JP5120144B2 - Confidential information management system, confidential information management method, and program - Google Patents

Description

  The present invention relates to a confidential information management system, a confidential information management method, and a program for protecting confidential information from unauthorized access.

  Confidential information may be stored in a system connected to a public communication network such as the Internet. In this case, it is necessary to protect confidential information from unauthorized access. When a connection request to confidential information is received from the outside, whether or not the connection request is unauthorized access is determined based on a predetermined criterion.

For example, Patent Document 1 describes a technique for detecting the presence or absence of unauthorized access based on the correspondence between an IP address and a MAC address. Specifically, the address table stores a correspondence relationship between the IP address and the MAC address that have already been detected. The change frequency table stores the number of times of change, which is the number of times different MAC addresses are combined with the same IP address, for each IP address. The inspection unit compares the MAC address stored in the address table corresponding to the destination IP address detected from the packet flowing through the network with the MAC address detected from the packet, and if there is a mismatch, changes the corresponding IP address. Update the number of changes stored in the frequency table. And the presence or absence of unauthorized access is detected by comparing the number of changes after the update with a predetermined threshold.
JP 2007-150778 A

  The criteria for determining whether or not the connection request to the confidential information is unauthorized access is updated as appropriate. When this standard is updated, it is necessary to prevent a normal connection request from being determined as unauthorized access. Conventionally, if the standard is updated in a system that is actually operated and a connection request that is determined to be unauthorized access is not verified after one day, for example, a normal connection request is not determined to be unauthorized access. I could not confirm.

  The present invention has been made in view of the above circumstances, and the purpose of the present invention is to determine that a normal connection request is an unauthorized access according to the updated criteria when updating the criteria for whether or not the access is unauthorized. It is an object of the present invention to provide a confidential information management system, a confidential information management method, and a program capable of immediately verifying whether or not it is performed.

According to the present invention, confidential information storage means in which confidential information is stored;
Confidential information connection means for receiving access information including a connection request to the confidential information storage means, and permitting connection to the confidential information storage means when the access information satisfies a standard;
Access log storage means for storing all the access information received by the confidential information connection means;
When updating the criteria, it is determined whether the access information stored in the access log storage means satisfies the updated criteria, and the access information that does not satisfy the updated criteria is selected. Verification data generation means to perform,
A confidential information management system is provided.

According to the present invention, the computer system stores confidential information,
The computer system receives access information including a request for reading the confidential information via a communication line, and permits connection to the confidential information when the access information satisfies a standard;
The computer system stores all the received access information,
When the criterion is updated, the computer system determines whether the stored access information satisfies the updated criterion, and selects the access information that does not satisfy the updated criterion A method for managing confidential information is provided.

According to the present invention, a program for causing a computer system to function as a confidential information management system,
In the computer system,
A function of receiving access information including a request to read out the confidential information via a communication line, and permitting connection to the confidential information when the access information satisfies a standard;
A function of storing all the received access information;
A function of determining whether the stored access information satisfies the updated criterion when the criterion is updated, and selecting the access information that does not satisfy the updated criterion;
A program is provided that implements.

  According to the present invention, it is possible to immediately verify whether or not a normal connection request is determined to be unauthorized access based on the updated criterion when updating the criterion of whether or not unauthorized access is made.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In all the drawings, the same reference numerals are given to the same components, and the description will be omitted as appropriate.

  FIG. 1 is a diagram showing the configuration of the confidential information management system 20 and the use environment of the confidential information management system 20 in the present embodiment. The confidential information management system 20 is a system used when a service for managing confidential information is provided as an ASP (Application Service Provider) service. The terminal 40 connected to the public communication network 60 can be connected to the confidential information management system 20 via the public communication network 60. The public communication network 60 is an Internet network, for example.

  The confidential information management system 20 includes a firewall device 22, a confidential information management device 24, a plurality of LAN terminals 26, and a batch processing device 28. These devices are connected to each other by a local area network (LAN) 21.

  The firewall device 22 receives access information including a connection request from the terminal 40 to the confidential information management device 24, the LAN terminal 26, or the batch processing device 28 via the public communication network 60. The access information includes a remote access command. The firewall device 22 enables communication between the confidential information management device 24, the LAN terminal 26, or the batch processing device 28 and the terminal 40 when the access information satisfies a predetermined standard. . Further, when the access information does not satisfy the standard, the firewall device 22 determines that a third party without access right is about to enter the confidential information management system 20, and in order to prevent this intrusion, the confidential information management device 24, communication between the LAN terminal 26 or the batch processing device 28 and the terminal 40 is not permitted.

