WO2016046920A1

WO2016046920A1 - Load distribution device, load distribution method and program

Info

Publication number: WO2016046920A1
Application number: PCT/JP2014/075288
Authority: WO
Inventors: 篤史原田
Original assignee: 三菱電機株式会社
Priority date: 2014-09-24
Filing date: 2014-09-24
Publication date: 2016-03-31

Abstract

A terminal investigation unit (A-100) investigates a security state of a terminal device. A load state information reception unit (A-200) receives load state information indicating respective load states of a plurality of server devices. A selection unit (A-300) selects, from among the plurality of server devices, a server device which performs data processing for security management on the terminal device on the basis of the security state investigated by the terminal investigation unit (A-100) of the terminal device and the respective load states indicated by the load state information of the server devices.

Description

Load distribution apparatus, load distribution method, and program

The present invention relates to a load balancing technique of a server device that performs security management of a terminal device.

Network quarantine techniques are widely used to maintain the security of information systems in the organization.
In the network quarantine technology, data processing for security management is performed on a terminal device.
More specifically, when the terminal device connects to the network in the organization, a security check is performed to verify whether or not the terminal device is safe.
The security check is also called a quarantine process.
Only terminal devices that pass the security check are permitted to access important information systems (file server, business application server, etc.).
Here, a terminal device that does not pass the security check is typically limited in an accessible information system by a network access control technique.
Processing for restricting access of a terminal device that does not pass the security check is also referred to as isolation processing.
After a process that restores the safety of the terminal device, such as updating the software version of the security program, is executed on the terminal device, the quarantine process is executed again on the terminal device, and the terminal device passes the safety verification. In such a case, access to the important information system of the terminal device is permitted.
The process of restoring the security state of the terminal device by updating the security program is also referred to as a repair process.
As a conventional network quarantine technique, for example, there is a technique described in Patent Document 1.

In an environment using a network quarantine technique, for example, a load may be concentrated on a server device that performs security management on the next day after distribution of an update program for eliminating a serious security defect is started.
When such a load is concentrated, the processing performance of the server device is lowered, and there is a problem that it takes a long time until the terminal device can be used for the original business.
For this reason, for example, it is necessary to distribute the load of the server device.
As load distribution technologies for server devices, there are technologies described in Patent Documents 2 to 4.

JP 2007-235730 A Japanese Patent Laid-Open No. 2003-24866 JP 2012-174051 A JP 2007-241712 A

When load distribution is performed by distributing quarantine processing, isolation processing, and repair processing to a plurality of server devices, there are the following problems.
For example, in a system that distributes loads by performing quarantine processing, quarantine processing, and repair processing of a terminal device at a certain base on a server device at another base, and the terminal device at a certain base is in a state of security risk If the terminal device accesses a server device and a network at another base, there is a possibility that a security problem may be caused at the other base.

The main purpose of the present invention is to avoid such security risks and to distribute the load on the server device that performs security management.

The load balancer according to the present invention is
A terminal investigation unit that investigates the security status of the terminal device;
A load state information receiving unit for receiving load state information indicating each load state of the plurality of server devices;
A server device that performs data processing for security management on the terminal device based on the security state of the terminal device investigated by the terminal investigation unit and the load state of each server device indicated in the load state information And a selection unit for selecting from a plurality of server devices.

In the present invention, a server device that performs security management of the terminal device is selected based on the security state of the terminal device and the load state of each server device.
Therefore, according to the present invention, it is possible to avoid a security risk and to distribute the load of the server device that performs security management.

FIG. 3 is a diagram illustrating an example of a system configuration according to the first embodiment. FIG. 3 is a diagram illustrating a general configuration example of a load distribution apparatus according to the first embodiment. FIG. 3 is a diagram illustrating a detailed configuration example of the load distribution apparatus according to the first embodiment. FIG. 3 shows an example of an access terminal information table according to the first embodiment. FIG. 4 is a diagram showing an example of a terminal affiliation information table according to Embodiment 1. The figure which shows the example of the terminal security state information table which concerns on Embodiment 1. FIG. FIG. 4 is a diagram showing an example of an update program information table according to the first embodiment. FIG. 4 is a diagram showing an example of a load state information table according to the first embodiment. The figure which shows the example of the allocation rule information table which concerns on Embodiment 1. FIG. FIG. 3 is a flowchart showing an operation example of the load distribution apparatus according to the first embodiment. The figure which shows the example of terminal ID of the terminal device which concerns on Embodiment 1, mounted OS, and the latest patch update date. FIG. 4 is a diagram illustrating a detailed configuration example of a load distribution apparatus according to a second embodiment. The figure which shows the example of the quarantine level information table which concerns on Embodiment 2. FIG. The figure which shows the example of the user information table which concerns on Embodiment 2. FIG. The figure which shows the example of the post information table which concerns on Embodiment 2. FIG. The figure which shows the example of the organization information table which concerns on Embodiment 2. FIG. FIG. 9 is a flowchart showing an operation example of the load distribution apparatus according to the second embodiment. The figure which shows the example of terminal ID of the terminal device which concerns on Embodiment 2, user ID, user name, organization ID, organization name, title ID, title, title level, confidentiality, loading OS, and the latest patch update date and time . FIG. 10 shows an example of an allocation rule information table according to the third embodiment. FIG. 4 is a diagram illustrating a hardware configuration example of a load distribution apparatus according to the first to third embodiments.

As described above, in an organization where network quarantine technology has been introduced, a server that performs data processing for security management during the next sunrise company time when a new software update patch is distributed or the quarantine policy in the organization is changed There is a case where the load is concentrated on the apparatus and the processing performance of the server apparatus is lowered.
As a method of distributing the load on the server device, (1) a method of distributing processing time zones on the same server, (2) a method of distributing processing to a plurality of servers in the same base, and (3) a plurality of servers between different bases There is a method to distribute the processing.
The base is a management unit of the information system. Specifically, an organization such as a company is an example of the base.
When the above server load distribution methods (1) to (3) are applied to network quarantine, the following problems can be considered.

The method (1) has an advantage that it is not necessary to prepare an extra server device.
However, in the method (1), the terminal device that has been postponed by the quarantine process by the server device continues to be in an insecure state or is prohibited from being used for a long time.
For this reason, the method (1) has a problem in terms of security or convenience.

