JP5321256B2 - Quarantine network system, access management apparatus, access management method, and access management program - Google Patents

Description

  The present invention relates to a quarantine network system, and more particularly to a quarantine network system, a communication control method, and a communication control program that perform gradual quarantine.

  In a limited network such as an in-house network, a terminal connected to a LAN port such as an in-house net is once accessed to a network other than the in-house network, and the terminal is connected to the in-house network again. Is widely performed, and there is a risk that the virus may be brought into the in-house network or the like when the terminal is infected with a virus in a network different from the in-house network or the like.

  In order to solve such problems, when connecting to an in-house network, etc., it is inspected whether there are any significant security holes left such as whether the connected PC is not infected with a virus, etc. A quarantine network system is widely known as a system that makes it possible to access only the internal network.

  In a network within a limited range such as an in-house network, network authentication is generally performed to perform authentication when connecting to a network.

  The network authentication is performed by confirming whether or not the authorized user is authorized when connecting to the network. In order to determine whether the user is a regular user, there are user authentication using user identification information and terminal authentication using terminal unique information.

  From the viewpoint of strengthening security, multiple technologies including authentication in the quarantine network system have been proposed.

  For example, in the quarantine network system, the technology disclosed in Patent Document 1 performs connection to an authentication server at a level lower than the IP level, and performs quarantine and authentication before connection to a business network at the IP level. Even if a computer infected with a virus connects to the authentication server, the infected computer and the normal computer are prevented from being connected at the IP level that can infect the virus, thereby preventing the virus infection to the normal computer. It is possible.

  In addition, the technique disclosed in Patent Document 2 performs terminal authentication and user authentication of a terminal connected to a network. When authentication is successful, connection to the quarantine VLAN is permitted, and the security countermeasure check result is also OK. In addition, by permitting connection to the regular VLAN, it is possible to prevent a terminal infected with a virus from being connected to the regular VLAN.

JP 2006-155062 A JP2008-252256

  The problem with the related art is that although quarantine generally takes time, it is not possible to permit connection to the network until quarantine is completed.

  The reason is that if communication until the quarantine is completed is permitted, a terminal in a state that may be dangerous is temporarily connected to the network.

(Object of invention)
The object of the present invention is to first perform terminal authentication and user authentication of a terminal connected to a network to allow a minimum access, then execute quarantine on a terminal that has been successfully authenticated, classify the quarantine result, An object of the present invention is to provide a quarantine network system, a communication control method, and a communication control program that can shorten the time required for quarantine by expanding the accessible range in stages according to the result.

  The first quarantine network system of the present invention is a quarantine network system including at least one server and a terminal that accesses the server, and an authentication server that performs authentication related to the terminal and authentication is obtained. A quarantine server that performs quarantine on a terminal and an access management device that controls an access range of the terminal to the server according to the level of successful quarantine.

  A second access management apparatus according to the present invention is an access management apparatus that controls access of a terminal in a quarantine network system including at least one server and a terminal that accesses the server, wherein authentication is obtained. The range of access to the server of the terminal is controlled according to the level of quarantine that is successful for the terminal.

  The third access management method of the present invention comprises at least one server, a terminal that accesses the server, an authentication server that authenticates the terminal, a quarantine server that performs quarantine on the terminal, An access management method by a quarantine network system including an access management device that controls access, the step of authenticating a terminal with an authentication server, the step of executing a quarantine with a quarantine server for a terminal that has been authenticated, The access management device includes a step of controlling an access range of the terminal to the server according to a level of successful quarantine.

  The fourth access management program of the present invention is an access that operates on a computer device of a quarantine network system including at least one server, a terminal that accesses the server, and a computer device that controls access to the terminal. A management program that causes a computer device to execute a process for controlling an access range of a terminal to a server in accordance with the level of quarantine that has been successfully performed on the authenticated terminal.

  According to the present invention, terminal authentication and user authentication of a terminal connected to a network are first performed to allow minimum access, and then quarantine is performed on a terminal that has been successfully authenticated, and the quarantine result is classified into levels, According to the result, it is possible to provide a quarantine network system, a communication control method, and a communication control program that can reduce the time required for quarantine by expanding the accessible range in stages.

It is a figure which shows the structure of the 1st Embodiment of this invention. It is a block diagram which shows the structure of the 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the terminal in the 1st Embodiment of this invention. It is a figure which shows an example of the quarantine policy database in the 1st Embodiment of this invention. It is a sequence diagram which shows the process of the terminal authentication and user authentication in the 1st Embodiment of this invention. It is a sequence diagram which shows the process of quarantine in the 1st Embodiment of this invention.

