JP2008083886A - Confidential information leakage prevention method and system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problems of information leakage risk, convenience and cost while enabling external access to an in-house server having confidential information via an external network. <P>SOLUTION: A confidential information leakage prevention method comprises a first step of an environment checking means implemented in a client computer checking whether or not a writing means for a secondary storage device of the client computer and an external storage medium is enabled to write, and reporting the check result to a connection management apparatus for controlling connection to the server, and a second step of the connection management apparatus determining whether or not the writing means for the secondary storage device of the client computer and the external storage medium is disabled from writing according to the check result received from the environment checking means of the client computer, and permitting a connection to the server only if the writing means for the secondary storage device and external storage medium is disabled from writing. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a secret information leakage prevention method and system using a write control technique for a secondary storage device, a VPN technique, and a quarantine network technique.

Conventional technologies that can be used for information leakage include HDD encryption technology, external medium prevention technology, thin client technology, and virtualization technology as technologies for theft and loss of client PCs. Further, there are VPN and quarantine network technologies as technologies for eavesdropping and unauthorized connection on the network (Non-Patent Document 1).
The conventional information leakage prevention method is basically a combination of the technology for theft and loss of the client PC and the technology for eavesdropping and unauthorized connection on the network. (1) The HDD encryption technology and the external medium prevention technology There are a method used (Patent Document 1), (2) a method using a thin client technique (Non-Patent Document 2), and (3) a method using a virtualization technique (Non-Patent Document 3).

The method (1) will be briefly described as follows.
By interrupting the file IO processing of the OS of the client PC and automatically performing encryption / decryption processing, the HDD is encrypted or access to an external medium is prohibited. Furthermore, it uses VPN and quarantine network technology to access an in-house network where confidential information exists.
As a result, confidential information exists in the OS environment of the client PC, but since access to the external medium is prohibited, there is no risk of information leakage via the external medium. Further, since the HDD is encrypted, there is no risk of information leakage due to PC theft.

The method (2) will be briefly described as follows.
The client PC is diskless, an OS environment exists on the server side in the in-house network, and the OS and applications operate on the server side. The client PC only performs operation input and screen output. Further, access to the external medium on the client PC is prohibited by using an external medium prevention technique. Further, the server and the client PC are connected using VPN and a quarantine network technology.
Accordingly, since the client PC is prohibited from accessing the external medium, there is no risk of information leakage via the medium. Further, since the client PC does not have confidential information, information leakage due to PC theft does not occur.

The method (3) will be briefly described as follows.
A virtual terminal is created in the OS environment of the client PC, and another OS environment is constructed on the virtual terminal. Further, HDD encryption or activation authentication of the virtual terminal is performed, data movement from the OS environment on the virtual terminal to the OS environment of the client PC, or access to an external medium is prohibited. Furthermore, using VPN and the quarantine network technology, only the OS on the virtual terminal is allowed to access the in-house network where the confidential information exists, and the confidential information is handled only by the virtual terminal.
As a result, confidential information does not exist in the OS environment of the client PC, and information leakage does not occur directly or indirectly. In the OS environment on the virtual terminal, since access to the external medium is prohibited, information leakage through the external medium does not occur. Furthermore, even if the virtual terminal itself leaks, the HDD cannot be activated by HDD encryption or activation authentication, and the HDD is also encrypted, and no information leakage occurs.

JP-A-11-149414 VPN-1 SecureClienthttp: //www.checkpoint.co.jp/data/200602VPN1SClient_E.pdf Security client solution http://www.hitachi.co.jp/products/secure_client_solution/system_type.html VMware ACE http://www.vmware.com/en/products/ace/

However, the above methods (1) to (3) have the following problems.
First, the problem of the risk of information leakage will be described.
In the method (1), confidential information exists on the client side. For this reason, there is a possibility that confidential information is leaked via the network by connecting to an external network other than the in-house network and the user himself intentionally or negligently. However, if the connection to the external network is restricted, there are many problems such as hindering the general use of the PC outside the office, and therefore the connection to the external network cannot be uniformly prohibited.
On the other hand, in the method (3), confidential information exists in the OS environment on the virtual terminal, but since the OS environment of the client PC is separated, powerful network access control and the like are introduced into the OS environment on the virtual terminal. This problem can be avoided.