In the method (2), the number of terminal devices for which the quarantine process is postponed is reduced.
However, in the method (2), it is necessary to maintain an extra server device for distribution of processing even in a normal time when a new security program or the like is not disclosed.
For this reason, the method (2) has a problem of inefficiency.
Normally, a significant security update is released every month to several months, and the surplus server device processing capacity during that period is useless.

The method (3) is an extension of the method (2), and it is possible to use a server device at the base Y with a sufficient processing capability so that the base X does not have to have a surplus server device. There are benefits.
However, using the server device at the base Y for the network quarantine process at the base X has a security risk.
The security risk is a possibility that the terminal device, the server device, and the network are exposed to threats. Examples of the security risk include the following.
When the terminal device at site X is infected with a computer virus and the terminal device accesses the server device at site Y, the computer virus at the terminal device attacks the server device or network at site Y.
When the terminal device holding the important secret of the base X accesses the server device of the base Y infected with the computer virus, the important secret of the base X leaks through the server device of the base Y.
The quarantine policy such as the quarantine method and the strength of quarantine is different between the base X and the base Y, and what is not recognized as safe at one base is judged as safe at the other base.

In the following first to third embodiments, a method for avoiding a security risk in a configuration in which load distribution of server devices is performed using a plurality of server devices arranged at a plurality of bases will be described.

Embodiment 1 FIG.
*** Explanation of configuration ***
FIG. 1 shows a system configuration example according to the present embodiment.
In this embodiment, a system composed of a base A (A00) and a base B (B00) is taken as an example.
The number of bases may be any number as long as it is two or more.

At the site A (A00), the terminal device (A-01) is a terminal device used by users belonging to the site A (A00).
The terminal device (A-01) transmits a packet for accessing the access destination server device via the network in the base A (A00).
The packet transmitted by the terminal device (A-01) is received by the load balancer (A-02).

The load balancer (A-02) sends the packet from the terminal device (A-01) to the repair server device (A-16) in the base A (A00) or the repair server device (B in the base B (B00)). -16)).
In addition, the load balancer (A-02) transmits the packet from the terminal device (A-01) to the quarantine server device (A-17) in the site A (A00) or the quarantine server device (B00) in the site B (B00). Forward to B-17).
In this way, the load distribution apparatus (A-02) performs load distribution between the server apparatus in the base A (A00) and the server apparatus in the base B (B00).

The repair server device (A-16) and the quarantine server device (A-17) perform data processing for security management on the terminal device.
Security management is a measure for preventing terminal devices, server devices, and networks from being exposed to security threats.
The repair server device (A-16) performs repair processing on the terminal device (A-01) or a later-described terminal device (B-01) as data processing for security management.
More specifically, the repair server device (A-16) distributes an OS (Operating System) update program or an application update program to the terminal device (A-01) or the terminal device (B-01).

The quarantine server apparatus (A-17) performs a quarantine process on the terminal apparatus (A-01) or a terminal apparatus (B-01) described later as data processing for security management.
When the terminal device (A-01) or the terminal device (B-01) does not match the quarantine policy as a result of the quarantine process, the quarantine server device (A-17) cooperates with the network switch device or firewall device, Access from terminal devices that do not match the quarantine policy can be restricted.

The terminal attribute information storage device (A-18) is a data store that stores terminal attribute information that is information relating to the terminal device (A-01).
The terminal attribute information includes, for example, an identifier of the terminal device (A-01), software information installed in the terminal device (A-01), user information of the terminal device (A-01), and terminal device This is information on the confidential level of the data held in (A-01).
In the drawing, the terminal attribute information storage device (A-18) is described as “terminal attribute information” for reasons of drawing space.

The repair information storage device (A-19) is a data store that stores repair information used for repair processing.
The repair information is, for example, security program update information and repair processing history information for the terminal device (A-01).
In the drawing, the repair information storage device (A-19) is referred to as “repair information” for reasons of drawing space.

The quarantine information storage device (A-20) is a data store that stores quarantine information used for quarantine processing.
The quarantine information is, for example, information indicating a quarantine policy, quarantine processing history information for the terminal device (A-01), and security status information of the terminal device (A-01).
In the drawing, the quarantine information storage device (A-20) is described as “quarantine information” for reasons of drawing space.

The components of the base B (B00) are the same as the base A (A00).
That is, the terminal device (B-01) is the same as the terminal device (A-01), and the load balancer (B-02) is the same as the load balancer (A-02).
The repair server device (B-16) is the same as the repair server device (A-16), and the quarantine server device (B-17) is the same as the quarantine server device (A-17).
The terminal attribute information storage device (B-18) is the same as the terminal attribute information storage device (A-18), and the repair information storage device (B-19) is the same as the repair information storage device (A-19). Yes, the quarantine information storage device (B-20) is the same as the quarantine information storage device (A-20).
Therefore, the terminal device (B-01), the load balancer (B-02), the repair server device (B-16), the quarantine server device (B-17), the terminal attribute information storage device (B-18), the repair Detailed descriptions of the information storage device (B-19) and the quarantine information storage device (B-20) are omitted.

FIG. 2 shows a general configuration example of the load distribution apparatus (A-02) according to the present embodiment.

The terminal investigation unit (A-100) investigates the security state of the terminal device (A-01).
The security state is a state of dealing with vulnerabilities such as security holes.
More specifically, the terminal investigation unit (A-100) investigates the security program update state in the terminal device (A-01) as the security state of the terminal device (A-01).
The terminal investigation unit (A-100) receives the update program information from the repair information storage device (A-19) and the terminal attribute information from the terminal attribute information storage device (A-18).
Then, the terminal investigation unit (A-100) analyzes the received update program information and terminal attribute information, and investigates the update state of the security program in the terminal device (A-01).
The terminal attribute information indicates the update date and time of the security program in the terminal device (A-01).
The update program information indicates a security program update history for each OS (Operating System).
The terminal check unit (A-100) checks the update status of the security program in the terminal device (A-01) by comparing the terminal attribute information with the update program information.

