JP4572086B2 - Network, authentication server device, router device, and terminal management method used therefor - Google Patents

Description

  The present invention relates to a network, an authentication server device, a router device, and a terminal management method used therefor, and more particularly to terminal ledger management and filtering / policy management by cooperation between the authentication server device and the router device.

  In recent years, with the spread of the Internet and e-mail, the infection of computer viruses using them has increased rapidly. This computer virus has spread rapidly to terminals that have not been applied with the latest patches for closing security holes in OSs (Operating Systems) and application software, and there is a risk that many companies will be forced to stop services due to network congestion. . The task of dealing with computer viruses and applying the latest patches is left to individual morals.

  In addition, malicious users use terminals in the intranet without permission, and crimes involving attacks on network devices, data tampering, interception, etc. are increasing, but user authentication minimizes damage. It becomes possible to keep it on.

  In a conventional system that controls network connection of a terminal, a server-type system that collects terminal operating status and user information remotely by installing dedicated resident software on the terminal (see, for example, Patent Documents 1 and 3) And a network type system in which a network device authenticates a connected terminal (for example, see Patent Document 2).

JP 2003-174482 A JP 2002-325077 A JP 11-102333 A

  In the conventional system described above, there are completely independent systems of a server type system and a network type system, but these have imperfect parts in terms of security.

  For example, in a network type system, a terminal once permitted to connect to a network can freely communicate within an intranet according to a set policy, regardless of who the user is (an unauthorized user). There is a problem that it can be done.

  In addition, when the state of a terminal changes to a weak state for security reasons, it is possible for the administrator to immediately grasp the state, but it must be done manually to disconnect the terminal from the network. I must. Further, if the terminal disconnection process is delayed, the computer virus may spread.

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to provide a network, an authentication server device, a router device, and a terminal management method used for them, which can solve the above-described problems and can automatically manage terminals connected to the network in an integrated manner. It is in.

The network according to the present invention is a network including an authentication server device that at least acquires terminal operation information and user authentication, and a plurality of router devices that relay IP (Internet Protocol) packets within an organization network. And
Means for acquiring ARP (Address Resolution Protocol) from the terminal and acquiring terminal information of the terminal; means for notifying the acquired terminal information to the authentication server apparatus; and terminal information managed by the authentication server apparatus A means for performing a filtering process on the packet transmitted by the terminal based on the router,
The authentication server device, the terminal the user authentication and the at least line physicians and acquire operation information including at least the version information of the applied patches and virus definition file of the terminal based on the information notified from the router device Generating a packet filtering policy for the filtering processing in the router device based on the result,
The router device dynamically controls a destination network that can be relayed for each terminal by filtering processing based on the packet filtering policy .

An authentication server device according to the present invention is an authentication server device that performs at least acquisition of terminal operation information and user authentication,
In a plurality of router devices that relay IP (Internet Protocol) packets in an organization network, the terminal has already been applied based on terminal information of the terminal obtained by listening to ARP (Address Resolution Protocol) from the terminal . Means for obtaining at least operation information including version information of patches and virus definition files and user authentication, and generating packet filtering policies for filtering processing in the plurality of router devices based on the result Means .

A router device according to the present invention is a router device that relays an IP (Internet Protocol) packet within an organization network,
And means for acquiring the acquisition and user authentication and terminal information used for the operation information of the terminal to be performed in the authentication server by listening to ARP from the terminal (Address Resolution Protocol), the the acquired terminal information Means for notifying the authentication server device, and means for performing filtering processing on a packet transmitted by the terminal based on terminal information managed by the authentication server device,
The authentication server device performs at least acquisition of operation information including at least version information of an applied patch and virus definition file of the terminal and the user authentication based on the terminal information, and generated based on the result A destination network that can be relayed for each terminal is dynamically controlled by filtering processing based on a packet filtering policy for filtering processing.

A terminal management method according to the present invention is a system including an authentication server device that at least acquires terminal operation information and user authentication, and a plurality of router devices that relay IP (Internet Protocol) packets in an organization network. A terminal management method for managing the connection of the terminal to the network,
Listening to ARP (Address Resolution Protocol) from the terminal and acquiring terminal information of the terminal on the router apparatus side, notifying the acquired terminal information to the authentication server apparatus, the authentication server apparatus Filtering a packet transmitted by the terminal based on terminal information managed by the terminal ,
The authentication server device, the terminal the user authentication and the at least line physicians and acquire operation information including at least the version information of the applied patches and virus definition file of the terminal based on the information notified from the router device Generating a packet filtering policy for the filtering processing in the router device based on the result,
The router device dynamically controls a destination network that can be relayed for each terminal by filtering processing based on the packet filtering policy .

In other words, the network according to the present invention is configured such that an authentication server that acquires terminal operation information and user authentication and all router apparatuses that form an intra-organization network (hereinafter referred to as an intranet) cooperate with each other. It is a system that dynamically controls a destination network that can be relayed to the network.

