JPWO2012049761A1 - Quarantine program, quarantine method and information processing apparatus - Google Patents

Abstract

An attempt is made to acquire a quarantine result in response to an authentication request, and if the quarantine result can be acquired, the quarantine target node connected to the authentication server 40 that permits the authentication request source to use the VLAN according to the quarantine result 90, a detection step S201 for detecting that the authentication server 40 has been authenticated by the existing authentication software 94, and a quarantine step S202 for performing a quarantine process when it is detected that the authentication has been performed; Re-authentication step S207, which allows the authentication software 94 to perform authentication again upon completion of the quarantine process, thereby causing the authentication server 40 to acquire the quarantine result and permit the use of the VLAN according to the quarantine result. Let it run.

Description

  The present invention relates to a quarantine program, a quarantine method, and an information processing apparatus.

  When accessing the network from the user terminal, not only authentication by ID and password, but also add the security countermeasure status of the user terminal as a judgment factor, and if a new security patch is released, set the security countermeasure standards. There is a network management system that pulls up and switches a user terminal that does not satisfy the standard from the network or switches to a quarantine VLAN (virtual local area network) (see Patent Document 1). In this network management system, a process of collecting security countermeasure information of a user terminal and a process of determining whether or not to connect to a network in response to a network request from the user terminal and performing a network connection are executed.

  Also, the authentication at the time of network access of the terminal and the quarantine of the security status of the terminal are performed independently, and the Layer2 connectivity of the terminal is controlled based on the respective results, and the other Layer2 connectivity control mechanism is provided. There is a network access control system to be combined (see Patent Document 2). In this network access control system, a process of authenticating a user terminal with Layer 2 and connecting to the network and a process of performing a quarantine process of the user terminal and changing the connection destination network according to the quarantine result are executed.

JP 2006-252256 A JP 2006-339933 A

  2. Description of the Related Art Conventionally, there is an authentication / quarantine system that performs authentication (for example, IEEE 802.1X authentication) and quarantine on a quarantine target such as a user terminal and permits participation in the network for a quarantine target that has passed authentication and quarantine. In such an authentication / quarantine system, authentication and quarantine may be executed by the same software in order to link authentication and quarantine. In particular, in an environment where quarantine communication is permitted after passing authentication, it is necessary to execute authentication and quarantine with the same software in order to link authentication and quarantine.

  However, when authentication and quarantine are executed by the same software, existing authentication software (such as an authentication client; for example, a supplicant in IEEE 802.1X authentication) cannot be used. For this reason, when an attempt is made to add a quarantine system to an environment where an existing authentication system is introduced, work including installation or replacement of authentication software in the quarantine target is required. Further, in such a case, if the existing authentication software is replaced with new authentication / quarantine software, there may be a problem that the existing authenticated connection is disconnected.

  In view of the problems described above, an object of the present invention is to provide a quarantine system that can be linked with existing authentication software.

  The present invention has the following configuration to solve the above-described problems. That is, the present invention attempts to acquire a quarantine result in response to an authentication request, and when the quarantine result is acquired, the authentication server that permits the authentication request source to use the network according to the quarantine result. A detection step of detecting that the authentication with respect to the authentication server has been performed on the connected computer by the authentication software installed on the computer, and a case where it is detected that the authentication has been performed in the detection step The quarantine step for performing the quarantine process, and the authentication software receiving the completion of the quarantine process, the authentication server acquires the quarantine result, and the network according to the quarantine result is obtained. A quarantine program for executing a re-authentication step for permitting use.

  According to the quarantine program of the present invention, the quarantine result is acquired by the authentication server by detecting that the authentication software has performed authentication and performing quarantine, and then allowing the authentication software to perform authentication again. And allow the use of the network according to the quarantine result. Therefore, the quarantine program according to the present invention can provide an authentication service and a quarantine service in cooperation with existing authentication software.

  In the present invention, the authentication server attempts to obtain a quarantine result in response to an authentication request, and if the quarantine result cannot be obtained, the authentication server permits the use of the quarantine network to the authentication request source. In the detection step, it is detected that the use of the quarantine network is permitted to the computer by detecting that the authentication software has authenticated the authentication server, In the quarantine step, when it is detected that the authentication is performed in the detection step, a quarantine process may be performed via the quarantine network.

  According to the present invention, when the quarantine result cannot be obtained, the authentication server that permits the use of the quarantine network is authenticated once, and the use of the quarantine network is permitted. By detecting that authentication has been performed and performing quarantine, the quarantine can be performed while the quarantine network is available.

  In the present invention, in the detecting step, the authentication to the authentication server may be detected by monitoring the operation status by the computer or monitoring the communication content by the computer. For example, the operation status can be monitored by monitoring an event log of the system.

  Furthermore, the present invention can be grasped as a method executed by an information processing apparatus or a computer. Further, the present invention may be a program in which the above-described program is recorded on a recording medium readable by a computer, other devices, machines, or the like. Here, a computer-readable recording medium is a recording medium that stores information such as data and programs by electrical, magnetic, optical, mechanical, or chemical action and can be read from a computer or the like. Say.

