JP4490254B2 - User authority control device, user authority control method, and user authority control program - Google Patents

Description

  The present invention relates to a user authority control technique for controlling user authority of a computer system.

  In recent information systems that are generally connected to an external communication network such as the Internet, security problems such as unauthorized access to the information system from the outside and destruction of information assets due to viruses frequently occur. For this reason, security managers protect their information systems from such security risks by installing firewalls and introducing antivirus software as security measures.

  In some cases, a security evaluation tool for evaluating the security status inherent in the information system is introduced, and security measures are taken accordingly. Such a security assessment tool performs hundreds of types of inspection items, such as the presence of security holes and incomplete settings, on computers in the information system, and identifies the problems found (hereinafter referred to as “vulnerabilities”). Since enumerated reports are output together with the risk assessment, the security administrator can take security measures by taking countermeasures such as applying patches to the vulnerable computers based on the reports. It can be applied.

  Recently, computers that have insufficient security measures, such as “no patch applied” or “anti-virus software pattern file version is old” are called “quarantine networks” that do not connect to information systems via networks. Thoughts are also spreading and the security awareness of the information system, that is, the computer itself, is considerably high.

  On the other hand, in security measures for users who use information systems, it is common to set user authority for each user according to the user's role and control access to shared resources (files, programs, etc.) in the information system. It is popular as a method.

The prior art document information related to this application includes the following.
JP 2001-101135 A JP 2002-278797 A Microsoft Corporation, “Active Directory Technical Information”, [online], [searched on December 15, 2004], Internet <URL: http://www.microsoft.com/japan/windowsserver2003/techinfo/overview/activedirectory. mspx>

  As described above, in the conventional information system, the user authority is set for each user. Once the user authority is set, the user authority is not changed unless the department or job title is changed. User authority tends to be fixedly set.

  Originally, when a user authority is given as a security measure for a user, not only the role of the user in the organization but also a security awareness should be considered (for example, a user authority with a high security management level is given) However, for users with low security literacy and unauthorized access or computer virus infections, low security management level user rights should be reassigned) No such response has been made.

  The present invention has been made in view of the above circumstances, and a user authority control device, a user authority control method, and a user authority control program capable of granting user authority reflecting daily user security awareness The purpose is to provide.

In order to achieve the above object, the present invention as claimed in claim 1 is a user authority control apparatus for dynamically setting user authority of a computer system, wherein each group has a predetermined user's authority. Group storage means having a security right indicating a security access level indicating a level of access to resources, and a security point threshold that is a security point value obtained by quantifying unauthorized access in a predetermined period or vulnerability of a computer used by the user; in a predetermined period, to obtain information about unauthorized access performed by the user from the intrusion detection system for detecting fraud user, or test the vulnerability of the vulnerability information of the computer the user is using the computer Information obtained from a vulnerability inspection device or information related to unauthorized access Wherein the user information acquisition means for acquiring information relating to the vulnerability of the vulnerability inspection apparatus acquires from intrusion detection system, the user information acquisition means has acquired, the risk is included in the information about the unauthorized access or the fragile degree included in the information about the vulnerability, the converted respective predetermined points according to the degree of risk or the fragility of the total value of each point converted, security points in the predetermined time period of the user Security point calculation means for calculating as a value, threshold value acquisition means for acquiring a security point threshold value of the group to which the user belongs from the group storage means, security point value calculated by the security point calculation means, and the threshold value acquisition means Security point threshold acquired by And compare, if the security point value exceeds the security point threshold, and having a a user rights updating means for updating the group to which the user belongs security rights to a lower group.

The present invention is claimed in claim 2, wherein, in the invention according to the first aspect, wherein the user authorization maintenance means when said security point value exceeds the security point threshold, with reference to the group storage means, said user The group to which the security point belongs is updated to a group whose security point value does not exceed the security point threshold value .