  In the network of the present invention, terminal / user management by an authentication server and connection destination network management by a router device can be performed integrally, and terminal ledger management, terminal operating status, and filtering based on terminal user information Control can be realized.

In the network of the present invention, an authentication server that acquires terminal operation information and user authentication cooperates with all router devices (a plurality of router devices) that relay IP (Internet Protocol) packets within an intranet. It is possible to dynamically control a destination network that can be relayed for each terminal.

  In the network of the present invention, terminal / user management by the authentication server and connection destination network management by the router device can be integrally performed, and terminal ledger management, terminal operating status, and filtering based on terminal user information Control can be realized.

  In the network of the present invention, by using the above-described router device as a relay device between each subnet of an intranet, it is possible to control a user or a terminal so as not to send out an illegal packet generated outside the subnet. Therefore, it is possible to keep the damage caused by DoS attack (Denial of Service attack) and virus spread within the subnet.

  With the configuration and operation described below, the present invention provides an effect that the terminals connected to the network can be managed automatically.

  Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a network configuration according to an embodiment of the present invention. In FIG. 1, a network according to an embodiment of the present invention includes terminals 1-1 and 1-2, IC (Integrated Circuit) card readers 2-1 and 2-2, routers 3-1 and 3-2, and authentication. The server 4 and the download server 5 are included.

  Terminals 1-1 and 1-2 exist in the intranet, and are connected to the network by connecting to routers 3-1 and 3-2 via a switching hub (not shown). Each of the terminals 1-1 and 1-2 has a function of providing operation information (and applied patch and virus definition file version information) and user information to the authentication server 4, and the authentication server 4 itself Dedicated software (hereinafter referred to as resident software) that can display the management level (hereinafter referred to as terminal management level) is installed.

  The IC card readers 2-1 and 2-2 are connected to the terminals 1-1 and 1-2, respectively, and are readers for connecting an IC card (not shown) used for user authentication. That is, information used for user authentication read from the IC card by the IC card readers 2-1 and 2-2 is sent to the terminals 1-1 and 1-2.

  The routers 3-1 and 3-2 have a routing function for relaying IP (Internet Protocol) communication between the segments # 1 to # 3 and the monitoring target segment (in the case of FIG. 1, the router 3-1 is the segment # 2 and the router 3 -2 detects the terminals 1-1 and 1-2 connected to the segment # 3 as the monitoring target segment), and tabulates terminal information existing in the monitoring target segment (hereinafter, the tabulated table is the terminal table). And a function for transmitting to the authentication server 4 and a function for dynamically generating a packet filtering rule according to an instruction from the authentication server 4.

  The authentication server 4 has a function of collecting terminal locations, terminal operation information, and user information and creating a ledger, a function of generating a packet filtering policy based on the collected information, and the packet filtering policy as a router 3-1. , 3-2.

  The download server 5 includes the resident software installed on the terminals 1-1 and 1-2, the latest patches and viruses so that the authentication server 4 can collect the operation information and user information of the terminals 1-1 and 1-2. And a function for providing a definition file download service.

  FIG. 2 is a block diagram showing the configuration of the terminal shown in FIG. In FIG. 2, the terminal 1 includes a resident software unit 11 and an IC card reader connection unit 12, and the resident software unit 11 includes a providing function 111. The terminals 1-1 and 1-2 shown in FIG. 1 have the same configuration as the terminal 1 described above.

  The resident software unit 11 is a storage unit in which dedicated software (hereinafter referred to as resident software) capable of displaying its own management level (hereinafter referred to as terminal management level) in the authentication server 4 is installed. The provision function 111 of the resident software unit 11 is a function that provides the authentication server 4 with operation information (and applied patch and virus definition file version information) and user information. The IC card readers 2-1 and 2-2 are connected to the IC card reader connection unit 12, and the IC card readers 2-1 and 2-2 acquire information used for user authentication read from the IC card.

  FIG. 3 is a block diagram showing the configuration of the router of FIG. In FIG. 3, the router 3 includes a routing function 31, a terminal detection function 32, a terminal table 33, a transmission / reception function 34, a packet filtering function 35, and a traffic amount observation function 36. The packet filtering function 35 includes a dynamic filtering rule generation function 35a and a packet filtering processing function 35b. The routers 3-1 and 3-2 have the same configuration as the router 3 described above.

  The routing function 31 relays the IP communication between the segments # 1 to # 3, the terminal detection function 32 is the monitored segment (in the case of FIG. 1, the router 3-1 has the segment # 2, the router 3-2 has the segment # 3 The terminals 1-1 and 1-2 connected to the monitoring target segment) are detected.

  The terminal table 33 is a table of terminal information existing in the monitoring target segment. The transmission / reception function 34 includes a function of transmitting the terminal table 33 to the authentication server 4. The packet filtering function 35 dynamically generates a packet filtering rule according to an instruction from the authentication server 4.

