JP2009258852A - Information management system, information management method, and network device - Google Patents

Abstract

An information management system capable of preventing leakage of confidential information data when transmitting file and character string data via a network without installing special software on a client PC.
An integrated take-out control server includes a storage device that stores take-out policy information that defines a take-out policy of transmission information, and a policy distribution unit that distributes take-out policy information to a network device. When the take-out policy information is received, the policy receiving means for storing in the storage device, the take-out judging means for judging whether or not the transmission information from the client can be taken out based on the take-out policy information, and the take-out judging means At the time of determination, it has band control means for changing the communication speed, limits the transmission band by the band control means, and determines whether to take out transmission information by the take-out determination means.
[Selection] Figure 1

Description

  The present invention relates to an information leakage prevention technique capable of preventing leakage of confidential information data when transmitting file and character string data via a network.

In conventional information leakage countermeasure software, take-out control is performed by installing in advance software for take-out control in a client PC (Personal Computer) (see, for example, Patent Document 1).
JP 2004-227056 A

  In Patent Literature 1, there is a problem that data take-out control cannot be performed when information leakage countermeasure software is not installed in the client PC. In addition, even when a large amount of confidential information is transmitted, the electronic data has a problem that it is difficult to detect the removal of confidential information in real time and to suppress the removal because the transmission process is completed in a short time. In addition, there is a problem that it is not possible to carry out control for a compressed / encrypted file.

  The present invention is an invention for solving the above-mentioned problems, and is an information management system and information management capable of preventing leakage of confidential information data when transmitting file and character string data via a network It is an object to provide a method and a network device.

In order to achieve the object, a network device (for example, network device 106) that transmits transmission information transmitted from a client to an external network, and a management server (for example, integrated take-out control server 104) that manages the network device are provided. An information management system for managing transmission information to an external network,
The management server includes a first storage device (for example, the storage device 107B) for storing take-out policy information that defines a take-out policy for transmission information, and policy distribution means for distributing the take-out policy information to a network device (for example, a take-out policy) Distribution processing unit 343),
When the network device receives the take-out policy information from the management server, the network device stores the policy receiving means (for example, the take-out policy reception processing unit 344) for storing in the second storage device (for example, the storage device 107C) and the stored take-out policy information. Based on a take-out determination unit (for example, a take-out determination processing unit 371) that determines whether or not transmission information from the client may be taken out, and a bandwidth control unit that changes the communication speed when the take-out determination unit determines the transmission information. For example, the bandwidth control processing unit 383)
The band control means limits the transmission band, and the take-out determining means determines whether to take out transmission information while the band is limited.

  According to the present invention, it is possible to prevent leakage of confidential information data even when information leakage countermeasure software for carrying out take-out control is not installed in the client PC.

The best mode for carrying out the present invention will be described below in detail with reference to the drawings.
(First embodiment)
FIG. 1 is a diagram illustrating a configuration of a take-out control system according to the first embodiment. As shown in FIG. 1, the take-out control system (information management system) includes an integrated network management server 103, an integrated take-out control server 104, and network equipment connected to a LAN (Local Area Network) network 102 as an in-house network. 1 illustrates a configuration including a client PC 105 and a client PC 105. The network device 106 is connected to the Internet 101. The internal network of this embodiment is defined as a diagram in which there are two sub-networks (sub-network 1 and sub-network 2). However, there may be three or more sub-networks, or one case. But you can. In addition, the client PC 105 may be directly connected to the network 102 by wire or may be connected by a wireless LAN.

  The integrated network management server 103 (see FIG. 2), for example, collects the activation status and system information of the client PC 105 and the network device 106 existing on the management target network using a protocol such as SNMP (Simple Network Management Protocol). Management is performed.

  The integrated take-out control server 104 (see FIG. 3) has a function of storing take-out control policies in which confidential information is defined and distributing it to each network device 106, and plays a role of collecting logs from each network device 106.

  The network device 106 (see FIG. 4) performs a role of carrying out determination, security countermeasure processing, alarm processing, log processing (log collection processing, log transmission processing) and the like for communication information taken out from the in-house network by the client PC 105. Bear. Details of the integrated network management server 103, the integrated take-out control server 104, and the network device 106 will be described later.

  FIG. 2 is a diagram illustrating a hardware configuration and a functional block configuration of the integrated network management server. The hardware of the integrated network management server 103 includes a CPU (Central Processing Unit) 108A, a memory 109A, a storage device 107A such as a hard disk, and a communication interface 110A. The storage device 107A stores an IP address assignment table 241, a network configuration information table 251, and a network device information table 261, which are shown in detail in FIG. In FIG. 2, the storage device 107 </ b> A is illustrated as an external storage device, but is a part of the integrated network management server 103. The same applies to FIGS. 3 and 4.

  The CPU 108A reads various programs and data stored in the storage device 107A and realizes a predetermined function. The memory 109A is a work area used by the CPU 108A, and data and programs stored in the storage device 107A are secured. Data exchange between the CPU 108A, the memory 109A, and the storage device 107A is performed via a bus. The integrated network management server 103 is connected to the network 102 via the communication interface 110A. However, the integrated network management server 103 may be directly connected to the network 102 by wire or may be connected by a wireless LAN.

  The integrated network management server 103 manages the startup status and system information of the network devices 106 and client PCs 105 existing on the management target network, and stores these information in the network configuration information table 251 and the network device information table 261. To save. The IP address allocation table 241 may be manually set by a system administrator using an editor, or data automatically generated by a program may be used.

