing which shows an example of an analysis result. It is explanatory drawing which shows an example of a countermeasure production | generation algorithm. It is the schematic diagram which showed typically the rule contained in the setting information of a firewall, and the setting information of an intrusion detection system. It is the schematic diagram which showed typically the state which employ | adopted the simple correction method and corrected the rule of the firewall. It is the schematic diagram which showed typically the correction | amendment which a new mismatch does not arise. 6 is an explanatory diagram illustrating an example of information to be output (displayed) to the input / output device 200. FIG. It is a block diagram which shows 2nd Embodiment of the security policy inconsistency cancellation assistance system by this invention. It is a flowchart which shows the example of operation | movement of the security policy inconsistency cancellation assistance system of 2nd Embodiment. It is a block diagram which shows 3rd Embodiment of the security policy inconsistency cancellation assistance system by this invention. It is a flowchart which shows the example of operation | movement of the security policy inconsistency cancellation assistance system of 3rd Embodiment. It is explanatory drawing which shows the example of the screen which prompts selection of the correction method. It is a block diagram in case a security apparatus is provided with a setting information extraction means. It is a block diagram which shows the structural example in case the data processing apparatus 100 memorize | stores setting information previously. It is a block diagram which shows the specific structural example of the security policy inconsistency cancellation assistance system by this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Data processor 110 Setting information analysis means 120 Analysis method database 130 Countermeasure plan generation means 140 Countermeasure plan generation method database 200 Input / output device

Claims (16)

