JP6359260B2 - Information processing system and firewall device for realizing a secure credit card system in a cloud environment - Google Patents

Description

  The present invention relates to a data processing technique, and more particularly to an information processing system and a firewall apparatus for realizing a secure credit card system in a cloud environment.

  PCI DSS (Payment Card Industry Data Security Standard) has been established as an international security standard for the credit card industry in order to securely handle credit card membership data at credit card merchants and payment service providers. Yes. Credit card payment service providers require a comprehensive proxy agreement with the card company as a precondition of the business. Currently, the card company requires that the payment service provider's system conforms to PCI DSS. There are things to do. Credit card member stores are also required to comply with PCI DSS from international card brands and domestic credit card companies. Therefore, it is becoming increasingly important to construct a system that conforms to PCI DSS.

Payment Card Industry (PCI) Data Security Standards Requirements and Security Standards Version 2.0, [online], October 2010, [searched September 26, 2013], Internet <URL: https: //en.pcisecuritystandards. org / _onelink_ / pcisecurity / en2ja / minisite / en / docs / pci_dss_v2-0.pdf>

  The PCI DSS includes requirements for several hundred items, and in order to realize a system compliant with the PCI DSS, a large cost is required for the construction and operation of the system.

  The present invention has been made in view of the above problems, and a main object thereof is to provide a technology that supports efficient implementation of a PCI DSS-compliant system.

  In order to solve the above-described problems, an information processing system according to an aspect of the present invention is a device arranged in a firewall and an internal segment in which the firewall prohibits communication from an external network, and processes credit card information. 1 apparatus, and the 2nd apparatus arrange | positioned at DMZ which a firewall permits communication from an external network. When the first device should communicate with a device on the external network, the first device sends a packet designating the address of the first device as the source address and the address of the device on the external network as the destination address. When a packet sent from one device is received, and the source address specified in the received packet is an address of the internal segment, the received packet is transferred to the second device, and the second device transfers from the firewall The packet is transmitted, the packet in which the source address specified in the received packet is changed to the address of the second device is sent, and the firewall receives the packet sent from the second device, When the designated source address is the address of the DMZ and the received packet satisfies a predetermined standard, It allows you to transfer a signal packet to the external network.

  Another aspect of the present invention is a firewall device. This device prohibits communication from the external network to the first device that processes the credit card information arranged in the internal segment, while permitting communication from the external network to the second device arranged in the DMZ. A packet receiving unit that receives the packet that is sent from the first device and that specifies the address of the first device as the source address and the address of the device of the external network as the destination address, and the packet receiving unit receives A packet transfer unit that transfers the packet to the second device when the source address specified in the packet is an address of the internal segment. The second device sends out a packet in which the source address specified in the packet transferred by this device is changed to the address of the second device, and the packet receiving unit receives the packet sent from the second device. The communication permission / rejection unit transfers the received packet to the external network when the transmission source address specified in the packet received by the packet reception unit is the address of the DMZ and the received packet satisfies a predetermined criterion. Allow to do.

  Note that any combination of the above-described constituent elements and a representation of the present invention converted between a method, a program, a recording medium storing the program, and the like are also effective as an aspect of the present invention.

  ADVANTAGE OF THE INVENTION According to this invention, it can support implement | achieving efficiently the system based on PCI DSS.

It is a figure which shows the physical structure of the cloud system of embodiment. It is a figure which shows the logical structure of the cloud system of embodiment. It is a figure which shows the template of a virtual server. It is a block diagram which shows the function structure of the firewall of FIG. It is a block diagram which shows the function structure of the relay server of FIG. It is a block diagram which shows the function structure of the work server of FIG. It is a figure which shows typically the communication control policy in a cloud system.

  FIG. 1 shows a physical configuration of a cloud system 10 according to the embodiment. The cloud system 10 is an information processing system that provides a cloud service that supports PCI DSS compliance of a user company system. For example, the cloud system 10 controls communication so as to satisfy the network requirements defined by the PCI DSS. The cloud system 10 provides a dedicated server PaaS (Platform as a Service) environment to each user company. Then, by causing a plurality of user companies to use a communication device such as a common firewall device, the system construction cost and the system operation cost borne by each user company are reduced. A typical user company is a company that is required to comply with PCI DSS, for example, a credit card member store, a settlement agent, an EC site provider, and a card company.

  FIG. 1 shows a physical network configuration and hardware configuration of the cloud system 10. The cloud system 10 includes a layer 3 switch (L3 switch 12), a layer 2 switch (L2 switch 14), a firewall 16, and a load balancer 18 as infrastructure devices shared among a plurality of users. Each of the L3 switch 12, the L2 switch 14, the firewall 16, and the load balancer 18 has a redundant configuration of the active machine and the spare machine (the spare machine is not shown).

  In the cloud system 10, two physical servers are assigned to each user company (referred to as user A and user B in the embodiment) that uses the cloud service. In other words, each time the number of users increases, two information processing devices dedicated to the users are added. User A server 20a and user A server 20b (collectively referred to as "user A server 20") assigned to user A, user B server 22a and user B server 22b (collectively referred to as "user A server 20") Each of the “user B servers 22”) is connected to the L2 switch 14.