  The present invention can also be understood as an invention of a server device. That is, the present invention relates to a quarantine result acquisition unit that attempts to acquire a quarantine result in response to an authentication request from a quarantine target, and to the authentication request source when the quarantine result cannot be acquired by the quarantine result acquisition unit. Permits use of the quarantine network, and if a quarantine result indicating that the predetermined standard is not satisfied is obtained, permits the use of the healing network to satisfy the predetermined standard to the authentication request source And a communication control means.

  That is, according to the server device according to the present invention, it is possible to vary the network to be assigned depending on whether the quarantine result cannot be obtained or when the quarantine result can be obtained but the quarantine result does not satisfy the predetermined standard.

  The server device according to the present invention further includes an authentication unit that performs authentication in response to an authentication request from a quarantine target, wherein the communication control unit cannot acquire a quarantine result by the quarantine result acquisition unit, and When authentication by the authentication unit is not completed, at least use of the quarantine network by the quarantine target may be disallowed.

  Further, in the present invention, the communication control unit excludes communication for authentication by the quarantine target when the quarantine result cannot be acquired by the quarantine result acquisition unit and the authentication by the authentication unit is not completed. The use of all networks may be prohibited.

  According to the server device of the present invention, until the authentication is completed, at least the use of the quarantine network is prohibited for the quarantine target, or the use of all networks except the communication for authentication is prohibited. I can do it.

  In the present invention, the quarantine result obtaining unit may attempt to obtain a quarantine result by inquiring of a quarantine server.

  In the present invention, the communication control means may control the use of the network by the quarantine target by instructing a communication control device (for example, an authentication switch) of the network to which the quarantine target is connected.

  Furthermore, the present invention can be understood as a method executed by a computer or a program executed by a computer. Further, the present invention may be a program in which such a program is recorded on a recording medium readable by a computer, other devices, machines, or the like. Here, a computer-readable recording medium is a recording medium that stores information such as data and programs by electrical, magnetic, optical, mechanical, or chemical action and can be read from a computer or the like. Say.

  According to the present invention, it is possible to provide a quarantine system capable of cooperating with existing authentication software.

It is the schematic which shows the structure of the quarantine system which concerns on embodiment. It is a figure which shows the hardware constitutions of the security countermeasure server which concerns on embodiment, an authentication server, and a quarantine object node. It is a figure which shows the outline of a function structure of the authentication server and quarantine object node which concern on embodiment. It is a flowchart which shows the flow of the authentication process (1st phase) which concerns on embodiment. It is a flowchart which shows the flow of the quarantine process (2nd phase) which concerns on embodiment. It is a flowchart which shows the flow of the authentication process (3rd phase) which concerns on embodiment. It is the schematic which shows the structure of the modification of the quarantine system which concerns on embodiment.

  Hereinafter, an embodiment of a quarantine system 1 according to the present invention will be described with reference to the drawings.

<System configuration>
FIG. 1 is a schematic diagram illustrating a configuration of a quarantine system 1 according to the present embodiment. The quarantine system 1 according to the present embodiment includes a network segment 2 to which an information processing device 90 (hereinafter referred to as “quarantine target node 90”) to be quarantined is connected, and a network segment 2 via the network connection control device 20. Business server 50, security countermeasure server (quarantine server) 30, authentication server 40, and healing server 60. The network segment 2 and the various servers may be connected via a device such as a hub or a router (not shown) in addition to the network connection control device 20.

  The quarantine target node 90 is, for example, a personal computer connected to the network segment 2 and used by a user. However, the quarantine target node 90 is not limited to a personal computer as long as it is a terminal device connected to the network. For example, in addition to the server device, a communication control device such as a router or a switch can be the quarantine target node 90.

  The business server 50 provides a service for business to the quarantine target node 90, and the security countermeasure server 30 provides a quarantine service to the quarantine target node 90 connected to the network segment 2. The authentication server 40 corresponds to the server device according to the present invention, and authenticates the quarantine target node 90. The network connection control device 20 corresponds to a communication control device according to the present invention, and controls communication by the quarantine target node 90 in accordance with an instruction from the authentication server 40. In the present embodiment, a so-called authentication switch is used as the network connection control device 20.

  The healing server 60 is a server that is preferably allowed to communicate in order to improve the security environment of the quarantine target node 90 or to cure an environment that does not pass the quarantine. Examples of such a healing server 60 include a server that provides system software updates, a server that provides security software updates and the latest definition files, and the like. By permitting such communication with the healing server 60, even if the quarantine target node 90 fails to pass the quarantine, the security deficiency is cured and the quarantine is completed again after receiving the quarantine. I can do it.

  Various servers connected from the quarantine target node 90 may be connected to a local network where the quarantine target node 90 and the network connection control device 20 exist, or may be connected at a remote location via the Internet or a wide area network. For example, it may be provided by an ASP (Application Service Provider).

  In the present embodiment, the various servers belong to one of a plurality of VLANs (Virtual Local Area Networks) managed by the network connection control device 20. Therefore, the quarantine target node 90 can be communicated with a server that can communicate from the assigned VLAN by being assigned to any one of the VLANs by the network connection control device 20. In the quarantine system according to the present embodiment, the network connection control device 20 that has received an instruction from the authentication server 40 permits or disallows the participation of the quarantine target node 90 in each VLAN, thereby enabling communication by the quarantine target node 90. Is controlled.