Next, the convenience problem will be described.
First, the method (1) is not convenient because non-confidential information cannot be output to an external medium in the OS environment of the client PC.
The method (2) is not convenient because the OS environment itself cannot be used unless it can be connected to the in-house network.
Next, the cost problem will be described.
First, in the method (3), since two OS environments operate on one terminal, a very rich hardware environment is required. In addition, although the license of the software including the OS depends on the license form, in many cases, the cost is higher than in the case of one OS environment.
In the method (2), a client PC and a server environment are required for one user. In many cases, a high-spec server environment and a network environment with a large bandwidth are required.
As described above, the methods (1) to (3) have some problems.

  The object of the present invention is to solve the problem of risk of information leakage, the problem of convenience, and the problem of cost while enabling external access via an external network to an internal server having confidential information. To provide a method and system for preventing leakage of confidential information that can be solved.

In order to achieve the above object, a confidential information protection method according to the present invention is a method for preventing leakage of confidential information from a client computer connected via a network to a server holding confidential information,
An environment check means mounted on the client computer checks whether the secondary storage device and the external storage medium of the client computer are in a writable state, and the check result is connected to the server. A first step of reporting to a connection management device that controls
Based on the check result received from the environment check means of the client computer, the connection management device determines whether or not the writing means to the secondary storage device and the external storage medium of the client computer is in a write-inhibited state. And a second step of permitting connection to the server only when writing means to the secondary storage device and the external storage medium is in a write-inhibited state.
Further, the environment check means checks whether or not the writing means to the secondary storage device and the external storage medium is in a writable state every predetermined time, reports the check result to the connection management device, and The management device is characterized in that the connection to the server is cut off when the check result is not reported every predetermined time.

A confidential information protection system according to the present invention includes a server holding confidential information, a client computer connected to the server via a network, and a connection management device that controls connection of the client computer to the server via the network. A confidential information leakage prevention system comprising:
The client computer is
Environment checking means for checking whether or not writing means to the secondary storage device and external storage medium of the client computer is in a writable state, and reporting the check result to a connection management device that controls connection to the server With
The connection management device is
Based on the check result received from the environment check means of the client computer, it is determined whether the secondary storage device of the client computer and the writing means to the external storage medium are in a write-inhibited state, and the secondary storage device and A means for permitting connection to the server is provided only when the means for writing to the external storage medium is in a write-inhibited state.
The client computer may further include a control unit that controls the writing unit to the secondary storage device and the external storage medium in a write prohibited state and a write permitted state in response to a user operation.
Further, the environment check means checks whether or not the writing means to the secondary storage device and the external storage medium is in a writable state every predetermined time, reports the check result to the connection management device, and The management device is characterized in that the connection to the server is cut off when the check result is not reported every predetermined time.

According to the present invention, the server holding the confidential information can be accessed only when writing to the secondary storage is prohibited, and does not remain on the client PC side.
On the other hand, in a situation where access to confidential information is not required, confidential information cannot be accessed, but writing to secondary storage is possible, and a general client PC can be used. For this reason, the convenience is improved, and the OS and the application can be updated without being a specific administrator.
Furthermore, it solves cost problems such as a server using a thin client technology and a software license when using a virtualization technology.
As a result, it is possible to solve the risk of information leakage, convenience, and cost while enabling access to the server having confidential information from the outside via the network.
Further, by applying the VPN and the quarantine network technology, it is possible to solve the problem of risk of information leakage via the network.

Hereinafter, an embodiment for carrying out the present invention will be specifically described with reference to the drawings.
FIG. 1 is a system configuration diagram showing an embodiment of the present invention.
The system according to the present embodiment includes a client PC 100, an external network 130, a connection management server machine 140, an in-house network 150, and an in-house server machine 160.
The client PC 100 includes a secondary storage device 101 represented by an HDD, a memory 102, an OS 110, and an application group 120. Other hardware such as a CPU and a display is present in the same manner as an existing PC.

The OS 110 includes an external medium access control driver 111 and a secondary storage write control driver 112 in addition to the existing OS.
The external medium access control driver 111 has a function for prohibiting access to an external medium, and also has a function for switching the function ON and OFF.

  The secondary storage write control driver 112 controls the writing to the secondary storage such as the HDD, has a function of writing only on the memory 102 at the time of writing, and has a function of switching the function between ON and OFF.

