JP7117917B2 - Quarantine Server and Quarantine Method - Google Patents

Description

The present invention relates to a quarantine server and quarantine method.

As IoT (Internet of Things) progresses, terminals, which are various communication devices having a network connection function, are connected to the network. Then, it is desirable to check whether the terminal has any problem in terms of security.

Therefore, when these terminals are connected to a network, there are technologies that check the installation status and version of antivirus software, and the update status of virus definition information, and control the network connection (for example, Patent Documents 1 and 2). .

JP 2016-174255 A JP 2008-84266 A

As in the above-mentioned patent documents, even if the virus definition information of the terminal is up-to-date, if the execution status of the virus scan is not appropriate, there is a security problem.

SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to provide a quarantine server and a quarantine method for quarantining a terminal more appropriately.

The above and other objects and novel features of the present invention will become apparent from the description of the specification and the accompanying drawings.

A brief outline of typical inventions disclosed in the present application is as follows.

A quarantine server for quarantining a terminal according to a representative embodiment of the present invention, comprising: a definition information providing unit for providing the latest virus definition information to the terminal; and a scan control for controlling the terminal to execute a virus scan an acquisition unit that acquires from the terminal a scan result that is the result of causing the terminal to perform a virus scan based on control by the scan control unit; and quarantines the terminal based on the scan result acquired by the acquisition unit. It comprises a quarantine section and a transmission section for transmitting the result of quarantine by the quarantine section.

Among the inventions disclosed in the present application, the effects obtained by representative ones are briefly described below.

That is, according to the exemplary embodiment of the present invention, terminals can be quarantined more appropriately.

1 is a diagram showing an overview of a configuration example of a network system that is an embodiment of the present invention; FIG. 3 is a functional block diagram of a quarantine server according to this embodiment; FIG. 3 is a diagram showing the hardware configuration of a quarantine server according to this embodiment; FIG. FIG. 4 is a sequence diagram showing a processing procedure for quarantining a terminal by the quarantine server according to the present embodiment;

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In principle, the same parts are denoted by the same reference numerals throughout the drawings for describing the embodiments, and repeated descriptions thereof will be omitted. On the other hand, parts that have been described with reference numerals in one drawing may be referred to with the same reference numerals, although they are not shown again in the description of other drawings.

<System configuration>
FIG. 1 is a diagram showing an overview of a configuration example of a network system 1 that is an embodiment of the present invention. The network system 1 includes a quarantine server 100 , a terminal 200 , an authentication switch 300 , a virus definition information acquisition destination server 400 and an internal server 500 .

Terminal 200 is connected to authentication switch 300 . The authentication switch 300 is connected to an internal network 600 to which the internal server 500 and the quarantine server 100 are connected. The quarantine server 100 may be connected to the authentication switch 300 . Internal network 600 is connected to external network 700 via a gateway. A virus definition information acquisition destination server 400 is connected to the external network 700 . The internal network 600 is specifically an in-house LAN (Local Area Network) or the like. The internal server 500 is various server devices. External network 700 is, for example, the Internet.

The terminal 200 is a mobile terminal such as a smart device, or a terminal device such as a communication device such as a personal computer.

Terminal 200 can access internal network 600 on condition that it is authenticated by authentication switch 300 . When terminal 200 is authenticated by authentication switch 300 , terminal 200 can access internal server 500 and external network 700 via internal network 600 .

The quarantine server 100 can also communicate with the virus definition information acquisition destination server 400 via the external network 700 .

The quarantine server 100 is a server device that quarantines the terminal 200 . The quarantine server 100 acquires the virus scan result from the terminal 200, refers to the virus scan result, and quarantines the terminal 200. FIG. The quarantine server 100 may also quarantine items other than the results of virus scanning (for example, application status of OS patches, etc.). In addition, the quarantine server 100 transmits to the terminal 200 the result of quarantining the terminal 200 (quarantine result) and information on whether or not access to the internal server 500 is permitted.

The authentication switch 300 is a switch device that manages access to the internal server 500 by the terminal 200 . For example, when the authentication switch 300 receives an authentication request from the terminal 200 , the authentication switch 300 determines whether or not to allow the terminal 200 that requested authentication to access the internal network 600 . At this time, the authentication may be performed in cooperation with an authentication server, which is one of the internal servers 500 .