  In the present embodiment, the security countermeasure server 30 belongs to the quarantine VLAN. The healing server 60 belongs to the healing VLAN, and the business server 50 belongs to the business VLAN. Therefore, the quarantine target node 90 can be connected to the security countermeasure server 30 by being assigned to the quarantine VLAN by the network connection control device 20 that manages each VLAN, and can be healed by being assigned to the healing VLAN. Connection to the server 60 becomes possible, and connection to the business server 50 becomes possible by being assigned to the business VLAN.

  On the other hand, the authentication server 40 belongs to an authentication network that can communicate from the authentication switch without being assigned a VLAN. In the present embodiment, the network connection control device 20 blocks communication by the quarantine target node 90 newly connected to the network segment 2, but the authentication communication is unauthenticated and unquarantined. And transfer to the authentication server 40 on the authentication network. By adopting such a network configuration, the quarantine target node 90 newly connected to the network segment 2 can execute an initial authentication process described later.

  However, in this embodiment, a VLAN is adopted as a network managed by the network connection control device 20, but the network managed by the network connection control device 20 may not be a VLAN. For example, network management may be performed by setting an access control list (Access Control List) for each authenticated user. In addition, the network connection control device is not limited to a logically divided network such as a VLAN, and uses a method of performing transfer control for each physical port, etc. The node 90 can be permitted / denied to use the network.

  FIG. 2 is a diagram illustrating a hardware configuration of the security countermeasure server 30, the authentication server 40, and the quarantine target node 90 according to the present embodiment. In FIG. 2, illustrations of devices other than the security countermeasure server 30, the authentication server 40, and the quarantine target node 90 (network connection control device 20, business server 50, healing server 60, etc.) are omitted. The security countermeasure server 30, the authentication server 40, and the quarantine target node 90 all include a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory) and an EEPROM (Electrically Erasable and Programmable Memory). A computer including a storage device such as an HDD (Hard Disk Drive), a communication unit such as a NIC (Network Interface Card), an input / output device such as a mouse, a keyboard, a display, and a printer.

  Here, the user / terminal list 44 is recorded in the storage device of the authentication server 40. In the user / terminal list 44, authentication information to be compared with information such as user identification information, password, and terminal specific information included in the authentication request transmitted from the quarantine target node 90 is stored for each user or It is recorded for each quarantine target node 90.

  Further, the countermeasure standard 31 and the user terminal quarantine result cache 32 are recorded in the storage device of the security countermeasure server 30. The countermeasure standard 31 includes a condition for determining whether or not a security-related environment in the quarantine target node 90 satisfies a predetermined security policy that can permit participation in the network and connection to the business server 50 ( For example, system conditions of the quarantine target node 90, system software version conditions, recommended system settings, security software conditions, definition file version conditions, detection engine version conditions, and the like are stored. In addition, the user terminal quarantine result cache 32 holds the result of the quarantine process executed recently or last (quarantine result) for each user and the quarantine target node 90.

  Further, the authentication client program 94 and the quarantine program 95 according to the present invention are installed in the storage device of the quarantine target node 90. The authentication client program 94 is existing authentication software installed in the quarantine target node 90, and is software for independently communicating with an authentication server and receiving authentication such as IEEE 802.1X authentication.

  Note that devices (network connection control device 20, business server 50, healing server 60, etc.) other than the security countermeasure server 30, authentication server 40, and quarantine target node 90 in this embodiment are also CPU, RAM, ROM, storage device, and communication. The computer includes a unit, an input / output device, and the like, and its configuration is substantially the same as that of the security countermeasure server 30, the authentication server 40, and the quarantine target node 90.

  FIG. 3 is a diagram showing an outline of functional configurations of the authentication server 40 and the quarantine target node 90 according to the present embodiment. In FIG. 3, devices other than the authentication server 40 and the quarantine target node 90 (network connection control device 20, security countermeasure server 30, business server 50, healing server 60, etc.) are not shown.

  The authentication server 40 functions as a server device including a quarantine result acquisition unit 41, a communication control unit 42, and an authentication unit 43 by reading a program recorded in the storage device into the RAM and executing it by the CPU. To do. In the present embodiment, each function provided in the authentication server 40 is executed by a CPU that is a general-purpose processor. However, part or all of these functions may be executed by one or a plurality of dedicated processors.

  The quarantine result acquisition unit 41 attempts to acquire the quarantine result by making an inquiry to the security countermeasure server 30 in response to the authentication request from the quarantine target.

  When the quarantine result cannot be acquired by the quarantine result acquisition unit 41 and the authentication by the authentication unit 43 is not completed (that is, in the case of unauthenticated and unquarantined), the communication control unit 42 performs authentication for the quarantine target. Use of all networks except for communication is prohibited. However, depending on the embodiment, it is not always necessary to disallow use of all networks except for communication for authentication. When it is desired to provide a quarantine service only to the authenticated quarantine target node 90, at least the use of the quarantine VLAN should be prohibited.