  FIG. 3 is a diagram illustrating a hardware configuration and a functional block configuration of the integrated take-out control server. The hardware of the integrated take-out control server 104 includes a CPU 108B, a memory 109B, a storage device 107B such as a hard disk, and a communication interface 110B. The CPU 108B, memory 109B, storage device 107B, and communication interface 110B have the same functions as the CPU 108A, memory 109A, storage device 107A, and communication interface 110A shown in FIG. The storage device 107B, which is the first storage device, includes a takeout policy table 201B (201) (see FIG. 5), a takeout file storage table 211B (211) (see FIG. 5), and a communication log storage table 221B. (221) (see FIG. 6) is stored.

  As a functional block configuration of the integrated take-out control server 104, a take-out file determination processing unit 311 that performs take-out determination of a file transmitted via the network 102 and an alarm transmitted from the network device 106 are received in the memory 109B. An alarm processing unit 321 (see FIG. 27), a log reception processing unit 332 that receives a log transmitted from the network device 106, and a take-out policy processing unit 341B that performs processing related to a take-out policy. The take-out policy processing unit 341B includes a file size policy generation processing unit 342 that generates a policy relating to the file size, and a take-out policy distribution processing unit 343 that is a policy distribution unit that distributes the generated policy.

  FIG. 4 is a diagram illustrating a hardware configuration and a functional block configuration of a network device. The hardware of the network device 106 includes a CPU 108C, a memory 109C, a storage device 107C such as a hard disk, and a communication interface 110C. The CPU 108C, the memory 109C, the storage device 107C, and the communication interface 110C have the same functions as the CPU 108A, the memory 109A, the storage device 107A, and the communication interface 110A illustrated in FIG. The storage device 107C, which is the second storage device, includes a takeout policy table 201C (201) (see FIG. 5), a takeout file storage table 211C (211) (see FIG. 5), and a communication log storage table 221C (221) (see FIG. 5). 6), and an IP address conversion table 231 (see FIG. 6) is stored.

  Further, the program configuration of the network device 106 includes a take-out determination processing unit 371C (371), which is a take-out determination unit that performs determination of take-out of data transmitted from the client PC 105 via the network, in the memory 109C. And a security measure processing unit 381C that performs security measures after determination, an alarm processing unit 391C (391) that transmits an alarm to the integrated take-out control server 104 (see FIG. 26), and a log process that performs processing related to a log that stores the result of take-out determination Unit 331C (331), a take-out policy processing unit 341C that processes a take-out control policy distributed from the integrated take-out control server 104, and an IP address conversion process that converts an IP address of a packet transmitted from the client PC 105 Part has a 401C (401).

  The take-out determination processing unit 371 includes an IP address determination processing unit 372 that performs take-out determination based on the IP address of the packet, a port number determination processing unit 373 that performs take-out determination based on the port number of the packet, and a keyword included in the packet A keyword determination processing unit 374C (374) that performs take-out determination based on the file size, and a file size determination processing unit 375C (375) that performs take-out determination based on the file size.

  The security countermeasure processing unit 381C is targeted when the carry-out determination processing unit 371C is unable to take out as a result of the bandwidth control processing unit 383, which is a bandwidth control unit for controlling the bandwidth of the network when taking out data. A port blocking processing unit 382 that blocks a communication port is included.

  The log processing unit 331C integrates the log collection processing unit 333C (333) that stores the result of the take-out determination in the communication log storage table 221 and the take-out file storage table 211, and the communication log storage table 221 and the take-out file storage table 211. A log transmission processing unit 334 </ b> C (334) that transmits the data to 104.

  The take-out policy processing unit 341C includes a take-out policy reception processing unit 344 that is a policy receiving unit that receives the take-out control policy distributed from the integrated take-out control server 104 and stores it in the storage device 107C.

  FIG. 5 is a diagram showing details of the take-out policy table and the take-out file storage table. The takeout policy table 201 and the takeout file storage table 211 are stored in the integrated takeout control server 104 and the network device 106.

  As shown in FIG. 5A, the takeout policy table 201 includes an item classification 202 used for takeout control determination, a check condition 203 used for takeout determination, the importance 204 of each check item, and takeout permission / prohibition. It is composed of entries such as a defined permission / prohibition policy 205 and a disclosure range 206 defining a keyword disclosure range. The classification 202 includes an IP address, a port number, a keyword, a size, and the like. When the classification 202 is an IP address, a port number, or a keyword, the system administrator edits it with an editor or the like. However, the integrated take-out control server 104 automatically generates and updates an entry whose classification 202 is a size. It has become. The disclosure range 206 is defined only when the classification 202 is a keyword by the system administrator. For example, when the classification 202 is “keyword” and the check condition 203 is “confidential”, the disclosure range 206 is defined as “internal”. Here, the classification 202 is “including at least one of an IP address, a port number, a keyword defined by the administrator, and a file size of the taken-out file”, and “the classification item identifies the level of importance of taking-out” It is registered in association with the importance level, identification information for permission or prohibition of taking-out, and the disclosure range of taking-out ”.

  As shown in FIG. 5B, the take-out file storage table 211 includes an entry ID 212, a file name 213 from which the take-out was performed, a file size 214 corresponding to the file name 213, a registration date and time 215 when the corresponding entry was registered, The keyword 216 included in the file, the highest importance 217 included in the file among the keywords defined in the take-out policy table 201, and the file 218 are included. These entries are automatically generated as a result of take-out determination in the network device 106 or the integrated take-out control server 104.

  FIG. 6 is a diagram showing details of the communication log storage table and the IP address conversion table. As shown in FIG. 6A, the communication log storage table 221 includes a date and time 222 when a log is saved, a transmission source IP address 223, a transmission destination IP address 224, a transmission source port of a packet that has been prohibited as a result of carry-out determination. It consists of a number 225, a transmission destination port number 226, and a take-out file ID 227. The take-out file ID 227 is stored in association with the ID 212 of the take-out file storage table 211 (see FIG. 5) when a file including a keyword defined in the take-out policy table 201 is determined.