For example, the authentication switch 300 acquires the quarantine result from the quarantine server 100 from the terminal 200 together with the above authentication request, and refers to the quarantine result to determine access permission. The terminal 200 may determine whether or not to authenticate with the authentication switch 300 based on the quarantine result of the quarantine server 100 . The authentication switch 300 denies access to the internal network 600 when the quarantine result indicates NG (indicates that the terminal 200 is infected with a virus), and the quarantine result indicates OK (indicates that the terminal 200 is infected with a virus). ), access to the internal network 600 is permitted. In this way, authentication switch 300 functions as an access control device that controls access to internal network 600 .

Note that the authentication switch 300 controls communication between the terminal 200 and the quarantine server 100 via the internal network 600 before access to the internal network 600 is permitted. Specifically, the authentication switch 300 transfers packets whose destination IP address is the IP address of the quarantine server 100 to the internal network 600 . Alternatively, a quarantine VLAN may be set in the internal network 600 and the quarantine VLAN may be assigned to permit communication to the quarantine server 100 .

The virus definition information acquisition destination server 400 is a server device that stores the latest virus definition information. The virus definition information acquisition destination server 400 provides the latest virus definition information in response to a virus definition information acquisition request from the quarantine server 100 or the terminal 200 .

Next, functions of the quarantine server 100 will be described with reference to FIG. FIG. 2 is a functional block diagram of the quarantine server 100. As shown in FIG.

The quarantine server 100 includes a scan control unit 101, a definition information providing unit 102, an acquisition unit 103, a quarantine unit 104, a transmission unit 105, and a scan/quarantine result DB 106 (storage unit). The scan control unit 101 also stores security inspection software 107 . Also, the security inspection software 107 includes a virus scan module 108 .

The scan control unit 101 is a part that controls the terminal 200 to execute a virus scan. Specifically, when accessed from the terminal 200 , the scan control unit 101 presents a download screen of the security inspection software 107 to the terminal 200 .

When the terminal 200 designates the download of the security inspection software 107 on the download screen, the scan control unit 101 transmits the security inspection software 107 to the terminal 200 and causes the terminal 200 to execute the security inspection software 107 .

Here, executing the security inspection software 107 corresponds to executing an execution file (for example, an exe file) of the security inspection software 107 .

The security inspection software 107 has a function of collecting various information of the terminal 200 for quarantine, a function of controlling acquisition of the latest virus definition information, and a function of controlling execution of virus scanning. The security inspection software 107 also includes a virus scan module 108 which is a module for executing virus scan.

Upon receiving the security inspection software 107 , the terminal 200 executes the security inspection software 107 . The executed security inspection software 107 requests the virus scan module 108 to acquire the latest virus definition information.

The virus scan module 108 requests the quarantine server 100 to acquire the latest virus definition information in response to the acquisition request. In this way, the security inspection software 107 controls acquisition of the latest virus definition information. When the virus scan module 108 acquires the latest virus definition information from the quarantine server 100, the security inspection software 107 requests the virus scan module 108 to execute a virus scan. Triggered by this, the virus scan module 108 executes a virus scan. The terminal 200 transmits the virus scan result to the quarantine server 100 .

If the terminal 200 already has the security inspection software 107, it inquires of the quarantine server 100 whether the security inspection software 107 itself is up to date. You may make it up. After confirming that the security inspection software 107 is up to date, the virus scan module 108 of the security inspection software 107 requests the quarantine server 100 to acquire the latest virus definition information.

The timing for checking whether the security inspection software 107 and the virus definition information are up-to-date may be triggered by switching the network to which the terminal 200 is connected, when the terminal 200 is started up, when returning from the standby state.

In this way, the scan control unit 101 transmits the security inspection software 107 including the virus scan module 108 to the terminal 200 and causes the security inspection software 107 to be executed, so that the latest virus definition information is provided to the terminal 200. Using this as a trigger, the terminal 200 is made to perform a virus scan.

