JP3852276B2 - Network connection control method and apparatus - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network connection control method and apparatus, and more particularly to a network connection control method and apparatus for determining whether or not access to a network is included including elements other than user authentication.
[0002]
[Prior art]
Resources such as information industry equipment and various types of information are managed according to a common purpose (for example, business), and a management entity exists for each purpose. Resources managed by a single management entity are connected to a single network. This grouped (closed) network will be referred to as an intranet hereinafter. Although there are a plurality of such intranets, they are often connected to each other in order to use mutual (or only one-way) resources. In order to distinguish a network in which a plurality of intranets are connected from the intranet, the network is hereinafter referred to as outside the intranet.
[0003]
Generally, when accessing a resource (hereinafter referred to as an access destination server) in an intranet from a terminal outside the intranet (hereinafter referred to as an access source client), a firewall (hereinafter abbreviated as F / W) or a remote access server (hereinafter referred to as an access destination server). Via RAS).
[0004]
In the access via the F / W, since the F / W is implemented by the packet filtering method or the application gateway method, access denial determination from outside the intranet to the inside is determined for each service. When access is permitted, there is no distinction between outside and inside the intranet.
[0005]
On the other hand, in access via RAS, user authentication is performed in RAS, and only authorized users are connected. After connection, the access source client is treated as one terminal in the intranet.
[0006]
For both access via F / W and access via RAS, once access within the intranet is permitted from outside the intranet, the access source client should use the same usage as in the intranet. Can do. While this is convenient for the user, there are many problems in terms of safety. For example, when user authentication is impersonated, resources in the intranet are freely accessed.
[0007]
Further, even if the user is a legitimate good-will person, it is dangerous to take a document in the intranet (internal) outside the intranet (external). For example, if the administrator accesses from a terminal outside the intranet that is the same as in the intranet, that is, if the access is only from a specific terminal outside the intranet, the risk is low. For example, the administrator is different from the administrator in the intranet (For example, in other intranets) or when a user accesses from an unspecified number of terminals (Internet cafes, etc.), files obtained from the intranet can remain on the terminal (for example, remain recorded on a disk, etc.) There is sex.
[0008]
Further, once a user has been authenticated, it can be accessed even if the user is not the authenticator. As described above, even if the user is an authorized user, the way of use must be distinguished between the intranet and outside the intranet, but such a management method is not currently taken.
[0009]
Therefore, in order to keep these safetys, the F / W currently prohibits access to services other than the mail service (using SMTP as a protocol) in principle. In other words, safety is given priority and convenience is sacrificed. In addition, there are cases where access to the intranet is performed using RAS, focusing on the use of a telephone line that is less likely to be wiretapped compared to the Internet. It is dangerous and increases convenience at the expense of safety. In addition, in RAS, the accessible location is limited to the degree of sacrificing safety, so convenience does not increase so much.
[0010]
In addition, recent advances in cryptography have made it possible to improve the secrecy of transmission paths over the Internet. Along with this, it is considered that access via F / W, which has been prohibited from external access, is permitted for access from a specific user. For example, as disclosed in Japanese Patent Application Laid-Open No. 11-338799, there is a method of performing user authentication in F / W and determining resource access permission. However, it is access control based on user authentication to the last, and cannot solve the problems described above. This is the same even if CA or solid authentication is performed.
[0011]
By the way, the conventional intranet system is composed of various existing application services, which are made on the assumption that they are used from within the intranet. Therefore, it is necessary and sufficient if such access restrictions are made for the user. However, with the recent development and spread of Internet and mobile devices, there is an increasing demand to access resources in the intranet from any location. However, as described above, there is a trade-off relationship in which convenience decreases when safety is emphasized, and safety decreases when convenience is increased as described above. Therefore, there is a demand for improving convenience while maintaining safety.
[0012]
[Problems to be solved by the invention]
As described above, the demand for connection from the outside to the intranet is increasing against the background of the recent development of network environments. However, the conventional connection control mainly using user authentication cannot prevent impersonation and the like, and it is difficult to permit connection from the outside while maintaining safety.
[0013]
SUMMARY OF THE INVENTION An object of the present invention is to provide a network connection control method and apparatus that can maintain network security and relax access restrictions from outside.