  As shown in FIG. 6B, the IP address conversion table 231 includes a packet source IP address 232, a destination IP address 233, a source port number 234, a destination port number 235, and a converted source IP address 236. Protocol 237. The post-conversion source IP address 236 is used when the network device 106 converts the source IP address of the packet transmitted from the client PC 105 into the IP address of the network device 106. Details will be described with reference to FIG.

  FIG. 7 is a diagram showing details of the IP address assignment table, the network configuration information table, and the network device information table. As shown in FIG. 7A, the IP address assignment table 241 includes an organization name 242, an assigned IP address 243 assigned to the organization name 242, and a subnet mask 244.

  As shown in FIG. 7B, the network configuration information table 251 holds network configuration information such as an IP address 252, an interface number 253 corresponding to the network interface, a network 254 indicating a network name, and an upper segment 255. .

  As shown in FIG. 7C, the network device information table 261 holds an entry for each IP address 262, and the system information 263 of the network device 106 and client PC 105 to be managed, the type 264 of the network device, and the like. keeping. Each information in the network configuration information table 251 and the network device information table 261 is automatically collected and updated by the integrated network management server 103.

Next, the processing of each processing unit will be described in detail with reference to FIGS.
FIG. 8 is a diagram illustrating a processing flow of the take-out determination processing unit of the network device. The take-out determination processing unit 371C (371) executed in the network device 106 receives the packet (S501), acquires the source IP address and destination IP address of the packet, and the source IP address is the IP address of the internal network. It is then determined whether the destination IP address is an IP address of the external network (S502). When it is determined that the source IP address of the packet is the IP address of the internal network and the destination IP address is the IP address of the external network (S502, Yes), data is taken out from the internal network to the external network. It is determined that the IP address has occurred, and is compared with the entry of the IP address of the classification 202 in the take-out policy table 201 to determine whether the transmission destination IP address is permitted / prohibited (S503). Specifically, referring to the IP address record of the classification 202 of the take-out policy table 201 shown in FIG. 5, when the check condition 203 is “destination IP address is ABCD”, permission / prohibition If the policy 205 determines “prohibited” and the “destination IP address is VWXA to VWXZ”, it is determined “permitted”.

  As a result of the determination, if the carry-out is prohibited (S503, No), the port blocking processing unit 382 is called, and the communication prohibited to be taken out is blocked (S507). If the IP address is permitted (S503, Yes), it is checked against the entry of the port number of the classification 202 in the take-out policy table 201 to determine whether the destination port number is permitted / prohibited (S504). Specifically, referring to the port number of the classification 202 of the take-out policy table 201 shown in FIG. 5, when the check condition 203 is “80”, the permission / prohibition policy 205 determines “permitted” and “23”. In this case, it is determined as “prohibited”. In the case of a prohibited port number (S504, No), the port blocking processing unit 382 is called to block the corresponding communication (S507). If the destination port number is permitted in the take-out policy table 201 (S504, Yes), the IP address conversion processing unit 401 is called (S505).

  In S502, when it is not determined that the source IP address of the packet is the internal network and the destination IP address is the IP address of the external network (S502, No), IP address conversion processing 3 (see FIG. 11) is called (S506). ). The IP address conversion process (see FIG. 9), the IP address conversion process 2 (see FIG. 10) called in the IP address conversion process, and the IP address conversion process 3 (see FIG. 11) will be described next.

  FIG. 9 is a diagram illustrating a processing flow of the IP address conversion processing unit of the network device. The IP address conversion processing unit 401C (401) executed in the network device 106 acquires an entry having an IP address that matches the source IP address from the network device information table 261 held by the integrated network management server 103 (S511). . Next, it is determined whether or not the device type of the acquired entry matches “client” (S512). If it is “client” (S512, Yes), the IP address conversion process 2 is called (S513). The IP address conversion process 2 will be described in detail with reference to FIG. Here, the IP address conversion process 2 is configured to be executed in a separate thread so that subsequent processes can be executed simultaneously.

  After executing the IP address conversion processing 2, the inside of the packet is analyzed, and file data included in the packet is extracted according to a protocol such as HTTP (Hyper Text Transfer Protocol) or FTP (File Transfer Protocol) (S514).

  It is determined whether all the file data has been received (S515). If all the file data has been received (S515, Yes), the keyword determination process is called (S516). If all the file data has not been received (S515, No), the process ends. The keyword determination process will be described in detail with reference to FIG.

  After executing the keyword determination process, the IP address conversion process 2 (see FIG. 10) is notified of the signal that has been taken out (S517).

  If the device type corresponding to the source IP address of the received packet is not “client” in S512 (No in S512), the packet is transmitted to the destination IP address (S518).

  In this way, in the environment in which the network device 106 is connected in multiple stages by performing the carry-out determination only for communication with the packet source IP address “client”, the source IP address of the packet that is being taken out is determined. Is changed to the IP address of the network device 106, it is only necessary to determine whether the transmission source IP address is a communication of the client PC 105, and it is possible to suppress the determination of the plurality of network devices 106 to take out.

  FIG. 10 is a diagram showing a process flow of the IP address conversion process 2. In the IP address conversion process 2 of the IP address conversion processing unit 401, whether or not the transmission source IP address, transmission destination IP address, transmission source port number, and transmission destination port number of the received packet are registered in the IP address conversion table 231. Determine. That is, it is searched whether there is a match in the IP address conversion table 231 (S521). When there is no matching entry (S521, No), it is determined that the received packet is a communication start packet (SYN packet) transmitted from the client PC 105, and the transmission source IP address, transmission destination IP address, transmission source The port number and destination port number are registered in the IP address conversion table 231 (S522), and the process proceeds to S523. On the other hand, if there is a matching entry (S521, Yes), the process proceeds to S523.

