JP4581104B2 - Network security system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network security system, and more particularly to a network security system that suppresses unauthorized data access from an external network to a protection target network. The present invention also relates to a network security management method.
[0002]
[Prior art]
In recent years, the Internet has spread rapidly and has become an indispensable part of our living environment. And the use is performed in various fields, for example, exchange of e-mails, provision of information by opening a website, and further opening an online shop site using a web server on the network. Online shopping such as selling products on the site is also popular. In this way, security management of information and communication networks is extremely important because it is an indispensable part of our lives and credit card numbers are sent and received via online networks when shopping online. It is positioned.
[0003]
  In addition, there are various illegal actions such as impersonation of others on a computer on the network, unauthorized access such as falsification of data in the server, attacks that neutralize server functions, and the spread of malicious computer viruses. The damage is constant. In particular, in recent years, the environment for constant connection to the Internet via ADSL and CATV networks has been enhanced.thingTherefore, even a general user's terminal is conspicuously connected to the network, and such a general user has a low level of attention regarding security, and is likely to be a target of fraud.
[0004]
Therefore, various security systems have been developed as a defense against fraud as described above.
[0005]
One network security technology is firewall technology.
A firewall is a system for protecting an internal network (a network to be protected) from attacks from untrusted networks such as the Internet and unauthorized access. The purpose of the firewall is to allow only necessary communication to pass and block unnecessary communication. Normally, external access is possible from the internal network, but internal (defendable) network cannot be accessed from the outside. Control is common.
[0006]
Specific implementation methods include packet filtering for controlling a port used by an application at a packet level, and an application gateway method for communicating an internal and external network with an application (proxy response by proxy). First, packet filtering will be described with reference to the block diagram of FIG.
[0007]
As shown in FIG. 11A, in the construction of a firewall using packet filtering, routers R101 and R102 are respectively provided at the entrances and exits of the external network No (Internet) and the internal network Ni (inside the LAN). A demilitarized zone D100 (hereinafter referred to as DMZ) composed of the servers D103 and D104 such as the WWW server D101 and the mail server D102 is separated from the external and internal networks between the routers R101 and R102. It is prepared in the state. Here, in the DMZ (D100), in addition to the above-described server, a service published on the Internet, a proxy server D104 used when the external network communicates with the external network, and the like are operated. Packet filtering provides a firewall function by restricting access to these networks using a router filtering function.
[0008]
Here, the router R101 (external connection router) connected to the external network No discards a packet intended for access to other than the DMZ. Of course, when the external network and the internal network communicate with each other, direct communication cannot be performed, so that the safety of the internal network is ensured. Similarly, the router R102 (internal connection router) connected to the internal network Ni discards packets from other than the DMZ. Since the external network No. can only access services published in the DMZ, it is difficult for terminals on the external network to access the internal network.
[0009]
Conversely, the router R102 connected to the internal network Ni discards a packet intended for access to other than the DMZ. When the internal network Ni wants to access a server or the like of the external network No, it is necessary to go through the proxy server D104 in the DMZ (D100). When there is an access request to the external network, the proxy server holds the source IP and the destination IP and communicates with the external network by proxy. At this time, the router R101 discards packets from other than the DMZ. Note that the internal network Ni can access the DMZ.
[0010]
Next, the application gateway method will be described. The gateway in the firewall is used to connect a specific application from the host of the internal network Ni to the outside. However, the result shows the same utility as filtering. That is, it is impossible to directly access the host of the internal network Ni from the external network No. At this time, an application gateway (proxy) is used for connection from the internal network Ni to the external network No. However, it is possible to control such that use other than authorized services and hosts is not permitted.
[0011]
While packet filtering manages packets at the network layer and transport layer, the method using an application gateway allows monitoring at a higher application level, and can be obtained only by packet filtering performed by a router. It is possible to build an advanced firewall that cannot be used. The functions of the application gateway include a packet passage restriction, a proxy server function, an access log collection function, a cache function, etc. in each layer protocol.
[0012]
An example in which a security system is constructed by the application gateway method is shown in FIG. Note that the firewall FW100 shown in this figure collectively shows the external connection router R101 and the internal connection router R102 shown in FIG. The flow of data is indicated by an arrow. First, as indicated by an arrow A101, only data transmitted according to a predetermined rule is passed through the DMZ (D100) from the external network No. For example, the data conforms to a predetermined protocol such as HTTP or SMTP. These data are transmitted again from the DMZ (D100) through the firewall FW100 to the internal network, which is the internal network Ni (arrows A102 and A103).
[0013]
At this time, corresponding to the servers D111 to D113 in the DMZ (D100), the internal (in-house) network Ni is provided with the servers and terminals Ni101 to 106, and conforms to the protocol handled by each server and terminal. Only transmitted data (arrows)A103reference). Contrary to the above data flow, the data is transmitted from the in-house mail server of the in-house network Ni to the Internet No. via the firewall, the mail relay server, and the firewall again (see arrows A102 and A105). From the above, data according to a protocol that is not registered in the firewall FW 100 from the Internet No is not transmitted to the in-house network Ni (see arrow A106), and unauthorized access can be suppressed. On the contrary, data by the HTTP protocol or the like from the in-house network Ni passes through the firewall FW100 and is transmitted on the Internet No (see arrow A107).
[0014]
In addition to firewall technology, unauthorized access monitoring systems or intrusion detection systems (hereinafter referred to as IDS (Intrusion Detection System)) have been developed as security systems. This is to monitor packets flowing through the network, display an alarm when a packet that seems to be unauthorized access is found, and collect and store the communication record.NoIt is a thing of the mechanism. Some tools have functions such as displaying an alarm and disconnecting the session at the same time or changing the rules of the firewall or router. There are two types of IDS: network type monitoring (monitoring packets on the network) and host type monitoring (monitoring host server I / O packets).
[0015]
  The basic configuration of IDS will be described with reference to FIG. First, the device H100 to be IDS is, OutsideThe packet P100 is provided between the local network No and the internal network Ni, and monitors the packet P100 transmitted from the external network No. For example, the senderas well asRecipientofThe IP address is monitored and compared with the rule base H101 of illegal data stored in the storage unit in advance. If the IP address is not matched, the packet P100 is passed through the internal network Ni. On the other hand, if they match, the log is recorded as unauthorized access (see symbol H102), the administrator is notified (see symbol H103), the session is disconnected, and the rule is changed by the operator.
[0016]
A specific use example of IDS is shown in FIG. The network system shown in this figure includes a network type IDS (H110) for monitoring the inside of the DMZ (D100) between them in addition to the firewall FW100 comprising routers R101 and R102 as described above. Each server in the DMZ (D100) is also provided with a host type IDS (H111 to H113). In this way, first, the source / destination IP address, port number, and permitted protocol authorized by the firewall FW100 are restricted, and the packets flowing in the DMZ (D100) are narrowed down to some extent. The packets flowing in the DMZ (D100) are monitored by the network type IDS (H110), and the terminals (servers) on the DMZ are directly monitored by the host type IDS (H111 to H113). This is because various servers on the DMZ that are likely to be attack targets and are relatively open in terms of security are intensively monitored, and the damage caused by unauthorized intrusion can be dealt with quickly. This security model guarantees much higher security strength than using each security system alone.