  The authentication unit 43 performs authentication in response to an authentication request from a quarantine target. Specifically, when receiving the authentication request transmitted from the quarantine target node 90 and transferred by the network connection control device 20, the authentication unit 43 receives the user identification information, the password, the terminal specific information, and the like included in the authentication request. Authentication is performed by comparing the authentication information with the authentication information registered in the user / terminal list 44.

  Further, when the quarantine result indicating that the predetermined standard is not satisfied is acquired by the quarantine result acquiring unit 41, the communication control unit 42 is a healing VLAN for satisfying the predetermined standard with respect to the authentication request source. When a quarantine result indicating that a predetermined standard is satisfied is acquired by the quarantine result acquisition unit 41, use of a network (for example, a business VLAN) according to the quarantine result is permitted. In the present embodiment, the communication control unit 42 controls the use of the network by the quarantine target by instructing the network connection control device 20 (the communication control device in the present invention) of the network segment 2 to which the quarantine target node 90 is connected. To do.

  The quarantine target node 90 functions as an information processing apparatus including an authentication client by reading the authentication client program 94 recorded in the storage device into the RAM and executing it by the CPU. Further, the quarantine target node 90 includes a detection unit 91, a quarantine unit 92, and a re-authentication unit 93 by reading the quarantine program 95 recorded in the storage device into the RAM and executing it by the CPU. It functions as an information processing device. In the present embodiment, each function of the information processing apparatus is executed by a CPU that is a general-purpose processor. However, part or all of these functions may be executed by one or a plurality of dedicated processors.

  The detection unit 91 detects that the authentication server 40 has been authenticated by the authentication client installed in the computer. In this embodiment, authentication is performed by the authentication client, and when the authentication is successful, the quarantine target node 90 is permitted to use the quarantine VLAN. That is, the detection unit 91 detects that the quarantine target node 90 is permitted to use the quarantine VLAN by detecting that the authentication server 40 has been authenticated by the authentication client installed in the computer. doing. In this embodiment, the detection unit 91 monitors the operation status of the quarantine target node 90 by monitoring the event log of the system and detects that authentication by the authentication client has been performed. Instead of such a detection method, it may be detected that the authentication by the authentication client is performed by monitoring the communication content of the quarantine target node 90.

  When the detection unit 91 detects that the authentication is performed, the quarantine unit 92 transmits quarantine information to the security countermeasure server 30 via the quarantine VLAN, and receives the quarantine result. Quarantine processing.

  The re-authentication unit 93 causes the authentication client to perform authentication again in response to the completion of the quarantine process, thereby causing the authentication server 40 to acquire the quarantine result and permit the use of the network according to the quarantine result.

<Process flow>
Next, the flow of processing executed by the quarantine system 1 according to the present embodiment will be described using a flowchart.

  In the present embodiment, when it is detected that the quarantine target node 90 is newly connected, the network connection control device 20 converts the communication by the quarantine target node 90 into authentication communication with the network control device 20. limit. For this reason, the quarantine target node 90 newly connected to the network segment 2 cannot use the quarantine VLAN at first, and even if an attempt is made to execute the quarantine process immediately after the quarantine target node 90 is connected, the security countermeasure server Cannot communicate with 30.

  In the quarantine system according to the present embodiment, an existing authentication client installed in the quarantine target node 90 is used. For this reason, authentication and quarantine cannot be performed simultaneously by a single software having an authentication function and a quarantine function.

  Therefore, in the present embodiment, the first phase in which communication to the security countermeasure server 30 is permitted by performing authentication processing by an existing authentication client in an unauthenticated and unquarantined state, and after the first phase, the present invention relates to The second phase in which the quarantine process is performed by executing the quarantine program 95, and after the quarantine is completed in the second phase, the authentication process is performed again by the existing authentication client, so that the quarantine target node 90 that has been quarantined By executing authentication and quarantine processing consisting of three phases, the third phase of releasing network usage, it is possible to link existing authentication clients with quarantine software that is additionally installed. Hereinafter, specific contents of the processing over three phases will be described with reference to the drawings.

  Here, the interruption of communication means that communication by the information processing apparatus is not performed using any method. In the present embodiment, as a specific method for blocking communication, a method is employed in which communication transmitted from the quarantine target node 90 and going through the network connection control device 20 is not transferred. The method is not limited to the method shown in the embodiment. For example, as a communication blocking method, a method of blocking communication by notifying the quarantine target node 90 of a fake MAC address, a method of physically blocking a line, or the like may be employed.

  FIG. 4 is a flowchart showing the flow of authentication processing according to the present embodiment. The authentication processing according to the present embodiment is started when the authentication client program 94 is executed in the quarantine target node 90 and the authentication client is activated and the authentication client is instructed to start the authentication processing. The The instruction to the authentication client may be an instruction from the system or an instruction based on a user operation. Note that the specific contents and processing order of the processing shown in this flowchart are examples for carrying out the present invention. Specific processing contents and processing order may be appropriately selected according to the embodiment of the present invention.

  FIG. 4 shows a flowchart of the entire authentication process, but processes that are not executed in the first phase, which is the first authentication process, are indicated by broken lines.