[0014]
[Means for Solving the Problems]
In order to achieve the above object, the invention of claim 1 is a network connection control method for controlling connection to a network in which resources are managed by a management entity, and after authenticating a user, from the attribute information of the access source Based on a comparison result between the obtained reliability and the confidentiality obtained from the attribute information of the access destination, whether or not the access destination can be accessed is determined and controlled based on different criteria for each user.
[0015]
According to a fifteenth aspect of the present invention, in the network connection control method for controlling connection to a network in which resources are managed by a management entity, after authenticating the user, the reliability and access obtained from the attribute information of the access source Based on the result of comparison with the confidentiality obtained from the previous attribute information, whether to access the access destination is determined and controlled based on different criteria for each user.
[0044]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of a network connection control method and apparatus according to the present invention will be described in detail with reference to the accompanying drawings.
[0045]
FIG. 1 is a block diagram showing a schematic configuration of a router device to which the present invention is applied. In the figure, the components that the router device for performing routing and the like originally have are omitted, and only the components required to apply the present invention are shown.
[0046]
As shown in the figure, the router device 10 includes an access request monitoring unit 1, an access source analysis unit 2, an access destination analysis unit 3, and an access filter unit 4, and is configured as an external network such as the Internet or another intranet. 20 and an internal network (intranet) 30 are connected.
[0047]
The access request monitoring unit 1 monitors an access request message from an access source client on the external network 20 side, extracts information (hereinafter referred to as access source information) for specifying the access source from the access request message, Information output to the analysis unit 2 and information for identifying the access destination (inside the internal network 30) server, server resources, and access type to the server resources from the access request message (hereinafter referred to as access destination information) Is extracted and output to the access destination analysis unit 3.
[0048]
The access source analysis unit 2 obtains the current reliability of the access source client (hereinafter referred to as access source reliability) based on the access source information and outputs it to the access filter unit 4.
[0049]
Based on the access destination information, the access destination analysis unit 3 obtains the confidentiality of the access destination server or the resources in the server (hereinafter referred to as “access destination confidentiality”) and outputs it to the access filter unit 4.
[0050]
The access filter unit 4 determines whether or not the access request message can be passed based on the access source reliability and the access destination device density. When permitting the access request message to pass, the access filter unit 4 sends the access request message to the access destination server (internal When it is transferred to the network 30) and the access request message is rejected, the access request message is discarded.
[0051]
Further, here, the access request monitoring unit 1, the access source analysis unit 2, the access destination analysis unit 3, and the access filter unit 4 are arranged in the router device 10, that is, as shown in FIG. As described above, a configuration in which each unit is arranged in the firewall 40 as shown in FIG. 2B, and a configuration in which each unit is arranged in the proxy server as shown in FIG. 2C are also possible.
[0052]
Further, the access request monitoring unit 1, the access source analyzing unit 2, the access destination analyzing unit 3, and the access filter unit 4 are arranged in the RAS 60 shown in FIG. 2D, and the internal network 30 via the public telephone network 70 is arranged. It can also support remote access to.
[0053]
In any case, since the present invention performs access control when a client (terminal) outside the internal network 30 accesses resources in the internal network 30, there is no account for accessing the internal network 30. If there is no access right to the resource, the access is of course denied. However, since the operation is the same as before, the description is omitted here.
[0054]
Further, it is desirable that the path from the client to the connection point of the internal network 30 is encrypted, and the encryption method at that time may be a conventional technique such as SSL. Therefore, the description here is after user authentication and after the path from the client to the connection point is established.
[0055]
Here, the operation of access control will be described with reference to FIGS.
3 and 4 are diagrams illustrating the flow of information between the respective units.
[0056]
First, when there is an access request 101 from the access source client 21 of the external network 20 to the internal network 30, the access request monitoring unit 1 extracts the access source information from the access request 101 (packet thereof) and accesses the access source analysis unit 2 The access destination information is extracted and output to the access destination analyzing unit 3.
[0057]
Specific examples of access source information include the value of the source address field (hereinafter referred to as source address) in the packet header of the network layer in the packet, the CPU serial number of the access source terminal, the user There is a signature with the secret key of The signature based on the CPU serial number or the user's private key may be obtained by incorporating it into a mechanism (challenge and response) for exchanging the user name and password during user authentication.