[0017]
In addition to the network security system described above, a network dynamic defense method disclosed in Non-Patent Document 1 is disclosed.
As shown in FIG. 13, the system shown in Non-Patent Document 1 is called A-IDS (Autonomous Intrusion Detection System), and all terminals in the network (DMZ (D100)) to be protected. It is a feature that H120 to H123 take a mutual monitoring form in which they are monitored by different terminals. Therefore, no matter what kind of attack the terminal is subjected to, it is possible to detect and respond to intrusions autonomously without the intervention of an administrator at another terminal that is not under attack.
[0018]
Specifically, each terminal exchanges data with the monitoring target terminal in accordance with the topology of the A-IDS monitoring network, and monitors whether the monitoring target terminal is operating normally, that is, whether it has received unauthorized intrusion. Therefore, unlike the conventional IDS, the A-IDS can be detected even if the terminal is driven to a stopped state. The A-IDS periodically transmits a survival confirmation signal (SYN) to the monitored A-IDS. The A-IDS that has received the survival confirmation signal immediately returns a survival response signal (ACK).
If the survival response signal does not return within a certain time, it means that the monitoring destination terminal has been put into a stopped state due to a fatal attack. At this time, an operation of autonomously reconstructing the A-IDS monitoring network is performed.
[0019]
[Non-Patent Document 1]
Kojiro Yanagawa, Motoaki Inayoshi, Masao Mukaidon, Unauthorized Intrusion Detection System Based on Autonomous Distributed Concept, 12th Intelligent System Symposium, pp. 345-348, 2002
[0020]
[Problems to be solved by the invention]
However, the following inconveniences occur even in the security systems according to the conventional techniques described above.
[0021]
First, the firewall described above is a system that controls communication between the external network No and the internal network Ni, and can block unauthorized access from the outside. Since permission and disapproval are decided, it is not difficult to restrict the unexpected access of this rule. Therefore, it is considered that no countermeasures have been taken against intrusion attempts by unknown methods.
[0022]
For example, in packet filtering of a firewall, the header part of a packet is analyzed. Here, since the IP address and port number of the communication source and communication destination of the packet are shown, a rule is set in advance for the packet of the specific communication source, communication destination IP address and port number. Passing / non-passing of packets is determined by matching. In such a case, the contents of the packet are not known at all. In such a case, if there is an access to an IP address and a correct port number (usually 80) to a web server that is open to the public, communication is permitted regardless of the contents of the packet. Therefore, there arises a problem that the request content to the web server cannot prevent an inappropriate attack.
[0023]
On the other hand, since the application gateway inspects the contents of the packet, the amount of data passing through the firewall in the location connecting the internal network and the external network is enormous, processing load is very large, and communication speed decreases due to processing delay The problem arises. Furthermore, there is a problem that the firewall cannot prevent the virus associated with the illegal use from the internal network Ni and the protocol permitted by the firewall such as HTTP and SMTP.
[0024]
Also, regarding IDS, the complexity and annoyance of rule description can be cited as problems. To enhance security, rules must be added and changed in the same way as firewalls. In other words, since the IDS rules are described in the default permission stance, the administrator has to manually add and change rules every time a new type of attack is discovered. It brings a great burden. At the same time, since the judgment is made based on the past results (pattern match), there arises a problem that it is ineffective against an unknown attack. Even if the system is attacked by an unknown attack, a time lag from discovery to defense occurs.
[0025]
Furthermore, due to the nature that IDS handles a wide variety of packets existing on the network, there are problems of false detection and detection omission of illegal packets. As the number of rules increases, the security strength increases accordingly, but the number of false detections increases accordingly, increasing the troublesomeness of the security administrator, and vice versa, the trade-off problem that the detection omission increases and the security strength decreases. There is.
[0026]
Also, in A-IDS, rules for new types of attacks are added, the burden on system administrators is reduced by changes, the time lag of defense measures from detection of new types of attacks is shortened, and a system in a state where communication is impossible due to fatal attacks Provides solutions to the problem of autonomous coping. However, also in A-IDS, at present, only a fatal attack to a monitoring terminal is detected as a detection target for unauthorized intrusion. That is, an attack involving the stop of a monitoring terminal is defined as an unauthorized intrusion and is proposed on the assumption. For this reason, there is a problem that an unknown attack (abnormality detection) that does not involve falsification of information or a system down due to a virus cannot be dealt with. At the same time, detection by A-IDS means that damage has already occurred after successful unauthorized access. Similarly, when a plurality of terminals are shut down at the same time and the monitoring source terminal and the monitoring destination terminal cannot communicate with each other at the same time, it is impossible to cope with the problem.
[0027]
As described above, the network security system in the conventional example can cope with an illegal attack against the intrusion of known illegal data, but can only cope with an unknown illegal attack after the fact. The problem arises that it is impossible to cope in advance.
[0028]
OBJECT OF THE INVENTION
  The present invention improves the disadvantages of the above-described conventional example, and in particular, a network security system that can effectively cope with an unknown attack on the network system.TheThe purpose is to provide.
[0029]
[Means for Solving the Problems]
  Therefore, in order to achieve the above object, the present invention provides a network security system including a firewall unit for monitoring data transmitted between an external network and a protection target network, and the firewall unit includes any one of the networks. A virtual test terminal that does not belong to the network, and the firewall means transmits data transmitted from the external network to one terminal in the defense target network based on a pre-registered distribution rule. A data distribution function for distributing and transferring to the one terminal or the virtual test terminal, and executed data transfer for transferring the executed data returned from the virtual test terminal to the one terminal in the protection target network It was set as the structure provided with the function.
  Further, in the present invention, the virtual test terminal is set to an application environment equivalent to each terminal in the protection target network, and the virtual test terminal executes the data transferred from the firewall means. And a normal execution data return function for returning the executed data determined to have been normally executed based on a preset criterion among the temporarily executed data to the firewall means.
  Further, in the network security system according to the present invention, the distribution rule executed by the firewall means is passed to the protection target network when the transmitted data has a reliable address and port number. And whether or not the data has a packet pattern corresponding to a service or application that can be executed on the virtual test terminal and is applied to data that does not match the pass permission rule. For discarding unsupported dataTPC execution support rulesAnd thisTPC execution support rulesIs applied to data having a packet pattern corresponding to, and whether or not it is a pre-registered illegal packet is checked to discard data judged to be illegal and prohibit its passageTPC transfer prohibition ruleIt was.
  The firewall means described above is configured to transfer data that sequentially passes through the contents of the distribution rule to the virtual test terminal having an application environment equivalent to each terminal in the protection target network as an unknown packet. It was.