  Next, an embodiment of the present invention will be described in detail with reference to FIGS.

(First embodiment)
FIG. 1 is a diagram showing a configuration of a quarantine network system according to the first embodiment of the present invention, and FIG. 2 is a block diagram showing a configuration of the first embodiment.

  Referring to FIG. 2, a quarantine network system 100 according to the first embodiment of the present invention includes a terminal 60, an access management apparatus 10 that controls communication of the terminal 60 based on an authentication result and a quarantine result of the terminal 60, and An authentication server 20 that returns an authentication result of the terminal 60 in response to an inquiry from the access management apparatus 10, a quarantine server 30 that transmits a quarantine result of the terminal 60 to the access management apparatus 10, and a terminal that has succeeded in terminal authentication and user authentication 60 includes a local network 40 that can communicate, and a server group 50 in which terminal authentication, user authentication, and a terminal 60 that has completed quarantine can communicate according to the level of a quarantine result.

  The terminal 60 includes a terminal information transmission unit 601 and a communication unit 601.

  The terminal information transmission unit 601 has a function of transmitting the unique information of the terminal 60, user identification information of the user who uses the terminal 60, and security information of the terminal 60 to the access management apparatus 10. In the present embodiment, the MAC address information is used as the unique information of the terminal 60, but the present invention is not limited to this.

  The user identification information is assumed to be a login ID and password, etc., and the security information includes the OS and version of the terminal, security patch application status, presence of anti-virus software, firewall setting status, etc. It is assumed that there is a software list.

  The communication unit 602 has a function of communicating with the local network 40 and the server group 50 via the access management apparatus 10.

  The access management apparatus 10 includes a transmission / reception unit 101, a terminal information registration unit 102, a terminal information holding unit 103, and an access control unit 104.

  The transmission / reception means 101 has a function of receiving the MAC address information and user identification information of the terminal 60 transmitted from the terminal 60.

  The transmission / reception unit 101 has a function of transmitting the received MAC address information and user identification information of the terminal 60 to the authentication server 20.

  The transmission / reception unit 101 has a function of receiving the authentication result of the terminal authentication and the user authentication of the terminal 60 transmitted from the authentication server 20.

  The transmission / reception unit 101 has a function of receiving an access control release command for the terminal 60 transmitted from the quarantine server 30.

  The terminal information registration unit 102 transmits the MAC address information transmitted from the terminal 60 when the terminal authentication is successful when the authentication of the terminal 60 is successful in the authentication server 20 and from the terminal 60 when the user authentication is successful. The registered user identification information is registered in the terminal information holding means 103.

  The terminal information holding unit 103 has a function of holding the MAC address information of the terminal 60 and user identification information.

  The access control unit 104 has a function of canceling access to the terminal 60 when receiving an access control release command from the quarantine server 30.

  The access control unit 104 has a function of controlling communication between the local network 40 or the server group 50 and the terminal 60 when communication from the terminal 60 to the local network 40 or the server group 50 is started.

  Specifically, when the terminal 60 has succeeded in terminal authentication and user authentication, the access control means 104 permits the terminal 60 to communicate with the local network 40. Further, the access control means 104 gradually expands the accessible range in the server group 50 according to the range in which the terminal 60 has completed the quarantine.

  The authentication server 20 includes an authentication unit 201.

  The authentication unit 201 performs terminal authentication when the MAC address information of the terminal 60 is received from the access management apparatus 10, performs user authentication when the user identification information of the terminal 60 is received, and when authentication is successful. It has a function of notifying the access management apparatus 10 to that effect.

  The authentication information database 210 holds the MAC address information of the terminal 60 and user identification information. It is assumed that the MAC address information and user identification information of the terminal 60 are registered in advance.

  The quarantine server 30 includes a quarantine unit 301.

  The quarantine unit 301 has a function of quarantining the terminal 60 when receiving the security information of the terminal 60 from the terminal 60.

  The quarantine unit 301 performs quarantine for each quarantine level stored in the quarantine policy database 310. In this embodiment, the quarantine is performed in the order from the lowest quarantine level. However, the order of the quarantine is not limited to the order from the lowest level, and can be performed in the order from the highest level or randomly. Shall.