  The dynamic filtering rule generation function 35 a of the packet filtering function 35 dynamically generates a filtering rule based on the packet filtering policy distributed from the authentication server 4. The packet filtering processing function 35b performs transmission / reception packet filtering processing in the monitoring target segment.

  The traffic volume observation function 36 is a function for transmitting information to the authentication server 4 and filtering the traffic based on an instruction from the authentication server 4 when a terminal that continues to transmit abnormally large traffic is found.

  FIG. 4 is a block diagram showing the configuration of the authentication server of FIG. In FIG. 4, the authentication server 4 includes an information collection function 41, a packet filtering / policy generation function 42, and a filtering / policy distribution function 43.

  The information collection function 41 is a function that collects the location of the terminals 1-1 and 1-2, the operation information of the terminals 1-1 and 1-2, and the user information to make a ledger. The packet filtering policy generation function 42 is a function for generating a packet filtering policy based on the information collected by the information collection function 41. The filtering policy distribution function 43 is a function for distributing the packet filtering policy generated by the packet filtering policy generation function 42 to the routers 3-1 and 3-2.

  FIG. 5 is a block diagram showing the configuration of the download server of FIG. In FIG. 5, the download server 5 includes a resident software unit 51 and a download service function 52.

  The resident software unit 51 stores and downloads resident software installed in the terminals 1-1 and 1-2 so that the authentication server 4 collects the operation information and user information of the terminals 1-1 and 1-2. The service function 52 provides a download service for the latest patches and virus definition files.

  6 is a flowchart showing the terminal table generation procedure in the routers 3-1 and 3-2 in FIG. 1, FIG. 7 is a flowchart showing the processing of the aging timer used in the terminal table 33 in FIG. 3, and FIG. It is a figure which shows the structural example of the terminal table 33 of FIG. The terminal table generation procedure in the routers 3-1 and 3-2 will be described with reference to FIG. 1, FIG. 3, and FIGS.

  Registered in the terminal table 33 is information on all hosts connected to the monitoring segment obtained by listening to all ARP (Address Resolution Protocol) communications that the routers 3-1 and 3-2 flow through the monitoring segment. Is done. Here, ARP is a protocol for obtaining a hardware address such as a MAC (Media Access Control) address from an IP address.

  8, the terminal table 33 includes an IP address (“192.168.0.1”, “192.168.0.2”), a MAC address (“aaa.aaa.aaaa”, “bbbb.bbbb. bbbb ") and an aging timer (" remaining 10 minutes "," remaining 20 minutes ").

  The terminal table generation procedure in the routers 3-1 and 3-2 will be described in detail. When the routers 3-1 and 3-2 receive the ARP request from the terminal (step S1 in FIG. 6), if the IP address of the terminal that has transmitted the ARP request is not registered in the terminal table 33 (step S2 in FIG. 6), The IP address is registered in the terminal table 33 (step S3 in FIG. 6), and an initial value (for example, “30 minutes remaining”) is set in the aging timer of the registered entry (step S4 in FIG. 6). The entry change information is transmitted to the authentication server 4 (step S9 in FIG. 6).

  If the routers 3-1 and 3-2 have registered the IP address of the terminal that has transmitted the ARP Request in the terminal table 33 (step S 2 in FIG. 6), the same IP address and MAC address pair has already been registered. Is checked (step S5 in FIG. 6).

  If the same combination of IP address and MAC address has already been registered, the routers 3-1 and 3-2 reset the aging timer of the corresponding entry and set an initial value (step S 6 in FIG. 6). It returns and waits for reception of the ARP Request from the terminal.

  On the other hand, if the pair of the same IP address and MAC address is not already registered in the routers 3-1 and 3-2, the new IP address and MAC address pair is changed to the old IP address and MAC address pair. Overwriting (step S7 in FIG. 6), resetting the aging timer of the entry, setting an initial value (step S8 in FIG. 6), and transmitting entry change information in the terminal table 33 to the authentication server 4 (step S9 in FIG. 6). .

  Deletion of entries registered in the terminal table 33 is executed by an aging timer. Each time an entry is registered in the terminal table 33, an initial value is set in the aging timer (step S11 in FIG. 7), and an aging timer reset that is output every time an ARP request is received from an already registered host is received. Then (step S12 in FIG. 7), an initial value is set in the aging timer of the corresponding entry (step S13 in FIG. 7). The initial value of the aging timer in the terminal table 33 is preferably a sufficiently long time in consideration of the load on the authentication server 4. An example of the terminal table 33 is shown in FIG. 8 as described above.