[0030]
  With such a configuration, first, data transmitted from an external network to a predetermined terminal in the protection target network is received by a firewall unit provided between the external network and the protection target network. In the firewall means, the transmission destination, data format, etc. of the transmission data are extracted and compared with the sorting rules stored in the firewall means in advance. As a result of the comparison, if it is determined that the data can be transmitted to a terminal in the protection target network, the firewall means passes the transmission data to the protection target network, and otherwise transfers it to the virtual test terminal.In addition, since transmission data is provisionally executed in a virtual test terminal in almost the same environment as a terminal in the protection target network, the data determined to be normal is actually transmitted to the terminal in the protection target network and the terminal Even if it is executed at, abnormal operation is effectively suppressed. Therefore, it is possible to improve the reliability of data transferred in the defense target network.
[0031]
In the virtual test terminal, the transmission data from the firewall means is executed, and it is checked whether or not it conforms to the standard of whether or not normal execution is stored in advance. If it is determined that the execution is normal, the transmission data is transmitted to the terminal in the protection target network via the firewall means. On the other hand, when the execution is not normal, such transmission data is not transmitted to the defense target network.
[0032]
Therefore, unknown transmission data that is not registered in the firewall means in advance is transferred to the virtual test terminal and executed by the virtual test terminal, and only data that is determined to be normally executed is transferred to the protection target network. Therefore, unauthorized access from the outside can be suppressed, damage to unknown attacks can be suppressed, and network security can be strengthened.
[0033]
  Furthermore, in the network security system,The virtual test terminal isSaidBased on the data executed by the temporary execution function, new distribution rule data to be added to the distribution rule registered in the firewall means is generated andNew distribution rule generatedA distribution rule generator for transmitting data to the firewall means;SaidThe firewall means has already registered the new distribution rule data received from the virtual test terminalSaidIt has a distribution rule registration part to newly register to distribution rulesThe configuration was as follows.
  Then, the distribution rule generation unit of the virtual test terminal adds a packet rule in such a case to the passage permission rule when the execution result obtained by executing the temporary execution function of the virtual test terminal is normal execution. And when the execution result is an abnormal execution, a packet rule in such a case is generated to be added to the TPC transfer prohibition rule.It was.
[0034]
As a result, the virtual test terminal generates a rule for identifying data determined to be safe as a result of provisional execution, or a rule for identifying data determined to be dangerous. It will be registered in the firewall. Then, from the next time, the data registered in the rule that allows passage by the firewall means will be passed to the protected network without being temporarily executed by the virtual test terminal, while the rule identified as dangerous data Since the data matching the above is dangerous data without being temporarily executed by the virtual test terminal, it is discarded by the firewall means without being transferred to the virtual test terminal. Accordingly, it is possible to reduce the amount of data temporarily executed by the virtual test terminal, and to reduce the processing load on the virtual test terminal.
[0035]
The virtual test terminal may be a server that provides a predetermined service to a predetermined terminal in the protection target network. Thereby, for example, a server that operates as a proxy server or a mail server for a terminal in the network to be protected functions as a virtual test terminal. Then, when data is transmitted from an external network to a terminal in the protection target network, such data is always stored in the server. At this time, provisional execution is performed in the server, Safety is checked. Accordingly, various service servers can be effectively used, and it is not necessary to provide virtual test servers that support various data independently while enhancing security, thereby reducing operational costs. it can.
[0037]
  Further, in this network security system, other firewall means is provided between the external network and the firewall means, and the other firewall means is connected to one of the defense networks from the external network. In the data transmitted to the terminal, the pass rule is set so as to pass only the SMTP compatible packet and a specific packet other than the SMTP compatible packet, and the firewall means uses the SMTP compatible as the pass permission rule. A configuration may be adopted in which only a specific packet other than a packet is allowed to pass and only the SMTP compatible packet is transferred to the virtual test terminal.Yes.
  Furthermore, an unauthorized access monitoring terminal for monitoring a packet existing between the firewall means and the virtual test terminal is provided, and the unauthorized access monitoring terminal detects an unauthorized access packet based on a predetermined criterion. Then, a configuration may be provided with an illegal packet detection function for storing information related to the unauthorized access packet for registration in the firewall means.
[0038]
  As a result, transmission data from the external network is transmitted to the firewall means.Before and afterThe check is received by other firewall means or IDS. Therefore, since illegal data is distributed in advance, packets distributed by the firewall unit can be narrowed down, and the distribution burden of the firewall unit can be reduced.
[0039]
  (Delete)
[0040]
  (Delete)
[0041]
DETAILED DESCRIPTION OF THE INVENTION
<First Embodiment>
Hereinafter, a first embodiment of the present invention will be described with reference to FIGS. 1 to 6. FIG. 1 is a block diagram showing a configuration of a network security system according to the present invention, and FIG. 2 is a functional block diagram. FIG. 3 is an explanatory diagram showing the flow of data in the system. 4 to 6 are flowcharts showing the operation of the system.
[0042]
(Constitution)
As shown in FIG. 1, the network security system according to the present invention includes firewall means 3 for monitoring data transmitted between the external network 1 and the protection target network 2, and the firewall means 3 includes the external network 1, A virtual test terminal 4 that does not belong to any of the protected networks 2 is connected and provided.
[0043]
And since the said firewall means 3 and the virtual test terminal 4 are provided with the function which is mentioned later, the safety of the data transmitted from the external network 1 to the terminal in the protection target network 2 is checked, and the safety This is a system in which only highly reliable data is allowed to pass through the defense target network 2 to enhance security. This will be described in detail below.
[0044]
(External network)
The external network 1 is the Internet, which is a network environment spread around the world using a telephone line or the like. On the Internet, an unspecified number of computers are connected. For example, a web server for establishing a website and a personal terminal for exchanging electronic mail are connected. Therefore, a wide variety of data is transmitted between them. The external network 1 is not limited to the Internet network described above, and refers to a network that is positioned outside the defense target network 2 described later. Further, the line for constructing the Internet is not limited to a telephone line, and may be one using an optical fiber or a CATV network.
[0045]
Here, it has been described above that the firewall means 3 is connected between the external network 1 and the protection target network 2, but between the firewall means 3 and the external network 1, further, from the external network 1. Is provided with a router 5 that efficiently guides the transmitted data to the defense target network 2. The router 5 operates so as to permit passage only when data from the external network 1 is for a terminal in the protection target network 2, for example. However, such a router 5 may not be provided.
[0046]
(Protected network)
The protection target network 2 is a network in which there are terminals to be protected from attacks such as unauthorized access from the Internet, which is the external network 1, and reception of unauthorized data. For example, it may be a corporate LAN or simply a so-called internal network where personal terminals exist. Further, the defense target network 2 is not limited to a so-called internal network in which such a general user's terminal exists, and is a mail server in the demilitarized zone D100 disclosed with reference to FIG. D102 or the like may be targeted. In the following description of the present embodiment, it is assumed that the protection target network 2 is a predetermined in-house LAN to which each user terminal is connected.