  The confidential information management device 24 holds confidential information. The LAN terminal 26 is a terminal operated by an employee of a company that manages the confidential information management system. The batch processing device 28 is a device that collectively performs predetermined processing at a predetermined time (for example, at night). The predetermined process includes, for example, a process of updating confidential information stored in the confidential information management device 24.

  FIG. 2 is a block diagram showing a functional configuration of the confidential information management device 24. The confidential information management device 24 includes a confidential information storage unit 210, a reference storage unit 220, and a confidential information connection unit 230. The confidential information storage unit 210 stores confidential information. The confidential information includes, for example, customer personal information.

  The reference storage unit 220 stores reference information indicating a reference for determining whether or not to permit connection to the confidential information storage unit 210 from an external device. When the reference is updated, the reference storage unit 220 stores both the reference before update and the reference after update. Further, the reference storage unit 220 stores the date and time when the reference is updated in association with the updated reference.

  The confidential information connection unit 230 receives access information including a connection request to the confidential information storage unit 210 via the LAN 21, and stores the confidential information when the access information satisfies the criteria stored in the reference storage unit 220. Connection to the unit 210 is permitted. Devices that transmit access information to the confidential information connection unit 230 include the terminal 40, the LAN terminal 26 in the confidential information management system 20, and the batch processing device 28. The access log storage unit 250 stores all access information received by the confidential information connection unit 230.

  The confidential information management device 24 has a verification data generation unit 270. When the reference data stored in the reference storage unit 220 is updated, the verification data generation unit 270 generates verification data for verifying whether or not the updated reference is valid. The verification data generation unit 270 determines whether or not the access information stored in the access log storage unit 250 satisfies the updated criteria, and selects access information that does not satisfy the updated criteria. Generate verification data.

  The confidential information management device 24 further includes a first alert transmission unit 240. When the confidential information connection unit 230 determines that the received access information does not satisfy the criteria, the first alert transmission unit 240 sends first alert information indicating that there has been unauthorized access to the first LAN terminal 26 ( To the first terminal). The first LAN terminal 26 is, for example, a terminal of a person in charge of management of the confidential information management system 20.

  The confidential information management device 24 further has a function of verifying whether or not unauthorized access is accurately selected based on the updated standard after the standard stored in the standard storage unit 220 is updated. This function is realized by the verification data generation unit 270, the unauthorized access storage unit 260, the reference verification unit 280, and the second alert transmission unit 290.

  When performing this verification, the verification data generation unit 270 selects the access information after the update of the reference from the access information stored in the access log storage unit 250 after the reference is updated, and further selects the selected access. Access information that does not satisfy the updated criteria is selected from the information. The unauthorized access storage unit 260 stores all access information determined to be unauthorized access. In the access information stored in the unauthorized access storage unit 260, the access information determined by the confidential information connecting unit 230 that the updated standard is not satisfied after the standard stored in the standard storage unit 220 is updated. Is included. The reference verification unit 280 determines whether the access information stored in the unauthorized access storage unit 260 after the update of the reference matches the access information selected by the verification data generation unit 270. Then, the second alert transmission unit 290 sends the second alert information to the predetermined second LAN terminal 26 (second terminal) when the result of determination by the reference verification unit 280 is “does not match”. Send. The second LAN terminal 26 is, for example, a person's terminal that determines a standard.

  In FIG. 2, the configuration of parts not related to the essence of the present invention is omitted. Each component of the confidential information management device 24 shown in FIG. 2 is not a hardware unit configuration but a functional unit block. Each component of the confidential information management device 24 includes a CPU, a memory of a computer, a program for realizing the components of this figure loaded in the memory, a storage unit such as a hard disk for storing the program, and a network connection interface. It is realized by any combination of hardware and software. It will be understood by those skilled in the art that there are various modifications to the implementation method and apparatus.

  FIG. 3 is a diagram illustrating an example of the reference stored in the reference storage unit 220. This criterion may be defined, for example, by a combination of the IP address of the terminal that is the source of the access information and the connection time, or the IP address of the terminal that is the source of the access information, the access time, and the SQL included in the access information It may be defined by a combination of texts. In addition, this criterion may further include at least one of the MAC address and the name of the application that transmitted the access information. These pieces of information are all included in the access information.