  Next, the source IP address of the packet is changed to the IP address of the network device 106 (S523). Then, it is determined whether the size of the received packet is larger than the minimum packet size that can be sent to the network (S524). If the size of the received packet is larger than the minimum packet size that can be sent to the network (S524, Yes), it is determined whether a take-out controlled signal has been received (S525). When the take-out controlled signal has not been received (S525, No), the packet is divided into the minimum packet size that can be sent to the network (S526). Thereafter, the IP address conversion processing 2 performs packet transmission processing (S527, S528) until the size of the received packet matches the transmission size of the packet divided by the processing 526 with respect to the PC of the packet destination IP address. Do.

  In S524, when the size of the received packet is equal to or smaller than the minimum packet size of the network (S524, No), the packet is transmitted to the transmission destination IP address without performing the division process (S529). In S525, when a take-out controlled signal is received (S525, Yes), the process proceeds to S529.

  By dividing and transmitting the packet in this way, the communication speed between the network device 106 and the communication destination computer having the transmission destination IP address is reduced. Therefore, the time for carrying-out control processing in the network device 106 and the carry-out are detected. It can be expected to secure time for.

  FIG. 11 is a diagram showing a processing flow of IP address conversion processing 3 in the network device. When the IP address conversion process 3 of the IP address conversion processing unit 401 is executed, the source IP address is the IP address of the external network, so the source IP address, destination IP address, and source port of the received packet The number and the destination port number are extracted, and it is determined whether or not they are registered in the IP address conversion table 231 (S531).

  Here, specifically, the source IP address of the received packet matches the destination IP address 233 of the IP address conversion table 231, or the destination IP address of the received packet is after the conversion of the IP address conversion table 231. Or the source port number of the received packet matches the destination port number 235 of the IP address conversion table 231, or the destination port number of the received packet matches the IP address conversion table 231. It is determined whether or not the transmission source port number 234 matches. If there is an entry in which all items match (S531, Yes), the destination IP address of the packet is changed to the value of the source IP address in the IP address conversion table 231 (S532), and the packet is transmitted (S533). . When there is no matching entry (S531, No), the packet is transmitted to the transmission destination IP address (S534).

  FIG. 12 is a diagram illustrating a processing flow of the keyword determination processing unit of the network device. When the keyword determination processing unit 374 of the network device 106 is executed, the bandwidth control processing unit 383 is called (S541). The bandwidth control processing unit 383 will be described in detail with reference to FIG. After calling the bandwidth control processing unit 383, it is determined whether or not the keyword of the take-out policy table 201 is included in the file data (S542). When a plurality of keywords are included, the highest importance is determined (S543), and take-out control is performed according to the importance.

  In the present embodiment, referring to the take-out policy table 201, when the highest importance level is “high” (S543, high), port blocking processing call (S544), alarm transmission processing call (S545), log The collection process is called (S546). When the highest importance level is “medium” (S543, medium), an alarm transmission process is called (S545) and a log collection process is called (S546). When the highest importance is “low” (S543, low), a log collection process is called (S546). In FIG. 12, it is stipulated that the above measures are taken according to the importance, but the processing may be configured so that other measures are taken.

  When measures are taken according to the importance, the carry-out control has been completed, so it is necessary to cancel the bandwidth control of the corresponding communication, and the bandwidth control command is executed as the maximum value that can be set (S547). If the keyword in the take-out policy table is not included in S542 (S542, No), the file size determination processing unit 375 is called because there is a possibility of a compressed / encrypted file (S548).

  FIG. 13 is a diagram illustrating a processing flow of the bandwidth control processing unit. When the bandwidth control processing unit 383 is executed, the source IP address of the packet is acquired (S551), and the minimum bandwidth value that can be set by the bandwidth control command is acquired (S552). At this time, the currently set bandwidth value is acquired (S553), the minimum bandwidth value that can be set by the bandwidth control command is compared with the currently set bandwidth value, and the currently set bandwidth value is bandwidth controlled. It is determined whether it is larger than the minimum bandwidth value that can be set by the command (S554). If the currently set bandwidth value is larger than the minimum bandwidth value that can be set by the bandwidth control command (Yes in S554), the bandwidth for the transmission of the source IP address is set with the minimum bandwidth value that can be set as a parameter. A control command is executed (S555), the minimum bandwidth value that can be set is changed, and the process ends. If the current bandwidth value is smaller than the minimum bandwidth value that can be set with the bandwidth control command (S554, No), the processing is terminated without changing the bandwidth value.

  FIG. 14 is a diagram illustrating a processing flow of the file size determination processing unit. The file size determination processing unit 375 executed in the network device 106 determines whether or not the file size of the taken-out file matches the file size registered in the take-out policy table 201 (S561). If there is a matching record (S561, Yes), the file data is transmitted to the integrated takeout control server 104, and the takeout file determination processing unit 311 is executed (S562). In addition, when transmitting file data to the integrated take-out control server 104, an arbitrary protocol may be used. The determination result of the take-out file determination processing unit 311 is received from the integrated take-out control server 104 (S563), and if importance is set, measures are taken according to the importance.

  The file size determination processing unit 375 determines whether the importance is set in the determination result (S564), and when the importance is set (S564, Yes), determines the importance (S565). When the importance level is “high” (S565, high), the port blocking process is called (S566), the alarm transmission process is called (S567), and the log collection process is called (S568). When the highest importance is “medium” (S565, medium), an alarm transmission process is called (S567) and a log collection process is called (S568). When the highest importance is “low” (S565, low), the log collection processing is called (S568).

  In the present embodiment, it is stipulated that the above measures are taken according to the importance, but the processing may be configured so that measures other than the above are taken. If the file size that matches the take-out policy table is not registered in process S561 (S561, No), or if the determination result does not have an importance level (S564, No), it is determined that take-out is permitted. To finish the process.

