JP7198617B2 - security system - Google Patents

Description

The present invention relates to technology for protecting information systems from cyberattacks.

Cyber-attacks on information systems are diversifying, and it is becoming increasingly difficult to protect information systems from cyber-attacks with only a single mechanism. Therefore, in recent years, there has been a need for entrance protection measures that eliminate cyberattacks before they reach information systems, and exit protection measures that minimize the impact of cyberattacks on computers even if they do occur. Protection may be sought on both sides. It is expected that resistance to cyber-attacks will be improved by implementing multi-stage protection in this way.

Patent Literature 1 listed below describes a technique for constructing a quarantine network. Quarantine network is intended to connect the computer to be inspected to a separate network isolated from the internal network, inspect it by an appropriate method, and allow the computer to be connected to the internal network only if it passes the inspection. be. In the same document, it is said that a quarantine network is realized by ARP responses (see abstract).

JP 2008-154012 A

A conventional quarantine network, such as that of Patent Document 1, is intended to detect unauthorized data such as computer viruses before they enter the internal network. That is, such a quarantine network is usually configured as one type of entrance protection system. On the other hand, in the exit protection system, after detecting a computer that has been affected by a cyberattack, it cannot be said that robust measures are taken to eliminate the impact on the internal network from that computer. I am in a difficult situation.

SUMMARY OF THE INVENTION The present invention has been devised in view of the above-described problems, and is intended to improve the security of a computer system by preventing unauthorized data from entering an internal network and by isolating infected computers infected with unauthorized data. The purpose is to improve

A security system according to the present invention comprises an entrance protection system that prevents unauthorized data from entering a computer network, and an exit protection system that inhibits unauthorized operations by an infected computer. from the computer network.

According to the security system of the present invention, the security of a computer network can be improved by eliminating unauthorized data in multiple stages both at the entrance and exit of the computer network.

1 is a network configuration diagram of a security system 10 according to Embodiment 1. FIG. 4 is a configuration example of a physical server 400; 3 is another configuration example of the physical server 400. FIG. It is a configuration example of a physical server 400 in the security system 10 according to the second embodiment. 4 is another configuration example of the physical server 400 in the security system 10 according to the second embodiment.

<Embodiment 1>
FIG. 1 is a network configuration diagram of a security system 10 according to Embodiment 1 of the present invention. The security system 10 is a system that protects the computer network to which the physical server 400 belongs from cyberattacks. Security system 10 comprises an entrance protection system 200 and an exit protection system 100 .

The computer network environment in which the security system 10 is installed is roughly divided into an external network and an internal network. The external network is a network on the Internet 500 side of the external router 310 . Ingress protection system 200 is located between external router 310 and internal router 320 . The internal network is the zone on the opposite side of the Internet 500 from the internal router 320 .

The external router 310 is a relay device that controls the communication path of packets sent to the Internet 500 . The internal router 320 is a relay device that controls communication paths of packets within the internal network and relays communication between the internal network and the external network.

Computers belonging to each network are generally connected via a network switch. FIG. 1 illustrates a network switch 330 that aggregates computers belonging to an internal network. The network switch 330 has a plurality of LAN (Local Area Network) cable ports. Computers belonging to the internal network are connected to other computers by connecting LAN cables to ports provided in the network switch 330 .

<Embodiment 1: Entrance protection system>
The entrance protection system 200 is a system for eliminating unauthorized data arriving from an external network before it enters the internal network. The entrance protection system 200 comprises a firewall (FW) 210 , an intrusion prevention system (IPS) 220 , a sandbox 230 and a web application firewall (WAF) 240 .

The FW 210 only passes communications using a specific TCP port. Since a specific TCP port number is assigned to each communication protocol in an IP (Internet Protocol) network, unauthorized communication can be eliminated to some extent by allowing only specific TCP ports to pass. Different rules can be applied when passing packets from the external network to the internal network and when passing packets from the internal network to the external network. For example, it is possible to control communication by permitting only HTTP protocol communication from the external network and permitting communication by other protocols from the internal network.

The IPS 220 holds a specific communication pattern in advance as an unauthorized communication pattern, and blocks communication that matches the unauthorized communication pattern. Therefore, IPS 220 is arranged on the communication path between the external network and the internal network. Examples of unauthorized communication patterns detected by the IPS 220 include SYN flood attacks and specific communication patterns caused by worms. In addition, sending a cross-site JAVA (registered trademark) script can also be regarded as an unauthorized communication pattern.