  FIG. 4 is a diagram showing details of the access information stored in the access log storage unit 250 in a table format. The access information includes the IP address of the terminal that is the source of the access information, the access date (including day of the week) and time, and the SQL text. The access information may further include the MAC address of the terminal that transmitted the access information and the name of the application that transmitted the access information.

  The details of the access information stored in the unauthorized access storage unit 260 are the same as the details of the data stored in the access log storage unit 250 shown in FIG.

  FIG. 5 is a flowchart showing processing performed when the confidential information management device 24 receives access information. The operation shown in this figure is performed regardless of whether the terminal that transmitted the access information is the terminal 40 located outside the confidential information management system 20, the LAN terminal 26, or the batch processing device 28 of the confidential information management system 20. Done.

  The confidential information connection unit 230 reads the reference from the reference storage unit 220. When the confidential information connection unit 230 receives the access information (S10), the confidential information connection unit 230 stores the access information in the access log storage unit 250 (S20), and determines whether the received access information satisfies the standard (S30). .

  When the access information satisfies the standard (S30: Yes), the confidential information connection unit 230 performs processing according to the access information (S40). This processing includes, for example, processing for reading out confidential information and transmitting it to a terminal that is a source of access information, processing for updating confidential information, and the like.

  When the received access information does not satisfy the standard (S30: No), the confidential information connection unit 230 determines that the access by this access information is an unauthorized access, and outputs this access information to the first alert transmission unit 240. To do. When the access information is input, the first alert transmission unit 240 generates first alert information including the access information, and transmits the generated first alert information to the first LAN terminal 26 (S50). Also, the confidential information connection unit 230 stores the access information determined to be unauthorized access in the unauthorized access storage unit 260 (S60).

  FIG. 6 is a flowchart showing a process performed by the confidential information management device 24 when the reference stored in the reference storage unit 220 is updated. When receiving the updated reference from the second LAN terminal 26, which is the terminal of the person who defines the reference, the reference storage unit 220 stores both the pre-update reference and the updated reference (S110). Then, the reference storage unit 220 outputs the updated reference to the verification data generation unit 270.

  Next, the verification data generation unit 270 reads access information that is not stored in the unauthorized access storage unit 260 among the access information stored in the access log storage unit 250 (S120). This process is performed by, for example, reading both access information stored in the access log storage unit 250 and access information stored in the unauthorized access storage unit 260 and obtaining a difference between the two read access information. Is called. Then, the verification data generation unit 270 selects, as unauthorized access, access information that does not satisfy the updated criteria from the read access information (S130).

  When unauthorized access is not selected (S140: No), since the normal connection request is not determined to be unauthorized access, information indicating that the updated standard is valid is output to the second LAN terminal 26 for processing. Exit. When unauthorized access is selected (S140: Yes), since a normal connection request is determined to be unauthorized access, information indicating that the updated reference should be changed is transmitted to the second LAN terminal 26. (S150).

  FIG. 7 is a flowchart showing a process performed by the confidential information management device 24 after the reference stored in the reference storage unit 220 is updated. This process is a process for verifying whether or not unauthorized access is selected with high accuracy according to the updated standard, and is performed after a predetermined time (for example, one day) has elapsed since the standard was updated.

  The verification data generation unit 270 reads the updated reference and the date and time when the reference was updated from the reference storage unit 220. Then, the verification data generation unit 270 reads the access information received after the reference is updated among the access information stored in the access log storage unit 250 (S210). Then, the verification data generation unit 270 selects, as unauthorized access, access information that does not satisfy the updated criteria from the read access information (S220). Next, the verification data generation unit 270 transmits the selected access information to the reference verification unit 280 together with the date and time when the reference is updated.

  When the reference verification unit 280 receives the access information and the date and time when the reference is updated from the verification data generation unit 270, the access date and time is determined from the date and time when the reference is updated among the access information stored in the unauthorized access storage unit 260. Select later access information. The access information selected here is information that the confidential information connection unit 230 determines to be unauthorized access when the access information is received. The confidential information connection unit 230 may determine that unauthorized access is made even if the access information is normal when the communication state is poor (for example, when the public communication network 60 or the LAN 21 is congested) or vice versa. Even unauthorized access may be determined to be normal access.

  Therefore, the reference verification unit 280 verifies whether the access information selected from the unauthorized access storage unit 260 matches the access information received from the verification data generation unit 270 (S230). The access information received from the verification data generation unit 270 is information selected as unauthorized access from the access information stored in the access log storage unit 250 and is not affected by the communication state. For this reason, the possibility of unauthorized access is extremely high.