  FIG. 15 is a diagram illustrating a processing flow of the take-out file determination processing unit. The take-out file determination processing unit 311 executed in the integrated take-out control server 104 determines whether or not the extension of the file received from the network device 106 is an extension of a compressed file or an encrypted file (S571). In the case of a compressed file or an encrypted file (S571, Yes), each compressed file and encrypted file are released (restored) (S572). It is determined whether or not the release is successful (S573). If the release is successful (S573, Yes), the binary compare between the file after the release and the file registered in the take-out file storage table 211 matches. Is determined (S574).

  If a matching file is registered as a result of the binary compare (S574, Yes), the highest importance level registered in the matching record in the taken-out file storage table 211 is returned to the network device 106 (S575), and the process is performed. Exit. If the binary compare does not match (S574, No), it is determined whether or not the keyword registered in the take-out policy table 201 is included (S576). When a keyword is included (S576, Yes), the highest importance is determined among one or a plurality of keywords (S577), and the highest importance is returned to the network device 106 (S575), and the process is terminated. To do. Note that “return” means transmitting the importance determination result to the network device 106.

  When it is not the extension of the compressed / encrypted file in the process S571 (S571, No), or when it is determined that the compression / encryption cannot be released normally in the process S573 (S573, No), it is registered in the take-out policy table 201 in the process S576. If the keyword is not included (S576, No), no importance is returned to the network device 106 (S578), and the process is terminated.

  FIG. 16 is a diagram illustrating a processing flow of the file size policy generation processing unit. The file size policy generation processing unit 342 executed in the integrated take-out control server 104 performs steps S582 to 585 for all entries registered in the take-out file storage table 211 (S581). That is, for all entries registered in the take-out file storage table 211, the take-out file is compressed / encrypted (S582), and the file size after compression / encryption is acquired (S583). It is determined whether there is a file size that matches the acquired file size in the take-out policy table 201 (S584). If the acquired file size is not registered in the take-out policy table 201 (No in S584), Registration is performed in the take-out policy table 201 (S585). If the acquired file size is registered in the take-out policy table 201 (S584, Yes), the process returns to step S582. Note that this processing may be configured to be executed periodically at regular time intervals, or may be configured to be executed at the time when an entry is registered in the take-out file storage table 211.

  FIG. 26 is a diagram illustrating a processing flow of the alarm processing unit in the network device. In the keyword determination processing unit 374 of the network device 106, the alarm processing unit 391 includes keywords whose importance 204 of the take-out policy table 201 is “medium” or higher even when the determination processing of all data of the taken-out file is not completed. If so, an alarm is transmitted to the integrated take-out control server (S651). In this embodiment, it is defined that an alarm is transmitted when a keyword having an importance level 204 of “medium” or higher is included. However, the importance level for transmitting an alarm can be changed by the system administrator. And

  After transmitting the alarm, when the determination result for the alarm is received from the integrated take-out control server (S652), the determination result is checked (S653). When the determination result is “prohibit to take out” (S653, prohibition to take out), the system administrator determines that the takeout is prohibited, calls the port blocking process (S654), executes the port blocking process, After the importance level is set to high (S655), a log collection process is called (S656), and the alarm process is terminated. If the determination result is “take-out permitted” (S 653, take-out permitted), a bandwidth control command is executed with the maximum settable bandwidth as a parameter (S 657), communication is permitted, and the alarm process is terminated. When the determination result is “timeout” (S653, timeout), the system administrator determines that the importance level could not be determined, sets the importance level of the determination result to “medium” (S658), and ends the alarm processing ( Continue the keyword determination process).

  FIG. 27 is a diagram illustrating a processing flow of the alarm processing unit in the integrated take-out control server. When the alarm processing unit 321 of the integrated take-out control server 104 receives an alarm from the network device (S661), it sets a timeout value (S662). After setting the timeout value, the keyword, file name, and importance included in the alarm are displayed as a dialog (S663).

  The system administrator determines from the file name, keyword, and importance level displayed in the dialog box whether to allow take-out, and presses the “prohibit take-out” and “permit take-out” buttons on the dialog. The alarm processing unit 321 determines whether or not a button on the dialog has been pressed (S664). If the button has been pressed, the type of the pressed button is determined (S665). When the “prohibit to take out” button is pressed (S665, the prohibition to take out button is pressed), “prohibit to take out” is transmitted to the network device 106 (S666), and the process ends. When the “take-out permission” button is pressed (S665, the take-out permission button is pressed), “take-out permission” is transmitted to the network device 106 (S667), and the process ends. If the button is not pressed (S664, no button is pressed), after the set timeout time has elapsed, “timeout” is transmitted to the network device 106 (S668), and the process is terminated.

  FIG. 17 is a conceptual diagram showing a state of data transmission / reception between the network device and the integrated take-out control server. The alarm processing unit 391 (see FIG. 26) executed in the network device 106 transmits an alarm 451 to the alarm processing unit 321 executed in the integrated take-out control server 104. The alarm may be, for example, an SNMP trap or a notification function used in various programs.

  Further, the log transmission processing unit 334 executed in the network device 106 transmits the communication log 431 to the log reception processing unit 332 executed in the integrated take-out control server 104. The communication log 431 indicates each entry stored in the communication log storage table 221.

  The take-out policy distribution processing unit 343 executed in the integrated take-out control server 104 transmits the take-out policy 441 to the take-out policy reception processing unit 344 executed in the network device 106. The take-out policy 441 indicates each entry registered in the take-out policy table 201. A method in which the integrated take-out control server 104 identifies the network device 106 to be distributed according to the take-out policy 441 will be described with reference to FIG.