The load status information receiving unit (A-200) receives load status information indicating the load status of each of the plurality of server devices.
That is, the load state information receiving unit (A-200) receives the load state information indicating the load state of the repair server device (A-16) from the repair server device (A-16), and also receives the quarantine server device ( The load status information indicating the load status of the quarantine server apparatus (A-17) is received from A-17).
Also, the load status information receiving unit (A-200) receives the load indicating the load status of the repair server device (B-16) from the repair server device (B-16) via the load balancer (B-02). The status information is received, and load status information indicating the load status of the quarantine server device (B-17) is received from the quarantine server device (B-17).

Based on the security status of the terminal device (A-01) surveyed by the terminal survey unit (A-100) and the load status of each server device indicated by the load status information, the selection unit (A-300) A server device that performs security management of the device (A-01) is selected from a plurality of server devices.
That is, the selection unit (A-300) selects the server device that performs the quarantine process of the terminal device (A-01) from the quarantine server device (A-17) and the quarantine server device (B-17).
Further, the selection unit (A-300) selects a server device that performs the repair process of the terminal device (A-01) from the repair server device (A-16) and the repair server device (B-16).

FIG. 3 is a configuration diagram showing the configuration shown in FIG. 2 in more detail.
That is, the configuration example of FIG. 3 is an example for realizing the load distribution apparatus (A-02) of FIG.

The access receiving unit (A-03) receives a packet from the terminal device (A-01).
Then, the access receiving unit (A-03) passes the received packet to the terminal information collecting unit (A-21) described later.
The access receiving unit (A-03) also receives a packet from the terminal device (B-01) at the site B (B00) transferred from the load distribution device (B-02) at the site B (B00). .
The access receiving unit (A-03) also passes the packet from the terminal device (B-01) to the terminal information collecting unit (A-21).

The terminal device information collection unit (A-21) acquires a packet from the access reception unit (A-03), and acquires terminal information from the acquired packet.
Then, the access receiving unit (A-03) stores the acquired terminal information in the access terminal information storage unit (A-24).

The access terminal information storage unit (A-24) stores the terminal information in the access terminal information table.
In the drawing, the access terminal information storage unit (A-24) is described as “access terminal information” for reasons of drawing space.

The access terminal information table is, for example, the table shown in FIG.
In FIG. 4, the access terminal information table includes a terminal ID, an IP address, a MAC address, a terminal type, an access destination IP address, and an access time.
In the terminal ID column, the ID (Identifier) of the terminal device of the packet transmission source extracted from the packet is described.
In the IP address column, the IP (Internet Protocol) address of the terminal device of the packet transmission source extracted from the packet is described.
The MAC address column describes the MAC (Media Access Control) address of the terminal device that is the packet transmission source extracted from the packet.
In the terminal type column, the device category (such as personal computer or tablet terminal) of the terminal device of the packet transmission source extracted from the packet is described.
In the column of access destination IP address, the IP address of the transmission destination of the packet extracted from the packet is described.
The access time column describes the time when the packet arrives at the access receiving unit (A-03).
The access receiving unit (A-03) also generates an access terminal information table similar to that in FIG. 4 for the packet from the terminal device (B-01) at the base B (B00), and the generated access terminal information table Is stored in the access terminal information storage unit (A-24).

The terminal information management unit (A-12) receives the terminal attribute information from the terminal attribute information storage device (A-18), and stores the received terminal attribute information in the terminal attribute information storage unit (A-06).
Specifically, in the present embodiment, the terminal information management unit (A-12) receives the terminal affiliation information table and the terminal security state information table as terminal attribute information.
The terminal information management unit (A-12), together with an update program information management unit (A-13) described later, realizes the terminal investigation unit (A-100) of FIG.

The terminal attribute information storage unit (A-06) stores terminal attribute information.
In the drawing, the terminal attribute information storage unit (A-06) is described as “terminal attribute information” for reasons of drawing space.

FIG. 5 shows an example of the terminal affiliation information table.
In the terminal affiliation information table, the user ID, organization ID, confidentiality, and installed OS are shown for each terminal ID.
The user ID indicates an identifier of a user who uses the terminal device specified by the terminal ID.
The organization ID indicates the identifier of the organization to which the user specified by the user ID belongs.
The confidentiality indicates the confidential level of information held by the terminal device specified by the terminal ID.
The installed OS indicates the OS installed in the terminal device specified by the terminal ID.
In the present embodiment, in the terminal affiliation information table, information on the installed OS is essential, but information on the user ID, organization ID, and confidentiality can be omitted.
It is assumed that the terminal information management unit (A-12) periodically receives the terminal affiliation information table from the terminal attribute information storage device (A-18).
However, the terminal information management unit (A-12), instead of the method of periodically receiving the terminal affiliation information table, when the access reception unit (A-03) receives the packet, the terminal that is the transmission source of the packet Only the device record may be received from the terminal attribute information storage device (A-18).

FIG. 6 shows an example of the terminal security state information table.
The terminal security status information table shows the latest patch update date and time for each terminal ID.
The latest patch update date and time indicates the date and time when the security program was last updated.
It is assumed that the terminal information management unit (A-12) periodically receives the terminal security state information table from the terminal attribute information storage device (A-18).
However, instead of the method of periodically receiving the terminal security status information table, the terminal information management unit (A-12), when the access receiving unit (A-03) receives the packet, Only the record of the terminal device may be received from the terminal attribute information storage device (A-18).

The update program information management unit (A-13) receives the update program information from the repair information storage device (A-19) periodically or when distributing a new update program, and receives the received update program information as an update program described later. The information is stored in the information storage unit (A-07).
The update program information management unit (A-13), together with the terminal information management unit (A-12), realizes the terminal investigation unit (A-100) of FIG.

The update program information storage unit (A-07) stores the update program information acquired by the update program information management unit (A-13).
In the drawing, the update program information storage unit (A-07) is described as “update program information” for the reason of the drawing space.

FIG. 7 shows an example of the update program information table.
The update program information table shows the update program ID, risk, and distribution date and time for each OS.
The update program ID indicates the identifier of the security program distributed for the target OS.
The risk indicates the degree of risk that is handled by the security program identified by the update program ID.
The distribution date / time indicates the distribution date / time of the security program specified by the update program ID.

