JP2002366525A - Security policy maintenance system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To newly develop a system for maintaining the security policy of a network. SOLUTION: When a client 6 logs in a network, resource information of the client is acquired by a security agent client 7, transmitted to a security agent server 5, an information data base 2 intrinsic to the client is compared with a security policy data base 3 in a security policy server 1 and permission or nonpermission of network log in by the client 6 is determined. In addition, the security agent client 7 always monitors an operating state of the client 6, transmits it to the security agent server 5 and when breach of the security policy is caused, disconnects network connection by the client 6.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network security level management control device and an application according to a client security level participating in a network when using a computer network, and a medium for recording the same.

[0002]

2. Description of the Related Art Conventionally, when constructing and operating a computer network, an operation manual or the like is created in advance, and items for maintaining security are set in the manual.
The moral of users was improved and the security level was maintained.

[0003] In addition, the network participants are distinguished by checking only the network login ID and password to permit participation, so that even a private personal computer or a client who does not maintain the determined security level,
Easy to join the network.

[0004] In addition, when a large number of clients with a low security level that the network administrator does not know participate in the network, the security level of the network is reduced, and serious problems such as virus infection and information leakage occur. was there.

[0005]

SUMMARY OF THE INVENTION In order to solve the above-mentioned problems, the present invention makes it possible to refuse and restrict participation in a network based on security level information of a client and the obtained security level. And is characterized by the following apparatus and method.

It is an object of the present invention to provide a management method for restricting a client who does not reach a security level standard set by a network administrator from participating in a network.

[0007]

Means for Solving the Problems A security check agent is made resident in a server and a client, the client is turned on, and the security agent is activated from the time of activation. The security agent is configured by the network administrator on the client,
Obtain the operating status and version information of applications that need to operate normally at all times. Further, it acquires other running application information and transmits the acquired information to the server together with the login processing.

[0008] The server side compares the transmitted client security information and the unique data such as the MAC address of the client, the size of the CPU and the HDD with the contents of the security policy setting database, and determines whether or not to participate in the network.

If network participation is permitted, network resources can be used, but if not, network login is rejected.

[0010] Further, when a client in which the security agent is not operating performs login processing to the network server, the network agent login processing is forcibly interrupted by the security agent resident on the server side. Refuse to participate.

[0011]

BEST MODE FOR CARRYING OUT THE INVENTION A network user activates six clients managed by himself, inputs an ID and a password after the activation, and logs in to the network.

If the client is an authorized client, the security agent client obtains the software operation status of 8 and the hardware resource information of 9, and together with the log-in processing, the security agent client of FIG. The security agent server is sent to the server, and the security agent server determines whether login is possible based on the client unique information database and the security policy database information on the security policy server.

If the security level has reached the standard, the security agent server 5 permits the security agent client 7 to log in.

However, when the security level is equal to or lower than the standard, the security agent server of No. 5 rejects the login to the security agent client of No. 7 and transmits the reason for rejecting the login to the security agent client of No. 7. The security agent client of No. 7 displays the received rejection reason. The user responds according to the instruction and performs the login process again.

If the client is not a personally authorized client, the security agent client 7 is not running, or even if it is running, the client-specific information such as the MAC address and CPU and HDD size is 2 Since there is no registration in the client specific information database, the security agent server 5 rejects participation in the network.

The security agent client 7 detects a change in the software or hardware resources of the client 6 while connected to the network, and notifies the security agent server 5 of the change. The contents are compared with the security policy database. If there is a violation of the security policy, the client 6 is forcibly disconnected from the network.

The security agent server (5) constantly monitors the operation of the security agent client (7), and when the signal from the security agent client (7) is interrupted, determines that an abnormality has occurred in the security level of the client (6). And forcibly disconnect from the network.

[0018]

By using the security policy maintenance system of the present invention, it is possible to prevent the connection of the client violating the security policy and maintain the security level of the network. In addition, by recording and managing the resource status of each client in the database, even if the MO or RAS environment is maliciously added, it will be automatically disconnected from the network, so leakage of confidential information and personal information and virus Intrusion can be prevented.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a flow of a basic process of the present invention.

[Explanation of symbols]

 1-Security Policy Server 2-Client Specific Information Database 3-Security Policy Database 4-Server 5-Security Agent Server 6-Client 7-Security Agent Client 8-Software 9-Hardware

[Procedure amendment]

[Submission date] July 23, 2001 (2001.7.2)
3)

[Procedure amendment 1]

[Document name to be amended] Statement

[Correction target item name] Claim 2

[Correction method] Change

[Correction contents]

[Procedure amendment 2]

[Document name to be amended] Statement

[Correction target item name] Technical field to which the invention belongs

[Correction method] Change

[Correction contents]

The present invention relates is, by the client security level to participate in the network in the use of the computer network, the network participation
The present invention relates to a device or application to be restricted and a medium for recording the device or application.

Claims (3)

[Claims] 1. A means for permitting and denying a client from participating in a network from a server according to a security level of a client participating in a network, and a means for confirming a security level between a client and a server by acquiring the security level information. And a security policy maintenance / management device and application, and a medium for recording the same. 2. A client joins the network,
A means for monitoring client security level information while processing continues, and restricting the use of network resources when the security level falls below the network participation level or when security level information cannot be obtained. Characterized by having
Email management devices and applications and media for recording them 3. A security policy maintenance / management apparatus and application, and a medium for recording the same, comprising means for judging an authorized client and an unauthorized client permitted by a network administrator.