  Further, virtualization software (for example, VMWare (trademark or registered trademark)) is installed in each of the user A server 20 and the user B server 22. User A and user B logically construct a plurality of virtual servers such as a web server, an application server (AP server), and a database server (DB server) in one physical server. A plurality of virtual servers are linked to execute business processes such as an electronic commerce site, credit card settlement, card member information management, purchase history management / analysis, and the like.

  The user A terminal 24 is an information processing terminal through which an administrator of the user A inputs an operation (various setting work, maintenance work, etc.) for the user A server 20. The user A terminal 24 is connected to the cloud system 10 via the Internet. Although not shown in FIG. 1, a management server that is a physical server for managing the entire cloud system 10 and provides functions of a log server 42, a relay server 44, and a cloud management server 52 in FIG. Connected to the L2 switch 14.

  FIG. 2 shows a logical configuration of the cloud system 10 according to the embodiment. This figure shows the logical network configuration and functional configuration of the cloud system 10 shown in FIG. Hereinafter, a network for cloud management constituted by the DMZ 40 and the internal segment 50 is referred to as a “cloud management network”. A network for user A composed of the DMZ 60 and the internal segment 70 is referred to as a “user A network”. A network for user B configured by DMZ 80 and internal segment 90 is referred to as a “user B network”. Further, the external network for the cloud management network is a network including the user A network, the user B network, and the Internet, and the external network for the user A network is a network including the user B network, the cloud management network, and the Internet, and the user B The external network for the network is a network including the user A network, the cloud management network, and the Internet.

  The route FW 30 is a logical firewall realized by the firewall 16. The route FW 30 permits direct access from the external network of the cloud management network to the DMZ 40 (for example, allows a packet to pass), while prohibiting direct access from the external network to the internal segment 50 (for example, discards the packet). The user A-FW 32 is also a logical firewall realized by the firewall 16. The user A-FW 32 permits direct access to the DMZ 60 from the external network of the user A network, while prohibiting direct access to the internal segment 70 from the external network. The user B-FW 34 is also a logical firewall realized by the firewall 16. The user B-FW 34 permits direct access to the DMZ 80 from the external network of the user B network, while prohibiting direct access to the internal segment 90 from the external network.

  In the embodiment, the VLAN function of the L2 switch 14 is used so that one firewall 16 physically functions as a plurality of firewalls. For example, the L2 switch 14 assigns a VLAN-ID previously assigned to the user A to the packet received from the user A network. Further, a VLAN-ID assigned to user B in advance is assigned to the packet received from the user B network. The firewall 16 identifies a packet to which a VLAN-ID indicating the user A is assigned as a packet transmitted from the user A network. And it functions as user A-FW32 by performing packet filtering according to the policy predetermined by user A. Similarly, a packet to which VLAN-ID indicating user B is assigned is identified as a packet transmitted from the user B network. And it functions as user B-FW34 by performing packet filtering according to the policy predetermined by user B.

  A system for executing user A's business process is constructed in the user A network, and a system for executing user B's business process is constructed in the user B network. FIG. 2 shows a three-layer configuration divided into a presentation layer, an application layer, and a data layer. Specifically, two virtual servers, that is, a web server 62 and a relay server 64 are arranged in the DMZ 60 of the user A network, and four virtual servers, that is, an AP server 72, a DB server 74, and a directory server are arranged in the internal segment 70. 76 and a work server 78 are arranged. In the DMZ 80 of the user B network, a web server 82 and a relay server 84 are arranged, and in the internal segment 90, an AP server 92, a DB server 94, a directory server 96, and a work server 98 are arranged.

  The network segment of each virtual server in the user A network is determined by the user A according to the PCI DSS. Typically, the server is required to have a high security level. For example, an AP server 72 that executes data processing using credit card information and a DB server 74 that holds credit card information and settlement information include an internal segment 70. To place. On the other hand, a server such as a web server 62 and a relay server 64 that are to communicate directly with an external network device are arranged in the DMZ 60. The web server 62 provides a web page related to electronic commerce and accepts HTTP access from an external network. The relay server 64 relays communication between the server of the internal segment 70 and the external network device.

  For example, the user A uses the virtualization software installed on the user A server 20 to construct the web server 62 and the relay server 64 and sets the IP address of the DMZ 60 in each server. Similarly, the AP server 72, the DB server 74, and the directory server 76 are constructed using the virtualization software installed in the user A server 20, and the IP address of the internal segment 70 is set in each server. Similarly, the network segment of each virtual server in the user B network is determined by the user B according to the PCI DSS.

  A different login account, that is, a login ID and a password, is set for each administrator of user A in each virtual server and network device of the user A network. On the other hand, a login account for each virtual server and network device is set in common for each administrator. That is, an account of an administrator belonging to the user A is different from other administrators' accounts, but the same account can log in to the user A-FW 32, the web server 62, the relay server 64, the AP server 72,.