[0047]
A plurality of terminals 21 to 23 exist in the internal network 2 and are connected to each other to form a LAN. Although these terminals 21 to 23 are terminals to be protected, in the example shown below, the terminal 21 is particularly described as a protection target.
[0048]
(Firewall means)
The basic configuration of the firewall unit 3 is the same as that of a general firewall device. That is, it is a server-type firewall device that includes a CPU having a predetermined arithmetic processing capability and a storage device having a predetermined storage capacity. Therefore, the basic operation is the same as that of the conventional one, and it is prepared at the data entry / exit for the internal network (defense target network) 2, analyzes the packet pattern entering / exiting the internal network 2, and sends it to the internal network Is to filter the transfer of.
[0049]
  However,This embodimentThe firewall means 3 is different from the conventional one in the following points. This will be described in detail below. This firewall means 3 is called an internal firewall 3 in order to distinguish it from the router 5 described above.
[0050]
The configuration of the internal firewall 3 will be described with reference to FIG. FIG. 2 is a functional block diagram showing the configuration of the present invention. As shown in this figure, the internal firewall 3 is first provided with a distribution rule storage unit 31. The storage unit 31 is a storage device such as a hard disk that stores data relating to a packet distribution rule to be filtered by the internal firewall 3.
[0051]
Here, the distribution rule will be described. The distribution rule in this embodiment is mainly composed of two rule bases, specifically, a passage permission rule and a TPC transfer prohibition rule.
[0052]
The passage permission rule describes a packet rule that permits passage from the external network 1 to the internal network 2 in the same manner as a conventional firewall device. That is, in the default state, that is, when no rule is described, any packet is prohibited from passing. Specifically, the pass permission rule includes a source / destination IP address and port number, a data protocol type, a character string included in the data, and the like. Therefore, by describing the IP address of a reliable transmission source, such packet data is allowed to pass through the internal network 2 which is a defensive network. Conversely, unknown packets are transmitted into the internal network 2. Never happen.
[0053]
  The TPC transfer prohibition rule describes a packet rule that prohibits transfer to the virtual test terminal 4 described later. That is, in the default state, that is, when no rule is described, all packets are transferred to the virtual test terminal 4. This transfer prohibition rule is the IP address and port number of the transmission source / destination, the protocol type of the data, the character string included in the data, and the like, similar to the above-described passage permission rule. Therefore, data related to packets that have been determined to be invalid in the pastTransfer prohibitedBy describing as a rule, such a packet can be discarded by the internal firewall 3 as described later without being transferred to the virtual test terminal 4. Then, an unknown packet can be transferred to the virtual test terminal 4.
[0054]
In the present embodiment, not only the two rules described above as the distribution rule but also a TPC execution correspondence rule is included. The TPC execution correspondence rule describes a rule for identifying a packet corresponding to a service or application that can be temporarily executed by the virtual test terminal 4 as described later. That is, even if a packet not described in the rule is transferred to the virtual test terminal 4, it cannot be temporarily executed by the virtual test terminal 4. Therefore, such a packet is transferred by the internal firewall before transfer. It is a sort.
[0055]
Next, functions of the internal firewall 3 will be described. It should be noted that the functions described below operate as each function when a program for realizing each function process is incorporated in the CPU. This is schematically shown in FIG.
[0056]
  The internal firewall 3 includes an external data reception function (transmission / reception unit 32) for receiving data transmitted from the external network 1 to predetermined terminals 21 to 23 in the internal network (defense target network) 2, and the received data in advance. A data distribution function (data distribution unit) that distributes and transfers to predetermined terminals 21 to 23 or virtual test terminal 4 in the internal network 2 based on the distribution rule registered in the distribution rule storage unit 3133And the transmission / reception unit 34), the executed data transfer function (transmission / reception unit 34) for transferring the executed data returned from the virtual test terminal 4 to the predetermined terminals 21 to 23 in the internal network 2, and the virtual test A distribution rule registration function (distribution rule registration unit 35) for newly registering new distribution rule data, which will be described later, received from the terminal 4 in an already registered distribution rule. The transmission / reception units 32 and 34 are configured by the same network connection device as a device, and transmission / reception data passing through the device is handled for each function. Each part which comprises the said function is explained in full detail.
[0057]
  First, the transmission / reception unit 32 connected to the external network 1 transfers the received data to the data distribution unit 32. Data distribution function is the data distribution part33And the data transmission / reception unit 34.33Then, based on the distribution rule in the distribution rule storage unit 31 as described above, if the packet matches the passage permission rule, the packet is passed through the internal network 2. If the other packets do not match the TPC execution correspondence rule, the virtual test terminal 4 cannot perform temporary execution, and therefore the packet is discarded. A packet that matches the TPC execution correspondence rule is discarded if it matches the TPC transfer prohibition rule, and is transferred to the virtual test terminal 4 because it is an unknown packet if it does not match. At this time, the packet transferred to the internal network 2 or the virtual test terminal 4 is transmitted to each via the transmission / reception unit 34.
[0058]
Further, when new distribution rule data is transmitted from the virtual test terminal 4 via the transmission / reception unit 34, the distribution rule registration unit 35 corresponds to the distribution rule storage unit 31 corresponding to the new distribution rule data. Update and register each rule. For example, when a new source IP address to be added to the TPC transfer prohibition rule is transmitted as new distribution rule data, the IP address is additionally registered in the TPC transfer prohibition rule. The processing contents by the above functions (each unit) will be described in detail when the operation is described.
[0059]
  (Virtual test terminal)
  The virtual test terminal 4 (TestPC: hereinafter also referred to as TPC) is a storage device or a computing device (CPU) connected to the internal firewall 3.ThePreparationTasaIt is a terminal computer that does not belong to either the external network 1 or the internal network (defense target network) 2.
[0060]
The system environment of the virtual test terminal 4 is set to substantially the same environment as the terminals 21 to 23 existing in the internal network 2 to be protected. Specifically, an application environment equivalent to the terminals 21 to 23 in the internal network 2 is prepared. In addition, although the details of setting differ for every terminal 21-23, it is good to set it as the same environmental setting especially as an important terminal (for example, terminal of a code | symbol 21). In this way, the reason why the environment is set to be the same as that of the terminal in the internal network 2 is that, as will be described later, the virtual test terminal 4 performs the operation execution instead of the terminal on the defense network against unknown access. Because. The configuration will be described in detail below.
[0061]
  First, a storage device such as a hard disk of the virtual test terminal 4 is formed with an unauthorized execution definition storage unit 41, and as a result of temporary execution of data transmitted from the internal firewall 3 by the virtual test terminal 4 as described later, Judgment that unauthorized execution was performedforA reference rule is stored. Illegal executionofFor example, the monitoring target process on the virtual test terminal 4 does not end normally, the registry is falsified, the file is falsified, a new unknown file is created, or an unexpected packet transmission is performed This is data indicating that is performed. However, such definition data is not limited to the above, and differs depending on the terminals 21 to 23 of the internal network 2 to be protected.