The definition information providing unit 102 is a part that acquires the latest virus definition information from the virus definition information acquisition destination server 400 and provides the latest virus definition information to the terminal 200 . Specifically, upon receiving a request to obtain the latest virus definition information from the terminal 200, the definition information providing unit 102 requests the virus definition information acquisition destination server 400 to obtain the latest virus definition information. As a result, the definition information providing unit 102 acquires the latest virus definition information from the virus definition information acquisition destination server 400 and provides the latest virus definition information to the terminal 200 .

Before accepting the acquisition request from the terminal 200, the definition information providing unit 102 acquires the latest virus definition information from the virus definition information acquisition destination server 400, and holds the latest virus definition information. You can

Further, the definition information providing unit 102 may connect the virus definition information acquisition destination server 400 and the terminal 200 and provide the latest virus definition information to the terminal 200 via its own device. For example, the quarantine server 100 may function as a proxy server to connect the terminal 200 and the virus definition information acquisition destination server 400 .

The acquisition unit 103 acquires from the terminal 200 a scan result, which is the result of causing the terminal 200 to perform a virus scan under the control of the scan control unit 101 .

Note that the above scan results include information identifying the terminal 200 (a so-called terminal ID, user ID, etc.), the type of scan performed (for example, full scan, quick scan), the date and time of the scan, and whether the virus was infected. It includes information indicating whether or not there is. Acquisition unit 103 , upon acquiring the scan result from terminal 200 , sends it to quarantine unit 104 . The acquisition unit 103 also stores the scan result in the scan/quarantine result DB 106 .

The quarantine unit 104 is a part that quarantines the terminal 200 based on the scan result acquired by the acquisition unit 103 . When the quarantine unit 104 acquires the scan result from the acquisition unit 103, the quarantine unit 104 refers to the scan result and determines that the terminal 200 is OK if it indicates that the terminal 200 is not infected with a virus. In addition, the quarantine unit 104 refers to the scan result, and if it indicates that the terminal 200 is infected with a virus, determines NG. It should be noted that this quarantine result may be judged comprehensively including results other than the virus scan quarantine result. Information such as this quarantine result, date and time, and information identifying the terminal 200 (so-called terminal ID, etc.) is stored in the scan/quarantine result DB 106 .

Quarantine section 104 sends information including information identifying terminal 200 and information indicating OK or NG to transmission section 105 as a quarantine result.

The transmission unit 105 is a part that transmits the quarantine result from the quarantine unit 104 . Upon obtaining the quarantine result from the quarantine unit 104 , the transmission unit 105 transmits the quarantine result to the terminal 200 . Note that the transmission unit 105 may transmit the quarantine result to the authentication switch 300 .

The scan/quarantine result DB 106 is a part that stores the scan results acquired by the acquisition unit 103, and is a database that holds the scan results and quarantine results.

Next, the hardware configuration of the quarantine server 100 will be explained using FIG. FIG. 3 is a diagram showing the hardware configuration of the quarantine server 100. As shown in FIG. As shown in FIG. 3, the quarantine server 100 includes one or more CPUs 10, RAM 11 and ROM 12 which are main storage devices, communication modules 13 which are data transmission/reception devices such as network cards, and auxiliary devices such as semiconductor memories and magnetic disks. It is configured as a computer system including a storage device 14 and the like.

The functions of the quarantine server 100 shown in FIG. 2 are realized by each element of the hardware configuration described above. For example, by loading predetermined computer software onto hardware such as the CPU 10 and the RAM 11, the communication module 13 is operated under the control of the CPU 10, and data is read from and written to the RAM 11 and the auxiliary storage device 14. It is realized by Note that the quarantine server 100 may operate as one OS on the virtual base.

<Process flow>
A processing procedure for quarantining the terminal 200 by the quarantine server 100 will be described with reference to FIG. FIG. 4 is a sequence diagram showing a processing procedure for the quarantine server 100 to quarantine the terminal 200. As shown in FIG.

First, when the terminal 200 accesses the authentication switch 300 , the authentication switch 300 transmits to the terminal 200 a control signal for accessing the quarantine server 100 . The terminal 200 receives the control signal and accesses the quarantine server 100 (step S1). The scan control unit 101 of the quarantine server 100 transmits the security inspection software 107 to the terminal 200 (step S2). The terminal 200 receives the security inspection software 107 and executes the security inspection software 107 . The terminal 200 uses the virus scan module 108 included in the security inspection software 107 to request the quarantine server 100 to acquire virus definition information (step S3).