[0058]
As a specific example of the access destination information, first, as information specifying the access destination server, the value of the destination address field in the packet header of the network layer in the packet (hereinafter referred to as the destination address). And so on).
[0059]
In addition, information specifying the resource and access type in the access destination server is obtained from the application layer message in the routed packet, but the message and the field in the message including these information are the application layer message. Different for each protocol.
[0060]
Specific application layer protocols include the following, but in each case, information specifying the access type includes a command message defined in each protocol, and many of them are argument fields. Specify the resource of the access destination.
[0061]
Pop (RFC-1081 Post Office Protocol-Version 3, 1988)
・ Ftp
・ Telnet
・ Http
[0062]
Here, as an example, a part of a command message specified by pop is shown.
USER command (designating mail / spool as an access destination resource by notifying the authentication user name)
LIST command (requests a list of new mail)
・ RETR N (Requests the acquisition of the Nth mail)
-DELE N (requests deletion of Nth mail)
[0063]
The access source analysis unit 2 obtains the current reliability of the access source client 21 based on the access source information 103.
[0064]
The reliability is based on the access source information 103 (in this example, the source address, CPU serial number, user signature information, etc.) and a list of access source reliability corresponding to each (registered in advance). Ask.
[0065]
The reliability is, for example, 2 when the access source client 21 indicated by the access source information 103 such as the source address is appropriate as the access source, 0 when it is inappropriate, and not registered in the list. The value of is 1. However, when the access source information 103 is the signature information of the user, the signature is verified based on the registered public key information. If the access source information 103 is correct, the signature is 2; 1 if not. Note that the reliability value is not limited to three levels of 0, 1, and 2, and may be classified into more levels.
[0066]
Subsequently, when the access source analysis unit 103 obtains the corresponding reliability value from the list, the access source analysis unit 103 outputs the lowest value of the obtained one or more reliability levels as the access source reliability level 105 to the access filter unit 4. To do.
[0067]
The access destination analysis unit 3 obtains the confidentiality of the access destination from the access destination information 104, and the confidentiality is the access destination information (in this example, the destination address) and the resource name, URL, or folder name. Or a file name and a list of access destination density corresponding to each file (which is registered in advance).
[0068]
For example, the confidentiality is 3 when no access request message from outside is allowed, 2 when the access request message is allowed only when the access source is appropriate, and the access source is unknown However, when the access request message from the outside is allowed, 1 is set when the access source is inappropriate even when the access source is inappropriate, and the access destination information is not registered in the list. The value of is 2. The confidentiality value is not limited to four levels of 0, 1, 2, and 3, and may be classified into more levels.
[0069]
When the access destination information 104 is output from the access request monitoring unit 1, the access destination analysis unit 3 obtains a corresponding confidentiality value from the list and outputs it as an access destination confidentiality 106 to the access filter unit 4. .
[0070]
The access filter unit 4 determines whether or not the access request 102 output from the access request monitoring unit 1 can pass based on the access source reliability 105 and the access destination density 106.
[0071]
For this determination, for example, the access filter unit 4 compares the value of the access source reliability 105 with the value of the access destination device density 106, and the value of the access source reliability 105 is equal to or greater than the value of the access destination device density 106. The access request 102 is permitted to pass (passed as the access request 107 in the figure), and the access request reliability 105 is less than the access destination device density 106, the corresponding access request. 102 is rejected.
[0072]
Further, when the value of the access source reliability 105 is the same as the value of the access destination density 106, the access request 102 is allowed to pass only in the case of a read command, and the value of the access source reliability 105 is When the value is higher than the value of the destination device density 106, the access request 102 is allowed to pass even for the write command and the execution command, and the value of the access source reliability 105 is higher than the value of the access destination device density 106. If it is lower, the passage of the corresponding access request 102 is rejected.
[0073]
Then, the access request 107 that has passed through the access filter unit 4 is accepted by the access destination server 31, and an access response 108 is returned to the access source client 21.