The present invention described in claim 3 further includes a user authority storage unit that sets a group to which the user belongs for each user according to the invention described in claim 1 , wherein the user authority update unit includes: When the security point value exceeds the security point threshold value, the group storage means is referred to, the group to which the user belongs stored in the user authority storage means belongs, and the security point value exceeds the security point threshold value. It is characterized by updating to a group that does not exceed .

The present invention is claimed in claim 4, the invention according to any one of claims 1 to 3, wherein the security point calculation means, wherein the risk and the fragility of the discovery of the unauthorized access or the vulnerability The security point value is calculated by multiplying each elapsed time from time to time and multiplying the sum of each multiplied value by the importance of the computer .

The present invention as set forth in claim 5 is a user authority control method for dynamically setting user authority of a computer system, wherein the user authority control device is provided for each group with a predetermined number of users belonging to the group. A group storage unit having a security right indicating a level of access to resources and a security point threshold that is a threshold of a security point value obtained by quantifying unauthorized access in a predetermined period or vulnerability of a computer used by the user; , in the predetermined period, to obtain information about unauthorized access performed by the user from the intrusion detection system for detecting fraud user, or vulnerability of the user computer vulnerability information a computer by using Obtained from a vulnerability inspection device that inspects or information related to unauthorized access A user information acquisition step of acquiring information about the vulnerabilities acquires from the intrusion detection system from the vulnerability inspection apparatus, acquired by the user information acquisition step, the risk included in the information about the unauthorized access or the fragile degree included in the information about the vulnerability, the converted respective predetermined points according to the degree of risk or the fragility of the total value of each point converted, security points in the predetermined time period of the user A security point calculation step to calculate as a value, a threshold acquisition step to acquire a security point threshold of a group to which the user belongs from the group storage unit, a security point value calculated in the security point calculation step, and the threshold acquisition step Secur obtained in And a user authority update step of updating a group to which the user belongs to a group having a lower security authority if the security point value exceeds the security point threshold. To do.

The present invention according to claim 6 is a user authority control program readable by a user authority control apparatus that dynamically sets user authority of a computer system, wherein the user authority control apparatus is provided for each group. Security that is a threshold of a security point value that quantifies the security authority indicating the access level of a user belonging to the group to a predetermined resource and the unauthorized access in a predetermined period or the vulnerability of the computer used by the user computer having a group storage unit having a point threshold in the predetermined period, to obtain information about unauthorized access performed by the user from the intrusion detection system for detecting fraud user, or, that the user has used preparative the vulnerability information from the inspection to the vulnerability checking device vulnerabilities computer And, alternatively, the a user information acquisition step of acquiring information relating to the vulnerability of the vulnerability inspection apparatus acquires the information about the unauthorized access from the intrusion detection system, obtained in the user information acquisition step, wherein the weakness of that contained in the information about the risk or the vulnerability included in the information about the unauthorized access, the converted respective predetermined points according to the degree of risk or the fragility of the total value of each point converted, the The security point calculation step for calculating the security point value of the user for the predetermined period, the threshold acquisition step for acquiring the security point threshold value of the group to which the user belongs from the group storage unit, and the security point calculation step Security point A user right to compare a value with a security point threshold value acquired in the threshold value acquisition step, and update the group to which the user belongs to a lower security right group if the security point value exceeds the security point threshold value An updating step is executed by the user authority control apparatus.

The present invention is claimed in claim 7, wherein, in the invention of claim 6, wherein said user rights updating step, if the security point value exceeds the security point threshold, with reference to the group storage unit, the user The group to which the security point belongs is updated to a group whose security point value does not exceed the security point threshold value .

Invention of claim 8, wherein, in the invention of claim 6 or claim 7, wherein the security point calculating step, the risk level and the weak level, until addressed from the time the discovery of unauthorized access or the vulnerability The security point value is calculated by multiplying the respective elapsed times, and multiplying the sum of the multiplied values by the importance of the computer .