The definition information providing unit 102 of the quarantine server 100 receives the virus definition information acquisition request and provides the latest virus definition information to the terminal 200 (step S4).

When the terminal 200 acquires the latest virus definition information, the terminal 200 applies the latest virus definition information to execute a virus scan. That is, the terminal 200 executes a virus scan triggered by the provision of the latest virus definition information (step S5). The terminal 200 then transmits the scan result, which is the result of executing the virus scan, to the quarantine server 100 (step S6).

The acquisition unit 103 acquires the scan result from the terminal 200 , the quarantine unit 104 refers to the scan result, quarantines the terminal 200 , and sends the quarantine result to the transmission unit 105 . The transmission unit 105 transmits the quarantine result to the terminal 200 (step S7). The terminal 200 receives the quarantine result and accesses the authentication switch 300 based on the quarantine result (step S8).

Although not described above, when the definition information providing unit 102 provides the terminal 200 with the latest virus definition information, the definition information providing unit 102 may notify the quarantine unit 104 to that effect. In this case, the quarantine unit 104 refers to the scan results stored in the scan/quarantine results DB 106 to check the past virus scan status of the terminal 200 to be provided (the terminal to be subjected to the virus scan). In this confirmation, it may be determined whether or not the scan has been executed within a predetermined period of time, and the content of the virus scan to be executed may be determined. The execution content here indicates whether or not to execute a virus scan, the type of virus scan to be executed, and the like.

For example, if the terminal 200 has executed a virus scan within a certain period of time and is not infected with a virus, the quarantine unit 104 sends a control signal (for example, a signal indicating OK) to the scan control unit 101 indicating that the virus scan is unnecessary. , and the scan control unit 101 may transmit the control signal to the terminal 200 . Also, if the terminal 200 has not executed a virus scan within a certain period of time, the quarantine unit 104 sends a control signal (for example, a signal indicating NG) indicating that the virus scan is to be executed to the scan control unit 101, Scan control section 101 may transmit the control signal to terminal 200 . When the quarantine unit 104 sends out the control signal, information such as the quarantine result, date and time, and information for identifying the terminal 200 (so-called terminal ID, etc.) is stored in the scan/quarantine result DB 106 . At this time, the notification may be sent to the terminal 200 by sending it also to the transmission unit 105 .

In addition, if the terminal 200 has already been scanned within a certain period of time, the quarantine unit 104 sends a control signal to the terminal 200 via the scan control unit 101 to indicate execution of a quick scan (a virus scan that narrows down the scan target). may In addition, if the terminal 200 has not been scanned within a certain period of time, the quarantine unit 104 sends a control signal to the terminal 200 via the scan control unit 101 to indicate that a full virus scan (a virus scan that does not narrow down the scan target) is to be performed. 200.

The terminal 200 acquires the latest virus definition information and, when acquiring a control signal, executes a virus scan based on the control signal.

In the above-described embodiment, the case where the security inspection software 107 includes the virus scan module 108 has been described, but the present invention is not limited to this. When the security inspection software 107 is executed without the virus scan module 108 included in the security inspection software 107, the security inspection software 107 inquires of the quarantine server 100 or the virus definition information acquisition destination server 400, and updates the latest virus scan module 108 to the terminal. 200 may be made to acquire it. Alternatively, the terminal 200 may have a virus scan module installed in advance, and the security inspection software may request the virus scan module to acquire the virus definition information and execute the virus scan.

Also, in the above-described embodiment, a case has been described in which the terminal 200 executes a virus scan triggered by the provision of the latest virus definition information, but the present invention is not limited to this. For example, it may be executed after a predetermined period of time has elapsed since the latest virus definition information was provided.

Also, the security inspection software 107 may be executed using a component such as a web browser.

Alternatively, the terminal 200 may install the security inspection software 107 and then execute the security inspection software 107 .