  In addition, the quarantine unit 301 has a function of notifying the access management device 10 of an access control release command at a level where the quarantine is successful when the quarantine is successful.

  The quarantine policy database 310 holds security policies classified into levels and information on access ranges to the networks corresponding to the classified security policies. It is assumed that the security policy divided into levels and the access range to the network corresponding to the security policy divided into levels are registered in advance. FIG. 4 shows an example of the quarantine policy database 301.

  The local network 40 includes a server 401 and a printer 402. The local network 40 can communicate with a terminal 60 that has succeeded in both terminal authentication and user authentication.

  The server group 50 includes servers 501, 502, and 503. In the server group 50, the terminal 60 that has completed terminal authentication, user authentication, and quarantine can communicate according to the level of the quarantine result. It is assumed that quarantine levels are set in advance in the servers 501, 502, and 503.

  In the present embodiment, the number of servers in the server group 50 is three. However, the number of servers is not limited to this number, and the quarantine level is not limited to each server, for example, for each specific area in the server. It can also be set.

(Description of the operation of the first embodiment)
Next, the operation of the present embodiment will be described in detail with reference to the drawings.

  The operation of terminal 60 in the present embodiment will be described using the flowchart shown in FIG.

  When the terminal 60 is connected to the quarantine network system 100, first, terminal authentication is performed (step S301).

  If the terminal authentication fails (step S301 “NO”), the terminal 60 cannot access the network of the quarantine network system 100 (step S303).

  When terminal authentication is successful (step S301 “YES”), user authentication is performed (step S302).

  When the user authentication fails (step S302 “NO”), the terminal 60 cannot access the network (step S303).

  When the user authentication is successful (step S302 “YES”), the terminal 60 can perform level 0 access (step S304). That is, as shown in FIG. 4, the terminal 60 can access the local network 40.

  The terminal 60 that has completed terminal authentication and user authentication sequentially performs level 1 to N quarantine (steps S305 to S307).

  When the level i quarantine is successful (step S305 “YES”), access to the level i server becomes possible (step S306). If the quarantine fails (step S305 “NO”), access to the level (i-1) server is possible. For example, if the quarantine up to level 4 is successful and the quarantine at level 5 fails, the terminal 60 can access the level 1 to level 4 server.

  Note that the security policy divided into levels shown in FIG. 4 and the access range to the network corresponding to the security policy divided into levels are not limited to this example, and can be arbitrarily set. .

  Next, terminal authentication and user authentication operations of the present embodiment will be described in detail with reference to the sequence diagram shown in FIG.

  First, the terminal 60 transmits the MAC address information of the terminal 60 to the access management apparatus 10 using the terminal information transmission unit 601 (step S501).

  When the transmission / reception unit 101 receives the MAC address information of the terminal 60, the access management apparatus 10 transmits the received MAC address information to the authentication server 20 using the transmission / reception unit 101 (step S502).

  Upon receiving the MAC address information of the terminal 60, the authentication server 20 performs terminal authentication of the terminal 60 using the authentication unit 201 (step S503).

  The authentication unit 201 confirms whether the received MAC address information is registered in the authentication information database 210. If the MAC address information is registered in the authentication information database 210, the terminal authentication is successful.

  When the terminal authentication is successful (step S504 “YES”), the authentication unit 201 notifies the access management apparatus 10 of the authentication result.

  When the transmission / reception unit 101 receives the authentication result, the access management apparatus 10 registers the MAC address information of the terminal 60 in the terminal information holding unit 103 using the terminal information registration unit 102 (step S505).

  Next, the terminal 60 transmits the user identification information of the terminal 60 to the access management apparatus 10 using the terminal information transmission unit 601 (step S507).

  When the transmission / reception unit 101 receives the user identification information of the terminal 60, the access management apparatus 10 transmits the received user identification information to the authentication server 20 using the transmission / reception unit 101 (step S508).

  Upon receiving the user identification information of the terminal 60, the authentication server 20 performs user authentication using the authentication unit 201 (step S509).

  The authentication unit 201 confirms whether the received user identification information is registered in the authentication information database 210. If the user identification information is registered in the authentication information database 210, the user authentication is successful.

  When the user authentication is successful (step S510 “YES”), the authentication unit 201 transmits an authentication result to the access management apparatus 10 (step S511).

  When the transmission / reception unit 101 receives the authentication result, the access management apparatus 10 registers the user identification information in the terminal information holding unit 103 using the terminal information registration unit 102 (step S512).