  In steps S101 to S103, the quarantine target node 90 is authenticated. The authentication client of the quarantine target node 90 transmits an authentication request including authentication information (user identification information, password, terminal specific information, etc.) input by the user to the network connection control device 20 (step S101). The network connection control device 20 that has received the authentication request transfers the received authentication request to the authentication server 40 (step S102). Upon receiving the authentication request, the authentication unit 43 of the authentication server 40 registers authentication information such as user identification information, password, and terminal-specific information included in the authentication request in the user / terminal list 44 that is held in advance. The user or the quarantine target node 90 is authenticated by collating it with the information for authentication that has been made (step S103). If the authentication fails, the process proceeds to step S104. If the authentication is successful, the process proceeds to step S105.

  In step S104, an authentication result indicating that the authentication has failed is transmitted. The authentication unit 43 of the authentication server 40 transmits an authentication result indicating that the authentication of the user or the quarantine target node 90 has failed to the network connection control device 20 (step S104). The network connection control device 20 that has received the authentication result transmits the authentication result to the quarantine target node 90 (step S114). The authentication client of the quarantine target node 90 receives an authentication result indicating that the authentication has failed, and then the processing shown in this flowchart ends.

  In steps S105 to S107, an attempt is made to acquire a quarantine result related to the quarantine target node 90. When the authentication in step S103 is successful, the quarantine result acquisition unit 41 of the authentication server 40 transmits the quarantine result request transmitted from the quarantine target node 90 in step S101 to the security countermeasure server 30 (step S105). Upon receiving the quarantine result request, the security countermeasure server 30 acquires the last quarantine result relating to the user and the quarantine target node 90 from the user terminal quarantine result cache 32 (step S106), and the acquired quarantine result is the authentication server 40. (Step S107).

  However, if the security countermeasure server 30 fails to obtain the quarantine result relating to the user and the quarantine target node 90 from the user terminal quarantine result cache 32, the security countermeasure server 30 applies the authentication server 40 that is the transmission source of the quarantine result request to the authentication server 40. That there is no quarantine result of the user and the quarantine target node 90 (step S107). The fact that there is no quarantine result of the corresponding user and the quarantine target node 90 in the user terminal quarantine result cache 32 indicates that the user and the quarantine target node 90 in the quarantine result request have not been quarantined (unquarantined). It means) When the authentication server 40 receives a quarantine result or a notification that no quarantine result exists (hereinafter also referred to as “unquarantined notification”), the process proceeds to step S108.

  In step S108, the presence / absence and contents of the quarantine result are determined. First, the communication control unit 42 of the authentication server 40 determines whether there is a quarantine result by determining which of the quarantine result or the unquarantined notification is received from the security countermeasure server 30. If the information received from the security countermeasure server 30 is an unquarantined notification, the process proceeds to step S109.

  When the quarantine result transmitted in step S107 is received, the communication control unit 42 of the authentication server 40 further determines the content of the quarantine result, and the process proceeds to step S110 or step S111 depending on the determination result. . However, since the first phase described with reference to FIG. 4 is a phase in which authentication processing is performed in an unauthenticated and unquarantined state, the security countermeasure server 30 does not hold a quarantine result. For this reason, the information that the authentication server 40 receives from the security countermeasure server 30 is an unquarantined notification, and the process proceeds to step S109. Since the quarantine result is received in the third phase, the contents of the processing of step S110 and step S111 processed when the quarantine result is received will be described later with reference to FIG.

  In step S109, a quarantine VLAN is assigned to the quarantine target node 90. The communication control unit 42 of the authentication server 40 assigns a quarantine VLAN (quarantine network) to the quarantine target node 90 that is the transmission source of the authentication request received in step S103, thereby ensuring security from the quarantine target node 90. Connection to the countermeasure server 30 is permitted. Thereafter, the process proceeds to step S112.

  In step S112, the authentication result and the determination result are transmitted. The authentication server 40 transmits the authentication result in step S103 and the determination result in step S108 to the network connection control device 20. The determination result transmitted here includes information that can identify the VLAN assigned to the quarantine target node 90. Note that the authentication result and the determination result may be transmitted at different timings. However, if the authentication result reaches the quarantine target node 90 prior to the quarantine VLAN assignment by the network connection control device 20 that has received the determination result, the quarantine process (described later with reference to FIG. 5) in the quarantine target node 90 is performed. There is a possibility that the quarantine VLAN may be started in a state where use is not yet permitted. For this reason, the network connection control device 20 sends the authentication result to the quarantine target node 90 after completion of VLAN assignment according to the determination result regardless of the timing of receiving the authentication result indicating that the authentication is successful from the authentication server 40. It is preferable to transmit. When the authentication result and the determination result are transmitted, the process proceeds to step S113.

  In step S113, the quarantine target node 90 is permitted to connect to a network (such as a VLAN) corresponding to the determination result. Upon receiving the determination result, the network connection control device 20 extracts information that can identify the VLAN assigned to the quarantine target node 90 from the received determination result, and the VLAN indicated in the extracted information is extracted from the quarantine target. Assign to node 90. In the first authentication process (first phase), since quarantine has not been performed and there is no quarantine result, the determination result transmitted in step S112 is information that can identify the VLAN assigned to the quarantine target node 90. , Information indicating the quarantine VLAN is included. Therefore, in the first authentication process, the quarantine VLAN is assigned to the quarantine target node 90 by the network connection control device 20 in step S113. Thereafter, the process proceeds to step S114.