  According to the present invention, at least one of information related to unauthorized access performed by a user or information related to computer vulnerability used by the user is acquired, and the degree of risk indicated by each acquired information is quantified and quantified. Since the user authority is updated based on the security point value, the user authority reflecting the daily security awareness of the user can be given.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a schematic configuration diagram of an information system 10 to which a user authority control apparatus 1 according to an embodiment of the present invention is applied. An information system 10 shown in FIG. 1 is an information system built in a predetermined organization (company, group, etc.), and is connected to an external communication network 4 such as the Internet via a firewall 3. The information system 10 includes a computer 5i (i = a, b,..., N) used by each user of the organization, and an IDS (Intrusion Detection System) that detects user fraud (for example, unauthorized access to other computers). (Intrusion detection system) 6 and a user authority control device 1 that dynamically sets the user authority of each user who uses the information system 10.

  Specifically, the user authority control apparatus 1 periodically acquires the IDS log data 601 from the IDS 6 and quantitatively calculates the security management level of the user in a predetermined period based on the IDS log data 601. The user authority reflecting the management level is given to the user. As shown in FIG. 2, the user authority control apparatus 1 includes an authentication unit 11 that performs user authentication when a user accesses the information system 10, an inspection unit 12 that periodically acquires IDS log data 601 from the IDS 6, and the acquired IDS. A calculation unit 13 that calculates a security point from the log data 601 by a calculation method that will be described later, a determination unit 14 that determines whether or not the currently given user authority is appropriate from the calculated security point, and the user authority When it is not appropriate, the configuration includes an authority control unit 15 that changes to an appropriate user authority, and a user authority control information storage unit 16 that stores various information related to user authority control. The security point is obtained by quantitatively quantifying the daily user's fraud. In the present embodiment, the higher the value, the lower the security management level.

  Here, the user authority control information storage unit 16 includes a group master database (hereinafter referred to as group master DB) 101, a user authority database (hereinafter referred to as user authority DB) 102, and an authentication log database (hereinafter referred to as authentication log DB) 103. , A security point database (hereinafter referred to as “security point DB”) 104 and a point master database (hereinafter referred to as “point master DB”) 105.

  As shown in FIG. 3A, the group master DB 101 is a database for managing the security authority of the group to which the user belongs, and includes a security point limit value Th in addition to the group authority information given for each group. . According to FIG. 3A, specifically, the group “admin” is permitted to read, write, and execute all the shared resources of the information system 10, and the group “power” is the information system. This indicates that reading and writing are permitted for 10 shared resources, but execution is not permitted. The table shown in FIG. 3A shows the group authority for a predetermined shared resource. In addition to this, a table indicating which resources each group can access is also managed by the group master DB 101. Has been. The security point limit value Th is a security point that is a threshold value for belonging to a group. For example, since the group “admin” is required to have a security point of 100 or less, if the user belonging to the group “admin” has 70 calculated security points, the group “admin” continues. However, when the security point is 130, the user cannot belong to the group “admin” and is changed to the group “power” having lower security authority.

  As shown in FIG. 3B, the user authority DB 102 is a database for managing the security authority of each user, and includes information on the group to which the user belongs and the highest authority. For example, since user A belongs to the group “admin”, referring to FIG. 3A described above, it can be seen that the user A is a user who can read, write, and execute all the shared resources of the information system 10. . The highest authority means a group having the highest security authority (the highest security management level) among the groups to which the user can belong. For example, in the case of the user A belonging to the group “admin”, The group “admin” has the highest authority (no matter how well the user A acts, the group “admin” is the upper limit). In this embodiment, the highest authority is set to limit the group change. However, other methods, for example, the lowest authority (the lowest security authority (security management level among the groups to which the user can belong) May be provided, or both the highest authority and the lowest authority may be provided to limit the group change.

  The authentication log DB 103 is a database that manages an access log that is accumulated whenever a user logs in to the information system 10 and is authenticated. As shown in FIG. 3C, the login date, logout date, user ID, Information regarding the IP address of the accessed computer 5i is provided. The reason why the user ID and the IP address of the accessed computer 5i are managed in association with each other is that the information system 10 may be accessed using a computer 5i other than the user ID.