The sandbox 230 is a system that operates data that may be fraudulent data, monitors its behavior, and eliminates data if it can be confirmed as fraudulent data. For example, a file attached to an e-mail or a file transmitted by FTP (File Transfer Protocol) is monitored. The object to be monitored is not necessarily limited to executable files, and data that operates in conjunction with other executable files such as link libraries may also be monitored. Sandbox 230 is located in a segment that is isolated from the internal network because it is necessary to allow malicious data to run freely.

The WAF 240 stores specific behavior patterns on the web application as fraudulent patterns in advance, and blocks behaviors on the web application that match the fraudulent patterns. For example, when a password entry form is provided on a web application, a password brute force attack can be detected and blocked. SQL injection attacks and the like can also be blocked by the WAF 240 .

<Embodiment 1: Exit protection system>
The exit protection system 100 is a system for suppressing the influence of fraudulent behavior by an infected computer infected with fraudulent data in an internal network. The egress protection system 100 comprises an exclusion system 110 and an endpoint security system 120, described below.

When the elimination system 110 recognizes that an infected computer infected with illegal data exists in the internal network, it isolates the infected computer from the internal network by blocking the communication path between the infected computer and the internal network. do. Specifically, any one of the following methods can be used alone, or two or more of them can be used in combination.

(Method 1 for blocking the communication route: route control)
When establishing communication between computers, a communication path must exist. The communication path is controlled by the router to which the computer belongs. The internal router 320 has that role in the internal network of FIG. Specifically, the internal router 320 holds communication path data defining communication paths between computers in the internal network, and each computer first accesses the internal router 320 when communicating with other computers. The internal router 320 relays communication according to communication route data. In order to isolate the infected computer from the internal network, the internal router 320 should not have a communication path for the infected computer to communicate with other computers. Therefore, when the exclusion system 110 recognizes the presence of an infected computer, it rewrites the communication route data held by the internal router 320 so that there is no communication route with the infected computer as the transmission source. Specifically, it statically overwrites the corresponding part of the routing table. This allows the infected computer to be logically excluded from the internal network.

(Method 2 for blocking the communication path: switch control)
Since the computers in the internal network are connected through network switch 330, infected computers can be isolated through network switch 330. FIG. Specifically, the exclusion system 110 can physically isolate the infected computer from the internal network by disabling the LAN cable port to which the infected computer is connected. Alternatively, by changing the internal connection between the LAN cable ports, communication between the port to which the infected computer is connected and the port to which other computers are connected may be cut off. Furthermore, if the network configuration between the computers connected to the network switch 330 is defined by software inside the network switch 330, the infected computer can be isolated from other computers by changing the settings on the software. Can be placed in segments. The exclusion system 110 can logically isolate infected computers by any of the above methods.

(Method 3 for blocking the communication path: ARP table (1))
When a source computer transmits a packet to a destination computer on an IP network, it is necessary to know in advance the correspondence between the IP addresses and MAC (Media Access Control) addresses of both computers. ARP (Address Resolution Protocol) is a protocol used by each computer to obtain this correspondence. Each computer holds this correspondence as an ARP table. If the destination computer's MAC address is not known, the source computer broadcasts an ARP request asking it to reply. The exclusion system 110 uses the above mechanism in the IP network to isolate infected computers by the following method.

(Method 3 for blocking the communication path: ARP table (2))
When receiving an ARP request from an infected computer, the exclusion system 110 returns an ARP response that prevents establishment of communication between the infected computer and other computers in the internal network on the ARP table held by the infected computer. logically isolates the infected computer from the internal network. For example, it is conceivable to return an ARP response falsifying the correspondence relationship between the IP address and MAC address of the destination computer. As a result, even if the infected computer tries to access another computer, the access is disabled because the correct MAC address of the other computer cannot be obtained. Furthermore, an ARP response that rewrites the ARP table in the other computer may be transmitted so that the other computer does not access the infected computer. Specifically, an ARP response falsifying the correspondence relationship between the IP address and MAC address of the infected computer may be sent on the other computer. All of these logically isolate the infected computer from the internal network by sending an ARP response that falsifies the ARP table of each computer belonging to the internal network. Since the ARP table generally has an expiration date, the elimination system 110 can rewrite the ARP table of each computer when the expiration date expires. In addition to the above, the method described in Patent Document 1 can be used as appropriate.

FIG. 2 is a configuration example of the physical server 400. As shown in FIG. The physical server 400 includes a CPU (Central Processing Unit) 410 . Endpoint security system 120 is implemented on physical server 400 . The endpoint security system 120 detects unauthorized data present on the physical server 400 and attempts to remove it from the physical server 400 as much as possible.