  The directory server 76 is account information determined for each administrator of the user A, and collects common account information for each administrator for logging in to each virtual server and network device of the user A network. Hold. The same applies to the directory server 96, which is account information determined for each administrator of the user B and collects common account information for each administrator for logging in to each virtual server and network device of the user B network. Hold.

  A log server 42 and a relay server 44 are arranged in the DMZ 40 of the cloud management network, and a cloud management server 52 is arranged in the internal segment 50. The log server 42 has a function of sequentially storing the log data output by each device of the user network in units of users and virtual servers, and a function of providing the stored log data in response to a user request.

  The cloud management server 52 has a function of executing various settings for the user A server 20 and the user B server 22 in accordance with requests from the user A and the user B. The relay server 44 receives a setting request for constructing a virtual server (for example, a web server) in the user A server 20 transmitted from a device outside the cloud system 10 (for example, the user A terminal 24), and the cloud management server 52 The function to transfer to is provided.

  Specifically, the cloud management server 52 holds virtual server template data. The cloud management server 52 transmits and displays a template selection screen to a device outside the cloud system 10 (for example, the user A terminal 24) via the relay server 44, and acquires a selection result by the user. The cloud management server 52 may be installed with a VMWare (trademark or registered trademark) cloud management application. Then, the virtual server setting instruction may be notified from this application to the VMWare (trademark or registered trademark) of the user A server 20 and the user B server 22.

  FIG. 3 shows a template of a virtual server. The figure shows 16 types of templates. For example, ID “5” is a template indicating a server in which the OS is Windows (registered trademark) and web server software and antivirus software are installed. The ID “4” is a template indicating a server in which the OS is Linux (registered trademark) and no antivirus software is installed. In the latter case, typically, after a virtual server is constructed, a user installs necessary applications as appropriate. Although not illustrated in FIG. 3, a template indicating another type of server such as a directory server, a DNS server, or a relay server may be further included.

The firewall 16 will be described in detail.
The firewall 16 determines whether communication is permitted or not based on the packet data from the layer 3 to the layer 7, and controls the route of the packet. For example, based on the IP address, port number, payload application data set in the IP packet, and any combination thereof, the packet is allowed to pass or the packet is not allowed to pass. It can be said that the firewall 16 functions as a layer 3 to layer 7 switch.

  FIG. 4 is a block diagram showing a functional configuration of the firewall 16 of FIG. Each block shown in the block diagram of the present specification can be realized in hardware by an element such as a CPU and memory of a computer, a mechanical device, and an electronic circuit, and in software by a computer program or the like. However, here, functional blocks realized by their cooperation are depicted. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software.

  The firewall 16 includes a data holding unit 100 that is a storage area for storing various data, and a control unit 110 that controls passage and discard of packets. The data holding unit 100 includes a policy holding unit 102. The control unit 110 includes a packet reception unit 112, a communication permission / rejection unit 114, a packet transfer unit 116, an authentication unit 118, and a policy update unit 120.

  The policy holding unit 102 holds a rule (hereinafter referred to as a “communication control policy”) that serves as a reference for determining whether to pass or discard a packet for each user (user company). For example, the communication control policy of each user is held in association with the VLAN-ID assigned in advance to each user. The communication control policy is defined by associating packet conditions with filtering processing contents such as connection / blocking.

  The firewall 16 of the embodiment is a white list method. For example, the communication control policy for user A is a packet in which the IP address of the internal segment 70 is designated as the transmission source IP address, and a packet that satisfies a passage permission condition predetermined by user A is sent to the relay server 64. Includes a policy to forward. Further, a packet in which the IP address of the DMZ 60 is designated as a source IP address, and a packet that satisfies a passage permission condition predetermined by the user A is converted into a predetermined global address. Then, a policy for permitting transfer outside the user A network according to the destination IP address is included.

  The communication control policy for user B is a packet in which the IP address of the internal segment 90 is designated as the transmission source IP address, and a packet that satisfies a passage permission condition predetermined by user B is transferred to the relay server 84 Including a policy to do so. In addition, a packet in which the IP address of DMZ80 is designated as a source IP address and a packet that satisfies a passage permission condition determined in advance by user B is converted into a predetermined global address. And a policy for permitting transfer to the outside of the user B network according to the destination IP address.

  The passage permission condition defines, for example, a condition to be satisfied by at least one of the destination IP address, the port number, and the content of the payload, or any combination thereof. Specifically, it includes a condition that is satisfied when the destination port number is a number indicating Syslog, SNMP, SSH, or NTP. Further, it includes a condition that is satisfied when the content of the payload (for example, application data) indicates a virus definition update file acquisition request or an OS update file acquisition request. In both the communication control policies for user A and user B, a packet that does not satisfy the passage permission condition, for example, a packet that specifies a destination port number other than a predetermined destination port number is rejected, for example, the packet is discarded. To that effect.