  As shown in FIG. 4A, the security point DB 104 is a database for managing security points for each user's day, and records security points calculated from the IDS log data 601 by a security point calculation method described later. It is supposed to be. In this embodiment, the security point is calculated and recorded every day. However, the security point is calculated every other fixed period (for example, one week, one month, etc.). May be.

  FIG. 4B shows a data structure of the IDS log data 601 periodically acquired from the IDS 6, and the IDS log data 601 is used by the user authority control device 1 to calculate the above-described security point. Here, the IDS 6 accumulates the IDS log data 601 every day. Specifically, the IDS log data 601 includes information on date and time, log contents, risk, transmission source address, and transmission destination address. "Date and time" is the date and time of unauthorized access, "Log content" is the content of unauthorized access, "Danger level" is the risk of unauthorized access (high, medium, low), "Send The “original IP address” records the IP address of the computer 5i used by the user who performed unauthorized access, and the “destination IP address” records the IP address of the computer 5i targeted for unauthorized access. For example, the IDS log data 601A indicates that on November 1, 2004, the computer 5a having the IP address a.a.a.a performed a port scan (medium risk) for the computer 5b having the IP address b.b.b.b.

  As shown in FIG. 4 (c), the point master DB 105 is a database that manages point data for converting the risk level of each IDS log data 601 into points. Point 3 is stored in association with point 2 for an action with a medium risk level and point 1 for an action with a low risk level. In this embodiment, the risk level is divided into three levels, but the risk level may be further subdivided into points.

  Here, a security point calculation method will be described.

  When the user authority control apparatus 1 periodically acquires the IDS log data 601, the user authority control apparatus 1 searches the authentication log DB 103 based on the transmission source IP address and date / time of the IDS log data 601, and performs authentication including the transmission source IP address and date / time. Identify log data. For example, in the case of the IDS log data 601A, the authentication log data 103A is specified from the IP address “aaaa” and the date and time “Nov. 1, 2004 10:10” (log in date and time Nov. 1, 2004 9:30). ≦ Unauthorized access date / time November 1, 2004 10: 10 ≦ Logout date / time November 1, 2004 20:00).

  By identifying the authentication log data, the user who has made unauthorized access can be identified, and the point master DB 105 is referred to and added as the security point of the user. For example, in the case of the IDS log data 601A, since it is known that the user A has performed the port scan, the point master DB 105 is referred to, and the port scan risk level of 2 points is added as the user A security point. From the acquired IDS log data 601, in this way, all the unauthorized access acts of the user A are added as the security points of the user A. For example, when the user A performs an unauthorized access act shown in the IDS log data 601A and 601B, the point 2 of “port scan” and the point 3 of “attack the security hole of ssh v1” are added. 5 points.

  The above-described user authority control apparatus 1 is an electronic device having a central processing unit (CPU) having at least a calculation function and a control function, and a main storage device (memory) including a RAM having a function of storing programs and data. It consists of various devices. Further, the user authority control device 1 may include an auxiliary storage device such as a hard disk in addition to the main storage device.

  Among these, the authentication part 11, the inspection part 12, the calculation part 13, the determination part 14, and the authority control part 15 are nothing but what specifically showed the arithmetic control function by said CPU. The user authority control information storage unit 16 has the functions of the main storage device and the auxiliary storage device.

  A program for executing various processes according to the present embodiment is stored in the main storage device or the hard disk described above. The program can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, or a DVD-ROM, or can be distributed via a communication network.

  Further, the user authority control device 1 may be any configuration such as a system in which a plurality of devices are connected to a network in addition to a physically single device.