  If the two types of access information match (S230: Yes), it means that unauthorized access has been accurately selected according to the updated criteria, and the process ends. If the two types of access information do not match (S230: No), it means that the unauthorized access has not been accurately selected according to the updated criteria, and the reference verification unit 280 indicates that the two types of access information do not match Is transmitted to the second alert transmission unit 290. The second alert transmission unit 290 transmits second alert information indicating that the two types of access information do not match to the second LAN terminal 26 (S240).

  Next, the effect of this embodiment is demonstrated. The access information stored in the access log storage unit 250 includes all access information actually transmitted to the confidential information management device 24. When the reference stored in the reference storage unit 220 is updated, the verification data generation unit 270 is updated using the access information stored in the access log storage unit 250 as shown in the flowchart of FIG. Process to verify later criteria. For this reason, it is possible to immediately verify whether or not a normal connection request is determined to be unauthorized access according to the updated standard.

  Further, while the confidential information connection unit 230 and the first alert transmission unit 240 of the confidential information management system 20 perform normal processing, the verification data generation unit 270 can perform processing for verifying the updated reference. Therefore, normal processing is not affected.

  The access information received by the confidential information connection unit 230 includes access information transmitted from the LAN terminal 26 of the confidential information management system 20 in addition to access information transmitted from the terminal 40 via the public communication network 60. include. For this reason, for example, even if a person inside the company that manages the confidential information management system 20 attempts unauthorized access using the LAN terminal 26, the confidential information storage unit 210 cannot be accessed.

  Further, when the reference stored in the reference storage unit 220 is not appropriate, or when the communication state is bad, the confidential information connection unit 230 may determine that the access is normal even if it is normal access information, or vice versa. Even unauthorized access may be determined to be normal access. In contrast, in the present embodiment, the processing shown in FIG. 7 is performed after a predetermined time (for example, one day) has elapsed since the reference was updated. For this reason, it is possible to verify whether or not unauthorized access is accurately selected based on the updated criteria.

As mentioned above, although embodiment of this invention was described with reference to drawings, these are the illustrations of this invention, Various structures other than the above are also employable.
(Invention 1)
Confidential information storage means for storing confidential information;
Confidential information connection means for receiving access information including a connection request to the confidential information storage means, and permitting connection to the confidential information storage means when the access information satisfies a standard;
Access log storage means for storing all the access information received by the confidential information connection means;
When updating the criteria, it is determined whether the access information stored in the access log storage means satisfies the updated criteria, and the access information that does not satisfy the updated criteria is selected. Verification data generation means to perform,
A confidential information management system.
(Invention 2)
In the confidential information management system according to the first aspect,
The confidential information connection means receives the access information from a first communication line that is a local area network (LAN),
further,
Firewall means for connecting the first communication line to a public communication network and preventing intrusion into the confidential information management system by a third party without access right;
At least one LAN terminal connected to the first communication line;
And the access information is transmitted from the public communication network or the LAN terminal to the first communication line.
(Invention 3)
In the confidential information management system according to the invention 1 or 2,
A confidential information management system further comprising: a first alert transmission unit configured to transmit first alert information to a first terminal when the confidential information connection unit determines that the received access information does not satisfy the criterion.
(Invention 4)
In the confidential information management system according to any one of the inventions 1 to 3,
After the reference is updated, the verification data generation unit is configured to obtain, from the access information after the reference is updated, of the access information stored in the access log storage unit.
Select the access information that does not meet the updated criteria,
further,
An unauthorized access storage means for storing the access information determined by the confidential information connection means if the updated criteria are not satisfied after the updated standards;
Reference verification means for determining whether or not the access information stored by the unauthorized access storage means matches the access information selected by the verification data generation means;
A confidential information management system.
(Invention 5)
In the confidential information management system according to the invention 4,
A confidential information management system further comprising second alert information output means for transmitting second alert information to a predetermined second terminal when the determination result by the reference verification means indicates a mismatch.
(Invention 6)
The computer system stores sensitive information,
The computer system receives access information including a request for reading the confidential information via a communication line, and permits connection to the confidential information when the access information satisfies a standard;
The computer system stores all the received access information,
When the criterion is updated, the computer system determines whether the stored access information satisfies the updated criterion, and selects the access information that does not satisfy the updated criterion How to manage confidential information.
(Invention 7)
A program that causes a computer system to function as a confidential information management system,
In the computer system,
A function of receiving access information including a request to read out the confidential information via a communication line, and permitting connection to the confidential information when the access information satisfies a standard;
A function of storing all the received access information;
A function of determining whether the stored access information satisfies the updated criterion when the criterion is updated, and selecting the access information that does not satisfy the updated criterion;
A program that implements