  The packet receiving unit 112 acquires the packet transferred from the L2 switch 14. The communication permission / rejection unit 114 permits or discards the packet received by the packet reception unit 112 or determines the transfer destination according to the communication control policy held in the policy holding unit 102. The packet transfer unit 116 sends the packet permitted to pass by the communication permission / rejection unit 114 to the L2 switch 14, and sends the packet to the transfer destination determined by the communication permission / rejection unit 114 to the L2 switch 14. In the latter case, the packet transfer unit 116 is a MAC frame in which the MAC address of the transfer destination device determined by the communication permission / rejection unit 114 is set as the transmission destination MAC address, and the MAC including the IP packet received by the packet reception unit 112 The frame may be sent to the L2 switch 14.

  When transferring a packet transmitted from the DMZ 60 to the outside of the user A network, the packet transfer unit 116 also functions as an address conversion unit that executes NAT processing. Specifically, the packet transfer unit 116 holds the local address of the DMZ 60 (for example, the IP address of the relay server 64) designated as the packet source IP address in advance for communication with an external network (such as the Internet). Convert to global address. The packet transfer unit 116 transfers the packet after the source IP address is converted to the global address to the outside of the user A network. Thereby, the user A can give an arbitrary IP address to the device inside the user A network.

  The authentication unit 118 receives a login request specifying the login ID and password transmitted from the user A terminal 24 and the relay server 64 and relayed by the L2 switch 14. Typically, a login request received by the packet receiving unit 112 and passed through the communication permission / rejection unit 114 is acquired. The authentication unit 118 transmits to the directory server 76 information indicating the network segment of the login request source user (for example, VLAN-ID indicated by the login request packet) and an LDAP message for an account inquiry specifying the login ID. The authentication unit 118 acquires the password of the login request source user from the directory server 76. The account information specified in the login request matches the account information acquired from the directory server 76. For example, the login is permitted when the combination of the login ID and the password matches.

  Although not shown in FIG. 4, the firewall 16 transmits a console screen data for operating the firewall 16 and displays it on a user device whose login is permitted by the authentication unit 118. May be provided. The policy update unit 120 receives the policy change information transmitted from the user A terminal 24 or the relay server 64 and relayed by the L2 switch 14. For example, the policy change information input on the console screen of the firewall 16 is received. Of the communication control policies stored in the policy holding unit 102, the communication control policy associated with the network segment of the login user (for example, the VLAN-ID of the login user) is changed according to the policy change information.

Next, the relay server 64 will be described in detail.
The relay server 64 functions as a platform server / proxy server for the devices in the internal segment 70 to access devices outside the user A network. Similarly, the relay server 84 functions as a platform server / proxy server for the devices in the internal segment 90 to access devices outside the user B network. Hereinafter, the function of the relay server 64 is shown, but the relay server 84 is the same.

  FIG. 5 is a block diagram showing a functional configuration of the relay server 64 of FIG. The relay server 64 includes a control unit 140 that executes various types of information processing. The control unit 140 includes a packet reception unit 142, a packet conversion unit 144, and a packet transfer unit 146.

  The packet receiving unit 142 acquires the packet transferred from the L2 switch 14. The packet conversion unit 144 converts a packet received by the packet reception unit 142 whose source IP address is the address of the internal segment 70 and whose destination IP address is a device of the external network of the user A network. Identifies as a packet. The data holding unit 130 may hold address information for this identification, for example, information indicating the IP address system of the internal segment and the IP address system of the DMZ. The packet converter 144 may identify the address of the internal segment 70 and the address of the external network of the user A network with reference to this address information.

  The packet conversion unit 144 changes the source IP address of the conversion target packet to the IP address of its own device, that is, the relay server 64. Other header information and payload of the packet are not changed. The packet transfer unit 146 transmits the packet whose source IP address is converted by the packet conversion unit 144 to the L2 switch 14. The packet conversion unit 144 records the original transmission source IP address of the conversion target packet. When a response packet from an external device for the packet to be converted is received, that is, a packet whose destination IP address is the address of the internal segment 70 and whose source IP address is a device of the external network of the user A network is received, the packet conversion unit 144 The destination IP address of the response packet is converted to the original source IP address. Then, the packet transfer unit 146 transmits the response packet after conversion to the L2 switch 14.

Next, the work server 78 will be described in detail.
The work server 78 functions as a relay server, a platform server, and a proxy server for devices outside the user A network to access the devices in the internal segment 70. Similarly, the work server 98 functions as a relay server, a platform server, and a proxy server for devices outside the user B network to access the devices in the internal segment 90. Hereinafter, although the function of the work server 78 is shown, the work server 98 is the same.

  FIG. 6 is a block diagram showing a functional configuration of the work server 78 of FIG. The work server 78 includes a data holding unit 130 that is an area for storing various types of data, and a control unit 147 that executes various types of information processing. The data holding unit 130 includes an image holding unit 132. The control unit 147 includes an authentication unit 148, a console screen display control unit 150, an image recording unit 152, a command reception unit 154, and a command execution unit 156.