  In the present embodiment, the IDS 6 is arranged in the information system 10 in order to detect a packet flowing in the information system 10. However, various arrangements of the IDS 6 can be considered depending on the application. For example, when detecting a packet exchanged between the information system 10 and the external communication network 4, the IDS 6 is arranged between the firewall 3 and the communication network 4 to detect a packet flowing between the information system 10 and the external network. You may do it. Alternatively, it may be arranged at the boundary of each segment of a LAN (Local Area Network) constructed in the information system 2 to detect packets flowing between the LANs.

  Next, the operation of the information system 10 to which the user authority control apparatus 1 according to the present embodiment is applied will be described with reference to FIGS. Here, FIG. 5 is a sequence diagram for explaining the operations of the user authority control device 1 and the IDS 6 when the user performs predetermined processing on the information system 10, and FIG. It is a sequence diagram explaining the operation | movement which calculates the security point of and controls user authority.

  First, the user logs in to the information system 10 from the computer 5i (step S10). Note that the computer 5i used for login may be its own terminal or another person's terminal.

  Thereby, the user authority control apparatus 1 performs user authentication (step S20). The user authentication method may be anything, and may be authentication using a password or authentication using biometric information such as a fingerprint.

  After user authentication, the user authority control apparatus 1 records authentication log data in the authentication log DB 103 (step S30). Specifically, the login date, user ID, and IP address shown in FIG. 3C are recorded. The recorded IP address is the IP address of the computer 5 i used when the user logs in to the information system 10.

  Next, the user performs a desired process on the information system 10 (step S40). At this time, when the user performs a malicious action (unauthorized access; for example, port scan or mass packet transmission), the IDS 6 detects unauthorized access from a packet flowing on the network, and identifies the unauthorized access action in the IDS log data 601. (Steps S50 and S60).

  Next, the user ends the above processing for the information system 10 and logs out from the information system 10 (step S70). Thereby, the user authority control apparatus 1 records the authentication log data in the authentication log DB 103 (step S80). Specifically, the logout date and time shown in FIG.

  Next, the user authority control apparatus 1 acquires the IDS log data 601 from the IDS 6 using a predetermined date and time as a trigger (Steps S110, S120, and S130). In the present embodiment, the user authority control device 1 periodically issues an acquisition instruction to the IDS 6, whereby the IDS 6 transmits the IDS log data 601 to the user authority control device 1. The IDS log data 601 may be voluntarily transmitted to the user authority control device 1 when a predetermined date and time (or when the IDS log data 601 is acquired).

  Upon receiving the IDS log data 601, the user authority control device 1 determines the unauthorized access user from the IDS log data 601 and the authentication log data recorded in the authentication log DB 103, and refers to the point master DB 105 for determination. The user's security point is calculated (step S140). As described above, the acquired IDS log data 601 is tabulated for each user.

  Next, the user authority control apparatus 1 records the calculated security point in the security point DB 104 (step S150).

  Next, the user authority control apparatus 1 determines the security management level from the security points recorded in the security point DB 104 (step S160). This obtains the security point limit value Th of the group to which the user belongs from the group master DB 101 and the user authority DB 102, and compares the acquired security point limit value Th with the calculated security point.

  As a result, when the calculated security point> the security point limit value Th, since the appropriate user authority is not set, the user authority is changed, that is, the group to which the user belongs is calculated with the calculated security point ≦ The security authority limit value Th is changed to a group with a low security authority, and the user authority DB 102 is updated (steps S170 and S180).

  On the other hand, when the calculated security point ≦ security point limit value Th, since the appropriate user authority is set, the user authority is not changed (step S170).

  Therefore, according to the present embodiment, IDS log data 601 relating to unauthorized access performed by the user to the information system 10 is acquired, the user who performed unauthorized access is identified, and the security point of the user is set for unauthorized access. Since the user authority is updated based on the point calculation according to the degree of risk, and the user authority is updated based on the quantified security point value, it is possible to reflect the daily unauthorized access act of the user in the user authority.

  As a result, users who have not taken proper security measures are restricted from accessing the shared resources of the information system 10, so that it is possible to prevent security damage caused by users who have not taken security measures.