  If no reset is received for the aging timer of any entry in the terminal table 33 (step S12 in FIG. 7), the counting process of the aging timer for each entry is performed (step S14 in FIG. 7). When the aging timer expires (step S15 in FIG. 7), the routers 3-1 and 3-2 delete the entry in the terminal table 33 (step S16 in FIG. 7) and transmit the entry change information in the terminal table 33 to the authentication server 4. (Step S17 in FIG. 7). If the aging timer does not expire (step S15 in FIG. 7), the routers 3-1 and 3-2 return to step S12 and repeat the above processing.

  9 is a diagram showing a configuration example in which the information collected by the information collection function 41 in FIG. 4 is converted into a ledger, and FIG. 10 is an example of a packet filtering policy created based on the ledger information shown in FIG. 11 and FIG. 12 are sequence charts showing connection processing to the network in the terminals 1-1 and 1-2 in FIG. 1, and FIG. 13 is a sequence showing information collection in the authentication server 4 in FIG. It is a chart. Information collection in the authentication server 4 will be described with reference to FIGS. 1, 2, 4, and 9 to 13.

  Here, FIG. 11 shows a case where terminal information can be collected from the authentication server 4 by downloading the resident software when the terminals 1-1 and 1-2 in FIG. 1 are physically connected to the network. Shows the processing. FIG. 12 shows a process when user authentication by the authentication server 4 fails without downloading the resident software when the terminals 1-1 and 1-2 in FIG. 1 are physically connected to the network. Show.

  First, the terminals 1-1 and 1-2 are not registered in the ledger of the authentication server 4 when they are physically connected to the network. The routers 3-1 and 3-2 normally operate so as to discard all packets, and only communicate with the authentication server 4 and the download server 5 according to the packet filtering policy from the authentication server 4. It is set to allow, and then allow all communication.

  That is, when the routers 3-1 and 3-2 listen to the ARP request from the terminals 1-1 and 1-2 connected to the network (a 1 in FIG. 11), the router 3-1 and 3-2 update the entry in the terminal table 33 (FIG. 11). a2) The update information (MAC address, IP address) is transmitted to the authentication server 4 (a3 in FIG. 11).

  In the information collection function 41 of the authentication server 4, the location information of the terminals 1-1 and 1-2 is collected based on the information (update information) in the terminal table 33 distributed from the routers 3-1 and 3-2. To run. Thereafter, the information collecting function 41 receives user information, etc. [OS (Operating) from each terminal 1-1, 1-2 based on the address information of each terminal 1-1, 1-2 registered in the terminal table 33. (System) type, applied patch / applied virus definition file version information, user information], a request for user information is transmitted to the terminals 1-1 and 1-2 (a4 in FIG. 11). .

  However, since resident software is not installed in the terminals 1-1 and 1-2, the authentication server 4 fails to acquire data such as user information (a5 in FIG. 11). 2 generates a packet filtering policy for blocking access to other than the authentication server 4 and the download server 5 (a6 in FIG. 11) and distributes it to the routers 3-1 and 3-2 (a7 in FIG. 11). ), The filtering setting of each of the routers 3-1 and 3-2 is performed (a8 in FIG. 11).

  Therefore, the terminals 1-1 and 1-2 send a resident software request to the download server 5 (a9 in FIG. 11), and when the resident software is sent from the download server 5 (a10 in FIG. 11), the resident software Is installed in the resident software unit 11 (a11 in FIG. 11).

  For authentication of user information, digital certificate authentication is used. This digital certificate is registered and managed in a database (not shown) when the IC card is created, and the contents of the database are reflected in the ledger used by the authentication server 4 for authentication of the terminals 1-1 and 1-2. When the contents of the database are changed, the changed contents are immediately reflected in the ledger.

  When authenticating user information, the terminal user connects the IC card readers 2-1 and 2-2 to the terminals 1-1 and 1-2, and the IC card readers 2-1 and 2-2 use the IC card to read the user information. The digital certificate is read, and the digital certificate read from the IC card is transmitted from the terminals 1-1 and 1-2 to the authentication server 4. The authentication server 4 authenticates whether the user is authorized by the organization based on the digital certificate read from the IC card.

  That is, when an IC card is inserted into the IC card readers 2-1 and 2-2 connected to the terminals 1-1 and 1-2 (a12 in FIG. 11), the terminals 1-1 and 1-2 are connected to the network. Is sent to the authentication server 4 (a13 in FIG. 11). When the notification of connection to the network is sent from the terminals 1-1 and 1-2, the authentication server 4 updates the ledger in order to update the operating state of the terminals 1-1 and 1-2 (FIG. 11). A14).

  The authentication server 4 generates a packet filtering policy based on the updated ledger and sends it to the routers 3-1 and 3-2 (a15 in FIG. 11). Filtering setting based on the policy is performed (a16 in FIG. 11). In this state, when an IP packet is transmitted from the terminals 1-1 and 1-2 to the network (a17 in FIG. 11), the routers 3-1 and 3-2 perform the above-described filtering based on the filtering setting. The IP packet is transferred (a18 in FIG. 11).