In the above-described embodiment, the case where the security inspection software 107 is transmitted from the quarantine server 100 to the terminal 200 has been described, but the present invention is not limited to this. For example, the terminal 200 may be controlled to execute a virus scan by transmitting a control signal for controlling the execution of the virus scan from the scan control unit 101 to the terminal 200 . For example, when the definition information providing unit 102 transmits the latest virus definition information to the terminal 200, it may transmit to the terminal 200 a control signal for controlling execution of a virus scan.

In the above-described embodiment, the terminal 200 obtains the quarantine result from the quarantine server 100, transmits the quarantine result to the authentication switch 300, and requests authentication, but the present invention is not limited to this. For example, if the quarantine result indicates that the terminal 200 is infected with a virus, the terminal 200 may block access to the internal network 600 without requesting authentication from the authentication switch 300 . Access to the internal network 600 may be permitted if the quarantine result from the quarantine server 100 indicates that the user is not infected with a virus.

Authentication switch 300 may not be a switch as long as it has an authentication function. For example, it may be a sensor type device or the like.

Further, by providing the security inspection software 107 with a function of authentication and network control, an authentication device such as the authentication switch 300 does not have to exist on the network.

As described above, in the quarantine server 100 according to one embodiment of the present invention, the scan control unit 101 controls the terminal 200 to perform a virus scan, and the acquisition unit 103 receives the scan result from the terminal 200. get. Also, the quarantine unit 104 quarantines the terminal 200 based on the scan result, and the transmission unit 105 transmits the quarantine result by the quarantine unit 104 . In this way, the quarantine server 100 causes the terminal 200 to perform a virus scan, acquires the execution result (scan result), refers to the scan result, and quarantines the terminal 200. can be quarantined to As a result, it is possible to more appropriately determine whether access to the internal server 500 is permitted or not, and to build a safer network.

Also, the definition information providing unit 102 of the quarantine server 100 acquires the latest virus definition information from the virus definition information acquisition destination server 400 and provides the latest virus definition information to the terminal 200 . Also, the security inspection software 107 transmitted to the terminal 200 by the scan control unit 101 executes a virus scan triggered by the provision of the latest virus definition information. That is, the scan control unit 101 causes the terminal 200 to perform a virus scan using the provision of the latest virus definition information to the terminal 200 as a trigger.

As a result, the quarantine server 100 reliably executes a virus scan while the terminal 200 has acquired the latest virus definition information, so the terminal 200 can be quarantined more appropriately, and a safer network can be constructed. can be done.

Further, the definition information providing unit 102 of the quarantine server 100 may connect the virus definition information acquisition destination server 400 and the terminal 200 and provide the latest virus definition information to the terminal 200 via its own device. In this case as well, the scan control unit 101 causes the terminal 200 to perform a virus scan triggered by the provision of the latest virus definition information to the terminal 200 . In this case as well, the quarantine server 100 ensures that the terminal 200 executes the virus scan with the latest virus definition information acquired, so the terminal 200 can be quarantined more appropriately, and a safer network can be constructed. be able to.

Further, the scan control unit 101 causes the virus scan to be executed based on the scan result of the virus scan execution target terminal 200 stored in the scan/quarantine result DB 106 via the quarantine unit 104 . In this case, the quarantine server 100 determines the execution contents of the virus scan according to the virus scan execution status of the terminal 200. Therefore, compared with the case where the terminal 200 uniformly executes the virus scan, the processing to the terminal 200 is reduced. A more secure network can be constructed while adjusting the load.

In addition, since the scan control unit 101 transmits the virus scan module 108 to the terminal 200, the processing load on the quarantine server 100 can be reduced compared to the case where the quarantine server 100 controls execution of virus scans sequentially. can.

Although the invention made by the present inventor has been specifically described above based on the embodiments, the present invention is not limited to the above embodiments, and can be variously modified without departing from the scope of the invention. Needless to say. For example, the above embodiments have been described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the described configurations. Moreover, it is possible to add, delete, or replace a part of the configuration of the above-described embodiment with another configuration.

INDUSTRIAL APPLICABILITY The present invention can be used for a quarantine server that quarantines terminals.

Reference Signs List 1 Network system 10 CPU 11 RAM 12 ROM 13 Communication module 14 Auxiliary storage device 100 Quarantine server 101 Scan control unit 102 Definition information providing unit 103 Acquisition unit , 104... quarantine unit, 105... transmission unit, 106... scan/quarantine result DB, 200... terminal, 300... authentication switch, 400... virus definition information acquisition destination server, 500... internal server.