  In addition, by regularly presenting the user authority (security point) to the user, the user's security literacy can be improved.

<Other embodiments>
While the embodiments of the present invention have been described above, various modifications and changes can be made to the embodiments of the present invention without departing from the spirit of the present invention. For example, in the above embodiment, the security point related to unauthorized access is calculated from the IDS log data 601 stored in the IDS 6, but the present invention is not limited to this, and for example, the vulnerability of the computer 5i is inspected. It is also possible to further include a vulnerability inspection device 7 that calculates security points related to the vulnerability.

  FIG. 7 is a schematic configuration diagram of an information system 20 to which the user authority control apparatus 2 according to the second embodiment of the present invention is applied. The information system 20 shown in FIG. 7 adds the above-described vulnerability inspection device 7 to the system configuration of the information system 10, and the user authority control device 2 provides information related to the vulnerability of the computer 5i in addition to information related to unauthorized access. Is also obtained and the user's security point is calculated. The vulnerability check according to the present embodiment may include a virus check that is included in the anti-virus software in addition to a check for hardware defects and software bugs.

  Specifically, when the user is logged in to the information system 20, the vulnerability inspection apparatus 7 inspects the vulnerability of the computer 5i to which the user is logged in, and information on the vulnerability discovered from the inspection result is obtained as vulnerability log data. 701 is recorded. Specifically, as shown in FIG. 8, the vulnerability log data includes information about date and time, log contents, vulnerability level, and IP address. “Log content” indicates the content of the discovered vulnerability, “Vulnerability” indicates the risk level of the vulnerability (high, medium, low), and “IP address” indicates the computer that the user has logged into the information system 20 The 5i IP address is recorded.

  A security point calculation method of the user authority control device 2 will be described.

  The user authority control apparatus 2 periodically acquires the IDS log data 601 and the vulnerability log data 701, and uses the unauthorized access user or the computer 5i having the vulnerability from the authentication log data recorded in the authentication log DB 103. Referring to the point master DB 105 ′ (the point master DB 105 ′ associates the risk level of unauthorized access with points and manages the risk level of vulnerability and points in association with each other) with reference to the user. Calculate security points. That is, the security point recorded in the security point DB 104 is a security point related to computer vulnerability in addition to a security point related to unauthorized access.

  Therefore, according to this embodiment, in addition to the effects of the first embodiment, the security point value is calculated by taking into account the point calculation according to the vulnerability risk of the computer 5i used by the user. Therefore, more appropriate user authority can be set.

  In the second embodiment, both the IDS 6 and the vulnerability inspection device 7 are provided. However, only the vulnerability inspection device 7 is provided, only the security points related to the vulnerability are calculated, and the calculated security is calculated. User authority may be controlled based on points.

  In the second embodiment, when calculating a security point, a security point related to unauthorized access and a security point related to computer vulnerability are simply added, but the present invention is not limited to this. Instead, for example, when unauthorized access or vulnerability is found, the user is notified, and whether the user has dealt with the discovered unauthorized access or vulnerability is reflected in the security point. Good.

  FIG. 9 is a calculation formula showing this example. In this calculation method, the security point RL is calculated by adding the security point RL_1 related to the vulnerability and the security point RL_2 related to unauthorized access, and multiplying the added security point by the computer importance. Here, the computer importance is an index indicating the importance of each computer 5 i in the information system 20. In addition, the security point RL_1 of the vulnerability is the elapsed time (the time from the discovery of the vulnerability until it is dealt with. The time when the security point is calculated when the vulnerability is not dealt with. To calculate the security point rl_1 of each vulnerability, and sum the security points rl_1 of the individual vulnerabilities. Similarly, the unauthorized access security point RL_2 calculates each unauthorized access security point rl_2 by multiplying each risk level by the elapsed time, and takes the sum of each unauthorized access security point rl_2. Each element of the above-described calculation formula has a numerical value corresponding to the degree as shown in FIG. 9, and the calculated security point RL indicates that the higher the numerical value is, the lower the security management level is. It has become.