An analysis rule storage means for storing a setting information analysis rule, which is a rule for deriving a type of inconsistency in setting information of a plurality of security functions of a security device provided in a network system, for each combination of setting information;
By reading a setting information analysis rule corresponding to a combination of a plurality of setting information subject to inconsistency detection from the analysis rule storage means, and comparing the plurality of setting information according to the setting information analysis rule, the plurality of settings Setting information analysis means for detecting inconsistencies between information;
Assuming that inconsistencies are detected by the setting information analysis means, the setting information for each security function is subject to correction individually, and the setting information targeted for correction is incorrect and the setting information that is not subject to correction is correct in security policy inconsistencies resolved support system is characterized in that a correction method generating means for deriving a correction method setting information targeted for correction. Comprising setting information storage means for storing setting information of each security function;
The security policy inconsistency resolution support system according to claim 1, wherein the setting information analysis unit detects inconsistencies between the setting information by comparing setting information of each security function stored in the setting information storage unit. Setting information acquisition means for acquiring setting information of each security function;
The security policy inconsistency resolution support system according to claim 2, further comprising setting information registration means for storing each setting information acquired by the setting information acquisition means in the setting information storage means. Provided with setting information acquisition means for acquiring setting information of each security function,
The security policy inconsistency resolution support system according to claim 1, wherein the setting information analysis unit detects inconsistencies between the setting information by comparing the setting information of each security function acquired by the setting information acquisition unit. The security policy inconsistency resolution support system according to claim 3 or 4, wherein the setting information acquisition unit acquires the setting information by inputting the setting information by an administrator. The security policy inconsistency resolution support system according to claim 3 or 4, wherein the setting information acquisition means acquires setting information by collecting setting information held by the security device from the security device. It is equipped with a device for which setting information is collected,
5. The security policy inconsistency resolution support system according to claim 3, wherein the device includes setting information transmission means for extracting setting information of a security function of the device and transmitting the setting information to setting information acquisition means. . Correction method selection means for prompting the administrator to select a correction method by displaying each correction method derived for each setting information by the correction method generation means;
The setting information corresponding to the correction method selected by the administrator, comprising setting information correction means for correcting the setting information held in the security device according to the correction method. The security policy inconsistency resolution support system according to any one of the above. Deriving a countermeasure that describes the setting information correction pattern based on the assumption that the setting information for each security function is subject to correction individually, and the setting information targeted for correction is incorrect and the setting information that is not the correction target is correct A countermeasure generation rule storage means for storing a countermeasure generation rule that is a rule for each combination of a plurality of setting information and setting information analysis rules,
The correction method generation means reads a countermeasure generation rule according to a combination of a plurality of setting information subjected to inconsistency detection and the setting information analysis rule read by the setting information analysis means, and follows the corresponding countermeasure generation rule. In accordance with the type of inconsistency detected, a countermeasure including a correction pattern for each setting information subject to inconsistency detection is identified, and each correction pattern is determined according to each correction pattern included in the countermeasure. The security policy inconsistency resolution support system according to any one of claims 1 to 8, wherein a corresponding setting information correction method is derived. The analysis rule storage means is a setting information analysis rule corresponding to a combination of firewall setting information and intrusion detection system setting information, and packets permitted to pass in the firewall setting information are intrusion detection system setting information. In the intrusion detection system, packets that are not monitored are not monitored for packets that are not allowed to be monitored, and packets that are not allowed to pass in the firewall configuration information are set in the intrusion detection system. If the information is a monitoring target, store the setting information analysis rule that determines that there is an over-monitoring inconsistency that monitors the packets that are prohibited from passing,
The setting information analysis means reads the setting information analysis rule, compares the setting information of the firewall with the setting information of the intrusion detection system, and in accordance with the setting information analysis rule, packets that are allowed to pass through the firewall setting information are detected. If the setting information of the intrusion detection system is not a monitoring target, a monitoring omission mismatch is detected, and the location of the firewall setting information and the intrusion detection system setting information that causes the monitoring omission inconsistency is identified. However, if a packet that is prohibited from passing in the firewall configuration information is monitored by the intrusion detection system configuration information, an over-monitoring inconsistency is detected and the firewall that causes the over-monitoring inconsistency is detected. Specify the description location of the setting information and the intrusion detection system setting information,
The countermeasure generation rule storage means is a countermeasure generation rule corresponding to a combination of firewall setting information, intrusion detection system setting information, and the setting information analysis rule, and firewall setting information corresponding to a monitoring omission mismatch. And a modification pattern for each setting information of the intrusion detection system, a firewall setting information corresponding to over-monitoring inconsistency and a countermeasure generation rule that defines the correction pattern for each setting information of the intrusion detection system are stored,
The correction method generation means reads the countermeasure generation rule, and when a monitoring omission inconsistency is detected, according to the correction patterns of the firewall setting information and the intrusion detection system setting information corresponding to the monitoring omission inconsistency, Based on the location of the firewall configuration information and intrusion detection system configuration information that causes the monitoring omission inconsistency, a correction method for each of the firewall configuration information and the intrusion detection system configuration information is generated. If detected, the firewall configuration information and intrusion detection system configuration information that cause overmonitoring inconsistency according to the respective modification patterns of the firewall configuration information and intrusion detection system configuration information corresponding to overmonitoring inconsistency Based on the description of the firewall Security Policy inconsistencies resolved support system according to claim 9 for generating a constant and configuration information their respective corrective actions intrusion detection system. The action plan generation rule storage means has a description that has a higher priority than the description part of the firewall setting information that caused the inconsistency and that passes the packet as a correction pattern of the firewall setting information corresponding to the monitoring omission inconsistency. A correction pattern that inserts the prohibited description is defined, and the firewall setting information corresponding to overmonitoring inconsistency has a higher priority than the description of the firewall setting information that caused the inconsistency. Store a countermeasure generation rule that defines a correction pattern to insert a description that allows the packet to pass,
When a monitoring omission inconsistency is detected, the correction method generation means gives priority to the description location of the setting information of the firewall identified as the cause of the omission of monitoring omission according to the correction pattern corresponding to the monitoring omission inconsistency. Generate a correction method that inserts a description that prohibits the passage of packets with port numbers of packets that are not monitored by the intrusion detection system, and if overmonitoring inconsistency is detected, overmonitoring A packet that has a higher priority than the description location of the firewall configuration information specified as the cause of overmonitoring mismatch according to the correction pattern corresponding to the mismatch, and has the port number of the packet that is monitored by the intrusion detection system The security method according to claim 10 , wherein a correction method is inserted in which a description permitting passage of a message is inserted. System to resolve inconsistency policy. The analysis rule storage means stores, for each combination of setting information, a setting information analysis rule that is a rule for deriving a type of inconsistency in setting information of a plurality of security functions of a security device provided in the network system,
The setting information analysis means reads a setting information analysis rule corresponding to a combination of a plurality of setting information to be inconsistent detection from the analysis rule storage means, and compares the plurality of setting information according to the setting information analysis rule By detecting an inconsistency between the plurality of setting information,
When the inconsistency is detected by the setting information analysis unit, the correction method generation unit sets the setting information of each security function individually as the correction target. A security policy inconsistency resolution support method characterized by deriving a method for correcting the setting information to be corrected under the assumption that it is correct . Setting information storage means stores setting information of each security function,
The security policy inconsistency resolving support method according to claim 12 , wherein the setting information analysis means detects inconsistencies between the setting information by comparing the setting information of each security function stored in the setting information storage means. The setting information acquisition means acquires the setting information of each security function,
The security policy inconsistency resolving support method according to claim 12 , wherein the setting information analyzing unit detects inconsistency between the setting information by comparing the setting information of each security function acquired by the setting information acquiring unit. This is a rule for deriving the type of inconsistency between the setting information storage means for storing the setting information of each security function that defines the setting of a plurality of types of security functions of the security device provided in the network system, and the setting information of the plurality of security functions. In a computer comprising analysis rule storage means for storing setting information analysis rules for each combination of setting information ,
A setting information analysis rule corresponding to a combination of a plurality of setting information targeted for inconsistency detection is read from the analysis rule storage unit, and the setting of the plurality of security functions stored in the setting information storage unit according to the setting information analysis rule The setting information analysis process that detects inconsistencies between the plurality of setting information by comparing the information, and the setting information of each security function is subject to correction individually when inconsistencies are detected in the setting information analysis process Security policy for executing the correction method generation process for deriving the correction method of the setting information to be corrected under the assumption that the setting information to be corrected is incorrect and the setting information that is not the correction target is correct Inconsistency resolution support program. A computer having analysis rule storage means for storing a setting information analysis rule, which is a rule for deriving a type of inconsistency of setting information of a plurality of security functions of a security device provided in a network system, for each combination of setting information ,
By reading a setting information analysis rule corresponding to a combination of a plurality of setting information subject to inconsistency detection from the analysis rule storage means, and comparing the plurality of setting information according to the setting information analysis rule, the plurality of settings When the setting information analysis process that detects inconsistencies between the information and the setting information analysis process detects an inconsistency , the setting information for each security function is subject to correction individually, and the setting information targeted for correction is incorrect. Security policy inconsistency resolution support program for executing a correction method generation process that derives a correction method for the setting information to be corrected under the assumption that the setting information that has not been corrected is correct .

Images