[0062]
The virtual test terminal 4 has the following functions. It should be noted that the functions described below operate as each function when a program for realizing each function process is incorporated in the CPU. This is schematically shown in FIG.
[0063]
The virtual test terminal 4 is determined to have been normally executed based on the temporary execution function (temporary execution unit 42) for executing the data transferred from the internal firewall 3 and the above-described illegal execution definition among the temporarily executed data. Registered in the internal firewall 3 based on the data executed by the temporary execution unit 42 and the normal execution data return function (the temporary execution unit 42 and the transmission / reception unit 43) for returning the executed data to the internal firewall 3 A distribution rule generation function (distribution rule generation unit 44 and transmission / reception unit 43) that generates new distribution rule data to be added to the distribution rule and transmits the data to the internal firewall 3 is provided.
[0064]
The parts that operate as the above functions will be described in detail. First, the transmission / reception unit 43 receives an unknown packet transferred from the internal firewall 3 and sends it to the temporary execution unit 42. Also, the data normally executed by the temporary execution unit 42 and the new distribution rule data generated by the distribution rule generation unit 44 are returned to the internal firewall.
[0065]
Further, the temporary execution unit 42 actually executes the unknown packet transmitted from the internal firewall 3. And when it is executed, the state occurring on the terminal 4 is compared with the data in the unauthorized execution definition storage unit 41, and if it does not correspond to such definition data, it is determined that the execution result is normal, The packet is returned to the internal firewall 3 via the transmission / reception unit 43. At this time, a rule creation command is issued to the distribution rule so as to be added as a rule that allows passage of the internal firewall to the defense network. On the other hand, the monitored process does not end normally, the registry is falsified, the file is falsified, or a new unknown file is created. In some cases, an instruction is issued to discard the packet and generate a new distribution rule to describe the packet rule in the TPC transfer prohibition rule. In such a case, the environment of the virtual test terminal 4 is then restored to the environment before the test execution.
[0066]
Then, as described above, the distribution rule generation unit 44 responds to an instruction from the temporary execution unit 42, that is, according to an execution result of the temporary execution unit 42, the distribution rule storage unit 31 of the internal firewall 3. New rule data for updating the distribution rule stored in the table is generated. Specifically, when the temporary execution unit 42 performs normal execution, the packet rule is generated so as to be added to the pass permission rule, and when it is illegal execution, it is added to the TPC transfer prohibition rule. Generate to do. Then, the generated new distribution rule data to be updated is transmitted to the internal firewall 3 via the transmission / reception unit 43.
[0067]
Although not shown, the virtual test terminal 4 has a self-repair function. This self-repair function stores data related to its own system environment setting in advance, and as described above, when it is determined that unauthorized execution has been performed, the system environment setting is referred to by referring to the system environment setting. Restore to the environment. Alternatively, since the registry and the process are constantly monitored at the time of the test execution, when such an illegal registry change is detected, the registry and the process are discarded and the system environment is restored. In addition, the process for repairing such a system environment is not limited to being executed in its own terminal. The virtual test terminal 4 may be connected to another terminal that performs a repair process on the terminal 4.
[0068]
    (Operation)
  Next, the operation of the present invention will be described with reference to the diagram for explaining the data flow in FIG. 3 and the flowcharts in FIGS. In this description of operation, a case where the terminal indicated by reference numeral 21 in the internal network 2 requests data from the external network 1 is illustrated, and in this case, which packet data P from the external network 1 is How to transmit will be described. Accordingly, the virtual test terminal 4 is connected to the terminal 21.ofIt is adapted to the system environment. 4 and 6 mainly show the operation of the internal firewall 3, and FIG. 5 shows the operation of the virtual test terminal 4.
[0069]
  First, as shown in FIG. 3, predetermined packet data P from the external network 1 passes through the router 5 and is transmitted to the internal firewall 3 (arrow A1, step S1). Then, the internal firewall 3 compares the received packet data P with the passage permission rule stored in the distribution rule storage unit 31 (step S2: First step).
[0070]
    Here, if the packet pattern of the packet data P, for example, information included in the header portion of the packet data P matches the passage permission rule (affirmative determination in step S2), the packet passes through the internal firewall 3 as a normal packet. Is transmitted to the terminal 21 in the internal network 2 (arrow A2, step S6). And the requested terminal21Then, this packet is received and appropriate processing is performed. On the other hand, if the packet pattern does not match the passage permission rule (No at Step S2), the packet pattern is subsequently compared with the TPC execution corresponding rule stored in the distribution rule storage unit 31 (Step S3). . That is, it is checked whether or not this packet corresponds to the service and application that the virtual test terminal 4 is performing the test.
[0071]
  If the packet pattern does not match the TPC execution correspondence rule (No in step S3), the packet P cannot be executed in the virtual test terminal 4. That is, since the virtual test terminal 4 has the same environment as the terminal 21 that is the transmission destination of the packet P, it can be understood that the packet P should not be transmitted to the terminal 21 and is discarded as an illegal packet. (Arrow A3,Step S3,S7: Second step).
  On the other hand, when the packet pattern matches the TPC execution correspondence rule (Yes in step S3), the packet pattern is subsequently compared with the TPC transfer prohibition rule stored in the distribution rule storage unit 31. (Step S4). That is, it is checked whether or not the packet data P is registered in advance as an illegal packet.
[0072]
  If the packet pattern matches the TPC transfer prohibition rule (affirmative determination in step S4), it is confirmed that the packet P is an illegal packet and is discarded (arrow A3,Step S4,Step S7: Third step). On the other hand, if the packet pattern does not match the TPC transfer prohibition rule (No in step S4), it is transferred to the virtual test terminal 4 as an unknown packet (arrow A4, step S5, symbol A in FIG. 4). Go to FIG. 5).
[0073]
In this way, in other words, the operation so far is performed by transmitting data transmitted from the external network 1 to the predetermined terminal 21 in the internal network 2 based on the distribution rule registered in advance by the internal firewall 3 in the internal network 2. The data is distributed and transferred to a predetermined terminal or the virtual test terminal 4 (data distribution step).
[0074]
Subsequently, the virtual test terminal 4 that has received the unknown packet P performs provisional execution (test execution) on the received packet P (step S11, provisional execution step). At this time, the virtual test terminal 4 checks whether the operation by the test execution is normal execution based on the data stored in the unauthorized execution definition storage unit 41 (step S12). For example, if the monitored process on the virtual test terminal 4 does not end normally, the registry is falsified, the file is falsified, or a new unknown file is not created, it is executed normally. If this is not the case, the packet P is regarded as an illegal packet because of abnormal execution.