  Therefore, if the calculation time as shown in FIG. 9 is used to reflect the elapsed time from the discovery of unauthorized access or vulnerability until the countermeasure is taken to the security point, the user who has left unauthorized access or vulnerability untouched Since the security point is calculated high, the security management level is low, and access to the shared resources of the information system 20 is restricted. In other words, it is possible to operate such that a user with a high security management level is not given unless the user responds to unauthorized access or vulnerability more quickly.

  Furthermore, in the said embodiment, although IDS6 or the vulnerability test apparatus 7 was arrange | positioned on the network in the information system 10 or 20, the computer 5i is provided with the function of IDS6 or the vulnerability test apparatus 7. (For example, a program that functions as the IDS 6 or the vulnerability inspection device 7 is installed in the computer 5i), and the user authority control device 1 or 2 periodically sends the IDS log data 601 and the vulnerability log data 701 from the computer 5i. The security point may be calculated based on the log data acquired from the computer 5i.

It is a schematic block diagram of the information system to which the user authority control apparatus which concerns on embodiment of this invention is applied. It is a figure which shows the structure of the user authority control apparatus which concerns on embodiment of this invention. It is a figure explaining the structure of the database which stores user authority control information. It is a figure explaining the structure of the database which stores user authority control information. It is a sequence diagram explaining operation | movement of the user authority control apparatus which concerns on embodiment of this invention. It is a sequence diagram explaining operation | movement of the user authority control apparatus which concerns on embodiment of this invention. It is a schematic block diagram of the information system with which the user authority control apparatus which concerns on other embodiment of this invention is applied. It is a figure explaining the structure of the database which stores user authority control information. It is a figure which shows an example of the calculation formula which calculates the security point of the user authority control apparatus which concerns on other embodiment of this invention.

Explanation of symbols

1, 2 User authority control device 3 Firewall 4 Internet network (external communication network)
5i computer 6 IDS
7 Vulnerability Inspection Device 10, 20 Information System 11 Authentication Unit 12 Inspection Unit 13 Calculation Unit 14 Determination Unit 15 Authority Control Unit 16 User Authority Control Information Storage Unit 101 Group Master DB
102 User authority DB
103 Authentication log DB
104 Security point DB
105 Point master DB
601 IDS log data 701 Vulnerability log data

Claims (8)