The terminal device state evaluation unit (A-04) acquires the access terminal information table (FIG. 4) from the access terminal information storage unit (A-24), and acquires the terminal affiliation information table from the terminal attribute information storage unit (A-06). (FIG. 5) and the terminal security state information table (FIG. 6) are acquired, the update program information table (FIG. 7) is acquired from the update program information storage unit (A-07), these tables are analyzed, and the terminal Check the security status of the device (A-01).
Then, the terminal state evaluation unit (A-04) calculates a risk evaluation value from the security state investigation result of the terminal device (A-01), and uses the calculated risk evaluation value as an access allocation determination unit (A-09). ).
The risk evaluation value is also simply referred to as an evaluation value.
Further, the terminal state evaluation unit (A-04) implements the selection unit (A-300) of FIG. 2 together with an access allocation determination unit (A-09) described later.

The load state information receiving unit (A-14) periodically receives load state information indicating the load state in the repair server device (A-16) from the repair server device (A-16).
Further, the load status information receiving unit (A-14) periodically receives load status information indicating the load status in the quarantine server device (A-17) from the quarantine server device (A-17).
Further, the load status information receiving unit (A-14) periodically receives the load status information of the repair server device (B-16) and the quarantine server device (B-17) from the load balancer (B-02). Receive.
Then, the load state information receiving unit (A-14) stores the received load information in the load state information storage unit (A-15).
The load state information receiving unit (A-14) implements the load state information receiving unit (A-200) of FIG.

The load state information storage unit (A-15) stores load state information.
In the drawing, the load state information storage unit (A-15) is described as “load state information” for reasons of drawing space.
For example, the load state information storage unit (A-15) stores the load state information of the server device in the load state information table of FIG.
In the example of FIG. 8, the load level (LV) of the quarantine server device (A-17) at the site A is “90”, and the load level (LV) of the quarantine server device (B-17) at the site B is “20”. ".

The load state information transmission unit (A-23) periodically reads the load state information of the repair server device (A-16) stored in the load state information storage unit (A-15) and the quarantine server device (A-). 17) is transmitted to the load balancer (B-02).

The allocation rule information storage unit (A-08) stores allocation rule information.
The allocation rule information includes a server device in which an access allocation determination unit (A-09), which will be described later, performs data processing for security management, a server device in the base A (A00), and a server device in the base B (B00). A rule for selecting one of them is described.
In the drawing, the allocation rule information storage unit (A-08) is described as “allocation rule information” for reasons of drawing space.
For example, the allocation rule information storage unit (A-08) stores allocation rule information in the allocation rule information table of FIG.
In FIG. 9, the rule ID indicates an identifier of the allocation rule.
The access source base ID indicates an identifier of a base to which the access source terminal device belongs.
The access source name indicates the name of the base specified by the access source base ID.
The access destination base ID indicates an identifier of a base that executes data processing for security management.
The risk evaluation value indicates the condition of the risk evaluation value calculated by the terminal state evaluation unit (A-04).
The load level (LV) indicates the condition of the load state.

The access allocation determination unit (A-09) is configured to determine the risk evaluation value calculated by the terminal state evaluation unit (A-04), the load state of the quarantine server device (A-17), the quarantine server device (B-17) Based on the load state, either the quarantine server device (A-17) or the quarantine server device (B-17) is selected as the server device that performs the quarantine process of the terminal device (A-01) according to the allocation rule information table (FIG. 9). Select whether or not.
The access allocation determination unit (A-09) also calculates the risk evaluation value calculated by the terminal state evaluation unit (A-04), the load state of the repair server device (A-16), the repair server device (B-16). ) In accordance with the allocation rule information table (FIG. 9), the server device that performs the repair processing of the terminal device (A-01) is the repair server device (A-16) or the repair server device (B-16). Select one of these.
The access allocation determination unit (A-09) implements the selection unit (A-300) of FIG. 2 together with the terminal state evaluation unit (A-04).

The server communication unit (A-10) transfers the packet from the terminal device (A-01) to the server device selected by the access allocation determination unit (A-09).
Specifically, when the repair server device (A-16) is selected by the access allocation determination unit (A-09), the server communication unit (A-10) receives the request from the terminal device (A-01). The packet is transferred to the repair server device (A-16).
The server communication unit (A-10) quarantines the packet from the terminal device (A-01) when the quarantine server device (A-17) is selected by the access allocation determination unit (A-09). Transfer to server device (A-17).
Further, when the repair server device (B-16) or the quarantine server device (B-17) is selected by the access allocation determination unit (A-09), the server communication unit (A-10) The packet from A-01) is transferred to the load balancer (B-02).
The load balancer (B-02) sends a packet from the terminal device (A-01) transferred from the server communication unit (A-10) to the repair server device (B-16) or the quarantine server device (B-17). Forward to.

Since the configuration of the load balancer (B-02) is the same as that of the load balancer (A-02), the description of the configuration of the load balancer (B-02) is omitted.

*** Explanation of operation ***
Next, an operation example in the load balancer (A-02) will be described with reference to the flowchart of FIG.
Hereinafter, as a server device in which the terminal device (A-01) tries to access a file server device (not shown in FIG. 1) in the base A (A00) and the load distribution device (A-02) performs a quarantine process. The description proceeds using an example in which one of the quarantine server apparatus (A-17) and the quarantine server apparatus (B-17) is selected.
In the following, the terminal information management unit (A-12) periodically acquires terminal attribute information from the terminal attribute information storage device (A-18), and the file server device from the terminal device (A-01). When the terminal is accessed, the terminal attribute information of the terminal device (A-01) is stored in the terminal attribute information storage unit (A-06).
Similarly, in the following, the update program information management unit (A-13) periodically acquires update program information from the repair information storage device (A-19), and from the terminal device (A-01). When the file server apparatus is accessed, update program information is stored in the update program information storage unit (A-07).
Similarly, in the following description, when the terminal device (A-01) accesses the file server device, the load of the quarantine server device (A-17) is stored in the load status information storage unit (A-15). Assume that state information and load state information of the quarantine server apparatus (B-17) are stored.

The terminal device (A-01) transmits a packet for accessing the file server device in the base A (A00).
The packet from the terminal device (A-01) is received by the access receiver (A-03) of the load balancer (A-02) (S01).
The access receiving unit (A-03) passes the received packet to the terminal information collecting unit (A-21).

