JPH11313111A - Information passing control method, gateway device and record medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information passing control method, a gateway device and a record medium for deciding the propriety of the passing of communication information by the comparison of access policies. SOLUTION: A computer present inside a transmission origin network adds data for indicating the operation of the resources of the computer present inside a transmission destination network to the communication information and the data for indicating the operation to the computer present inside the transmission destination network or the resource permitted in a sub network are set to a data base simultaneously controllable from a device for controlling the connection of networks. The data for indicating the operation of the resources of the computer present inside the transmission destination network added to the communication information and the data for indicating the operation to the computer present inside the transmission destination network and the resources permitted in the sub network set to the simultaneously controllable data base are compared and the propriety of the passing of the communication information is decided by the result of the comparison.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for controlling the passage of information in the distribution of a program in computer communication, and more particularly to a technique for filtering an automatic execution program such as a Java applet or ActiveX control on a firewall. Things.

[0002]

2. Description of the Related Art When a communication network is modeled, as shown in FIG. 1, a transmission source network 12 formed by connecting a plurality of terminals 11 and a transmission network formed by connecting a plurality of terminals 13 similarly. The destination network 14 is connected via gateways 16 and 17 provided at the entrances and exits, respectively. 15 is an example of a subnetwork.

[0003] Existing filtering techniques include a digital signature method and a program content inspection method. The first digital signature method is a method of applying a digital signature to a program to specify a person who has given the digital signature. For this, the principle of public key cryptography or hash function is used. Public key encryption is an encryption method in which a sender and a receiver perform encryption and decryption using different keys. The encryption key of the sender is called a secret key, and the decryption key of the receiver is called a public key. The hash function is obtained from x to y = f for the function f.
Although it is easy to calculate (x), it is a function that is difficult to calculate x from y. This hash function is also called a one-way function.

In this method, a program user corresponding to a receiver obtains a public key of a program creator corresponding to a sender, and verifies a digital signature applied to the program using the public key. If this verification is correct, it is verified that the signature has been made using the secret key of the program creator.

The second program contents inspection method is a method of searching or tracing all the contents of a sent program to know how to realize the operation contents of the program. For this purpose, pattern matching for full-text search for a bit string appearing in a specific instruction, or program trace for emulating the operation of a program is used.

[0006]

The above-mentioned digital signature method merely specifies a person by using the relation between a public key and a private key, and does not provide any information regarding the operation contents of a program with a digital signature. I do not have. That is, although it is possible to specify the person who created the program, there is a problem that no guarantee is given as to how to realize the intention of the program. In addition, the program content inspection method requires enormous time for processing because it is necessary to search the entire program, and the information to be searched is often information specific to the programming language. There is a problem that lacks.

SUMMARY OF THE INVENTION The present invention has been made in view of the above points, and has an advantage that it is possible to inspect the operation contents of a program in a short time, to perform access control without depending on a programming language, and to realize a network. It is an object of the present invention to provide a method of controlling information passage in a gateway, a gateway device, and a recording medium, which can guarantee that the access policy is not changed by a user.

[0008]

According to the present invention, there is provided an information passing control method, wherein a computer existing in a transmission source network represents an operation of a resource of a computer existing in a transmission destination network. The data is added to the communication information, and the data representing the operation on the resources permitted in the computer or the subnetwork existing in the destination network is transferred between the source network and the destination network. Data indicating the operation of the resources of the computer existing in the transmission destination network added to the communication information set in the database which can be controlled collectively from the controlling device, and the transmission set in the collectively controllable database Data representing operations on resources that are permitted by computers or subnetworks in the destination network. And, and determines whether the passage of said communication information as a result of the comparison.

[0009] The gateway device of the present invention is a database in which data indicating an operation on a resource permitted in a subnetwork existing in a destination network is set, and is authorized by a computer existing in the destination network. A database in which data representing operations on resources being set is provided, and a function of extracting data representing operations of resources of computers existing in the destination network from communication information from computers existing in the source network,
A function of accessing the two databases, data representing the operation of the resources of the computer existing in the destination network added to the communication information, and a computer or sub-network existing in the destination network set in the database And a function of comparing the data with the data indicating the operation on the resource permitted in the step (a), and a function of determining whether or not the communication information can be passed based on a result of the comparison.

[0010] The recording medium of the present invention extracts data representing the operation of the resources of the computer existing in the destination network from communication information from the computer existing in the source network, and extracts the data from the computer or the computer existing in the destination network. Accessing a database in which data representing operations on resources permitted in the sub-network is set, and data representing operations of computer resources existing in the destination network added to the communication information; and Comparing with data representing an operation on a resource permitted in a computer or a sub-network existing in the destination network set in, and determining whether or not the communication information can be passed based on the result of the comparison. Features.

Here, the data representing the operation on the resource is:
This means writing to a file, reading from a file, deleting a file, connecting to a port, executing a program, and the like. Further, the internal network access policies stored in the gateway include those for sub-networks in the internal network and those for individual hosts in the internal network. The former can be rewritten only by the system administrator of the internal network.

In the present invention, since the operation of the program can be determined by examining only the specific portion in which the access policy of the program is written, the processing load required for the program analysis can be reduced. Furthermore,
By using a unified access policy, it is possible to perform access control independent of a programming language. Also, even if the data of the program itself increases,
Since the access policy is fixed, it does not affect the processing load.