  FIG. 18 is a diagram illustrating a processing flow of the take-out policy distribution processing unit. The takeout policy distribution processing unit 343 that identifies the network device 106 to which the integrated takeout control server 104 distributes the takeout policy 441 repeats the processing S592 to S598 for all entries in the takeout policy table 201 (S591). That is, the disclosure range is acquired from the entry of the keyword registered in the take-out policy table 201 (S592). The acquired disclosure range is compared with the IP address assignment table 241 stored in the integrated network management server 103, and an “assigned IP address” of a table whose disclosure range matches the organization name is acquired (S593).

  The take-out policy distribution processing unit 343 repeats the processes S595 to S598 for the network device information table 261 having the same network ID as the “assigned IP address” (S594). That is, an entry of the network device information table 261 having the same network ID as the “assigned IP address” is searched to obtain one table (S595). It is determined whether or not the device type matches “network device” (S596). If they match as a result of the determination (S596, Yes), an IP address is acquired from the entry that matches the network device (S597). A take-out policy 441 is transmitted to the network device 106 having the acquired IP address (S598). In processing S596, when it does not correspond (S596, No), it returns to processing S594.

  In this way, by determining the network device to which the take-out policy is distributed according to the keyword disclosure range, for example, a keyword that is not used in a certain business division A can be prevented from being checked in the business division A network. Thereby, the effect of raising the efficiency of take-out control can be expected.

  FIG. 19 is a diagram illustrating a processing flow of the log collection processing unit 333. The log collection processing unit 333 executed in the network device 106 acquires the date (S601), acquires the transmission source IP address and transmission destination IP address from the received packet (S602), the transmission source port number, the transmission destination port. A number is acquired (S603).

  It is determined whether the importance determined by the take-out determination processing unit 371 is high or medium (S604). If the importance is high or medium (S604, Yes), the file name, the file size, the matched keyword, The date and time and the file are saved in the take-out file storage table 211 (S605). The ID assigned when saved in the take-out file storage table 211 and the date / time, source IP address, destination IP address, source port number, destination port number are registered in the communication log storage table (S606), and processing Exit. If the importance is not high or medium in process S604 (S604, No), the process proceeds to process S606. In the present embodiment, it is defined that the take-out file is acquired only when the importance is high or medium, but it may be acquired with all the importance.

  When data including confidential information is transmitted via the network using the methods shown so far, even if no information leakage countermeasure software is installed in the client PC 105, control of taking out data including confidential information is performed. By securing the time for character string inspection processing when carrying out take-out control, it is possible to detect take-out of confidential information and to carry out carry-out control for compressed / encrypted files.

  Note that, in an environment in which the WWW (World Wide Web) is accessed through a proxy server, the keyword determination processing unit 374 and the file size determination processing unit 375 executed in the network device 106 are performed by the proxy server, thereby allowing the present invention. The take-out control at can be performed. This will be described with reference to FIGS.

(Second Embodiment)
FIG. 20 is a diagram illustrating a configuration of a take-out control system according to the second embodiment. In the second embodiment, the keyword determination processing unit 374 and the file size determination processing unit 375 performed in the network device 106 are performed by the take-out control server 111. The take-out control server 111 may be the proxy server or the integrated take-out control server 104.

  FIG. 21 is a diagram showing a hardware configuration and a functional block configuration of the integrated network management server in FIG. In the storage device 107A of the integrated network management server 103, a bandwidth control command file 271 storing a bandwidth control command of the network device 106 as a list, and a port cutoff command of the network device 106, which are enclosed by a square in the figure, are stored. A port blocking command file 281 saved as a list is saved. The functional blocks other than the bandwidth control command file 271 and the port blocking command file 281 have the same functions as those in FIG.

  FIG. 22 is a diagram illustrating a hardware configuration diagram and a functional block configuration of the take-out control server in FIG. The hardware of the take-out control server 111 includes a CPU 108D, a memory 109D, a storage device 107D such as a hard disk, and a communication interface 110D. The CPU 108D, the memory 109D, the storage device 107D, and the communication interface 110D have the same functions as the CPU 108A, the memory 109A, the storage device 107A, and the communication interface 110A illustrated in FIG.

  The storage device 107D stores a take-out policy table 201D (201) (see FIG. 5), a take-out file storage table 211D (211) (see FIG. 5), and a communication log storage table 221D (221) (see FIG. 6). Yes.

  As a functional block configuration of the take-out control server 111, a take-out determination processing unit 371D (371), a security countermeasure processing unit 381D, an alarm processing unit 391D (391), a log processing unit 331D (331), and a take-out policy process are stored in the memory 109D. Unit 341D and IP address conversion processing unit 401D. The take-out determination processing unit 371D includes a keyword determination processing unit 374D (374) and a file size determination processing unit 375D (375).

  The security countermeasure processing unit 381D includes a bandwidth control command transmission processing unit 384 (see FIG. 24) that transmits a bandwidth control command to the network device 106, and a port blocking command transmission that transmits a port blocking command to the network device 106. A processing unit 385 (see FIG. 25) is included.

  The bandwidth control processing unit 383 in FIG. 4 is changed to a bandwidth control command transmission processing unit 384, and the port blocking processing unit 382 is changed to a port blocking command transmission processing unit 385, whereby the take-out control server 111 in FIG. Bandwidth control and port blocking processing can be performed during processing by the keyword determination processing unit 374 and the file size determination processing unit 375.

  Note that the functional blocks of the bandwidth control command transmission processing unit 384 and the port blocking command transmission processing unit 385 have the same functions as the corresponding configurations in FIG.

  FIG. 23 is a diagram showing details of the bandwidth control command file and the port blocking command file. The bandwidth control command file 271 and the port blocking command file 281 are stored in the integrated network management server 103. As shown in FIG. 23 (a), the bandwidth control command file 271 includes a manufacturing vendor 272 of the network device 106 arranged in the network, a bandwidth control command 273 for each manufacturing vendor 272, and a minimum that can be set as a parameter in the bandwidth control command. A band value 274 and a settable maximum band value 275 are held. As shown in FIG. 23B, the port blocking command file 281 holds a manufacturing vendor 282 of the network device 106 arranged in the network and a port blocking command 283 corresponding to the manufacturing vendor.