Next, the terminal information collection unit (A-21) acquires the terminal ID, IP address, MAC address, terminal type, access destination IP address, and access time from the packet as terminal information (S02).
The terminal information is stored in the access terminal information table of FIG. 4 in the access terminal information storage unit (A-24).

Next, the terminal state evaluation unit (A-04) acquires the terminal ID of the terminal device (A-01) from the access terminal information table.
Further, the terminal state evaluation unit (A-04) obtains terminal attribute information corresponding to the terminal ID value of the terminal device (A-01) obtained from the access terminal information table from the terminal attribute information storage unit (A-06). Obtain (S03).
More specifically, the terminal state evaluation unit (A-04) acquires the value of the installed OS corresponding to the value of the terminal ID of the terminal device (A-01) from the terminal belonging information table (FIG. 5).
Further, the terminal state evaluation unit (A-04) obtains the latest patch update date and time corresponding to the terminal ID value of the terminal device (A-01) from the terminal security state information table (FIG. 6).
For example, assuming that the terminal ID of the terminal device (A-01) is “TRM01”, the terminal state evaluation unit (A-04) sets “OS-8” as the installed OS from the terminal affiliation information table (FIG. 5). Further, “2014/03/01 17:21:52” is acquired as the latest patch update date and time from the terminal security state information table (FIG. 6).
The terminal ID, installed OS, and latest patch update date and time of the terminal device (A-01) are summarized as shown in FIG.

Further, the terminal state evaluation unit (A-04) acquires update program information corresponding to the OS installed in the terminal device (A-01) and the latest patch update date and time from the update program information storage unit (A-07) (S04). ).
As described above, in S03, “OS-8” is acquired as the installed OS, and “2014/03/01 17:21:52” is acquired as the latest patch update date and time.
The terminal state evaluation unit (A-04) reads the records whose target OS is “OS-8” and whose distribution date and time is after “2014/03/01 17:21:52” from the update program information table ( Obtained from FIG.
As a result, the terminal state evaluation unit (A-04) acquires records of the update programs “UPD001”, “UPD002”, and “UPD003”.
The update programs “UPD001”, “UPD002”, and “UPD003” are security programs that have not been updated in the terminal device (A-01).

Next, the terminal state evaluation unit (A-04) calculates a risk state evaluation value of the security state of the terminal device (A-01) based on a predetermined evaluation rule (S05).
Here, an evaluation rule is assumed in which two evaluation values are counted for each update program for risk “HIGH” and one evaluation value is recorded for each update program for risk “LOW”.
The risks of the update programs “UPD001” and “UPD002” are “HIGH” from FIG. 7, respectively, and the risk of the update program “UPD003” is “LOW” from FIG.
Therefore, the terminal state evaluation unit (A-04) calculates 5 points as the risk evaluation value of the terminal device (A-01).
The terminal state evaluation unit (A-04) notifies the calculated evaluation value to the access allocation determination unit (A-09).

Next, the access allocation determination unit (A-09) acquires the load status information of the quarantine server device (A-17) and the quarantine server device (B-17) from the load status information storage unit (A-15) ( S06).
For example, it is assumed that the access allocation determination unit (A-09) acquires the load state information shown in FIG.

Next, the access allocation determination unit (A-09) acquires the allocation rule information table from the allocation rule information storage unit (A-08), and based on the risk evaluation value and the load state information, the terminal device (A− The quarantine server device (A-17) or the quarantine server device (B-17) is selected as the server device for performing the quarantine process of (01) (S07).
Since the access source terminal device (A-01) belongs to the base A (A00), the access allocation determination unit (A-09) has the rule ID “ARL001” from the allocation rule information table of FIG. A record and a record whose rule ID is “ARL002” are acquired.
According to the rule described in the record “ARL001”, if the risk evaluation value is 7 points or less and the load level of the quarantine server device (A-17) is 70 or less, the quarantine server device (A-17) ( This is a rule of selecting access destination name: base A).
The rule described in the record “ARL002” is that if the risk evaluation value is 5 points or less and the load level of the quarantine server device (A-17) is 50 or less, the quarantine server device (B-17) ( This is a rule of selecting access destination name: base B).
The risk evaluation value calculated by the terminal state evaluation unit (A-04) is “5 points”, and in the example of FIG. 8, the load level of the quarantine server device (A-17) is “90”. The load level of the quarantine server device (B-17) is “20”.
Since the risk evaluation value is “5 points”, it matches the conditions of the risk evaluation values of “ARL001” and “ARL002”.
However, since the load level of the quarantine server apparatus (A-17) is “90”, the load level condition of “ARL001” is not met.
On the other hand, since the load level of the quarantine server apparatus (B-17) is “20”, the load level condition of “ARL002” is met.
For this reason, the access allocation determination unit (A-09) selects the quarantine server device (B-17) according to the rule of “ARL002” as the server device that performs the quarantine process of the terminal device (A-01).

Next, the server communication unit (A-10) transfers the packet from the terminal device (A-01) to the quarantine server device (B-17) selected by the access allocation determination unit (A-09) (S08). ).
More specifically, the server communication unit (A-10) transfers the packet from the terminal device (A-01) to the load balancer (B-02).
Then, the load balancer (B-02) transfers the packet from the terminal device (A-01) to the quarantine server device (B-17), and causes the quarantine server device (B-17) to perform the quarantine process.

In the above description, the example in which the risk evaluation value and the load level match only the condition of “ARL002” has been described.
When the risk evaluation value and the load level meet both the conditions of “ARL001” and the condition of “ARL002”, the access allocation determination unit (A-09) selects, for example, a server device with a low load level.
For example, the evaluation value calculated by the terminal state evaluation unit (A-04) is “5 points”, the load level of the load state information of the quarantine server device (A-17) is “30”, and the quarantine server device ( If the load level in the load state of B-17) is “40”, the quarantine server apparatus (A-17) having a low load level is selected.
Also, if the risk evaluation value and the load level do not meet either the “ARL001” condition or the “ARL002” condition, the access allocation determining unit (A-09) selects the server device at the base A (A00). select.
For example, if the evaluation value calculated by the terminal state evaluation unit (A-04) is “8 points”, it does not match both the “ARL001” condition and the “ARL002” condition. A-17) is selected.