  After that, when the terminal 60 starts communication with the server 401 in the local network (step S513), the access management apparatus 10 uses the access control means 104, and the MAC address information and user identification information of the terminal 60 are stored in the terminal information holding means. 103, and if the MAC address information and user identification information of the terminal 60 are registered in the terminal information holding means 103 (step S514 “YES”), the terminal 60 is connected to the local network 40. Allow communication.

  Next, the operation of the quarantine according to the present embodiment will be described in detail using the sequence diagram shown in FIG.

  First, the terminal 60 transmits the security information of the terminal 60 to the quarantine server 30 using the terminal information transmission unit 601 (step S601).

  When the security information of the terminal 60 is received, the quarantine server 30 performs the quarantine using the quarantine unit 301.

  The quarantine unit 301 determines whether or not the received security information conforms to the security policy registered in the quarantine policy database 310 in order from the lowest security policy level (steps S602 to S605). If the security policy of level i registered in the quarantine policy database 310 is compliant, the level i quarantine is successful.

  If the quarantine at level i is successful (step S603 “YES”), the quarantine means 301 notifies the access management device 10 of a level i access control release command from the terminal 60 (step S606), and then the level (i + 1). Quarantine.

  As long as quarantine continues to be successful, the quarantine unit 301 performs quarantine in ascending order of the level of the security policy, and quarantine at all levels is completed (step S605 “YES”). When it fails (step S603 “NO”), the quarantine is terminated.

  When the transmission / reception means 101 receives the level i access control release command of the terminal 60 from the quarantine server 30, the access management apparatus 10 uses the access control means 104 to release the level i access restriction of the terminal 60 (step). S606).

  Thereafter, when the terminal 60 starts communication with the server 501 (step S607), the access management apparatus 10 uses the access control unit 104 to register the MAC address information and user identification information of the terminal 60 in the terminal information holding unit 103. (Step S608, S609).

  When both the MAC address information of the terminal 60 and the user identification information are registered in the terminal information holding means 103 (steps S608 “YES”, S609 “YES”), the access management apparatus 10 restricts the access of the terminal 60. Check the release status. When the access restriction on the server 501 of the terminal 60 is released, the access control unit 104 permits communication to the server 501.

(Effects of the first embodiment)
Next, the effect of this embodiment will be described.

  The first effect is that, according to the present embodiment, the range that can be accessed in stages is expanded depending on the result of quarantine, so that the time required for quarantine can be shortened, and network resources can be reduced without sacrificing user convenience. Can be used.

  According to the second embodiment, since both terminal authentication and user authentication are performed according to the present embodiment, it is possible to prevent an unauthorized user and an unauthorized terminal from being accessed, which can occur in the case of only one of the two, and more security. It can be increased.

  Although the present invention has been described with reference to the preferred embodiments, the present invention is not necessarily limited to the above embodiments, and various modifications can be made within the scope of the technical idea. .

DESCRIPTION OF SYMBOLS 100: Quarantine network system 10: Access management apparatus 101: Transmission / reception means 102: Terminal information registration means 103: Terminal information holding means 104: Access control means 20: Authentication server 201: Authentication means 210: Authentication information database 30: Quarantine server 301: Quarantine means 310: Quarantine policy database 40: Local network 401: Server 402: Server 50: Server group 501, 502, 503: Server 60: Terminal 601: Terminal information transmission means 602: Communication means

Claims (20)