It is a figure which shows the structure of a confidential information management system, and the use environment of a confidential information management system. It is a block diagram which shows the function structure of a confidential information management apparatus. It is a figure which shows an example of the reference | standard which the reference | standard memory | storage part has memorize | stored. It is a figure which shows the detail of the access information which the access log memory | storage part has memorize | stored in a table format. It is a flowchart which shows the process performed when a confidential information management apparatus receives access information. It is a flowchart which shows the process which a confidential information management apparatus performs when the reference | standard which the reference | standard memory | storage part memorize | stores is updated. It is a flowchart which shows the process which a confidential information management apparatus performs after the reference | standard which the reference | standard memory | storage part memorize | stores is updated.

Explanation of symbols

20 Confidential Information Management System 21 LAN
22 Firewall device 24 Confidential information management device 26 LAN terminal 28 Batch processing device 40 Terminal 60 Public communication network 210 Confidential information storage unit 220 Reference storage unit 230 Confidential information connection unit 240 First alert transmission unit 250 Access log storage unit 260 Unauthorized access storage Unit 270 verification data generation unit 280 reference verification unit 290 second alert transmission unit

Claims (7)

Confidential information storage means for storing confidential information;
Confidential information connection means for receiving access information including a connection request to the confidential information storage means, and permitting connection to the confidential information storage means when the access information satisfies a standard;
Access log storage means for storing all the access information received by the confidential information connection means;
When updating the criteria, it is determined whether the access information stored in the access log storage means satisfies the updated criteria, and the access information that does not meet the updated criteria is determined. After the selection is made and the reference is updated, the updated information is not satisfied from the access information after the reference is updated among the access information stored in the access log storage unit Verification data generation means for selecting the access information ;
After the standard is updated, whether or not the access information determined by the confidential information connection unit and the access information selected by the verification data generation unit match if the updated standard is not satisfied A standard verification means to judge;
A confidential information management system. In the confidential information management system according to claim 1,
The confidential information connection means receives the access information from a first communication line that is a local area network (LAN),
further,
Firewall means for connecting the first communication line to a public communication network and preventing intrusion into the confidential information management system by a third party without access right;
At least one LAN terminal connected to the first communication line;
And the access information is transmitted from the public communication network or the LAN terminal to the first communication line. In the confidential information management system according to claim 1 or 2,
A confidential information management system further comprising: a first alert transmission unit configured to transmit first alert information to a first terminal when the confidential information connection unit determines that the received access information does not satisfy the criterion. In the confidential information management system according to any one of claims 1 to 3 ,
Confidential information management system including unauthorized access storage hands stage before Symbol criteria after being updated, and stores the access information that is determined not to satisfy the criteria after the update by the confidential connection means. In the confidential information management system according to claim 4,
A confidential information management system further comprising second alert information output means for transmitting second alert information to a predetermined second terminal when the determination result by the reference verification means indicates a mismatch. The computer system stores sensitive information,
The computer system receives access information including a request for reading the confidential information via a communication line, and permits connection to the confidential information when the access information satisfies a standard;
The computer system stores all the received access information,
When the criterion is updated, the computer system determines whether the stored access information satisfies the updated criterion, and selects the access information that does not satisfy the updated criterion And
After the criterion is updated, the computer system verifies the access information that does not satisfy the updated criterion from the access information after the criterion is updated among the stored access information. Select as
After the standard is updated, the computer system determines whether or not the access information that is not permitted to connect because the updated standard is not satisfied and the access information included in the verification data match. Judgment method of confidential information management. A program that causes a computer system to function as a confidential information management system,
In the computer system,
A function of receiving access information including a request to read out the confidential information via a communication line, and permitting connection to the confidential information when the access information satisfies a standard;
A function of storing all the received access information;
When the criterion is updated, it is determined whether the stored access information satisfies the updated criterion, the access information that does not satisfy the updated criterion is selected , and A function for selecting, as verification data, the access information that does not satisfy the updated standard from the access information after the standard is updated among the stored access information after the standard is updated;
A function of determining whether or not the access information that is not permitted to be connected as not satisfying the updated criterion and the access information included in the verification data after the criterion is updated ;
A program that implements

Images