  On the other hand, when the IC card is removed from the IC card readers 2-1 and 2-2, the resident software unit 11 of the terminals 1-1 and 1-2 notifies the authentication server 4 of the information. That is, when the IC card is removed from the IC card readers 2-1 and 2-2 connected to the terminals 1-1 and 1-2 (a19 in FIG. 11), the terminals 1-1 and 1-2 are connected to the network. A disconnection notice is sent to the authentication server 4 (a20 in FIG. 11).

  Upon receiving a network disconnection notification from the terminals 1-1 and 1-2, the authentication server 4 updates the ledger in order to update the operating state of the terminals 1-1 and 1-2 (FIG. 11). a21). Since the authentication server 4 generates a packet filtering policy based on the updated ledger and sends it to the routers 3-1 and 3-2 (a22 in FIG. 11), the routers 3-1 and 3-2 are similar to the above. The filtering setting is performed based on the packet filtering policy.

  Next, processing when user authentication by the authentication server 4 fails without downloading the resident software when the terminals 1-1 and 1-2 in FIG. 1 are physically connected to the network will be described. First, when the routers 3-1 and 3-2 listen to the ARP request from the terminals 1-1 and 1-2 connected to the network (b 1 in FIG. 12), the router 3-1 and 3-2 update the entry in the terminal table 33 (in FIG. 12). b2) and update information (MAC address, IP address) is transmitted to the authentication server 4 (b3 in FIG. 12).

  In the information collection function 41 of the authentication server 4, the location information of the terminals 1-1 and 1-2 is collected based on the information (update information) in the terminal table 33 distributed from the routers 3-1 and 3-2. To run. Thereafter, the information collecting function 41 receives user information, etc. [OS (Operating) from each terminal 1-1, 1-2 based on the address information of each terminal 1-1, 1-2 registered in the terminal table 33. (System) type, applied patch / applied virus definition file version information, user information], a request for user information etc. is transmitted to the terminals 1-1 and 1-2 (b4 in FIG. 12). .

  However, since resident software is not installed in the terminals 1-1 and 1-2, the authentication server 4 fails to acquire data such as user information (b5 in FIG. 12), and thus user authentication fails. Therefore, the authentication server 4 generates a packet filtering policy for blocking access to the terminals 1-1 and 1-2 except for the authentication server 4 and the download server 5 (b6 in FIG. 12). 1 and 3-2 (b7 in FIG. 12), and filtering settings of the routers 3-1 and 3-2 are performed (b8 in FIG. 12).

  In this case, no resident software is installed on the terminals 1-1 and 1-2. In this state, when the IC card is inserted into the IC card readers 2-1 and 2-2 connected to the terminals 1-1 and 1-2 (b9 in FIG. 12), the terminals 1-1 and 1-2 are A notification of connection to the network is sent to the authentication server 4 (b10 in FIG. 12). When the notification of connection to the network is sent from the terminals 1-1 and 1-2, the authentication server 4 updates the ledger in order to update the operating state of the terminals 1-1 and 1-2 (FIG. 12). B11).

  Since the authentication server 4 generates a packet filtering policy based on the updated ledger and sends it to the routers 3-1 and 3-2 (b12 in FIG. 12), the routers 3-1 and 3-2 receive the packet filtering / Filtering setting based on the policy is performed (b13 in FIG. 12). At this time, the packet filtering policy is set so as to discard IP packets from the terminals 1-1 and 1-2.

  Therefore, when IP packets are transmitted from the terminals 1-1 and 1-2 to the network (b 14 in FIG. 12), the routers 3-1 and 3-2 make the above IP packet based on the above filtering settings. Is discarded (b15 in FIG. 12).

  On the other hand, when the IC card is removed from the IC card readers 2-1 and 2-2 connected to the terminals 1-1 and 1-2 (b16 in FIG. 12), the terminals 1-1 and 1-2 are connected to the network. A disconnection notice is sent to the authentication server 4 (b17 in FIG. 12). When the network disconnection notice is sent from the terminals 1-1 and 1-2, the authentication server 4 updates the ledger in order to update the operating state of the terminals 1-1 and 1-2 (FIG. 12). b18).

  Since the authentication server 4 generates a packet filtering policy based on the updated ledger and sends it to the routers 3-1 and 3-2 (b19 in FIG. 12), the routers 3-1 and 3-2 are similar to the above. Then, filtering setting based on the packet filtering policy is performed.

  As described above, when listening to the ARP request from the terminals 1-1 and 1-2 (c1 in FIG. 13), the routers 3-1 and 3-2 update the entry in the terminal table 33 (c2 in FIG. 13). ) And update information (MAC address, IP address) is transmitted to the authentication server 4 (c3 in FIG. 13).