  The image holding unit 132 holds the image data of the console screen of the work server 78 in association with the identification information of the login user (for example, the PC name and login ID of the login user's remote terminal). The image data stored in the embodiment is the moving image data indicating the display contents of the console screen over the entire period in which the administrator of the user A is logged in and the transition thereof. In other words, it is the moving image data showing the operation contents for the relay server 64 over the login period of the user and the operation contents for each device of the user A network in time series. As a modification, it may be a periodic snapshot of the console screen during the login period of the user, that is, a plurality of still image data.

  The work server 78 accepts access from the user A terminal 24 via a VPN (Virtual Private Network). Since security is secured by VPN, the work server 78 rejects access from other than the predetermined VPN, in other words, from other than the user A terminal 24.

  The authentication unit 148 receives the login request specifying the login ID and the password transmitted from the user A terminal 24 and transmitted via the VPN. Similar to the authentication unit 118, the authentication unit 148 transmits information indicating the network segment of the login request source user and an LDAP message for account inquiry specifying the login ID to the directory server 76. The authentication unit 148 acquires the password of the login request source user from the directory server 76. If the account information specified in the login request matches the account information acquired from the directory server 76, login is permitted.

  The console screen display control unit 150 transmits and displays a console screen, which is a GUI screen for operating the work server 78, to the user A terminal 24 permitted to log in by the authentication unit 148. The console screen may be a GUI screen of a remote desktop (such as X Window System or Remote Desktop Protocol). As a modification, the console screen may be a CLI screen.

  The image recording unit 152 stores the moving image data indicating the display contents of the console screen over the login period of the user, in other words, the video data in the image holding unit 132 in association with the identification information of the login user. The image recording unit 152 continuously accumulates moving image data in the image holding unit 132 during the login period of the user.

  The command receiving unit 154 is information indicating operation contents for the console screen displayed on the user A terminal 24, and acquires command information including information input by the user on the console screen from the user A terminal 24. The command execution unit 156 executes various programs according to the command information acquired by the command reception unit 154. Here, when the command information indicates an operation for another virtual server (for example, the AP server 72 or the DB server 74) of the user A network, or an operation for the user A-FW 32 (firewall 16), the command execution unit 156 The command information is transferred to the operation target device. And it is a response message from the operation target device, and acquires response information including the command execution result.

  The console screen display control unit 150 transmits the command execution result in the own device or another device to the user A terminal 24 and displays the command execution result on the console screen being displayed on the user A terminal 24. The image recording unit 152 records the console screen image indicating the command execution result in the image holding unit 132. That is, the console screen display control unit 150 also passes the console screen data to be transmitted to the user A terminal 24 to the image recording unit 152 and causes the image holding unit 132 to store it.

  Although not shown in FIG. 6, when the work server 78 receives an image provision request from a specific administrator who has authority of each user company, the work server 78 associates it with the PC name and login ID of the remote terminal of the requesting user. An image providing unit that provides the obtained image data may be further provided. The user identification information associated with the image data may be the user's OS ID, and the image providing unit may provide the image data associated with the requesting user's OS ID. . The user identification information associated with the image data may be any combination of the PC name of the remote terminal, the login ID, and the OS ID. In addition, the authentication unit 148, the console screen display control unit 150, the command reception unit 154, and the command execution unit 156 of FIG. 6 also include other virtual servers constructed in the user A server 20 and the user B server 22.

The operation of the cloud system 10 having the above configuration will be described with reference to FIGS.
First, an operation at the time of performing communication in which the virtual server of the internal segment 70 of the user A network is the transmission source and the device outside the user A network is the destination will be described. Here, as an example, an operation will be described in which the DB server 74 stores the log data of its own server in the log server 42 using Syslog. In the cloud system 10, each virtual server built in the user A server 20 and the user B server 22 stores log data of its own server in the log server 42 of the cloud management network. In other words, the log server 42 is shared as a log data storage destination. Thereby, each user can reduce the system cost for log management.

  When the running application outputs log data and the log data is to be stored in a nonvolatile manner, the DB server 74 sends out a log notification packet including the log data. In the log notification packet, the IP address of the DB server 74 is designated as the source IP address, the IP address of the log server 42 is designated as the destination IP address, and the Syslog number is designated as the destination port number. The L2 switch 14 once transfers packets received from the user A network, the user B network, and the external network to the firewall 16. Again, the L2 switch 14 assigns a VLAN-ID indicating the user A to the log notification packet (actually a MAC frame including the log notification packet) received at the port connected to the internal segment 70, and sends the log notification packet to the log notification packet. Transfer to firewall 16.

  The firewall 16 recognizes the VLAN-ID indicating the user A and operates as the user A-FW 32. That is, referring to the transmission source IP address of the log notification packet, it is identified that the transmission source IP address is the address of the internal segment 70, and the log notification packet is transferred to the relay server 64 according to the communication control policy of the user A. That is, since the source IP address of the log notification packet is the address of the internal segment 70 and the destination port number indicates Syslog, the packet is allowed to pass and the packet is transferred to the relay server 64. . The relay server 64 changes the source IP address of the log notification packet to the IP address of the relay server 64 itself, and sends out the changed log notification packet. The L2 switch 14 transfers the log notification packet to the firewall 16.