According to such an information passing control method of the present invention, for a program sent from a reliable communication partner, the intention programmed by the partner is reliable, but the method of realizing the program is determined by the access policy of the internal network. In the opposite case, that is, when a program that attempts to perform an operation prohibited by the internal network is sent, the operation content can be reduced in a short processing time by using a lighter load than the existing filtering technology at the gateway. You can check.

Further, according to the information passing control method of the present invention, the access policy possessed by the entire internal network is changed by the user arbitrarily changing the access policy possessed by each host existing in the internal network. The network can be protected from policy changes.

[0015]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, embodiments of the present invention will be described with reference to the drawings. As an example of the access policy, “read file”, “write file”, and “network connection” are used and described as follows. file.read = / tmp; / usr / home / share; file.write = / tmp; network.connect = 25; 80;

In these examples, the following is shown. That is, reading of files is permitted only for directories or files under / tmp and directories or files under / usr / home / share, and writing of files is permitted for directories or files under / tmp. Only the use of port 25 or port 80 is permitted for connection with other hosts. The program creator must create the Java applet or Acti
The access policy as described above is newly added to veXcontrol. An internal network (subnetwork) administrator, a host user, and the like also define an access policy for each.

FIG. 2 is a diagram showing the operation of the gateway in the embodiment. 21 is a process for extracting a destination of a program, 22 is a process for extracting an access policy from a program, and 23 is an access policy of a subnetwork of a program destination. The process 24 compares the access policy of the program with the access policy of the program, and compares the access policy of the host to which the program is sent with the access policy of the program.

In this case, when comparing the access policy of the destination network of the program with the access policy of the program in the process 23, the access policy database 25 of the destination subnetwork is referred to. When comparing the access policy of the host of the program transmission destination with the access policy of the program in the process 24, the access policy database 26 of the transmission destination host is referred to.

As is apparent from this embodiment, according to the information passage control method of the present invention, it is not necessary to search the entire program, so that the processing time is shortened and the highly versatile access independent of the program language. It is now possible to filter by policy.

[0020]

As described above, according to the information passing control method of the present invention, the processing load on the gateway is reduced, the processing time on the gateway is shortened, and the access policy independent of the language used. The effect of increasing versatility is achieved by using. Further, since passage control between a large number of transmission sources and transmission destinations can be performed by the gateway, there is an effect that an inflow of an unauthorized program due to an erroneous setting at the transmission destination host can be prevented.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a configuration example of a network.

FIG. 2 is a diagram illustrating an operation of a gateway according to the embodiment of the present invention.

[Explanation of symbols]

11, 13 Terminal 12 Source Network 14 Destination Network 15 Subnetwork 16, 17 Gateway 21 Processing for Extracting Program Destination 22 Processing for Extracting Access Policy from Program 23, 24 Processing for Passage Control 25 Processing for Destination Subnetwork Access Policy Database 26 Access Policy Database of Destination Host

Claims (4)

[Claims] 1. A method for controlling the passage of communication information from a source network to a destination network by a device that is located between the source network and the destination network and controls connection between the two networks. The computer that performs the operation adds the data representing the operation of the resources of the computer existing in the destination network to the communication information, and converts the data representing the operation to the resources permitted in the computer or the subnetwork existing in the destination network. ,
Set up in a database that is located between the source network and the destination network and can be controlled collectively by the device that controls the connection of both networks, and operate the computer resources existing in the destination network added to the communication information Data that is represented in the destination network, which is set in the collectively controllable database, and data that represents an operation on a resource that is permitted in a computer or a sub-network. An information passing control method characterized by determining whether communication information can pass. 2. A data added to the communication information and representing the operation of a resource of a computer existing in the destination network, and a computer or sub-network existing in the destination network set in the collectively controllable database. The step of comparing the data representing the operation of the resource permitted in the communication information with the data representing the operation of the resource of the computer existing in the destination network added to the communication information and the database which can be controlled collectively. Comparing the data representing the operation of the resource permitted in the sub-network existing in the destination network, and the data representing the operation of the resource of the computer existing in the destination network added to the communication information Exists in the destination network set in the database that can be controlled collectively Information transmission control method according to claim 1, characterized in that comprises the step of comparing the data representing the operation of resources allowed by the computer and that. 3. A gateway device located between a transmission source network and a transmission destination network for controlling connection between the two networks, the data representing an operation on resources permitted in a subnetwork existing in the transmission destination network. And a database in which data representing operations on resources permitted by the computers existing in the destination network are set, and from the communication information from the computers existing in the source network. A function of extracting data representing the operation of the resources of the computer existing in the destination network; a function of accessing the two databases; and data representing the operation of the resources of the computer existing in the destination network added to the communication information. Exists in the destination network set in the database. A gateway that has a function of comparing data representing an operation on a resource permitted in a computer or a sub-network to be executed, and a function of determining whether or not the communication information can be passed based on a result of the comparison. apparatus. 4. A recording medium which is located between a transmission source network and a transmission destination network and records a control program of a network connection control device which controls connection between the two networks by a computer, the recording medium being present in the transmission source network. Data representing the operation of the resources of the computer existing in the destination network is extracted from the communication information from the computer to be executed, and the data representing the operation to the resources permitted in the computer or the subnetwork existing in the destination network is set. Data representing the operation of the resources of the computer existing in the destination network added to the communication information, and a computer or sub-network existing in the destination network set in the database. Data representing operations on resources that are allowed in And a determination as to whether or not the communication information is allowed to pass based on a result of the comparison.