  The application group 120 includes a control driver operation client 121, a VPN and quarantine network client 122, security related software 123, and other software 124.

  The control driver operation client 121 is client software for switching ON / OFF of the external medium access control driver 111 and the secondary storage write control driver 112, and has a function of transmitting the state to the VPN and the quarantine network client 122.

The VPN and quarantine network client 122 are configured as shown in FIG.
The environment check processing unit 201 controls the external medium access control driver 111 and the secondary storage write control through the OS 110, the security-related software 123 to be described later, the update status of patches and pattern files of other software 124, and the control driver operation client 121. Check whether the driver 112 is ON or OFF.

The network control unit 202 blocks communication to other than the connection destination connected by the VPN connection processing unit 203 described later.
The VPN connection processing unit 203 connects to a VPN and quarantine server 141, which will be described later, and establishes a VPN connection.
The environment check result transmission unit 204 transmits the result checked by the environment check processing unit 201 to the VPN and quarantine server 141.
The VPN connection end processing unit 205 performs post-processing when the VPN connection ends, and turns off the external medium access control driver 111 and the secondary storage write control driver 112 through the control driver operation client 121. At this time, data written on the memory 102 is also deleted.
The VPN and the quarantine network client 122 apply the existing technology except for the ON / OFF check of the external medium access control driver 111 and the secondary storage write control driver 112.

The security related software 123 is an existing virus check software or the like. The other software 124 is software used on the client PC other than the software already mentioned.
The external network 130 is the so-called Internet, and the client PC 100 and the connection management server machine 140 are connected.

The connection management server machine 140 includes a VPN and a quarantine server 141. The VPN and quarantine server 141 are configured as shown in FIG.
The VPN connection acceptance processing unit 301 establishes a VPN connection in response to a connection request from the VPN connection processing unit 203.
The quarantine processing unit 302 compares the result sent from the environment check result transmission unit 204 with the connectable environment data 303, and if it matches, the client PC 100 can access the internal network 150. A connection rejection is returned to the client PC 100.
The connectable environment data 303 is data used by the quarantine processing unit 302 and includes a condition that the external medium access control driver 111 and the secondary storage write control driver 112 are ON.

  The VPN and the quarantine server 141 apply the conventional technique except that the connectable environment data 303 includes a condition that the external medium access control driver 111 and the secondary storage write control driver 112 are ON.

The internal network 150 is a so-called internal LAN environment, and is a network to which a server group including confidential information is connected.
The connection management server machine 140 and the in-house server machine 160 are connected to the in-house network 150.

The in-house server machine 160 includes a mail server, a file server 161, and the like.
The mail server or file server 161 is a server that stores mail and files including confidential information.

Next, each process will be described through general use. FIG. 4 shows a flowchart.
First, the user determines whether he / she wants to access the internal server machine 160 of the internal network 150 having confidential information (step 401).
When it is desired to access the in-house server machine 160, the control driver operation client 121 turns on the functions of the external medium access control driver 111 and the secondary storage write control driver 112 (step 402).
As a result, the client PC 100 cannot access the external medium or write to the HDD, and the write operation on the OS 110 is performed only on the memory 102.

Next, the user activates the VPN and the quarantine client 122 and performs connection processing with the connection management server machine 140 (step 403).
The processing on the client PC 100 side in step 403 is shown in the flowchart of FIG.
First, the environment check processing unit 201 performs general security environment checks such as patch application status of the OS 110 of the client PC 100, operation status of the security related software 123, update status, and pattern file update status.
At the same time, it is also checked whether the functions of the external medium access control driver 111 and the secondary storage write control driver 112 are ON through the control driver operation client 121 (step 501).
These checks use existing VPN and quarantine techniques, except for checks using the control driver operation client 121.

Next, the network control unit 202 is used to block communication other than communication with the connection management server machine 140 and communication with the in-house server machine 160 via the connection management server machine 140 (step 502).
This network control uses existing VPN and quarantine technologies.
Next, using the VPN connection unit 203, a VPN connection is established between the VPN on the connection management server machine 140 and the quarantine server 141 (step 503). At this time, on the VPN and quarantine server 141 side, the VPN connection acceptance processing unit 301 performs connection processing.
Finally, the result checked in step 501 is transmitted to the VPN and quarantine server 141 (step 504).