  In step S114, the authentication result and the determination result are transmitted. The network connection control device 20 transmits the authentication result and the determination result received from the authentication server 40 to the quarantine target node 90. When the authentication result and the determination result are received by the quarantine target node 90, thereafter, the processing shown in this flowchart ends, and the processing proceeds to the quarantine processing shown in FIG.

  FIG. 5 is a flowchart showing the flow of the quarantine process according to the present embodiment. In the quarantine process according to the present embodiment, in the authentication process (first phase) described with reference to FIG. 4, the authentication result transmitted from the network connection control device 20 (step S114) is received by the quarantine target node 90. This is a process that is started when this occurs (second phase). Note that the specific contents and processing order of the processing shown in this flowchart are examples for carrying out the present invention. Specific processing contents and processing order may be appropriately selected according to the embodiment of the present invention.

  In step S201, the completion of authentication is detected, and a quarantine client by the quarantine program 95 is activated. The quarantine target node 90 makes at least a part of the quarantine program 95 (detection unit 91) resident in the system RAM, and monitors the system event log by the detection unit 91, so that the network connection control device 20 in step S114. When the transmitted authentication result is received, it is detected that the authentication process is completed, and further, by referring to the content of the authentication result, it is detected that the authentication is successful. When it is detected that the authentication is successful, the detection unit 91 of the quarantine target node 90 starts the quarantine client by executing the quarantine program 95. Thereafter, the process proceeds to step S202.

  In step S202, information necessary for quarantine is transmitted. The quarantine unit 92 of the quarantine target node 90 transmits the previously collected quarantine information (hereinafter also referred to as “inventory”) to the security countermeasure server 30 (step S202). The inventory (quarantine information) includes various information related to the environment of the quarantine target node 90 (for example, system information of the quarantine target node 90, system software version information, system settings, security software information, definition file). Version information, detection engine version information, etc.).

  The quarantine target node 90 collects inventory prior to the process of step S202. Since the inventory only needs to be collected before being sent to the security countermeasure server 30, the timing at which the inventory is collected is appropriately determined according to the embodiment in the overall flow of the quarantine process. Is preferred. For example, the inventory may be collected after the quarantine client is activated in step S201, or may be collected in the background before the quarantine client is activated. When the inventory is transmitted to the security countermeasure server 30, the process proceeds to step S203.

  In step S203 and step S204, quarantine is executed and the quarantine result is stored. When the security countermeasure server 30 receives the inventory transmitted by the quarantine target node 90, the security countermeasure server 30 quarantines the quarantine target node 90 by examining the contents of the received inventory. Specifically, the security countermeasure server 30 includes various information included in the inventory related to the environment of the quarantine target node 90 (for example, system information of the quarantine target node 90, system software version information, system settings, security By confirming whether the software information, the definition file version information, the detection engine version information, etc. satisfy the predetermined conditions listed in the countermeasure standard 31, the environment of the quarantine target node 90 is predetermined. It is determined whether or not the condition is satisfied (step S203). As a result of the determination, if it is determined that the environment of the quarantine target node 90 satisfies a predetermined condition, the quarantine is passed. Moreover, when it is determined that the environment of the quarantine target node 90 does not satisfy the predetermined condition as a result of the determination, the quarantine is rejected.

  In addition to the above-described method, various methods may be adopted for the quarantine. For example, various information related to the environment of the quarantine target node 90 included in the inventory (quarantine information) is compared with predetermined conditions listed in the countermeasure standard 31, and the security level of the client is determined based on the comparison result. A method of calculating and determining that the environment of the quarantine target node 90 satisfies a predetermined condition when the security level is a certain level or higher may be employed.

  When the quarantine is completed, the security countermeasure server 30 stores the quarantine result, that is, whether the environment of the quarantine target node 90 satisfies a predetermined condition in the storage device of the security countermeasure server 30 as the user terminal quarantine result cache 32. The determination result is stored (step S204). The determination result includes information indicating whether the environment of the quarantine target node 90 has passed or failed. Thereafter, the process proceeds to step S205.

  In step S205 and step S206, the quarantine result is transmitted and a quarantine result screen is output. The security countermeasure server 30 transmits the quarantine result obtained as a result of the quarantine in step S203 to the quarantine target node 90 (step S205). At this time, the quarantine result is transmitted as a Web page, for example. Upon receiving the quarantine result, the quarantine unit 92 of the quarantine target node 90 outputs a quarantine result screen via an output device such as a display or a printer connected to the quarantine target node 90 (step S206). Thereafter, the process proceeds to step S207.

  In step S207, the authentication client is activated and the authentication process is started again. When the quarantine is completed, the re-authentication unit 93 of the quarantine target node 90 instructs the authentication client to execute the authentication process again. The authentication client is activated in response to the re-authentication instruction and executes the authentication process again. In this way, the re-authentication unit 93 causes the authentication server 40 to acquire the quarantine result and permit the use of the network according to the quarantine result.