A first server also less a quarantine network system including a terminal for access to said server,
An authentication server for authenticating the terminal;
A quarantine server that performs quarantine on the terminal that has been authenticated;
An access management device that controls an access range of the terminal to the server according to a level of successful quarantine ,
The quarantine server performs quarantine in ascending order of quarantine level,
The quarantine network system , wherein the access management device expands an access range to the server step by step for each level of successful quarantine. The authentication server performs authentication related to the terminal based on unique information of the terminal and user identification information of a user who uses the terminal,
The quarantine network system according to claim 1, wherein the access management apparatus permits a terminal that has obtained the authentication to communicate with a local network to which the terminal belongs. A security policy that has been classified in advance and a quarantine policy database in which information on the access range of the server that allows access for each quarantine level is set in advance,
The quarantine server
If the security information received from the terminal complies with the security policy registered in the quarantine policy database, the security policy is determined in order from the lowest level of the security policy. Including a quarantine means for notifying the level of access control release
The quarantine network system according to claim 1, wherein the access management device extends an access range of the terminal to the server based on the received access control release command . The access management device includes:
The access control means for permitting communication to the local area network and releasing access restriction for the server of the terminal in accordance with an access control release command from the quarantine server. The quarantine network system according to any one of the above . An authentication information database that holds the unique information of the terminal and user identification information;
The authentication server is
It comprises authentication means for checking whether the unique information of the terminal received from the terminal and the user identification information are registered in the authentication information database, and notifying the access management apparatus when it is registered. The quarantine network system according to any one of claims 2 to 4, characterized in that: A plurality of the servers;
The quarantine network system according to any one of claims 1 to 5, wherein a quarantine level permitting access is set for each server . An access management device that controls access of the terminal in a quarantine network system including at least one server and a terminal that accesses the server,
For the terminals for which quarantine has been executed and the authentication has been obtained in order from the lowest quarantine level, the range of access to the server is expanded step by step for each successful quarantine level
An access management device . 8. The access management apparatus according to claim 7, wherein the terminal that has obtained the authentication is permitted to communicate with a local network to which the terminal belongs . Determining whether the security information received from the terminal complies with a security policy, in order from the lowest level of the security policy, and releasing the access control from a quarantine server that notifies an access control release command of a compliant level The access management apparatus according to claim 7 or 8, wherein the access management apparatus receives an instruction and extends an access range of the terminal to the server . Characterized in that it comprises access control means for permitting communication of the terminal that has been authenticated to the local area network, and in accordance with an access control release command from the quarantine server, to release access restrictions on the server of the terminal. The access management apparatus according to claim 8 or 9 . At least one server; a terminal that accesses the server; an authentication server that authenticates the terminal; a quarantine server that performs quarantine on the terminal; and an access management device that controls access to the terminal An access management method using a quarantine network system,
Authenticating the terminal with the authentication server;
Performing quarantine on the quarantine server for the terminal for which authentication has been obtained;
Controlling an access range of the terminal to the server according to a level of successful quarantine in an access management device;
The quarantine server performs quarantine in ascending order of quarantine level,
The access management device expands the access range to the server step by step for each level of successful quarantine.
An access management method characterized by the above . In the authentication server, based on the unique information of the terminal and the user identification information of the user who uses the terminal, authentication related to the terminal is executed,
12. The access management method according to claim 11, wherein the access management apparatus permits a terminal that has obtained the authentication to communicate with a local network to which the terminal belongs . A security policy that has been classified in advance and a quarantine policy database in which information on the access range of the server that allows access for each quarantine level is set in advance,
In the quarantine server,
If the security information received from the terminal complies with the security policy registered in the quarantine policy database, the security policy is determined in order from the lowest level of the security policy. The access control release command at the specified level,
In the access management device,
13. The access management method according to claim 11, wherein the access range of the terminal to the server is expanded based on the received access control release command . In the access management device,
The access management according to claim 12 or 13, wherein communication to the local area network is permitted, and access restriction on the server of the terminal is released according to an access control release command from the quarantine server. Way . An authentication information database that holds the unique information of the terminal and user identification information;
In the authentication server,
The unique information of the terminal received from the terminal and the user identification information are collated to be registered in the authentication information database, and if registered, the fact is notified to the access management apparatus. The access management method according to any one of claims 12 to 14 . A plurality of the servers;
16. The access management method according to claim 11, wherein a quarantine level permitting access is set for each server . An access management program that operates on the computer device of the quarantine network system including at least one server, a terminal that accesses the server, and a computer device that controls access of the terminal,
In the computer device,
Quarantine is executed in descending order of the quarantine level, and the terminal which has been authenticated is executed to execute a process of gradually expanding the access range to the server for each successful quarantine level.
An access management program characterized by that . In the computer device,
18. The access management program according to claim 17, wherein a process for permitting communication to a local network to which the terminal belongs is executed for the terminal that has obtained the authentication . In the computer device,
Determining whether the security information received from the terminal complies with a security policy, in order from the lowest level of the security policy, and releasing the access control from a quarantine server that notifies an access control release command of a compliant level The access management program according to claim 17 or 18, wherein a command is received, and a process of extending an access range of the terminal to the server is executed . In the computer device,
Allowing the terminal that has been authenticated to communicate with the local area network, and performing a process of releasing the access restriction on the server of the terminal in accordance with an access control release command from the quarantine server. The access management program according to claim 18 or 19 .

Images