Next, the VPN and quarantine server 141 of the connection management server machine 140 compares the check result sent in step 504 with the connectable environment data 303 in the quarantine processing unit 302 and permits connection to the internal network. Whether or not (step 404).
At this time, since the connectable environment data 303 includes a condition that the external medium access control driver 111 and the secondary storage write control driver 112 are ON, it is determined that these drivers are ON. This is a necessary condition for connecting to the network 150.
When the connection is permitted in step 404, the client PC 100 can connect to the in-house server machine 160, and the mail server and file server 161 including the confidential information thereon can be used.

The user of the client PC 100 uses confidential information (step 405).
During the use of the confidential information in step 405, the client PC 100 periodically performs a check process as shown in FIG. 6, and the connection management server machine 140 performs a process as shown in FIG.
That is, the VPN of the client PC 100 and the quarantine client 122 are set on the client PC 100 at a predetermined time (specifically, a time interval slightly shorter than the timer time of the timer of the connection management server described later), as in Step 501 of FIG. Various checks are performed (step 601). Then, similarly to step 504 in FIG. 5, the check result is transmitted to the VPN and quarantine server 141 on the connection management server machine 140 (step 602).

The VPN of the connection management server machine 140 and the quarantine server 141 start the processing shown in the flowchart of FIG. 7 after the connection permission in step 404, and first starts a timer (step 701).
Next, using the timer, it is determined whether or not a check result has been received during a predetermined period (step 702).
If the check result sent in step 602 is received within the predetermined period, the check result sent is compared with the connectable environment data 303 in the same manner as in step 404, and whether connection to the in-house network is permitted. It is determined whether or not (step 703).
If permitted, the timer value is reset and the process returns to step 702 (step 704).
If the check result is not received during the predetermined period in step 702 or not permitted in step 703, the VPN connection from the client PC 100 is disconnected (step 705).
For this reason, if the client PC 100 becomes incompatible with the connectable environment data 303 while using the confidential information in step 405, the VPN connection is disconnected and the mail server including the confidential information on the The file server 161 cannot be used.

When the use of confidential information is terminated and the VPN connection is disconnected, or when the VPN connection is disconnected from the VPN of the connection management server 140 and the quarantine server 141 in step 705 of FIG. 7, the VPN connection of the VPN and the quarantine client 122 is performed. The end processing unit 205 turns off the external medium access control driver 111 and the secondary storage write control driver 112 through the control driver operation client 121.
At that time, the data written in the memory 102 is also deleted (step 406).
Therefore, the confidential information written on the memory 102 is completely deleted from the client PC 100.

If the connection is not permitted in step 404, the external medium access control driver 111 and the secondary storage write control driver 112 are turned off through the control driver operation client 121. At the same time, the blocking other than the communication to the connection management server machine 140 and the communication to the in-house server machine 160 via the connection management server machine 140, which was performed by the network control unit 202, is released (step 407).
As a result, the client PC 100 cannot access the internal network 150 but can access the external network 130.
The user updates the OS 110 and security-related software 123, updates the pattern file, etc. so as to match the connectable environment data 303, returns to step 402, and tries to connect again (step 408).

In step 401, if the user does not want to access the internal server 150 of the internal network 150 having confidential information, the external medium access control driver 111 and the secondary storage write control driver 112 are turned OFF (step 409). ), The client PC 100 is used as a normal PC (step 410).
At this time, updating of the OS 110 and security-related software 123, pattern file updating, and the like are also performed according to user operations.
When the external medium access control driver 111 and the secondary storage write control driver 112 are OFF, writing to the HDD is possible, and software can be updated.
In addition, writing to an external medium is freely possible, and the same usage as general PC usage is possible.

As described above, the client PC 110 in a state in accordance with the connectable environment data 303 such as the external medium access control driver 111 and the secondary storage write control driver 112 being turned on is an internal server having confidential information on the internal network 150. The machine 160 is accessible and can handle confidential information. However, it cannot be taken out to an external medium, taken out via another network, or written to a secondary storage such as an HDD.
On the other hand, when there is no need to handle confidential information, writing to the secondary storage device 101 such as an HDD, writing to an external medium, connection to another network is possible, and it is used in the same way as a general PC. I can do it.
The user can change the above-mentioned two states of the same client PC 110 according to use, and can also use a general PC while preventing leakage of confidential information.
In addition, the OS 110 and the application group 120 can be updated without the latter limitation.
Furthermore, the hardware specification of the client PC 110 may be about the same as a normal PC, and only one application license including the OS 110 may be used.
As a server, the connection management server machine 140 is newly required. However, unlike the thin client technology, the client OS environment does not operate, and an expensive server is not required.