  In the information collection function 41 of the authentication server 4, the location information of the terminals 1-1 and 1-2 is collected based on the information (update information) in the terminal table 33 distributed from the routers 3-1 and 3-2. To run. Thereafter, the information collecting function 41 receives user information, etc. [OS (Operating) from each terminal 1-1, 1-2 based on the address information of each terminal 1-1, 1-2 registered in the terminal table 33. (System) type, applied patch / applied virus definition file version information, user information], a request for user information etc. is sent to the terminals 1-1 and 1-2 (c4 in FIG. 13). .

  When the resident software installed in the terminals 1-1 and 1-2 receives the user information request from the authentication server 4, the user information data (OS type, applied patch / applied virus definition file version information, User information and operation information) are transmitted to the authentication server 4 (c5 in FIG. 13). The information collection function 41 of the authentication server 4 converts the collected information into a ledger and provides the information to the administrator (c6 in FIG. 13). An example of the ledger is shown in FIG.

  In FIG. 9, the ledger information includes a router name (“router # 1”, “router # 2”), an IP address (“192.168.0.1”, “192.168.0.2”, “172.16.1.1”, “172.6.1.1.10”) and MAC addresses (“aaaa.aaaa.aaaa”, “bbbb.bbbb.bbbb”, “cccc.cccc.cccc”, “ xxxx.xxxx.xxxx ”), OS type (“ A ”,“ B ”,“ C ”,“ unknown ”), latest patch / definition file (“ latest ”,“ not applied ”,“ unknown ”) , Users (“employees”, “unknown”), terminal management levels (“Admitted”, “Unlimited”, “Vulnerable”, “Guest”), and filtering policies (“Permit”, “Bloc”) And it is configured from a ").

  In the ledger shown in FIG. 9, each item (1) (router name, IP address, MAC address) is information sent from each router 3-1, 3-2, and each item (2). (OS type, latest patch / definition file, user) is information sent from the resident software of each terminal 1-1, 1-2, and each item (terminal management level, filtering policy) of (3) is Information defined by the authentication server 4.

  In addition, the filtering policy uses filtering parameters (“Permit” with “start address”, “end address”, “protocol type”, “applicability of latest batch / virus definition”, “user information”, and “traffic volume” as parameters. ”,“ Block ”) is defined by the administrator. The authentication server 4 performs filtering settings for the routers 3-1 and 3-2 based on the filtering condition.

  The packet filtering / policy generating function 42 of the authentication server 4 generates a packet filtering policy based on the information collected by the information collecting function 41 (c7 in FIG. 13) and distributes it to the routers 3-1 and 3-2. (C8 in FIG. 13), and filtering settings of the routers 3-1 and 3-2 are performed (c9 in FIG. 13). FIG. 10 shows an example of a packet filtering policy created based on the ledger example shown in FIG.

  In FIG. 10, the packet filtering policy is set for each transmission direction and reception direction of the router. In the transmission direction of router # 1, the source address (“192.168.0.1/32”, “192.168.0.2/32”, “192.168.0.2/32”, “above” ”), A destination address (“ no restriction ”,“ authentication server ”,“ download server ”) and an action (“ permission ”,“ discard ”) are set.

  In the receiving direction of the router # 1, the transmission source address (“no restriction”, “authentication server”, “download server”, “no restriction”) and the destination address (“192.168.0.1/32”, “192.168.0.2/32”, “192.168.0.2/32”, “other than the above”) and actions (“permit”, “discard”) are set.

  The authentication server 4 determines a packet filtering policy in each of the routers 3-1 and 3-2 based on the information collected by the information collection function 41. If it is confirmed that the latest patch and virus definition file are applied to the terminals 1-1 and 1-2 and the user authorized by the organization is operating, the routers 3-1 and 3-2 The communication to the other segments of the terminals 1-1 and 1-2 is not restricted.

  When the latest patch or the latest virus definition file is not applied to the terminals 1-1 and 1-2, the routers 3-1 and 3-2 download the server 5 and the authentication server 4 that provide the latest patch or the latest virus definition file. Only allow communication to the destination.

  Only communication addressed to the download server 5 and the authentication server 4 is permitted even when a user who is not permitted by the organization is operating, or a terminal on which no resident software is installed.

  FIG. 14 is a flowchart showing the filtering process in the routers 3-1 and 3-2 of FIG. The filtering process in the routers 3-1 and 3-2 will be described with reference to FIG. 1, FIG. 3, and FIG.

  When receiving the IP packet from the monitoring target segment (step S21 in FIG. 14), the routers 3-1 and 3-2 compare the source address and destination address of the IP packet with the packet filtering policy (step S22 in FIG. 14).

  If it is determined as permitted from the comparison result, the routers 3-1 and 3-2 transfer the IP packet to the destination according to the routing table (step S23 in FIG. 14). On the other hand, if it is determined that the packet is discarded from the comparison result, the routers 3-1 and 3-2 discard the IP packet received inside the router (step S24 in FIG. 14).