[0075]
If it is normally executed (Yes in step S12), a pass permission rule to be updated is generated to add the packet pattern of the packet to the pass permission rule of the internal firewall 3 (step S13). The rule is transmitted to the internal firewall 3 (arrow A6, step S15). At almost the same time, the packet P confirmed to operate normally is returned to the internal firewall 3 to be transmitted to the terminal 21 in the internal network 2 (arrow A5, step S14, normal execution data return step). .
[0076]
On the other hand, if the virtual test terminal 4 is not normally executed (No in step S12), the packet P is an illegal packet, and therefore the packet pattern of the packet is changed to the TPC transfer prohibition rule of the internal firewall 3. The TPC transfer prohibition rule to be updated is generated (step S16), and the generated rule is transmitted to the internal firewall 3 (arrow A6, step S15). At almost the same time, the packet P that has not been normally executed is discarded (step S17), and the system environment of the virtual test terminal 4 is restored to the environment before the test is executed (step S18).
[0077]
Subsequently, the process proceeds from FIG. When the packet P successfully executed by the fancy dress test terminal 4 is received by the internal firewall 3 (Yes in step S21), the packet P is transferred to the terminal 21 to which the packet P is to be transmitted ( Arrow A5, step S22, executed data transfer step). When new additional rule data generated by the virtual test terminal 4 is received by the internal firewall 3 (arrow A6, affirmative determination in step S23), the internal firewall 3 performs update registration of each rule. Performed (step S24).
[0078]
By doing so, unknown transmission data that is not registered in the internal firewall 3 in advance is transferred to the virtual test terminal 4 and is executed in the virtual test terminal 4, so that it is normally executed. Only data determined to be passed through the internal network. For this reason, it is possible to suppress unauthorized access to data from the outside, and to suppress damage to unknown attacks.
[0079]
The virtual test terminal 4 generates a rule for identifying data determined to be safe as a result of provisional execution, or a rule for identifying data determined to be dangerous. It will be registered in the firewall. Then, from the next time, the data registered in the rule permitting passage by the internal firewall 3 is passed to the internal network 2 without being temporarily executed by the virtual test terminal 4, while being identified as dangerous data. Since the data matching the rule is dangerous data without being temporarily executed by the virtual test terminal 4, it is discarded by the internal firewall 3 without being transferred to the virtual test terminal. Therefore, it is possible to reduce the amount of data temporarily executed by the virtual test terminal 4, and to reduce the processing load on the virtual test terminal.
[0080]
Here, even if the virtual test terminal 4 executes a test, even if the system is brought down due to an unknown attack (for example, exploiting a security hole of an application), the internal firewall 3 Only the permitted packet passes through the internal network 2 by the described passage permission rule. Even in such a case, security is ensured without passing unknown data to the internal network 2. That is, it has a so-called fail soft (degenerate operation) structure.
[0081]
On the other hand, even if the internal firewall 3 is forced to go down, a packet transmitted thereafter cannot pass through the internal firewall, and an illegal packet from the outside cannot reach the internal network 2. . That is, it has a so-called fail-safe structure. Therefore, in such a case, network security is ensured.
[0082]
<Second Embodiment>
Next, a second embodiment of the present invention will be described with reference to FIGS.
FIG. 7 is a block diagram showing a configuration in the second embodiment of the network security system, and FIG. 8 is a functional block diagram showing a configuration of the virtual test terminal.
[0083]
(Constitution)
The system in this embodiment operates specifically to check for viruses attached to emails. Specifically, the virtual test terminal 140 expands an email transmitted to the mail server 121 in the protection target network 120, and executes the file if the file is attached to the email. What is normally executed is transmitted to the mail server 121. Therefore, this embodiment is a specific operation example of the first embodiment, and each configuration thereof is substantially the same as that of the first embodiment. However, it differs in the following points.
[0084]
  First, virtual test terminal140The temporary execution function (function corresponding to the temporary execution unit in FIG. 2) expands an electronic mail that is packet data P transferred from an internal firewall 130 described later, and executes a file attached to the electronic mail. To do. For example, if the attached file is document data or the like, it is opened with a predetermined application, and if it is an executable file, it is executed. Then, based on the illegal execution definition data stored in the illegal execution definition storage unit, whether or not the illegal processing is performed when the e-mail is expanded or the attached file is executed is checked. At this time, in the illegal execution definition data, for example, data indicating registry change, writing to the hard disk, unexpected packet transmission, etc. is described as the definition of illegal execution. Monitor whether or not.
[0085]
If the packet is illegally executed, the packet is discarded, data for registering the packet rule in the TPC transfer prohibition rule is generated, or the system environment of the virtual test terminal 140 itself is repaired. If the execution is successful, the e-mail that is the packet P is transmitted to the mail server 121 in the protection target network 120.
[0086]
  Thus, in this embodiment, the virtual execution terminal140Is an external network110It operates as an SMTP server that receives e-mails sent from. In other words, the virtual test terminal 140 functions as a server that monitors the virus data attached to the e-mail after executing the test, and provides a service for transferring the e-mail to the mail server 121 in the protection target network 120. It is an SMTP server.
[0087]
Note that the defense target network 120 in this embodiment is a network described as a demilitarized zone in the conventional example, unlike the so-called internal network 2 to which a terminal such as a general user disclosed in the first embodiment is connected. The present invention can effectively cope with such data transmitted in the network 120.
[0088]
The specific configuration of the virtual test terminal 140 is as shown in FIG. 8, and will be described in detail when the operation is described.
[0089]
Then, along with the configuration of the virtual test terminal 140, the internal firewall 130 passes the packet data P from the external network 110 to the protection target network 120 side based on the distribution rule, as described above, or the virtual test terminal 140 However, the distribution rules are different from those described above. Specifically, in the passage permission rule, such a description is not made so that packets conforming to SMTP are not allowed to pass, and packet rules that can be passed to other mail servers 121 are described. The TPC transfer prohibition rule describes a packet rule relating to malicious virus data, and an e-mail including such virus data is discarded by the internal firewall 130.
[0090]
(Operation)
Next, the operation of the system will be described with reference to the data flow of FIGS.
First, when mail addressed to the mail server 121 on the protection target network 120 from the external network 110 reaches the internal firewall via the router 150, a pass permission packet other than SMTP is sent to the mail server 121 by comparison with the pass permission rule. Passed (arrow A11). On the other hand, the SMTP compatible packet is transferred to the virtual test terminal 140 (arrow A12).
[0091]
Here, the router 150 may be provided with a packet filtering function in advance so that only SMTP-compatible packets and specific packet rules are allowed to pass to the defense target network side (mail server 121 side). Then, only the specific packet rule other than the SMTP compatible packet rule is described in the pass permission rule of the internal firewall 130, and only the packet data of the specific packet rule is allowed to pass through the mail server 121. You may make it transfer to the terminal 140. FIG. Thus, by providing the router 150 as another firewall means and setting the distribution rule of the router different from the distribution rule of the internal firewall 130, the number of packets distributed by the internal firewall 3 can be reduced. it can.