As described above, according to the present embodiment, an in-house server machine that holds confidential information can be accessed only when writing to the secondary storage is prohibited, and does not remain on the client PC side. . Further, since VPN and quarantine network technology are applied, no information leakage occurs via the network.
On the other hand, in a situation where access to confidential information is not required, confidential information cannot be accessed, but writing to a secondary storage device or an external storage medium is possible, and a general client PC can be used. For this reason, the convenience is improved, and the OS and the application can be updated without being a specific administrator.
Furthermore, it solves cost problems such as a server using a thin client technology and a software license when using a virtualization technology.
As a result, it is possible to solve the problem of the risk of information leakage, the problem of convenience, and the problem of cost, and realize the prevention of confidential information leakage.
The function of the connection management server machine 140 may be provided in the in-house server machine.

It is a system configuration figure showing an embodiment of the invention. It is a block diagram of VPN and a quarantine network client. It is a block diagram of VPN and a quarantine server. It is a flowchart which shows the process of the whole system. It is a flowchart which shows the process at the time of connection of client PC. It is a flowchart which shows the process of a periodic check of client PC. It is a flowchart which shows the process of the connection management server machine corresponding to the periodic check of a client PC.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 101 ... Client PC, 101 ... Secondary storage device, 102 ... Memory, 110 ... OS, 111 ... External medium access control driver, 112 ... Secondary storage device write control driver, 120 ... Application group, 121 ... Control driver client, 122 ... VPN and quarantine client, 123 ... security related software, 124 ... other software, 130 ... external network, 140 ... connection management server, 141 ... VPN and quarantine server, 150 ... internal network, 160 ... internal server machine, 161 ... mail server , File server, 201 ... environment check processing unit, 202 ... network control unit, 203 ... VPN connection unit, 204 ... environment check result transmission unit, 205 ... VPN connection end processing unit, 301 ... VPN connection acceptance processing unit, 302 ... quarantine Processing unit, 3 3 ... can be connected environment data.

Claims (5)

A method for preventing leakage of confidential information from a client computer connected via a network to a server holding confidential information,
An environment check means mounted on the client computer checks whether the secondary storage device and the external storage medium of the client computer are in a writable state, and the check result is connected to the server. A first step of reporting to a connection management device that controls
Based on the check result received from the environment check means of the client computer, the connection management device determines whether or not the writing means to the secondary storage device and the external storage medium of the client computer is in a write-inhibited state. And a second step of permitting connection to the server only when the means for writing to the secondary storage device and the external storage medium is in a write-inhibited state. The environment check means checks whether or not the writing means to the secondary storage device and the external storage medium is in a writable state every predetermined time, and reports the check result to the connection management device,
The method for preventing leakage of confidential information according to claim 1, wherein the connection management device blocks connection to the server when the check result is not reported every predetermined time. A confidential information leakage prevention system comprising a server holding confidential information, a client computer connected to the server via a network, and a connection management device for controlling the connection of the client computer to the server via the network. And
The client computer is
Environment checking means for checking whether or not writing means to the secondary storage device and external storage medium of the client computer is in a writable state, and reporting the check result to a connection management device that controls connection to the server With
The connection management device is
Based on the check result received from the environment check means of the client computer, it is determined whether the secondary storage device of the client computer and the writing means to the external storage medium are in a write-inhibited state, and the secondary storage device and A confidential information leakage prevention system comprising means for permitting connection to the server only when the means for writing to the external storage medium is in a write-protected state.   The said client computer is further provided with the control means which controls the writing means to the said secondary storage device and an external storage medium to a write-inhibited state and a write-permitted state according to user operation. Confidential information leakage prevention system. The environment check means checks whether or not the writing means to the secondary storage device and the external storage medium is in a writable state every predetermined time, and reports the check result to the connection management device,
5. The confidential information leakage prevention system according to claim 3, wherein the connection management device blocks connection to the server when the check result is not reported every predetermined time.

Images