  Since the source IP address of the log notification packet is the address of DMZ 60 and the destination port number indicates Syslog, the firewall 16 that operates as the user A-FW 32 logs according to the communication control policy of the user A. Permit transfer of notification packet to external network. At this time, the firewall 16 operating as the user A-FW 32 converts the transmission source IP address into a global address prepared in advance, and transfers the log notification packet to the external network.

  Specifically, the firewall 16 operating as the user A-FW 32 sends a MAC frame including the log notification packet and specifying the MAC address of the route FW 30 as the transmission destination MAC address to the L2 switch 14. The MAC address of the route FW 30 specified here is a MAC address assigned to the user A among a plurality of different MAC addresses predetermined for each user. Note that the route FW 30 has one MAC address, and may be recognized as a substantially different address depending on the combination with the VLAN-ID. The L2 switch 14 transfers the MAC frame including the log notification packet to the firewall 16, and the firewall 16 operating as the route FW 30 transfers the MAC frame to the log server 42. The log server 42 receives the log notification packet, extracts log data from the log notification packet, and stores it in the storage as a log of the user A DB server.

  Similar to the log recording, the virus definition update file is acquired from the virtual server of the internal segment 70 of the user A network, the OS update file is acquired, the time is synchronized by NTP, and SNMP TRAP notification is performed. It becomes operation. When a response message is transmitted from the destination device of the external network, the L2 switch 14 once transfers the response message to the firewall 16. The firewall 16 converts the destination IP address from the global address to the IP address of the relay server 64 and then transfers the response message to the relay server 64. The relay server 64 writes the destination IP address of the response message (here, the address of the relay server 64) back to the IP address of the virtual server of the internal segment 70 recorded during the previous conversion. As a result, a response message is returned to the requesting virtual server.

  As described above, a situation occurs in which communication from the virtual server in the internal segment 70 of the user A network to a device outside the user A network should be permitted. However, according to the requirement of PCI DSS, it is necessary to restrict communication to devices outside the user A network only from the DMZ 60 server of the user A network. Therefore, in the cloud system 10, the relay server 64 of the DMZ 60 is used as a springboard, and the proxy server 64 is caused to execute proxy access to the destination device. Thus, communication from the server in the internal segment 70 of the user A network to a device outside the user A network is realized while satisfying the requirements of the PCI DSS. Also, there is no need to provide a log recording server, virus definition and OS update file acquisition server, NTP server, TRAP notification server, etc. in the DMZ 60, and the cost of system construction and operation can be reduced. That is, it is possible to efficiently realize a system having security strength conforming to PCI DSS.

  FIG. 7 schematically shows a communication control policy in the cloud system 10. “O” indicates that packet transmission is permitted, and “X” indicates that packet transmission is prohibited. In conventional systems, the internal segment device is normally considered to be reliable, and packets originating from the internal segment and destined for the external network are passed. However, if there is no restriction on internal segment originating and communication to external network, confidential information held in the internal segment in an unintended form will be externally exposed due to computer virus infection or attacks by malicious third parties. There is a possibility of leaking to the network. In the cloud system 10, communication from the internal segment to the external network is prohibited in principle, and the security strength is increased by transmitting only packets that meet the criteria predetermined by the user via the relay server 64 to the external network. Increase further.

  The same operation as described above is performed when the virtual server in the internal segment 90 of the user B network transmits a packet to a device outside the user B network. The L2 switch 14 assigns a VLAN-ID indicating the user B to the log notification packet received at the port connected to the internal segment 90 and transfers the log notification packet to the firewall 16. The firewall 16 recognizes the VLAN-ID indicating the user B and operates as the user B-FW 34. That is, when the transmission source IP address of the log notification packet is the address of the internal segment 90, the log notification packet is transferred to the relay server 84 according to the communication control policy of the user B. Similar to the relay server 64, the relay server 84 changes the transmission source IP address of the log notification packet to the IP address of the relay server 84 itself.

  The firewall 16 forwards the log notification packet to the external network according to the communication control policy of the user B because the source IP address of the log notification packet is the address of DMZ80 and the destination port number indicates Syslog. Allow to do. As described above, in the cloud system 10, communication between the virtual servers provided in the user A server 20, or communication between the virtual server and the external network device, and between the virtual servers provided in the user B server 22 or the virtual server The L3 switch 12, the L2 switch 14, the firewall 16, and the load balancer 18 are shared for any communication with an external network device. Thereby, the cost of system construction and operation which each user should bear can be further reduced.

  Next, an operation when an apparatus outside the user A network becomes a transmission source and accesses each apparatus of the user A network will be described. Here, as an example, an operation when logging in to the user A-FW 32 from the user A terminal 24 will be described. In this case, the cloud system 10 uses the work server 78 as a springboard. Note that the same operation is performed when a device outside the user B network serves as a transmission source and accesses each device of the user B network.