A user authority control device for dynamically setting user authority of a computer system,
For each group, a security right indicating the access level of a user belonging to the group to a predetermined resource, and a threshold of a security point value obtained by quantifying unauthorized access in the predetermined period or the vulnerability of the computer used by the user A group storage means having a security point threshold value of
In the predetermined period, to obtain information about unauthorized access performed by the user from the intrusion detection system for detecting fraud user, or the vulnerability of the vulnerability information of the computer the user is using the computer User information acquisition means that acquires from a vulnerability inspection device to inspect, or acquires information on the unauthorized access from the intrusion detection system and acquires information on the vulnerability from the vulnerability inspection device ;
Said user information acquisition means has acquired, the fragility degree included in the information about the risk or the vulnerability included in the information about the unauthorized access, respectively converted to a predetermined point in accordance with the risk or the fragility of Security point calculation means for calculating a total value of each converted point as a security point value for the predetermined period of the user;
Threshold acquisition means for acquiring a security point threshold of the group to which the user belongs from the group storage means;
The security point value calculated by the security point calculation unit is compared with the security point threshold value acquired by the threshold value acquisition unit. If the security point value exceeds the security point threshold value, the group to which the user belongs is assigned a security authority. User authority update means to update to a lower group,
A user authority control device characterized by comprising:   When the security point value exceeds the security point threshold value, the user authority update means refers to the group storage means to indicate the group to which the user belongs, and the security point value does not exceed the security point threshold value. The user authority control apparatus according to claim 1, wherein the user authority control apparatus is updated to a group. For each user, further has a user authority storage means for setting a group to which the user belongs,
The user authority update means refers to the group storage means when the security point value exceeds the security point threshold value, and assigns the group to which the user belongs stored in the user authority storage means to the security The user authority control apparatus according to claim 1, wherein the point value is updated to a group that does not exceed the security point threshold value. Said security point calculation means, wherein the risk and the fragility of the multiplied respectively the elapsed time until the address from the time the discovery of unauthorized access or the vulnerability importance of the computer to the sum of the multiplied values obtained by multiplying 4. The user authority control apparatus according to claim 1 , wherein the security point value is calculated by multiplying a degree . 5. A user right control method for dynamically setting user rights of a computer system,
The user authority control device
For each group, a security right indicating the access level of a user belonging to the group to a predetermined resource, and a threshold of a security point value obtained by quantifying unauthorized access in the predetermined period or the vulnerability of the computer used by the user A group storage unit having a security point threshold value of
In the predetermined period, to obtain information about unauthorized access performed by the user from the intrusion detection system for detecting fraud user, or the vulnerability of the vulnerability information of the computer the user is using the computer User information acquisition step of acquiring from the vulnerability inspection device, or acquiring information from the intrusion detection system and acquiring information about the vulnerability from the vulnerability inspection device , acquired from the vulnerability inspection device to be inspected , or
Acquired by the user information acquisition step, the weak degree included in the information about the risk or the vulnerability included in the information about the unauthorized access, respectively converted to a predetermined point in accordance with the risk or the fragility of A security point calculation step of calculating a total value of each converted point as a security point value in the predetermined period of the user;
A threshold acquisition step of acquiring a security point threshold of a group to which the user belongs from the group storage unit;
The security point value calculated in the security point calculation step is compared with the security point threshold value acquired in the threshold acquisition step, and if the security point value exceeds the security point threshold value, the group to which the user belongs is assigned a security authority. A user authority update step for updating to a lower group,
A user authority control method characterized by: A user authority control program that can be read by a user authority controller that dynamically sets user authority of a computer system,
For each group, the user authority control device includes a security authority indicating an access level to a predetermined resource of a user belonging to the group, an unauthorized access in a predetermined period, or a vulnerability of a computer used by the user. A group storage unit having a security point threshold that is a threshold of the quantified security point value;
In the predetermined period, to obtain information about unauthorized access performed by the user from the intrusion detection system for detecting fraud user, or the vulnerability of the vulnerability information of the computer the user is using the computer A user information acquisition step of acquiring from the vulnerability inspection device, or acquiring information from the intrusion detection system and acquiring information about the vulnerability from the vulnerability inspection device ;
Acquired by the user information acquisition step, the weak degree included in the information about the risk or the vulnerability included in the information about the unauthorized access, respectively converted to a predetermined point in accordance with the risk or the fragility of A security point calculation step of calculating a total value of each converted point as a security point value in the predetermined period of the user;
A threshold acquisition step of acquiring a security point threshold of a group to which the user belongs from the group storage unit;
The security point value calculated in the security point calculation step is compared with the security point threshold value acquired in the threshold acquisition step, and if the security point value exceeds the security point threshold value, the group to which the user belongs is assigned a security authority. A user authority update step for updating to a lower group,
Is executed by the user authority control apparatus.   In the user authority updating step, when the security point value exceeds the security point threshold value, the group storage unit is referred to and the group to which the user belongs is referred to, and the security point value does not exceed the security point threshold value. 7. The user authority control program according to claim 6, wherein the program is updated to a group. Said security point calculating step, the risk level and the weak level, the multiplied respectively the elapsed time until the address from the time the discovery of unauthorized access or the vulnerability importance of the computer to the sum of the multiplied values obtained by multiplying 8. The user authority control program according to claim 6 , wherein the security point value is calculated by multiplying a degree .

Images