*** Explanation of effects ***
In the present embodiment, in an information system environment to which network quarantine technology is applied, network quarantine is performed while reducing the security risks caused by distributing the load of quarantine, quarantine, and repair processing of terminal devices at multiple locations. The configuration for shortening the processing time has been described.
According to this embodiment, the following effects can be expected.
Reduction of security risk It is possible to prevent a terminal device with a low security state from being assigned to a server device at another base.
For this reason, the situation which causes a security problem to the server apparatus and network of another base can be avoided.
・ Distribution of network quarantine load When the load is concentrated on the server device at one site, the time required for network quarantine can be shortened by using the server device at another site.
-Reduction of spare resources By using server devices at other sites as spare resources, it is possible to reduce the spare resources of server devices prepared at each site.

Embodiment 2. FIG.
In the present embodiment, an example in which an attribute of a terminal device is used as a parameter for determining a server device that performs data processing for security management will be described.
The terminal device attribute is, for example, an attribute of a user of the terminal device or presence / absence of confidential information in the terminal device.
The user attribute is, for example, the job title of the user or the organization to which the user belongs.

Hereinafter, differences from the first embodiment will be mainly described.
Matters not described below are the same as those in the first embodiment.

*** Explanation of configuration ***
A system configuration example according to the present embodiment is as shown in FIG.
A general configuration example of the load distribution apparatus (A-02) according to the present embodiment is as shown in FIG.
However, in this embodiment, the terminal investigation unit (A-100) investigates the attributes of the terminal device in addition to the security state of the terminal device.
Further, the selection unit (A-300) according to the present embodiment performs security management based on the security status of the terminal device, the attribute of the terminal device, and the load status of each server device indicated in the load status information. A server device that performs data processing on the terminal device is selected from a plurality of server devices.
The selection unit (A-300) calculates an evaluation value based on the security state of the terminal device and the attribute of the terminal device.
For example, the selection unit (A-300) derives the priority of the terminal device from the attribute of the terminal device, and calculates the evaluation value based on the security state and the priority of the terminal device.
Then, the selection unit (A-300) selects, from the plurality of server devices, a server device that performs data processing for security management on the terminal device based on the calculated evaluation value and the load state of each server device. .
In more detail, the load distribution apparatus (A-02) according to the present embodiment has, for example, the configuration shown in FIG.

In FIG. 12, a quarantine level information storage unit (A-05) and a quarantine level information management unit (A-11) are added as compared to the configuration of FIG.
The quarantine level information management unit (A-11) receives the quarantine level information from the quarantine information storage device (A-20).
The quarantine level information storage unit (A-05) stores the quarantine level information received by the quarantine level information management unit (A-11).
The quarantine level information is, for example, a quarantine level information table shown in FIG.
In the quarantine level information table, conditions 1 and 2 are defined for each quarantine level ID, and a quarantine level is defined by a combination of conditions 1 and 2.
Condition 1 is a condition regarding the confidentiality of information held by the terminal device, and condition 2 is a condition regarding the job title of the user of the terminal device.
The quarantine level is the priority of the terminal device when performing the quarantine process.
In the quarantine level ID: QPL001, a low quarantine level is defined when the confidentiality of information held by the terminal device is low and the job title of the user of the terminal device is low.
On the other hand, in the quarantine level ID: QPL004, a high quarantine level is defined when the confidentiality of information held by the terminal device is high and the job title of the user of the terminal device is high.
The quarantine level information management unit (A-11) periodically receives the quarantine level information table from the quarantine information storage device (A-20).
In the drawing, the quarantine level information storage unit (A-05) is described as “quarantine level information” for reasons of drawing space.

In this embodiment, the terminal information management unit (A-12) stores the terminal attribute information in the terminal affiliation information table (FIG. 5) and the terminal security status information table (FIG. 6) shown in the first embodiment. In addition, the user information table (FIG. 14), the post information table (FIG. 15), and the organization information table (FIG. 16) are received from the terminal attribute information storage device (A-18).
In the first embodiment, the user ID, organization ID, and confidentiality can be omitted in the terminal affiliation information table (FIG. 4). However, in this embodiment, the user ID and confidentiality are essential. The organization ID can be omitted.
In the user information table (FIG. 14), a user name, an organization ID, and a post ID are defined for the user ID.
In the post information table (FIG. 15), the post name and post level (LV) are defined for the post ID.
In the organization information table (FIG. 16), an organization name is defined for the organization ID.
Note that the terminal information management unit (A-12) periodically receives these tables.
The terminal information management unit (A-12) stores these tables received from the terminal attribute information storage device (A-18) in the terminal attribute information storage unit (A-06).

Further, in the present embodiment, the terminal state evaluation unit (A-04) analyzes the terminal attribute information to investigate the security state of the terminal device, as well as the terminal device attribute, as in the first embodiment. investigate.
The terminal state evaluation unit (A-04) calculates a risk evaluation value based on the security state of the terminal device and the attribute of the terminal device, and the risk evaluation value and the server of the load balancer (A-02) The server device is selected based on the load state of the device and the load state of the server device of the load balancer (B-02).

*** Explanation of operation ***
Next, an operation example of the load distribution apparatus (A-02) according to the present embodiment will be described with reference to FIG.
In FIG. 17, S11, S12, and S13 are different from FIG.
Other steps are the same as those shown in FIG.

In the following, the server in which the terminal device (A-01) tries to access the file server device (not shown in FIG. 12) in the base A (A00) and the load distribution device (A-02) performs the quarantine process. The description will proceed using an example in which one of the quarantine server device (A-17) and the quarantine server device (B-17) is selected as the device.
In the following, the terminal information management unit (A-12) periodically acquires terminal attribute information from the terminal attribute information storage device (A-18), and the file server device from the terminal device (A-01). When the terminal is accessed, the terminal attribute information of the terminal device (A-01) is stored in the terminal attribute information storage unit (A-06).
Similarly, in the following, the update program information management unit (A-13) periodically acquires update program information from the repair information storage device (A-19), and from the terminal device (A-01). When the file server apparatus is accessed, update program information is stored in the update program information storage unit (A-07).
Similarly, in the following, the quarantine level information management unit (A-11) periodically acquires quarantine level information from the quarantine information storage device (A-20), and from the terminal device (A-01). It is assumed that the quarantine level information is stored in the quarantine level information storage unit (A-05) when the file server apparatus is accessed.
Similarly, in the following description, when the terminal device (A-01) accesses the file server device, the load of the quarantine server device (A-17) is stored in the load status information storage unit (A-15). Assume that state information and load state information of the quarantine server apparatus (B-17) are stored.