  Hereinafter, the authentication process performed in the third phase will be described. The authentication process started again here is processed by executing the same authentication client program 94 as the authentication process described with reference to FIG. 4, but after the second-phase quarantine process is performed, That is, it is different from the authentication process of the first phase executed in an unauthenticated and unquarantined state in that it is executed in a state where the quarantine result is stored in the user terminal quarantine result cache 32 of the security countermeasure server 30. In this embodiment, the purpose of distinguishing the authentication process (third phase) executed after the first authentication process (first phase) and the quarantine process (second phase) from the first authentication process This is also referred to as “re-authentication processing”.

  FIG. 6 is a flowchart showing the flow of authentication processing according to the present embodiment. The authentication process according to the present embodiment is started when the quarantine target node 90 is instructed to re-execute the authentication process from the re-authentication unit 93 of the quarantine target node 90 to the authentication client. The Note that the specific contents and processing order of the processing shown in this flowchart are examples for carrying out the present invention. Specific processing contents and processing order may be appropriately selected according to the embodiment of the present invention.

  FIG. 6 shows a flowchart of the entire authentication process, but processes that are not executed in the third phase, which is the re-authentication process, are indicated by broken lines.

  The processing from step S101 to step S105 is substantially the same as the initial authentication processing described with reference to FIG. That is, also in the re-authentication process, the quarantine target node 90 is authenticated, and if the authentication is successful, the acquisition of the quarantine result related to the quarantine target node 90 is attempted.

  In Step S106 and Step 107, acquisition of the quarantine result relating to the quarantine target node 90 is attempted. In the re-authentication process (third phase), the quarantine result of the quarantine target node 90 is stored in the user terminal quarantine result cache 32 as a result of the quarantine process (second phase). For this reason, when the security countermeasure server 30 receives the quarantine result request transmitted in step S105, the security countermeasure server 30 acquires the last quarantine result relating to the user and the quarantine target node 90 from the user terminal quarantine result cache 32 (step S106). The acquired quarantine result is transmitted to the authentication server 40 (step S107).

  In step S108, the presence / absence and contents of the quarantine result are determined. The communication control unit 42 of the authentication server 40 determines whether there is a quarantine result by determining whether a quarantine result or an unquarantined notification has been received from the security countermeasure server 30, and if the quarantine result has been received, Further, the contents of the quarantine result are determined. In the re-authentication process, the quarantine result is acquired by the security countermeasure server 30 and transmitted to the authentication server 40 (see step S106 and step S107). For this reason, the quarantine result is determined as “present”, and then the content of the quarantine result is determined.

  The content indicating that the quarantine result received from the security countermeasure server 30 has failed the quarantine, that is, various information related to the environment of the quarantine target node 90 satisfies the predetermined condition listed in the countermeasure standard 31. If the content indicates that there is not, the process proceeds to step S110. On the other hand, when the quarantine result received from the security countermeasure server 30 is content indicating that the quarantine has passed, that is, various information related to the environment of the quarantine target node 90 is listed as the countermeasure standard 31. If the quarantine result indicates that the predetermined condition is satisfied, the process proceeds to step S111.

  In step S110, a healing VLAN is assigned to the quarantine target node 90. The process shown in step S110 is executed when the quarantine target node 90 fails the quarantine. For this reason, the communication control unit 42 of the authentication server 40 assigns a healing VLAN (healing network) to the quarantine target node 90 that is the transmission source of the authentication request received in step S103, so that the quarantine target node 90 Permits connection to the healing server 60. Thereafter, the process proceeds to step S112.

  In step S111, a VLAN (network) corresponding to the quarantine result is assigned to the quarantine target node 90. The process shown in step S111 is executed when the quarantine target node 90 passes the quarantine. Therefore, the communication control unit 42 of the authentication server 40 assigns a VLAN corresponding to the quarantine result to the quarantine target node 90 that is the transmission source of the authentication request received in step S103. The VLAN assigned here is, for example, a business VLAN. Further, the communication control unit 42 may assign a VLAN that can communicate with all servers to the quarantine target node 90. Thereafter, the process proceeds to step S112.

  In step S112, the authentication result and the determination result are transmitted. The determination result transmitted here includes information that can identify the VLAN assigned to the quarantine target node 90. In the re-authentication process, when the quarantine result is acceptable as information that can identify the VLAN assigned to the quarantine target node 90, for example, information indicating a business VLAN is included, and the quarantine result is unacceptable. Includes information indicating the healing VLAN. Further, when the quarantine result is acceptable, the determination result may include blocking release permission information indicating that the communication blocking of the quarantine target node 90 by the network connection control device 20 may be released. Thereafter, the process proceeds to step S113.

