JP2004289260A - System for examining safety of client utilizing dynamic address imparting server - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system that does not leave the security management of clients connected to a network only to the clients and performs management by an entire network in the client server system. <P>SOLUTION: The system is equipped with an address imparting server that is connected to the network, assigns an identification number for identifying a communicating party to the clients, and stores the presence or absence of the security hole of the clients to a database. The address imparting server receives an identification number assignment request from the clients who do not have the assigned identification number and responds to the request for searching for the database. As a result, when the clients have the security hole or the presence or absence of the security hole of the clients who transmit the identification number assignment request is not clear, an identification numbers for accommodating the clients into a logically closed segment are assigned on the network. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a client safety examination using a dynamic address assignment server in a client server system network.
[0002]
[Prior art]
Conventionally, as a network system using a server that dynamically assigns an IP address, a network system as shown in FIG. 12 is known, which is composed of a dynamic address assignment server, a client, a LAN, a router, and a HUB. Yes.
[0003]
As a network protocol of such a network system, DHCP is mainly used, and when a client tries to connect to the network, the following connection operation is performed.
[0004]
A client connected to the HUB requests a TCP / IP configuration parameter including an IP address for information communication within the LAN from the dynamic address assignment server. In response to this request, the dynamic address assignment server returns a packet including an IP address to be used by the client and a DHCP option parameter (such as a subnet mask and a DNS server IP address).
[0005]
The client configures TCP / IP based on the IP address provided by the server and DHCP option parameters, and can communicate with other machines connected to the LAN and access the Internet via a router. become.
[0006]
In such a network system, the client side can freely connect to the LAN without setting the network environment including the IP address, which has contributed to the spread of computer networks for general users who do not have network knowledge.
[0007]
Furthermore, in such a network system, it is possible to prevent network disruption due to a setting error of a client, and it is also possible for the network administrator to reduce a burden spent on network management such as an IP address.
[0008]
On the other hand, in such a network environment, when a portable computer such as a notebook computer is brought in from the outside and used as a client, it can immediately communicate within the LAN in response to an IP address assignment request from the client. Has given the correct network settings. For this reason, there is a possibility that a computer infected with a virus or worm on another LAN can be freely connected as a network client, and the damage of the virus or worm is enlarged.
[0009]
Conventionally, there has been known a system that performs security monitoring diagnosis on a network, finds the cause of a problem hidden in the system, and proposes improvement (see, for example, Patent Document 1). Application software that analyzes a packet transmitted via a network and inspects the security of the client that transmitted the packet is known. (For example, refer nonpatent literature 1.).
[0010]
However, conventional security monitoring and diagnosis systems on the network diagnose clients connected to the network. Clients that have already been infected with viruses or worms are monitored and diagnosed before joining the LAN, and viruses and The worm damage could not be prevented.
[0011]
Furthermore, in the conventional network system, the countermeasures against the security of the client and the defense against viruses, worms, etc. depend on the security management on the client side, and the countermeasure state against the safety of the client connected to the LAN, There was no way to properly verify from the outside whether the latest security information was used to protect against viruses and worms.
[0012]
A network system that prevents damage from viruses and worms is desired.
[0013]
Furthermore, there is a need for a system that manages the security management of clients connected to the network not depending on the security management on the client side but on the entire network.
[0014]
[Patent Document 1]
JP 2002-185456 A (FIG. 1)
[Non-Patent Document 1]
“Nessus”, [online], [March 14, 2003 search], Internet <URL: http: // www. nessus. org />
[0015]
[Problems to be solved by the invention]
The problem to be solved by the present invention is to provide a system for managing the security of a client connected to a network in the client server system not only to the client, but to manage the entire network, thereby expanding the damage of viruses and worms. It is an object of the present invention to provide a network system that prevents the above-described problem.