Next, the terminal state evaluation unit (A-04) acquires the terminal ID of the terminal device (A-01) from the access terminal information table of the terminal information collection unit (A-21).
Further, the terminal state evaluation unit (A-04) obtains terminal attribute information corresponding to the terminal ID value of the terminal device (A-01) obtained from the access terminal information table from the terminal attribute information storage unit (A-06). Obtain (S11).
More specifically, the terminal state evaluation unit (A-04) displays the user ID, confidentiality, and installed OS value corresponding to the terminal ID value of the terminal device (A-01) in the terminal affiliation information table (see FIG. Obtain from 5).
Further, the terminal state evaluation unit (A-04) obtains the latest patch update date and time corresponding to the terminal ID value of the terminal device (A-01) from the terminal security state information table (FIG. 6).
Further, the terminal state evaluation unit (A-04) obtains the user name value, organization ID value, and post ID value corresponding to the user ID value acquired from the terminal affiliation information table (FIG. 5). Obtained from the information table (FIG. 14).
Further, the terminal state evaluation unit (A-04) displays the position name value and position level (LV) value corresponding to the position ID value acquired from the user information table (FIG. 14) in the position information table (FIG. 15). )
In addition, the terminal state evaluation unit (A-04) acquires the value of the organization name corresponding to the value of the organization ID acquired from the user information table (FIG. 14) from the organization information table (FIG. 16).
For example, if the terminal ID of the terminal device (A-01) is “TRM01”, the terminal ID, user ID, user name, organization ID, organization name, title ID, title of the terminal device (A-01) FIG. 18 summarizes the name, position level, confidentiality, installed OS, and latest patch update date and time.

The terminal state evaluation unit (A-04) acquires quarantine level information from the quarantine level information storage unit (A-05) (S12).
More specifically, the terminal state evaluation unit (A-04) acquires a record of quarantine level information that matches the confidentiality and job title level acquired in S11.
In the example of FIG. 18, since the confidentiality is “LOW” and the job title level is “LOW”, the terminal state evaluation unit (A-04) acquires the record of the quarantine level ID: QPL001.

Next, the terminal state evaluation unit (A-04) calculates a security state risk evaluation value of the terminal device (A-01) based on a predetermined evaluation rule (S13).
Here, 2 evaluation values are counted for each update program for risk “HIGH”, 1 evaluation value is recorded for each update program for risk “LOW”, and 1 evaluation value is assigned for quarantine level “HIGH”. Assume an evaluation rule of counting and counting 0 points for the quarantine level “LOW”.
The risks of the update programs “UPD001” and “UPD002” are “HIGH” from FIG. 7, respectively, and the risk of the update program “UPD003” is “LOW” from FIG.
The quarantine level is “LOW” from FIG.
Therefore, the terminal state evaluation unit (A-04) calculates 5 points as the risk evaluation value of the terminal device (A-01).
The terminal state evaluation unit (A-04) notifies the calculated evaluation value to the access allocation determination unit (A-09).

*** Explanation of effects ***
In this embodiment, in addition to the security state of the terminal device and the load state of the server device, the server device is selected using the attribute of the terminal device as a parameter.
For this reason, in addition to the effects of the first embodiment, it is possible to avoid a situation in which a terminal device that holds information with a high secret level or a terminal device that is used by a user in an important position is allocated to a server device at another base. can do.

Embodiment 3 FIG.
In the present embodiment, an example will be described in which the allocation rule information table used by the access allocation determination unit (A-09) is different from those in the first and second embodiments.

In the present embodiment, differences from the second embodiment will be mainly described.
Matters not described below are the same as those in the second embodiment.

*** Explanation of configuration ***
A system configuration example according to the present embodiment is as shown in FIG.
A general configuration example of the load distribution apparatus (A-02) according to the present embodiment is as shown in FIG.
A detailed configuration example of the load distribution apparatus (A-02) according to the present embodiment is as shown in FIG.

FIG. 19 shows an example of an allocation rule information table according to the present embodiment.
In FIG. 19, compared to the allocation rule information table shown in FIG. 9, an item of a quarantine level (LV) that is a priority of the terminal device is added.
In other words, in the present embodiment, the selection unit (A-300) (access allocation determination unit (A-09)) is a risk evaluation value, a quarantine level as a priority, and a load state of each server device. Based on the load level (LV), a server device that performs data processing for security management on the terminal device is selected.

*** Explanation of operation ***
An example of the operation of the load balancer (A-02) according to the present embodiment is as shown in FIG.
In FIG. 17, S01, S02, S11, S12, S04, S13, S06, and S08 are the same as those in the second embodiment, and a description thereof is omitted.
In S07, the access allocation determination unit (A-09) selects the server apparatus in addition to the quarantine level condition and the parameter in addition to the risk evaluation value condition and the load level condition shown in FIG.

*** Explanation of effects ***
In this embodiment, a server device is selected by adding a priority that reflects the confidential level of information held in the terminal device and the job title level of the user of the terminal device to the parameters.
For this reason, it is possible to avoid a situation in which a terminal device that holds information with a high confidentiality level or a terminal device that is used by a user in an important position is allocated to a server device at another base more directly than in the second embodiment. can do.

As mentioned above, although embodiment of this invention was described, you may implement in combination of 2 or more among these embodiment.
Alternatively, one of these embodiments may be partially implemented.
Alternatively, two or more of these embodiments may be partially combined.
In addition, this invention is not limited to these embodiment, A various change is possible as needed.

Finally, a hardware configuration example of the load distribution apparatus (A-02) shown in the first to third embodiments will be described with reference to FIG.
The load balancer (A-02) is a computer, and each element of the load balancer (A-02) can be realized by a program.
The hardware configuration of the load balancer (A-02) includes a bus, an arithmetic unit (901), an external storage unit (902), a main storage unit (903), a communication unit (904), and an input / output unit (905). Is connected.