Endpoint security system 120 may be configured as a protection program executed by CPU 410, for example. The protection program stores, for example, an operation pattern of known unauthorized data in advance, and detects unauthorized data by detecting an operation that matches this pattern on the physical server 400 . Alternatively, a protection program that learns behavior patterns of fraudulent data by itself by cumulatively learning fraudulent behavior can be used. Targets to be learned include (a) the binary arrangement pattern of the malicious data itself or the data used by the malicious data, (b) the TCP port used by the malicious data, and (c) the file path of the library used by the malicious data. Conceivable.

When the endpoint security system 120 detects unauthorized data on the physical server 400, it outputs a log to that effect. The exclusion system 110 acquires this log from the endpoint security system 120 and confirms its contents, thereby recognizing that the physical server 400 has been infected with unauthorized data. Alternatively, endpoint security system 120 and exclusion system 110 may be notified immediately of detection of unauthorized data.

One type of malicious data is command-and-control malware. This type of rogue data takes control of an infected computer and sends commands from a remote computer to the infected computer to perform desired rogue actions. A remote computer that sends commands is called a command and control server. If the Exclusion System 110 learns that an infected computer has been infected with this type of malicious data, the Exclusion System 110 may alternatively or additionally isolate the infected computer from the internal network by communication between them may be blocked. The specific means for blocking are the same as the methods 1 to 3 above.

FIG. 3 is another configuration example of the physical server 400 . The physical server 400 may have a configuration in which a virtual server (Virtual Machine: VM) is arranged under the hypervisor 420 . A firewall may also be deployed in a virtual server environment. FIG. 3 shows an example in which virtual FW 423 is arranged under the same hypervisor 420 in order to limit communication between VM 421 and VM 422 to a specific TCP port.

The virtual FW 423 outputs logs that record communications between the VM 421 and the VM 422 . The virtual FW 423 can also output flags representing the degree of normality or abnormality of communication to this log. For example, if too many communications attempt to use a prohibited TCP port, a corresponding warning level can be logged. The exclusion system 110 can recognize that the virtual server has been infected with unauthorized data by acquiring the log output by the virtual FW 423 and confirming the contents thereof. Alternatively, the virtual FW 423 may immediately notify the exclusion system 110 of the address of the virtual server whose warning level exceeds the threshold.

The specific means by which the elimination system 110 isolates the virtual server (VM 421 or 422 in FIG. 3) infected with unauthorized data from the internal network is the same as methods 1 to 3 above. This is because the virtual server still behaves as a computer belonging to the internal network.

In FIG. 3, it was explained that the virtual firewall 423 recognizes a virtual server infected with unauthorized data by detecting abnormal communication, but the endpoint security system 120 similar to that in FIG. By doing so, a virtual server infected with unauthorized data may be recognized.

<Embodiment 1: Summary>
The security system 10 according to the first embodiment comprises an entrance protection system 200 and an exit protection system 100, and the exit protection system 100 further comprises an exclusion system 110 that isolates infected computers from the internal network. As a result, the internal network can be protected from cyberattacks in multiple stages, and the impact of the infected computer on the internal network can be suppressed. Therefore, the cyber security of the internal network can be improved.

The security system 10 according to the first embodiment isolates the infected computer from the internal network by blocking the communication path between the infected computer and the internal network. Specifically, the exclusion system 110 (a) rewrites the routing table on the internal router 320 to cut off the communication path between the infected computer and the internal network, It is possible to use methods such as blocking the communication path between the infected computer and the internal network by changing it, and (c) camouflaging the ARP table of the computer belonging to the internal network. This allows the exclusion system 110 to ensure that the infected computer is isolated from the internal network.

The security system 10 according to the first embodiment can also block communication between the infected computer and the command and control server when the infected computer is infected with unauthorized command and control data. As a result, it is possible to comprehensively block not only the impact on the internal network, but also various command-and-control type cyber-attacks originating from infected computers. For example, infected computers can be prevented from acting as members of a bot network. Therefore, it is possible to suppress not only the influence on the internal network but also the influence on the peripheral network.

The security system 10 according to the first embodiment exchanges data identifying infected computers between the endpoint security system 120 and the exclusion system 110 . As a result, the endpoint security system 120 and the exclusion system 110, which conventionally operate independently, can cooperate with each other to enhance security synergistically. In this respect, the first embodiment is based on the technical idea unique to the first embodiment, which not only utilizes each system individually, but also provides a specific method for exhibiting a synergistic effect. I can say.