Claims (8)

A quarantine server that quarantines a terminal,
a definition information providing unit that provides the latest virus definition information to the terminal;
a scan control unit that controls the terminal to perform a virus scan;
an acquisition unit configured to acquire, from the terminal, a scan result obtained by causing the terminal to perform a virus scan under the control of the scan control unit;
a quarantine unit that quarantines the terminal based on the scan result acquired by the acquisition unit;
a transmission unit that transmits the results of quarantine by the quarantine unit;
with
The scan control unit transmits security inspection software for controlling acquisition of the latest virus definition information and execution of virus scan to the terminal, and causes the terminal to execute the security inspection software;
The security inspection software includes a virus scan module that performs a virus scan,
The security inspection software instructs the terminal to request the virus scan module to acquire the latest virus definition information, and when the terminal acquires the latest virus definition information, the virus scan module to execute the procedure for requesting the execution of a virus scan, and
A quarantine server, wherein the virus scan module causes the terminal to execute a procedure of requesting the quarantine server to acquire the latest virus definition information and a procedure of executing a virus scan . A quarantine server according to claim 1,
the definition information providing unit acquires the latest virus definition information from a device that stores the latest virus definition information, and provides the latest virus definition information to the terminal;
A quarantine server, wherein the scan control unit causes the terminal to perform a virus scan, triggered by the provision of the latest virus definition information to the terminal by the definition information providing unit. A quarantine server according to claim 1,
The definition information providing unit connects a device that stores the latest virus definition information to the terminal, and provides the latest virus definition information to the terminal via the own device,
A quarantine server, wherein the scan control unit causes the terminal to perform a virus scan, triggered by the provision of the latest virus definition information to the terminal by the definition information providing unit. The quarantine server according to claim 2 or 3,
further comprising a storage unit that stores the scan result acquired by the acquisition unit;
The quarantine server, wherein the scan control unit causes the virus scan to be executed based on the scan result of the virus scan target terminal stored in the storage unit. A quarantine method executed by a quarantine server that quarantines a terminal,
a definition information providing step of providing the latest virus definition information to the terminal;
a scan control step of controlling the terminal to perform a virus scan;
an acquisition step of acquiring from the terminal a scan result, which is a result of causing the terminal to execute a virus scan based on the control by the scan control step;
a quarantine step of quarantining the terminal based on the scan result obtained in the obtaining step;
a sending step of sending the quarantined result of the quarantine step;
including
In the scan control step, security inspection software for controlling acquisition of the latest virus definition information and execution of virus scan is transmitted to the terminal, causing the terminal to execute the security inspection software;
The security inspection software includes a virus scan module that performs a virus scan,
The security inspection software instructs the terminal to request the virus scan module to acquire the latest virus definition information, and when the terminal acquires the latest virus definition information, the virus scan module to execute the procedure for requesting the execution of a virus scan, and
The virus scan module causes the terminal to execute a procedure of requesting the quarantine server to acquire the latest virus definition information and a procedure of executing a virus scan,
the terminal requesting the quarantine server to acquire the latest virus definition information;
a step of performing a virus scan when the terminal obtains the latest virus definition information;
Quarantine methods, including The quarantine method according to claim 5,
the definition information providing step acquires the latest virus definition information from a device that stores the latest virus definition information, and provides the latest virus definition information to the terminal;
The quarantine method according to claim 1, wherein the scan control step causes the terminal to perform a virus scan triggered by the provision of the latest virus definition information to the terminal in the definition information provision step. The quarantine method according to claim 5,
In the definition information providing step, a device for storing the latest virus definition information is connected to the terminal, and the latest virus definition information is provided to the terminal via the own device;
The quarantine method according to claim 1, wherein the scan control step causes the terminal to perform a virus scan triggered by the provision of the latest virus definition information to the terminal in the definition information provision step. The quarantine method according to claim 6 or 7,
further comprising a storage step of storing the scan results obtained in the obtaining step;
The quarantine method, wherein the scan control step causes the virus scan to be executed based on the scan result of the virus scan execution target terminal stored in the storage step.

Images