  In step S113, the quarantine target node 90 is permitted to connect to the network corresponding to the determination result. Upon receiving the determination result, the network connection control device 20 extracts information that can identify the VLAN assigned to the quarantine target node 90 from the received determination result, and the VLAN indicated in the extracted information is extracted from the quarantine target. Assign to node 90. In the re-authentication process (third phase), the determination result transmitted in step S112 includes information indicating the business VLAN or the healing VLAN as information that can identify the VLAN assigned to the quarantine target node 90. . Therefore, in step S113, in the re-authentication process, the business connection VLAN or the healing VLAN is assigned to the quarantine target node 90 by the network connection control device 20.

  Moreover, when the quarantine result is acceptable, the determination result may include blocking release permission information. When the block cancellation permission information is extracted from the received determination result, the network connection control device 20 cancels the block communication with respect to the quarantine target node 90. Specifically, the network connection control device 20 releases the communication cutoff by starting transfer of communication transmitted from the quarantine target node 90 and going through the network connection control device 20. However, the specific method for canceling communication interruption differs depending on the specific method used for communication interruption. For example, when a method of blocking communication by notifying the quarantine target node 90 of a fake MAC address has been adopted, the correct MAC address related to the forged destination is notified to the quarantine target node 90. As a result, the communication interruption is released. Thereafter, the process proceeds to step S114.

  In step S114, the authentication result is transmitted. The network connection control device 20 transmits the authentication result received from the authentication server 40 to the quarantine target node 90. Here, information (Web page or the like) in a format that can be directly output by the quarantine target node 90 may be transmitted as the authentication result. When the authentication result is received by the quarantine target node 90 and the authentication result is output to the display, printer, or the like of the quarantine target node 90 as necessary, the processing shown in this flowchart is thereafter terminated.

  Next, a modified example of the network configuration of the quarantine system will be described. In the figure showing a modification, the same reference numerals are given to the same configurations as those in the above-described embodiment, and the description thereof is omitted.

  FIG. 7 is a schematic diagram illustrating a configuration of the quarantine system 1b according to the embodiment. The quarantine system 1b is the same as the quarantine system 1 shown in FIG. 1 except for parts relating to differences that will be specifically described below, and therefore, description of common parts is omitted. The quarantine system 1b differs from the quarantine system 1 shown in FIG. 1 in the configuration of the VLAN managed by the network connection control device 20.

  In the quarantine system 1b, both the security countermeasure server 30 and the healing server 60 belong to both the quarantine VLAN and the healing VLAN. That is, in the quarantine system 1b, the quarantine VLAN and the healing VLAN are equivalent. Therefore, the quarantine target node 90 can communicate with not only the security countermeasure server 30 but also the healing server 60 at the time when the quarantine VLAN is assigned in the phase 1. The quarantine target node 90 can communicate not only with the healing server 60 but also with the security countermeasure server 30 when the quarantine fails in phase 2 and the healing VLAN is assigned.

1, 1b Quarantine system 2 Network segment 20 Network connection control device (communication control device)
30 Security measures server (quarantine server)
40 Authentication server (server device)
90 Quarantine target node (information processing device)

Claims (5)

Attempts to obtain a quarantine result in response to an authentication request, and if the quarantine result can be obtained, to a computer connected to an authentication server that allows the authentication request source to use the network according to the quarantine result,
A detection step of detecting that the authentication with respect to the authentication server has been performed by authentication software installed on the computer;
A quarantine step for performing a quarantine process when it is detected that the authentication is performed in the detection step;
Re-authentication step for allowing the authentication server to perform authentication again upon completion of the quarantine process, causing the authentication server to acquire a quarantine result, and permitting use of the network according to the quarantine result;
Quarantine program to execute. The authentication server is an authentication server that attempts to obtain a quarantine result in response to an authentication request, and permits use of the quarantine network to the authentication request source when the quarantine result cannot be obtained;
In the detection step, it is detected that the use of the quarantine network is permitted for the computer by detecting that the authentication software has authenticated the authentication server.
In the quarantine step, when it is detected that the authentication is performed in the detection step, a quarantine process is performed via the quarantine network.
The quarantine program according to claim 1. In the detection step, it is detected that the authentication with respect to the authentication server has been performed by monitoring an operation state by the computer or monitoring a communication content by the computer.
The quarantine program according to claim 1 or 2. A computer connected to an authentication server that attempts to obtain a quarantine result in response to an authentication request and permits the use of the network according to the quarantine result when the quarantine result can be obtained,
A detection step of detecting that the authentication with respect to the authentication server has been performed by authentication software installed on the computer;
A quarantine step for performing a quarantine process when it is detected that the authentication is performed in the detection step;
Re-authentication step for allowing the authentication server to perform authentication again upon completion of the quarantine process, causing the authentication server to acquire a quarantine result, and permitting use of the network according to the quarantine result;
Quarantine method to run. Attempts to obtain a quarantine result in response to an authentication request, and if the quarantine result can be obtained, is connected to an authentication server that allows the authentication request source to use the network according to the quarantine result,
Detecting means for detecting that the authentication with respect to the authentication server has been performed by authentication software installed in the computer;
A quarantine unit that performs a quarantine process when the detection unit detects that the authentication has been performed;
Re-authentication means that allows the authentication software to perform authentication again in response to completion of the quarantine process, to cause the authentication server to acquire a quarantine result, and permit use of the network according to the quarantine result;
An information processing apparatus comprising:

Images