The security system 10 according to the first embodiment exchanges data identifying infected computers between the virtual FW 423 and the exclusion system 110 . As a result, even if a virtual server is infected with unauthorized data, the virtual server can be isolated from the internal network. Conventionally, the virtual FW 423 and the exclusion system 110 have only operated individually, but according to the first embodiment, they cooperate with each other to synergistically enhance security even in a virtual server environment. It can be said that the first embodiment is based on a unique technical idea in this respect as well.

<Embodiment 2>
FIG. 4 is a configuration example of a physical server 400 in the security system 10 according to Embodiment 2 of the present invention. The IP address that the virtual server has may be a private IP address inside the virtual network provided by the hypervisor 420 . In this case, for example, a NAT (Network Address Translation) 421 provided by the hypervisor 420 converts the IP address from a private address to an address on the internal network, thereby allowing each virtual server to communicate with other computers.

In the address configuration as shown in FIG. 4, inconvenience may occur when the exclusion system 110 attempts to exclude the virtual server from the internal network. This is because there is no way for the exclusion system 110 to know the private IP address of the infected computer when the exclusion system specifies the IP address of the infected computer and isolates it from the internal network. Specifically, when attempting to rewrite the ARP table of a virtual server infected with unauthorized data, there is no means for designating the private IP address of that virtual server.

Therefore, in the second embodiment, the exclusion system 110 requests the hypervisor 420 to isolate the virtual server infected with unauthorized data. The hypervisor 420 receives the request and isolates the virtual server from the virtual network under the NAT 421 . As a specific method for isolation, methods similar to methods 1 to 3 described in the first embodiment may be implemented in a virtual network. For example, if virtual routers and virtual network switches are configured in a virtual network, procedures corresponding to methods 1 and 2 may be performed for these. Alternatively, similarly to technique 3, an ARP response for rewriting the ARP table of the virtual server may be distributed within the virtual network.

FIG. 5 is another configuration example of the physical server 400 in the security system 10 according to the second embodiment. The approach described in FIG. 4 is necessary due to the fact that the virtual server's IP addressing scheme is separate from the exclusion system's 110 IP addressing scheme. Instead, in FIG. 5, a virtual exclusion system 111 operating as a slave of the exclusion system 110 is configured as a virtual server under the hypervisor 420 . The virtual exclusion system 111 is a system similar to the exclusion system 110 constructed on a virtual server.

The exclusion system 110 requests the virtual exclusion system 111 to isolate the virtual server infected with the malicious data. Since the virtual exclusion system 111 belongs to the same virtual network as the virtual server infected with unauthorized data, no special device is required to exclude the virtual server.

In the second embodiment, when the exclusion system 110 recognizes a virtual server infected with unauthorized data, the exclusion system 110 may acquire a log describing the private IP address of the virtual server on the virtual network, for example. Exclusion system 110 does not have the means to directly specify its private IP address, but instead allows hypervisor 420 or virtual exclusion system 111 to isolate the virtual server with that private IP address from the virtual network. can be requested.

<Embodiment 2: Summary>
Even if a virtual server is infected with unauthorized data, the security system 10 according to the second embodiment can isolate the virtual server from the virtual network by mutual cooperation between the exclusion system 110 and the virtual network. . As a result, it is possible to prevent the influence of unauthorized data from spreading within the virtual network. In addition, since it is not necessary to isolate the entire physical server 400, it is possible to minimize deterioration of system functions due to isolation.

<Regarding Modifications of the Present Invention>
The present invention is not limited to the embodiments described above, and includes various modifications. For example, the above-described embodiments have been described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the configurations described. Also, part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Moreover, it is possible to add, delete, or replace part of the configuration of each embodiment with another configuration.

In the above embodiment, the FW 210, IPS 220, sandbox 230, and WAF 240 can be implemented on separate server computers, or two or more of them can be implemented on the same server computer. Exclusion system 110 can also be implemented on a server computer.

Some or all of the above configurations, functions, processing units, processing means, etc. may be realized by hardware, for example, by designing integrated circuits. Moreover, each of the above configurations, functions, etc. may be realized by software by a processor interpreting and executing a program for realizing each function. Information such as programs, tables, and files that implement each function can be stored in recording devices such as memories, hard disks, SSDs (Solid State Drives), or recording media such as IC cards and SD cards. Further, the control lines and information lines indicate those considered necessary for explanation, and not all control lines and information lines are necessarily indicated on the product. In practice, it may be considered that almost all configurations are interconnected.