[0092]
Subsequently, the SMTP compatible packet transmitted from the internal firewall 130 passes through the communication device 141 and the OS 143 of the virtual test terminal 140, reaches the SMTP server 145 (arrow A21), and further, the test daemon 147 (Test Daemon). ) (Arrow A22). The test daemon 147 activates the corresponding mail application 146 (arrow A23) and executes this mail (arrow A24). Note that what type of mail application is used depends on the operating environment of the mail server 121.
[0093]
At this time, the test daemon 147 checks the update status of the registry, process, and file, and performs unauthorized processing such as falsifying the registry, adding an unknown file, and sending an e-mail to the outside without permission. It is monitored whether it is broken (arrow A25). If the result of the execution shows that an illegal situation has not been confirmed, the mail related to this packet is transmitted via the internal firewall 130 to the original mail transmission destination terminal, in this embodiment, the mail server 121. (Arrows A13 and A26).
[0094]
In this way, by using this system for virus detection that can be attached to e-mails, e-mails are actually executed on compatible applications and their trends are being checked. In this system, only known viruses can be found, but this system can detect and respond to unknown viruses and new types of viruses as long as they act on the monitoring target. Therefore, it is possible to improve the safety of the email received by the mail server on the protection target network 120, and the safety of the email transmitted to each user is also improved.
[0095]
<Third Embodiment>
Next, a third embodiment of the present invention will be described with reference to FIGS. FIG. 9 is a block diagram showing a configuration in the third embodiment of the network security system, and FIG. 10 is a functional block diagram showing a configuration of the virtual test terminal.
[0096]
(Constitution)
The system in the present embodiment operates to check for viruses incorporated in the HTML file, particularly when performing web browsing. Specifically, the virtual test terminal 240 executes an HTTP-compatible packet transmitted to the client terminal 221 that requested the Web page in the protection target network 220, and transmits the packet that has been normally executed to the client terminal 221. That's it. Therefore, this embodiment is a specific operation example of the first embodiment, and each configuration thereof is substantially the same as that of the first embodiment. However, it differs in the following points.
[0097]
In the present embodiment, the protection target network 230 is a so-called internal network 220 to which a general user terminal is connected, as in the first embodiment.
[0098]
First, the provisional execution function of the virtual test terminal 240 (function corresponding to the provisional execution unit in FIG. 2) executes an HTTP-compatible packet, which is packet data P transferred from the internal firewall 230 described later, on the Web browser. Then, whether or not fraudulent processing is performed when executed is checked based on the fraudulent execution definition data stored in the fraudulent execution definition storage unit. At this time, in the illegal execution definition data, for example, data indicating registry change, writing to the hard disk, unexpected packet transmission, etc. is described as the definition of illegal execution. Monitor whether or not.
[0099]
If the packet is illegally executed, the packet is discarded, data for registering the packet rule in the TPC transfer prohibition rule is generated, or the system environment of the virtual test terminal 140 itself is repaired. If the execution is successful, the HTTP packet as the packet P is transmitted to the terminal 221 in the internal network 220.
[0100]
Thus, in the present embodiment, the virtual execution terminal 240 operates as a proxy server that relays HTML data transmitted from the external network 1. In other words, the virtual test terminal 240 is a proxy server that provides a service of executing a test and monitoring virus data attached to the HTML file and transferring the HTML file to the client terminal 221 in the internal network 220. .
[0101]
The specific configuration of the virtual test terminal 240 is as shown in FIG. 10, and will be described in detail when explaining the operation.
[0102]
Then, with the configuration of the virtual test terminal 240, the internal firewall 230 passes the packet data P from the external network 210 to the internal network side based on the distribution rule, or forwards it to the virtual test terminal 240, as described above. However, the distribution rules are different from those described above. Specifically, in the passage permission rule, such a description is not made so that a packet conforming to HTTP is not allowed to pass, and other packet rules that are allowed to pass through the internal network 221 are described. The TPC transfer prohibition rule describes a packet rule regarding malicious virus data, and an HTTP file including such virus data is discarded by the internal firewall 230.
[0103]
(Operation)
Next, the operation of the system will be described with reference to the data flow of FIGS. First, communication between the external network 210 and the client terminal 221 on the internal network 220 is performed via the internal firewall 230. As described above, data transmitted from the external network 210 is allowed to pass through the internal firewall 230. Compared with the rule, the passage permission packet is passed through the internal network 220 (arrow A31). At this time, in this embodiment, a pass permission rule is set so that the HTTP-compatible packet is transferred to the virtual test terminal 240. Note that only data that is permitted to pass through the data transmitted from the internal network 220 to the external network 210 can pass through.
[0104]
Then, when the client terminal 221 on the internal network 220 makes an HTTP request to a Web server (not shown) on the external network 210, the request is transmitted to the virtual test terminal 240 via the internal firewall 230 (arrow). A32). In the virtual test terminal 240, the test daemon 247 receives this HTTP request via the communication device 241 (arrows A41 and A42), and the HTTP is sent to the Web server on the external network 210 as a proxy instead of the browser of the client terminal 221. A request is issued (arrows A46 and A33).
[0105]
Then, an HTTP response (for example, an HTML file) from the Web server in response to the HTTP request is transmitted to the virtual test terminal 240 based on the passage permission rule of the internal firewall 230 (arrow A34). Then, the test daemon 247 receives the HTTP response (arrows A41 and A42). The test daemon starts the corresponding Web browser 246 (arrow A43), and executes an HTML file that is the HTTP response (arrow A24). Note that the type of Web browser 246 to be used differs depending on the operating environment of the client terminal 221.
[0106]
At this time, the test daemon 247 checks the update status of the registry, process, and file, and performs unauthorized processing such as falsifying the registry, adding an unknown file, and sending an email to the outside without permission. Arrow A45) for monitoring whether or not it is broken. Then, as a result of the execution, if an illegal situation has not been confirmed, an HTTP response related to this packet is transmitted to the client terminal 221 that is the original HTTP request source via the internal firewall 230 (arrows A35 and A46). . On the other hand, if an illegal situation is confirmed, the HTTP response is discarded, and a message or the like is transmitted to the requesting client terminal 221. Thereafter, the virtual test terminal 240 is restored to the environment before execution.
[0107]
By doing so, even if the website is difficult to determine the safety, the HTML file transmitted in response to the request is executed by the virtual test terminal, and only the HTML file that has been normally executed is stored. Since an HTML file or the like transmitted to the client terminal and determined to be illegal is discarded, intrusion of illegal data can be suppressed and the risk of browsing a Web site is reduced.
[0108]
<Fourth Embodiment>
Next, a fourth embodiment of the present invention will be described. In this embodiment, the IDS technology described in the conventional example is incorporated into the configuration of the network security system described in the above embodiment.