The arithmetic device (901) is a CPU (Central Processing Unit) that executes a program.
The external storage device (902) is, for example, a ROM (Read Only Memory), a flash memory, or a hard disk device.
The main storage device (903) is a RAM (Random Access Memory).
The communication device (904) is, for example, a NIC (Network Interface Card), and includes an access receiving unit (A-03), a server communication unit (A-10), a load state information receiving unit (A-14), and load state information. This corresponds to the physical layer of the transmission unit (A-23).

The program is normally stored in the external storage device (902), and is loaded into the main storage device (903) and sequentially read into the arithmetic device (901) and executed.
The program is a program that realizes the functions described as “˜unit” (except for “˜storage unit”, the same applies hereinafter) shown in FIG. 2, FIG. 3 and FIG.
Further, an operating system (OS) is also stored in the external storage device (902), at least a part of the OS is loaded into the main storage device (903), and the arithmetic unit (901) executes the OS while 2, a program for realizing the functions of “˜unit” shown in FIGS. 3 and 12 is executed.
In the description of the first to third embodiments, “determine”, “determine”, “investigate”, “calculate”, “derived”, “select”, “generate”, “extract” ”,“ Set ”,“ Receive ”,“ Acquire ”, etc. Information, data, signal values, and variable values indicating the results of processing are stored as files in the main storage device (903). .

The configuration in FIG. 20 is merely an example of the hardware configuration of the load balancer (A-02), and the hardware configuration of the load balancer (A-02) is limited to the configuration shown in FIG. Alternatively, other configurations may be used.

Also, the load distribution method according to the present invention can be realized by the procedure shown in the first to third embodiments.

A00 site A, A-01 terminal device, A-02 load balancer, A-03 access receiving unit, A-04 terminal state evaluation unit, A-05 quarantine level information storage unit, A-06 terminal attribute information storage unit, A-07 update program information storage unit, A-08 allocation rule information storage unit, A-09 access allocation determination unit, A-10 server communication unit, A-11 quarantine level information management unit, A-12 terminal information management unit, A-13 update program information management unit, A-14 load status information reception unit, A-15 load status information storage unit, A-16 repair server device, A-17 quarantine server device, A-18 terminal attribute information storage device, A-19 Repair information storage device, A-20 Quarantine information storage device, A-21 Terminal information collection unit, A-23 Load status information transmission unit, A-24 Access terminal information storage unit, A-100 terminal survey unit, A-200 load status information reception unit, A-300 selection unit, B00 site B, B-01 terminal device, B-02 load distribution device, B-16 repair server Device, B-17 quarantine server device, B-18 terminal attribute information storage device, B-19 repair information storage device, B-20 quarantine information storage device.

Claims

A terminal investigation unit that investigates the security status of the terminal device;
A load state information receiving unit for receiving load state information indicating each load state of the plurality of server devices;
A server device that performs data processing for security management on the terminal device based on the security state of the terminal device investigated by the terminal investigation unit and the load state of each server device indicated in the load state information A load balancer having a selection unit for selecting from a plurality of server devices.
The terminal investigation unit
Investigate the attributes of the terminal device,
The selection unit includes:
Based on the security status of the terminal device, the attributes of the terminal device, and the load status of each server device indicated in the load status information, the terminal device performs data processing for security management. The load distribution device according to claim 1, wherein a server device to be executed is selected from among the plurality of server devices.
The selection unit includes:
An evaluation value is calculated based on the security state of the terminal device and the attribute of the terminal device investigated by the terminal investigation unit, and the calculated evaluation value and the load state of each server device indicated in the load state information The load distribution device according to claim 2, wherein a server device that performs data processing for security management on the terminal device is selected from the plurality of server devices.
The selection unit includes:
Deriving the priority of the terminal device from the attribute of the terminal device investigated by the terminal investigation unit,
The load distribution apparatus according to claim 3, wherein the evaluation value is calculated based on a security state of the terminal device investigated by the terminal investigation unit and a derived priority.
The selection unit includes:
Based on the evaluation value, the priority, and the load state of each server device indicated in the load state information, a server device that performs data processing for security management on the terminal device is included in the plurality of server devices. The load distribution apparatus according to claim 4, wherein the load distribution apparatus is selected from the following.
The terminal investigation unit
The load distribution apparatus according to claim 1, wherein an updated state of a security program in the terminal device is investigated as a security state of the terminal device.
The terminal investigation unit
The load distribution apparatus according to claim 2, wherein at least one of presence / absence of confidential information held by the terminal device and an attribute of a user of the terminal device is investigated as the attribute of the terminal device.
The load state information receiving unit
Receiving load status information indicating the load status of each of a plurality of server devices performing quarantine processing;
The selection unit includes:
Based on the security state of the terminal device investigated by the terminal investigation unit and the load state of each server device indicated in the load state information, a server device that performs a quarantine process of the terminal device is defined in the plurality of server devices. The load distribution apparatus according to claim 1, wherein the load distribution apparatus is selected from among them.
The load state information receiving unit
Receiving load status information indicating the load status of each of the plurality of server devices performing the repair process;
The selection unit includes:
Based on the security state of the terminal device investigated by the terminal investigation unit and the load state of each server device indicated in the load state information, a server device that performs repair processing of the terminal device is defined as the plurality of server devices. The load distribution apparatus according to claim 1, wherein the load distribution apparatus is selected from among them.
The selection unit includes:
The load distribution apparatus according to claim 1, wherein a server device that performs data processing for security management on the terminal device is selected from the plurality of server devices arranged at a plurality of bases.
The computer investigates the security status of the terminal device,
The computer receives load status information indicating a load status of each of the plurality of server devices;
The plurality of server devices for the computer to perform data processing for security management on the terminal device based on the security state of the terminal device investigated and the load state of each server device indicated in the load state information. Load distribution method to select from among the server devices.
On the computer,
Investigate the security status of the terminal device,
Receiving load status information indicating the load status of each of the plurality of server devices;
Based on the investigated security status of the terminal device and the load status of each server device indicated in the load status information, a server device that performs data processing for security management on the terminal device is assigned to the plurality of server devices. Program to choose from.