  FIG. 24 is a diagram illustrating a processing flow of the bandwidth control command transmission processing unit. When the keyword determination processing unit 374 is executed in the take-out control server 111, the bandwidth control command transmission processing unit 384 acquires the transmission source IP address of the packet (S611). The processes S613 to S620 are repeated for the network device information table 261 having the same network ID as the source IP address of the acquired packet (S612). One table is acquired from the entry of the network device information table 261 having the same network ID as the source IP address of the acquired packet (S613). An entry whose device type is “network device” is searched (S614). If an entry with the device type “network device” is found (S614, Yes), the manufacturing vendor is extracted from the system information registered in the network device information table 261, and the bandwidth control command is stored in the bandwidth control command file 271. A search is performed (S615).

  When the corresponding bandwidth control command exists (S615, Yes), the minimum bandwidth value that can be set by the bandwidth limitation command is acquired (S616), and the IP address registered in the network device information table 261 is acquired (S617). ). Next, the current bandwidth value is acquired (S618), and the settable minimum bandwidth value 274 registered in the bandwidth control command file is compared with the current bandwidth value for determination (S619). If the current bandwidth value is larger than the settable minimum bandwidth value 274 (S619, Yes), the network having the acquired IP address for communication of the transmission source IP address using the settable minimum bandwidth value as a parameter A bandwidth control command is transmitted to the device 106 (S620). If the current bandwidth value is not larger than the settable minimum bandwidth value 274 (No in S619), the bandwidth control command is not transmitted and the process proceeds to the loop end. If the device type is not “network device” in process S614 (S614, No), or if there is no bandwidth control command for the specified network device in process S615 (S614, No), the process proceeds to the loop end.

  FIG. 25 is a diagram illustrating a processing flow of the port blocking command transmission processing unit. When the keyword determination processing unit 374 is executed in the take-out control server 111, the port blocking command transmission processing unit 385 acquires the transmission source IP address of the packet (S631). The processes S633 to S637 are repeated for the network device information table 261 having the same network ID as the source IP address of the acquired packet (S632). One table is acquired from the entries in the network device information table 261 having the same network ID as the source IP address of the acquired packet (S633), and an entry whose device type is “network device” is searched (S634). If an entry with the device type “network device” is found (S634, Yes), the IP address registered in the network device information table 261 is acquired (S635).

  Next, a manufacturing vendor is extracted from the system information registered in the network device information table 261, and a search is made as to whether there is a port blocking command corresponding to the port blocking command file 281 (S636). If there is a corresponding port blocking command (S636, Yes), the port blocking command is transmitted to the network device 106 having the acquired IP address (S637). If the device type is not “network device” in process S634 (S634, No), or if it is not a port blocking process command for the specified network device in process S636 (S636, No), the process proceeds to the loop end.

  According to the present invention, the take-out control of data including confidential information is performed, and the take-out of confidential information can be detected by securing the time for the character string inspection process when the take-out control is performed. In addition, it is possible to perform take-out control for a compressed / encrypted file. Furthermore, according to the present invention, when an attempt is made to take out electronic data including a large amount of confidential information via a network, the corresponding takeout operation can be detected.

  According to the present invention, data take-out control management including a client PC, a network device, an integrated network management server that collects information on devices scattered in the network, and an integrated take-out control server that controls take-out is performed. In the network device, the network device can check the confidential information of the data transmitted by the client PC, and can dynamically change the communication speed of the network when the confidential information is checked.

It is a figure which shows the structure of the take-out control system which is 1st Embodiment. It is a figure which shows the hardware constitutions and functional block constitution of an integrated network management server. It is a figure which shows the hardware constitutions and functional block constitution of an integrated take-out control server. It is a figure which shows the hardware constitutions and functional block constitution of a network apparatus. It is a figure which shows the detail of a take-out policy table and a take-out file storage table. It is a figure which shows the detail of a communication log storage table and an IP address conversion table. It is a figure which shows the detail of an IP address allocation table, a network configuration information table, and a network equipment information table. It is a figure which shows the processing flow of the taking-out determination process part of a network device. It is a figure which shows the processing flow of the IP address conversion process part of a network device. It is a figure which shows the processing flow of the IP address conversion process. It is a figure which shows the processing flow of the IP address conversion process 3 in a network device. It is a figure which shows the processing flow of the keyword determination process part of a network device. It is a figure which shows the processing flow of a band control process part. It is a figure which shows the processing flow of a file size determination process part. It is a figure which shows the processing flow of a taking-out file determination process part. It is a figure which shows the processing flow of a file size policy production | generation process part. It is a conceptual diagram which shows the mode of data transmission / reception with a network apparatus and an integrated take-out control server. It is a figure which shows the processing flow of a taking-out policy distribution process part. It is a figure which shows the processing flow of the log collection process part. It is a figure which shows the structure of the take-out control system which is 2nd Embodiment. It is a figure which shows the hardware constitutions and functional block constitution of the integrated network management server in FIG. It is a figure which shows the hardware constitutions and functional block constitution of the taking-out control server in FIG. It is a figure which shows the detail of a bandwidth control command file and a port cutoff command file. It is a figure which shows the processing flow of a band control command transmission process part. It is a figure which shows the processing flow of a port cutoff command transmission process part. It is a figure which shows the processing flow of the alarm process part in a network device. It is a figure which shows the processing flow of the alarm process part in an integrated take-out control server.