[0074]
By the way, the access filter 107 determines whether or not the access request 102 can be passed from the access source reliability 105 and the access destination device density 106. However, the determination result is not always the same. For example, since user authentication is performed before determining whether or not the access request 102 can pass as described above, it is possible to determine whether or not the access request 102 can pass based on different criteria for each user. .
[0075]
This is because even if the access source client 21 is the same, the user's safety awareness and knowledge are different from each other, and as a result, the access source reliability 105 and the access destination density 106 are the same. Even so, a difference occurs for each user, such as the determination result shown in FIG. 5A and the determination result shown in FIG.
[0076]
Finally, the operation of each unit described above will be described as a processing flow.
FIG. 6 is a flowchart showing the flow of access control processing.
[0077]
First, when there is an access request 101, a user authentication unit (not shown) acquires user information (step 202), and performs user authentication based on the acquired user information (step 203).
[0078]
As a result, if the user is authenticated (YES in step 203), the access request monitoring unit 1 acquires the access source information 103 and the access destination information 104 from the access request 101 (step 204).
[0079]
Subsequently, the access source analyzer 2 calculates the access source reliability 105 based on the access source information 103, and the access destination analyzer 3 calculates the access destination density 106 based on the access destination information 104 (step 205). ).
[0080]
Then, if the access filter unit 4 determines whether or not the access request 102 is allowed to pass based on the access source reliability 105 and the access destination density 106, and determines that the access should be permitted (YES in step 206), the access request 102 is passed as the access request 107 (step 207), and if it is determined that the passage is not permitted (NO in step 206), the access request 102 is discarded without passing (step 208).
[0081]
As a matter of course, when the user is not authenticated by the user authentication in step 203 (NO in step 203), the access request 101 is discarded (step 208).
By such processing, convenience can be improved while maintaining safety. For example, at present, the number of accessible terminals is zero if safety is maintained (emphasized). However, about 35% of the documents are leaked outside the intranet and cause problems. Therefore, the current situation is that even the remaining 65% of the documents cannot be accessed in order to keep the safety of 35% of the whole. However, by implementing the present invention, 65% of documents can be accessed from any terminal. At the same time, 35% of highly confidential documents will not be placed outside the intranet unless security is guaranteed. In this way, the present invention can achieve both safety and convenience that have been in a trade-off relationship in the past, and the range of safe access such as access from public facilities such as Internet cafes and other intranets is greatly increased. To increase.
[0082]
【The invention's effect】
As described above, according to the present invention, since it is configured to determine whether access is possible based on the reliability of the access source client and the sensitivity of the access destination resource, it is convenient while maintaining safety. Was able to improve.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a schematic configuration of a router device to which the present invention is applied.
FIG. 2 is a diagram showing an application example of the present invention.
FIG. 3 is a diagram (1) illustrating a flow of information between each unit.
FIG. 4 is a diagram (1) illustrating a flow of information between each unit.
FIG. 5 is a diagram illustrating an example of a determination result of whether access is possible.
FIG. 6 is a flowchart showing a flow of access control processing.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Access request monitoring part 2 Access source analysis part 3 Access destination analysis part 4 Access filter part 10 Router apparatus 20 External network 30 Internal network 40 Firewall 50 Proxy server 60 RAS
70 public telephone network 101 access request 102 access request 103 access source information 104 access destination information 105 access source reliability 106 access destination density 107 access request 108 access response

Claims (2)

In a network connection control method for controlling connection to a network in which resources are managed by an administrative entity,
After authenticating the user, whether or not the access destination can be accessed on a different basis for each user based on the comparison result between the reliability obtained from the access source attribute information and the confidentiality obtained from the access destination attribute information A network connection control method characterized by determining and controlling the network connection. In a network connection control device that controls connection to a network in which resources are managed by a management entity,
User authentication means for authenticating a user in response to an access request;
Access request monitoring means for extracting access source information and access destination information from the access request;
Access source analysis means for obtaining the reliability of the access source from the access source information extracted by the access request monitoring means;
Access destination analyzing means for obtaining the confidentiality of the access destination from the access destination information extracted by the access request monitoring means;
By comparing the reliability obtained by the access source analysis unit with the confidentiality obtained by the access destination analysis unit, reading, writing, and execution of the access destination are performed according to different criteria for each user who issued the access request. And an access filter means for changing each access right.

Images