[0109]
As a specific configuration, an unauthorized access monitoring terminal (not shown) for monitoring a packet existing between the internal firewall 3 and the virtual test terminal 4 shown in FIG. 1 is provided. The unauthorized access monitoring terminal detects an unauthorized access packet based on a predetermined standard and stores information related to the unauthorized packet, and notifies the administrator of the stored unauthorized access packet information. An illegal packet information notification function is provided. Similar to the IDS technology described above, by logging the intrusion of an illegal packet or notifying the administrator of data related to the packet, the packet rule is registered in the firewall, and the packet is stored in advance. Can be eliminated.
[0110]
In particular, by using IDS, packets that are not subject to the virtual test terminal, that is, packets that cannot be executed by the virtual test terminal are analyzed, so that illegal packets are effectively excluded from the network. Can be further strengthened.
[0111]
In this configuration, a router that operates in the same manner as the router 150 described in the second embodiment, specifically, another firewall that filters packet data to be passed through the internal firewall 3 in advance, You may provide what provided the passage permission rule different from a firewall. As a result, the number of packets arriving at the internal firewall is filtered by existing rules to reduce the number of data to be distributed by the internal firewall, thereby enhancing security. Can also be planned.
[0112]
【The invention's effect】
  Since the present invention is configured and functions as described above, according to this, unknown transmission data not previously registered in the firewall means is transferred to the virtual test terminal and executed by the virtual test terminal. In addition, since the filtering is performed three times by the firewall means before that, it is executed normally.NotoSince only the determined data is passed through the protection target network, unauthorized access from the outside can be suppressed, damage to unknown attacks can be suppressed, and network security can be enhanced.
[0113]
  or,As a result of provisional execution, a rule for identifying data that is determined to be safe or a rule for identifying data that is determined to be dangerous is generated and registered in the firewall to automatically pass the data. Rules that are allowed or rules that are prohibited from being executed on the virtual test terminal can be updated, the amount of data temporarily executed on the virtual test terminal can be reduced, and the processing load on the virtual test terminal can be reduced. be able to.
  Furthermore, in the present invention, even if the virtual test terminal described above executes a test and is forced into a system down due to an unknown attack or the like, it is permitted by the passage permission rule described in the firewall means. Only the packet can pass through the internal network mentioned above, while the unknown data does not pass through the internal network, so that the security is ensured, so that the so-called fale soft (degenerate operation) structure is maintained. It is possible to provide an unparalleled excellent network security system.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration in a first embodiment of the present invention.
FIG. 2 is a functional block diagram showing a configuration in the first embodiment of the present invention.
FIG. 3 is an explanatory diagram showing a data flow in the system according to the present invention.
FIG. 4 is a flowchart showing an operation in the first embodiment.
FIG. 5 is a flowchart showing an operation in the first embodiment, showing a continuation of FIG. 4;
FIG. 6 is a flowchart showing an operation in the first embodiment, and shows a continuation of FIG. 5;
FIG. 7 is an explanatory diagram showing a data flow as well as a configuration in a second embodiment of the present invention.
FIG. 8 is a functional block diagram showing a configuration of a virtual test terminal in the second embodiment disclosed in FIG. 7;
FIG. 9 is an explanatory diagram showing a configuration of a third embodiment of the present invention and a data flow.
FIG. 10 is a functional block diagram showing a configuration of a virtual test terminal in the third embodiment disclosed in FIG. 9;
FIGS. 11A and 11B are explanatory diagrams for explaining the outline of a conventional network security system. FIG.
FIGS. 12A and 12B are explanatory diagrams for explaining the outline of a conventional network security system.
FIG. 13 is an explanatory diagram for explaining an overview of a conventional network security system.
[Explanation of symbols]
1 External network (Internet)
2 Defense network (internal network)
3 Firewall means (internal firewall)
4 virtual test terminals
5 routers
21-23 terminals (within the network to be protected)
31 Distribution rule storage unit
33 Data distribution part
35 Distribution Rule Registration Department
41 Unauthorized execution definition storage
42 Temporary execution part
44 Distribution rule generator
P packet data

Claims (3)

A network security system comprising a firewall means for monitoring data transmitted between an external network and a protected network,
A virtual test terminal that does not belong to any of the networks is connected to the firewall means,
The firewall means transmits data transmitted from the external network to one terminal in the protection target network based on a pre-registered distribution rule to the one terminal or the virtual test terminal in the protection target network. A configuration including a data distribution function for distributing and transferring, and an executed data transfer function for transferring the executed data returned from the virtual test terminal to the one terminal in the protection target network,
While setting the virtual test terminal to an application environment equivalent to each terminal in the defense target network,
The virtual test terminal, the temporary execution function for executing data that is transferred from the firewall device, the Executed data determined to have been executed successfully on the basis of a preset reference of the temporary run data A normal execution data return function for returning to the firewall means,
The distribution rule executed by the firewall means is
When the transmitted data has a reliable address or port number, it is applied to a passage permission rule that allows passage to the defense target network and data that does not match the passage permission rule. A TPC execution correspondence rule for checking whether or not a packet pattern corresponding to a service or application executable on the virtual test terminal is provided and discarding the unsupported data, and the TPC execution correspondence rule A TPC transfer prohibition rule is applied to data having a corresponding packet pattern to check whether it is an illegal packet registered in advance and discard data judged to be illegal and prohibit its passage. ,
The firewall means is configured to have a function of transferring data sequentially passing through the contents of the distribution rule as unknown packets to the virtual test terminal in an application environment equivalent to each terminal in the defense target network. ,
Based on the data executed by the temporary execution function, the virtual test terminal generates new distribution rule data to be added to the distribution rule registered in the firewall means, and generates the generated new distribution rule data. A distribution rule generator for transmitting the distribution rule data to the firewall means;
The firewall means includes a distribution rule registration unit for newly registering the new distribution rule data received from the virtual test terminal in the already registered distribution rule,
The distribution rule generation unit of the virtual test terminal is
When the execution result obtained by executing the temporary execution function of the virtual test terminal is normal execution, a packet rule in such a case is generated to be added to the passage permission rule, and the execution result is abnormal execution In this case, a network security system is generated so that a packet rule in such a case is added to the TPC transfer prohibition rule. The network security system according to claim 1,
Between the external network and the firewall means, another firewall means is provided,
The other firewall means sets a passing rule so that only the specific packet other than the SMTP compatible packet and the SMTP compatible packet among the data transmitted from the external network to one terminal of the defense network is allowed to pass. Set,
In the firewall means, the passage permission rule is set so that only a specific packet other than the SMTP compatible packet is allowed to pass and only the SMTP compatible packet is transferred to the virtual test terminal. system. The network security system according to claim 2,
An unauthorized access monitoring terminal for monitoring packets existing between the firewall means and the virtual test terminal;
The unauthorized access monitoring terminal includes an unauthorized packet detection function for detecting an unauthorized access packet based on a predetermined criterion and storing information related to the unauthorized access packet for registration in the firewall means. Network security system.

Images