  The administrator of the user A operates the user A terminal 24 to connect the user A terminal 24 and the work server 78 via the VPN. Then, a login request to the work server 78 is transmitted via the VPN. Since the connection is based on the VPN, the user A-FW 32 permits the login request to pass. When the work server 78 receives the login request, the work server 78 inquires of the directory server 76 about account information of the administrator of the user A, and the directory server 76 provides the account information of the administrator of the user A to the work server 78. The work server 78 permits login when the account information specified in the login request matches the account information provided from the directory server 76, and displays the contents displayed on the console screen for operating the work server 78. The indicated data is transmitted to the user A terminal 24. At the same time, the work server 78 starts recording image data indicating the display content of the console screen.

  When the login to the work server 78 is permitted, the user A terminal 24 displays the console screen of the work server 78 on the monitor. The administrator of user A inputs an operation for instructing login to the user A-FW 32 on the console screen of the work server 78. For example, a CLI shell may be started and an SSH command requesting remote login to the user A-FW 32 may be input. The user A terminal 24 transmits a login request to the user A-FW 32 to the work server 78, and the work server 78 transmits the login request to the user A-FW 32. In addition, the work server 78 stores image data indicating the operation contents of the administrator of the user A on the console screen.

  Since the work server 78 of the internal segment 70 is the transmission source and the destination port number indicates SSH, the user A-FW 32 passes the login request packet and accepts the login request. The user A-FW 32 inquires the account information of the administrator of the user A to the directory server 76, and the directory server 76 provides the account information of the administrator of the user A to the user A-FW 32. The user A-FW 32 permits login when the account information specified in the login request matches the account information provided from the directory server 76. When the user A-FW 32 permits login, the user A-FW 32 transmits a message to that effect to the work server 78 and waits in a state where the command can be accepted. The work server 78 transmits the message transmitted from the user A-FW 32 to the user A terminal 24 as display data of the console screen. At the same time, the work server 78 stores image data of the console screen including the message.

  Thereafter, the user A terminal 24 transmits an operation command for the user A-FW 32 to the user A terminal 24 via the work server 78, and the user A-FW 32 executes a process according to the operation command. For example, a process for changing the communication control policy for user A is executed. In addition, the user A-FW 32 transmits a message indicating the execution result of the operation command to the work server 78. The work server 78 transmits the message transmitted from the user A-FW 32 to the user A terminal 24 as display data of the console screen. At the same time, the work server 78 stores image data of the console screen including the message. When the user A terminal 24 logs out from the user A-FW 32 and then logs out from the work server 78, the work server 78 ends the recording of the image data on the console screen.

  The operation when logging in from the user A terminal 24 to the web server 62, the AP server 72, the DB server 74, and the like is the same. For example, when the work server 78 receives from the user A terminal 24 a login request for specifying the DB server 74 as a login destination, which is input on the console screen of the work server 78, the work server 78 transmits the login request to the DB server 74. . Since the work server 78 of the internal segment 70 is the transmission source and the destination port number indicates SSH, the user A-FW 32 passes the login request. The DB server 74 inquires about the account information of the administrator of the user A to the directory server 76, and the directory server 76 provides the account information of the administrator of the user A to the DB server 74. The DB server 74 permits login when the account information specified in the login request matches the account information provided from the directory server 76.

  Thus, in the cloud system 10, the user's account information is centrally managed by the directory server of the user network. This realizes efficient management and maintenance of user accounts. Since the firewall for the user network and the account for logging in to each virtual server are common for each administrator, the burden on the user can be reduced. In the cloud system 10, the work server 78 accepts access from the administrator terminal of the external network on the condition that it is via a predetermined VPN, and permits access to each virtual server using the work server 78 as a stepping stone. To do. At this time, the work server 78 continuously records an image indicating the operation input content of the user during the login period of the user. As a result, it is possible to leave a proof that an unauthorized operation has been performed.

Next, an operation when a virtual server is constructed in the user A server 20 will be described.
The administrator of user A operates the user A terminal 24 and logs in to the cloud management server 52 using the relay server 44 as a stepping stone. The cloud management server 52 provides the user A terminal 24 with a selection screen showing a plurality of types of templates of the virtual server shown in FIG. When the administrator of user A selects a specific template on the selection screen, the user A terminal 24 transmits information indicating the selected template to the cloud management server 52. The cloud management server 52 transmits a virtual server setting instruction associated with the selected template to the user A server 20. The VMWare (trademark or registered trademark) of the user A server 20 constructs a virtual server in a mode indicated by the selected template in accordance with the setting instruction.

  Thereby, a user's burden in construction of a virtual server can be reduced. Since the virtual server is automatically constructed if the user selects the template, the DMZ or the IP address of the internal segment may be assigned to the constructed virtual server and an application may be introduced as appropriate. The operation when building a virtual server in the user B server 22 is the same.

  The present invention has been described based on the embodiments. It is understood by those skilled in the art that these embodiments are exemplifications, and that various modifications are possible depending on combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. By the way.

  In addition, it should be understood by those skilled in the art that the functions to be fulfilled by the constituent elements described in the claims are realized by the individual constituent elements shown in the embodiments and the modified examples or by their cooperation. .