Explanation of symbols

1, 2 Sub-network 101 Internet 102 Network 103 Integrated network management server 104 Integrated take-out control server (management server)
105 Client PC
106 Network equipment (network equipment)
107A storage device 107B storage device (first storage device)
107C storage device (second storage device)
108A, 108B, 108C CPU
109A, 109B, 109C Memory 110A, 110B, 110C Communication interface 201 Takeout policy table (takeout policy information)
211 Take-out file storage table (take-out file storage information)
221 Communication log storage table (communication log storage information)
231 IP address conversion table 241 IP address allocation table 251 network configuration information table 261 network device information table 311 take-out file determination processing unit (take-out file determination means)
321 Alarm reception processing unit 331 Log processing unit 332 Log reception processing unit (log receiving means)
333 Log collection processing unit (log collection means)
334 Log transmission processing unit (log transmission means)
341B, 341C Take-out policy processing unit 342 File size policy generation processing unit (file size policy generation means)
343 Take-out policy distribution processing section (policy distribution means)
344 Take-out policy reception processing unit (policy reception means)
371 Take-out determination processing unit (take-out determination means)
381 Security countermeasure processing unit 383 Band control processing unit (band control means)
401 IP address conversion processing unit

Claims (10)

A network device that transmits transmission information transmitted from a client to an external network, and a management server that manages the network device, and an information management system that manages taking out of the transmission information to an external network,
The management server
A first storage device for storing take-out policy information defining a take-out policy of the transmission information;
Policy distribution means for distributing the take-out policy information to the network device;
The network device is:
When the take-out policy information is received from the management server, policy receiving means for storing in the second storage device;
Based on the stored take-out policy information, take-out determination means for determining whether or not the transmission information from the client may be taken out;
A band control means for changing the communication speed when making a determination by the take-out determination means,
An information management system characterized by limiting a transmission band by the band control unit and determining whether the transmission information is taken out by the take-out determination unit while the band is limited. The take-out policy information is
It includes information on classification items including at least one of IP address, port number, keyword defined by the administrator, and file size of the take-out file,
2. The information management according to claim 1, wherein the classification item is registered in association with an importance level that identifies a level of importance of take-out, identification information for permission or prohibition of take-out, and a disclosure range of take-out. system. The network device is:
3. The take-out determining means blocks the port of the network device according to the importance level or sends an alarm for taking out a warning to the management server. Information management system. The management server further includes:
Upon receiving the transmission information compressed / encrypted from the network device, create a file by releasing the compression / encryption of the transmission information, and based on the take-out policy information stored in the first storage device, A take-out file determination means for determining the importance level of the file and notifying the determined importance level to the network device;
The network device is:
When the transmission information is compressed / encrypted transmission information by the take-out determination unit, the transmission information is transmitted to the management server, and the network is determined according to the decision importance level notified from the management server. The information management system according to claim 2, wherein a device port is shut off, or an alarm for taking out a warning is transmitted to the management server. The management server
Storing IP address allocation information in which the organization name and the allocated IP address are associated with each other in the first storage device;
The policy distribution means includes:
Obtain the disclosure range from the policy information taken out,
From the IP address assignment information, obtain the IP address information of the policy distribution target whose disclosure name matches the organization name,
The information management system according to claim 2, wherein take-out policy information corresponding to the disclosure range is distributed to a network device corresponding to the policy distribution target IP address. The network device includes a log collection unit and a log transmission unit,
When the take-out determination unit determines whether to take out the transmission information,
The log collection means is connected to the second storage device.
The transmission date and time, the transmission source IP address, the transmission destination IP address, the transmission source port number, the transmission destination port number, and the take-out file ID are associated and registered as communication log storage information.
The take-out file ID, file name, file size, keyword, and importance level are associated and registered as take-out file storage information,
The log transmission means transmits the communication log storage information and the take-out file storage information to the management server,
2. The information management according to claim 1, wherein the management server has a log receiving unit that stores the received communication log storage information and the taken-out file storage information in the first storage device when the received management log storage information is received. system. The management server
Based on the take-out file storage information stored in the first storage device,
The information management system according to claim 6, further comprising a file size policy generation unit that extracts the file size and registers the file size in take-out policy information. In a system having a network device that transmits transmission information transmitted from a client to an external network, and a management server that manages the network device, an information management method for managing carry-out of the transmission information to an external network,
The management server
The first storage device stores take-out policy information defining a take-out policy of the transmission information,
Policy distribution means distributes the take-out policy information to the network device,
The network device is:
When the policy receiving means receives the take-out policy information from the management server, the policy receiving means stores it in the second storage device,
The take-out determining means determines whether or not the transmission information from the client may be taken out based on the stored take-out policy information,
The bandwidth control means changes the communication speed when determining by the take-out determination means,
An information management method comprising: limiting a transmission band by the band control unit; and determining taking out of the transmission information by the takeout determination unit while the band is limited. In a system for managing a take-out policy information in which a management server defines a take-out policy of transmission information and managing a network device that transmits the transmission information transmitted from a client to an external network,
A network device for controlling the sending of the transmission information to an external network,
When the take-out policy information is received from the management server, policy receiving means for storing in the storage device;
Take-out determination means for determining whether or not transmission information from the client may be taken out based on take-out policy information stored in the storage device;
A band control means for changing the communication speed when making a determination by the take-out determination means,
While limiting the transmission band by the band control means,
Determining whether the transmission information is taken out by the take-out determining means while the bandwidth is limited;
According to the importance level included in the take-out policy information by the take-out determination means, the port of the network device is blocked, or an alarm for warning the take-out is transmitted to the management server. Network device. The take-out policy information is
It includes information on classification items including at least one of IP address, port number, keyword defined by the administrator, and file size of the take-out file,
The network device according to claim 9, wherein the classification item is registered in association with an importance level for identifying the level of importance of take-out, identification information for permission or prohibition of take-out, and a disclosure range of take-out. .

Images