10: Security System 100: Exit Protection System 110: Exclusion System 120: Endpoint Security System 200: Entrance Protection System 210: FW
220: IPS
230: Sandbox 240: WAF
310: External router 320: Internal router 330: Network switch 400: Physical server 420: Hypervisor 423: Virtual FW

Claims (9)

A security system that protects an information system connected to an internal computer network from cyber attacks against said information system,
an entrance protection system that is placed between the internal computer network and an external network and blocks attacks from the external network to the internal computer network;
an exit protection system that suppresses unauthorized operations by computers connected to the internal computer network when infected with unauthorized data;
with
The entrance protection system comprises:
A firewall system that allows only communication using a specific TCP port and communication using the HTTP protocol in the case of communication from an external network to an internal network,
An intrusion prevention system that stores specific communication patterns in advance as fraudulent communication patterns and blocks communications that match the fraudulent communication patterns.
By operating the data transmitted from the external network on a sandbox computer isolated from the internal computer network and monitoring its behavior, it is determined whether or not the data is fraudulent data. A sandbox system that eliminates if it is determined that
A web application firewall system that stores specific operation patterns on web applications as fraud patterns in advance and blocks operations on web applications that match the fraud patterns;
with
The exit protection system further comprises a rogue computer exclusion system for isolating infected computers infected with the rogue data from an internal computer network to which the information system is connected ,
The egress protection system comprises a virtual firewall system that blocks communication using a specific TCP port between virtual computers belonging to the internal computer network;
When the virtual firewall system detects communication using a TCP port for which communication is not permitted, it outputs a notification or log to that effect,
The unauthorized computer exclusion system identifies a virtual computer using a TCP port for which communication is not permitted as an infected computer based on the notification or the log output by the virtual firewall system, and identifies the identified infected computer. isolate
A security system characterized by: 2. The security system according to claim 1, wherein said unauthorized computer exclusion system isolates said infected computer from said internal computer network by blocking a communication path between said infected computer and said internal computer network. . The internal computer network comprises a router that manages communication path data defining communication paths between each computer belonging to the internal computer network and the infected computer,
The unauthorized computer exclusion system rewrites the communication path data so that the communication path between each computer belonging to the internal computer network and the infected computer does not exist, thereby rewriting the infected computer and the internal computer network. 3. The security system according to claim 2, which cuts off a communication path between. the internal computer network comprises a network switch that relays communication between each computer belonging to the internal computer network and the infected computer;
The network switch has a plurality of communication ports that connect to computers, and is configured to be able to internally change the connection between each of the communication ports, A communication route between the infected computer and the internal computer network is cut off by changing connections between the communication ports so as not to relay communications to computers belonging to the internal computer network. 3. A security system according to claim 2. The unauthorized computer exclusion system monitors an address resolution packet requesting a response of correspondence between IP addresses and MAC addresses of computers belonging to the internal computer network;
When the unauthorized computer exclusion system detects the address resolution packet transmitted from the infected computer, the unauthorized computer exclusion system sends a reply that falsifies the correspondence relationship of the computers belonging to the internal computer network to the address resolution packet from the infected computer. 3. The security system according to claim 2, wherein replying cuts off a communication path between the infected computer and the internal computer network. The unauthorized computer exclusion system is characterized by blocking and suppressing unauthorized operations by the infected computer by detecting communication between the infected computer and a command and control server that transmits commands to the infected computer. 2. The security system of claim 1, wherein: the exit protection system detects the unauthorized data infected by the infected computer by executing a protection program for detecting the unauthorized data;
The unauthorized computer exclusion system specifies that the infected computer is infected with the unauthorized data and eliminates the unauthorized data by exchanging the detection result of the unauthorized data with the protection program. The security system according to claim 1, characterized in that: When the infected computer is configured as the virtual computer and is assigned an IP address on a hypervisor that hosts the virtual computer, the unauthorized computer exclusion system, via the hypervisor, 6. The security system according to claim 5, wherein a reply falsifying a correspondence relationship is returned to said address resolution packet. The infected computer protects itself from the unauthorized data by detecting the unauthorized data and executing a protection program that removes the detected unauthorized data from the infected computer,
The protection program detects the malicious data by learning an operational pattern of the malicious program and matching the learned operational pattern of the malicious program with the operational pattern of the malicious data. 1. The security system according to claim 1.

Images