  FIG. 15 is a sequence chart showing the process of providing the latest patch or the latest virus definition file by the authentication server 4 of FIG. The process of providing the latest patch or the latest virus definition file by the authentication server 4 will be described with reference to FIGS.

  When the patch or virus definition file stored therein is updated, the download server 5 sends a latest version notification to the authentication server 4 (d1 in FIG. 15). Upon receiving the latest version notification, the authentication server 4 sends a latest version application request to the corresponding terminals 1-1 and 1-2 (d2 in FIG. 15).

  When the resident software of the terminals 1-1 and 1-2 receives the latest version application request, it sends a latest version acquisition request to the download server 5 (d3 in FIG. 15), and downloads the latest version from the download server 5 (in FIG. 15). d4). The resident software of the terminals 1-1 and 1-2 applies the latest version by storing the latest patch or virus definition file downloaded (d5 in FIG. 15). This is sent to the authentication server 4 (d6 in FIG. 15).

  Upon receiving the latest version application completion notification, the authentication server 4 updates the contents corresponding to the terminals 1-1 and 1-2 of the ledger (d7 in FIG. 15), and generates a packet filtering policy based on the updated ledger. Then, the packet filtering policy is sent to the routers 3-1 and 3-2 (d9 in FIG. 15). The routers 3-1 and 3-2 perform filtering setting based on the packet filtering policy (d10 in FIG. 15).

  In the application of the latest version, there are terminals that can be applied successfully, but there are also terminals that cannot be applied successfully due to some abnormality (for example, infection with a computer virus, etc.). A terminal that has been successfully applied operates as described above, but a terminal that has not been successfully applied cannot send the latest version application completion notification.

  In this case, the authentication server 4 updates the latest patch / virus definition file item of the terminal that has not sent the latest version application completion notification as unapplied, and therefore discards the IP packet from that terminal in the packet filtering policy. Filtering is set as follows.

  FIG. 16 is a schematic diagram of a communication terminal system according to an embodiment of the present invention. In FIG. 16, the terminal 6 whose communication destination is restricted is described as a Block terminal, and the terminal 7 that is not restricted is described as a Permit terminal.

  In this case, since the communication destination of the terminal 6 is limited, the terminal 6 can be connected to the authentication server / download server 9 through the filter unit 81 of the router 8 and the network 100, but cannot be connected to the general server / terminal 10. On the other hand, since the communication destination of the terminal 7 is not limited, the terminal 7 can be connected to the general server / terminal 10 through the filter unit 81 of the router 8 and the network 100.

  Thus, in this embodiment, since the routers 3-1 and 3-2 existing in the network listen to the ARP packet output from the terminals 1-1 and 1-2, the terminals 1-1 connected to the network are connected. 1 and 1-2 can be automatically and centrally managed.

  In the present embodiment, the authentication server 4 checks the operating status and user information of the discovered terminals 1-1 and 1-2, and based on the result, the filtering policy is assigned to the routers 3-1 and 3-2. To instruct the routers 3-1 and 3-2, the packets sent by the terminals 1-1 and 1-2 to other segments are sent to the routers 3-1 and 3-2 according to the operating status of the terminals 1-1 and 1-2 and user information. Can be filtered.

  In this embodiment, authentication is performed using digital certificates of IC cards and data such as user information (OS type, applied patch / applied virus definition file version information, user information, operation information). However, authentication can be performed using data other than these, and the present invention is not limited to this.

It is a block diagram which shows the structure of the network by one Example of this invention. It is a block diagram which shows the structure of the terminal of FIG. It is a block diagram which shows the structure of the router of FIG. It is a block diagram which shows the structure of the authentication server of FIG. It is a block diagram which shows the structure of the download server of FIG. It is a flowchart which shows the terminal table production | generation procedure in the router of FIG. It is a flowchart which shows the process of the aging timer used for the terminal table of FIG. It is a figure which shows the structural example of the terminal table of FIG. FIG. 5 is a diagram illustrating a configuration example in which information collected by the information collection function of FIG. It is a figure which shows the example of the packet filtering policy produced based on the information made into the ledger shown in FIG. It is a sequence chart which shows the connection process to the network in the terminal of FIG. It is a sequence chart which shows the connection process to the network in the terminal of FIG. It is a sequence chart which shows the information collection in the authentication server of FIG. It is a flowchart which shows the filtering process in the router of FIG. 5 is a sequence chart showing a process for providing the latest patch or the latest virus definition file by the authentication server of FIG. It is a schematic diagram of the communication terminal system by one Example of this invention.