  16 firewall, 60 DMZ, 64 relay server, 70 internal segment, 74 DB server, 76 directory server, 78 work server, 112 packet receiving unit, 114 communication permission / rejection unit, 116 packet transfer unit, 144 packet conversion unit, 150 console screen A display control unit; 152 an image recording unit;

Claims (4)

An information processing system that supports the management of credit card information,
A firewall,
A first apparatus for processing credit card information arranged in an internal segment for which communication from an external network is prohibited by the firewall, wherein the first user company arranged in the internal segment provided for the first user company A first device and a first device of a second user company located in an internal segment provided for a second user company;
A second device arranged in the DMZ that allows the firewall to allow communication from the external network, the second device of the first user company arranged in the DMZ provided for the first user company; A second device of a second user company located in a DMZ provided for the user company;
With
The first device of the first user company is a device constructed in the information processing system as an external network device for the network of the first user company and the network of the second user company, and a plurality of user companies When communicating with a shared device that is a device shared by the device, specify the address of the own device as a source address, send a packet specifying the address of the shared device as a destination address,
When the first device of the second user company is to communicate with the shared device, the first device address designates the address of the own device as a transmission source address, and sends a packet designating the address of the shared device as a destination address,
The firewall receives a packet addressed to the shared device transmitted from the first device of the first user company, and an internal segment in which a source address designated by the received packet is provided for the first user company The received packet is forwarded to the second device of the first user company,
The firewall receives a packet addressed to the shared device sent from the first device of the second user company, and an internal segment in which the source address specified in the received packet is provided for the second user company The received packet is forwarded to the second device of the second user company,
Each of the second device of the first user company and the second device of the second user company receives the packet forwarded from the firewall, and sets the source address specified in the received packet to the address of the own device. Send out the modified packet,
The firewall receives both a packet sent from the second device of the first user company and a packet sent from the second device of the second user company, and the source address specified in the former packet Is the address of the DMZ provided for the first user company, and if the former packet satisfies the criteria predetermined by the first user company, the source address of the former packet is set to the global address. The converted packet is transferred to the shared device , the source address specified in the latter packet is the address of the DMZ provided for the second user company, and the second user company the predetermined reference when the latter packet satisfies, translates the source address of the latter packet to the global address, strange The information processing system comprising a benzalkonium be forwarded packet after to the shared device. A directory server that collectively stores common account information for each administrator for logging in to the firewall, the first device, and the second device, which is account information determined for each administrator; ,
Whether each of the firewall, the first device, and the second device accepts a login request, the account information specified in the login request matches the account information held in the directory server. 2. The information processing system according to claim 1, wherein whether or not to log in is determined based on the above. A third device that accepts an administrator's login from the external network device and transmits a console screen for operating the device to the external network device for display;
The third device receives data indicating an operation of an administrator for the console screen from a device of the external network, and when the operation indicates an instruction for the firewall or the first device, the third device receives the instruction for the firewall or the Notifying the first device, sending the response result of the firewall or the first device to the device of the external network for display,
3. The information processing system according to claim 1, wherein the third device stores image data of the console screen during a login period of an administrator in a predetermined storage device. A first device for processing credit card information, wherein a first device of a first user company arranged in an internal segment provided for a first user company and an internal segment provided for a second user company While prohibiting communication from the external network to the first device of the second user company arranged, the second device of the first user company arranged in the DMZ provided for the first user company and the second user A communication permission / rejection unit that permits communication from the external network to a second device of a second user company arranged in a DMZ provided for a company;
A packet sent from the first device of the first user company, specifying the address of the first device of the first user company as the source address and specifying the address of the device of the external network as the destination address is received. And a packet sent from the first device of the second user company, specifying the address of the first device of the second user company as the source address and specifying the address of the device of the external network as the destination address A packet receiver to
When the source address specified in the packet received by the packet receiving unit is the address of the internal segment provided for the first user company, the packet is transferred to the second device of the first user company. When the source address specified in the packet received by the packet receiver is the address of an internal segment provided for the second user company, the packet is transferred to the second device of the second user company A packet forwarding unit to
With
Each device of the first user company and each device of the second user company are built in an information processing system that supports the management of credit card information,
The external network device is a device constructed in the information processing system as an external network device for the first user company network and the second user company network, and is shared by a plurality of user companies. Device,
Each of the second device of the first user company and the second device of the second user company sends out a packet in which the source address specified in the packet transferred by the device is changed to the address of the own device. Yes,
The packet receiving unit receives both a packet sent from the second device of the first user company and a packet sent from the second device of the second user company;
The packet transfer unit is configured such that a source address specified in a packet transmitted from the second device of the first user company is an address of a DMZ provided for the first user company, and the first user if it meets a predetermined criteria by companies the packet, it translates the source address of the packet to the global address, to transfer the packet after conversion to the device which is the common, first the second user enterprise When the transmission source address specified in the packet transmitted from the two devices is the address of the DMZ provided for the second user company, and the packet satisfies the criteria predetermined by the second user company a, converts the transmission source address of the packet to the global address, especially the Turkey forwards the packet after conversion to the device which is the common That the firewall device.

Images