Explanation of symbols

1,1-1,1-2,6,7 terminal
2-1, 2-2 IC card reader 3, 3-1, 3-2, 8 router
4 Authentication server
5 Download server
11 Resident Software Department
12 IC card reader connection
31 Routing function
32 Terminal detection function
33 Terminal table
34 Transmission / Reception Function
35 Packet filtering function
35a Dynamic filtering rule generation function
35b Packet filtering processing function
36 Traffic volume observation function
41 Information collection function
42 Packet filtering policy generation function
43 Filtering policy distribution function
51 Resident Software Department
52 Download service function
100 network
111 Provided functions

Claims (14)

A network including an authentication server device that performs at least acquisition of terminal operation information and user authentication, and a plurality of router devices that relay IP (Internet Protocol) packets within an organization network,
Means for listening to ARP (Address Resolution Protocol) from the terminal to acquire terminal information of the terminal; means for notifying the acquired server information to the authentication server apparatus; and terminal information managed by the authentication server apparatus And a means for performing filtering processing on the packet transmitted by the terminal based on the router,
The authentication server device, the terminal the user authentication and the at least line physicians and acquire operation information including at least the version information of the applied patches and virus definition file of the terminal based on the information notified from the router device Generating a packet filtering policy for the filtering processing in the router device based on the result,
The network in which the router device dynamically controls a destination network that can be relayed for each terminal by filtering processing based on the packet filtering policy . 2. The terminal device and user management by the authentication server device and the connection destination network management by the router device are integrally performed by linking the authentication server device and the router device. Network. 3. The network according to claim 1, wherein the router device is used as a relay device between subnets of an organization network. An information storage medium for storing information for performing the user authentication in the authentication server device; and a reading device connected to the terminal and reading the information for performing the user authentication from the information storage medium. ,
4. The network according to claim 3, wherein the authentication server device determines connection of the terminal to the intra-organization network in accordance with an insertion / extraction operation of the information storage medium to / from the reading device. An authentication server device that performs at least acquisition of terminal operation information and user authentication,
In a plurality of router devices that relay IP (Internet Protocol) packets in an organization network, the terminal has already been applied based on terminal information of the terminal obtained by listening to ARP (Address Resolution Protocol) from the terminal. Means for obtaining at least operation information including version information of patches and virus definition files and user authentication, and generating packet filtering policies for filtering processing in the plurality of router devices based on the result And an authentication server device. 6. The authentication server device according to claim 5, wherein in cooperation with the router device, management of a connection destination network by the router device and management of the terminal and the user are integrally performed. When an information storage medium that stores information for performing user authentication is connected to the terminal and is inserted into or removed from a reader that reads information for performing user authentication from the information storage medium The authentication server device according to claim 5 or 6, wherein the connection of the terminal to an intra-organization network is determined according to the method. A router device that relays IP (Internet Protocol) packets in an organization network,
And means for acquiring the acquisition and user authentication and terminal information used for the operation information of the terminal to be performed in the authentication server by listening to ARP from the terminal (Address Resolution Protocol), the the acquired terminal information Means for notifying the authentication server device, and means for performing a filtering process on a packet transmitted by the terminal based on terminal information managed by the authentication server device,
The authentication server device performs at least acquisition of operation information including at least version information of an applied patch and virus definition file of the terminal and the user authentication based on the terminal information, and generated based on the result A router apparatus that dynamically controls a destination network that can be relayed for each terminal by filtering processing based on a packet filtering policy for filtering processing. 9. The router device according to claim 8, wherein management of a connection destination network and management of the terminal and the user by the authentication server device are integrally performed in cooperation with the authentication server device. The router device according to claim 8 or 9, wherein the router device is used as a relay device between subnets of an organization network. Connection of the terminal to the network in a system including an authentication server device that at least acquires terminal operation information and user authentication, and a plurality of router devices that relay IP (Internet Protocol) packets in an organization network A terminal management method for managing
Listening to ARP (Address Resolution Protocol) from the terminal and acquiring terminal information of the terminal to the router apparatus, and notifying the acquired terminal information to the authentication server apparatus, the authentication server apparatus Filtering the packet transmitted by the terminal based on the terminal information managed by
The authentication server device performs at least acquisition of operation information including at least version information of the applied patch and virus definition file of the terminal based on the terminal information notified from the router device and the user authentication, Generate a packet filtering policy for the filtering process in the router device based on the result,
The terminal management method, wherein the router device dynamically controls a destination network that can be relayed for each terminal by a filtering process based on the packet filtering policy. 12. The terminal device and user management by the authentication server device and the connection destination network management by the router device are integrally performed by linking the authentication server device and the router device. Terminal management method. The terminal management method according to claim 11 or 12, wherein the router device is used as a relay device between subnets of an organization network. When the information storage medium for storing the information for performing user authentication is connected to the terminal and is inserted into and removed from the reader for reading the information for performing user authentication from the information storage medium, the authentication server 14. The terminal management method according to claim 13, wherein the apparatus determines the connection of the terminal to an intra-organization network according to the insertion / extraction operation.

Images