[0016]
[Means for Solving the Problems]
The means for solving the problem will be described below using the numbers used in the [Embodiments of the Invention]. These numbers are added to clarify the correspondence between the description of [Claims] and [Embodiments of the Invention]. However, these numbers should not be used to interpret the technical scope of the invention described in [Claims].
[0017]
A computer communication network constructed using a client server system, which is connected to the network and assigns an identification number for identifying a communication partner on the network to a client (3) connected to the network; An address assigning server (1) is provided for storing in the database (11) the presence or absence of a security hole of the client (3).
[0018]
The address assignment server (1) receives an identification number assignment request from a client (3) to which the identification number is not assigned, searches the database (11) in response to the request, and performs the search As a result, when the client (3) has a security hole, or when it is unclear whether the client (3) that has transmitted the identification number assignment request has a security hole, the client (3) is placed on the network. Assign an identification number for accommodation in the logically closed segment (13).
[0019]
As a result, clients suspected of security on the network can be accommodated in the logically closed segment (13).
[0020]
Furthermore, a computer communication network constructed using a client-server system, which is connected to the network and has an identification number for identifying a communication partner on the network, connected to the client (3) connected to the network An address assignment server (1) for storing the presence / absence of security holes of the client (3) in the database (11), and the client (3) to which the identification number is not assigned to the address assignment server (1) From the information contained in the packet connected to the network and received via the network, in response to the request, searching the database (11) Analyzes the presence or absence of a security hole at the sender, and And notifies the result to the addressing server (1), secure scan server (2) comprises a.
[0021]
The security inspection server (2) is accommodated in a logically closed segment (13) on the network, and the address assignment server (1) transmits the identification number assignment request to the client (3 ) Is assigned an identification number for accommodating the client (3) in the same segment as the safety inspection server (2).
[0022]
The client (3) connects to the network using the identification number, sends a packet to the security inspection server (2), the security inspection server (2) analyzes the packet, The analysis result is notified to the address assignment server (1), and the address assignment server (1) stores the presence / absence of a security hole in the client (3) in the database (11) based on the content of the notification. To do.
[0023]
As a result, a client (3) suspected of security on the network can be accommodated in the same segment (13) as the safety inspection server (2), which is logically closed, and the security inspection server ( 2) Analyzes a packet sent from a client (3) whose security is suspected, and if there is no problem, notifies the address assignment server (1) of this, so that the security of the entire network can be maintained. .
[0024]
The address assignment server (1) sets an effective time for the identification number, and the client (3) transmits an identification number assignment request again when the effective time expires.
[0025]
As a result, the client (3) accommodated in the logically closed segment (13) does not continue to be accommodated in the segment (13), and the suspicion of security on the network that the client (3) has has been solved. The client (3) can connect to a normal network.
[0026]
When the address assignment server (1) receives the information on the new security hole, based on the information, all the clients (3) stored in the database (11) are in a state having the security hole. The database (11) is updated.
[0027]
As a result, it is possible to quickly take measures when a new security hole is discovered.
[0028]
When there is no security hole in the client (3), the address assignment server (1) gives a normal network connection identification number (14).
[0029]
DETAILED DESCRIPTION OF THE INVENTION
(Configuration of implementation)
Referring to FIG. 1, an embodiment of a “client safety examination system using a dynamic address assignment server” of the present invention is a client 3 for connecting to a LAN 6, and a HUB 4 having a port for connecting to the LAN 6. , A dynamic address assignment server 1 for assigning TCP / IP configuration parameters including an IP address requested by the client 3, a safety inspection server 2 for examining the security of the client 3, and a connection point between the LAN 6 and the Internet 7 And a router 5 installed in the network.
[0030]
The LAN 6 is a local area network for configuring the system of this embodiment. In this embodiment, the LAN 6 is described mainly using a local area network such as 100BASE-TX using HUB4, but this does not limit the LAN6 standard in the implementation of the present invention.
[0031]
The router 5 is a network device that connects the LAN 6 and the Internet, and performs control such as determining an optimum route for passage of packets flowing between the LAN 6 and the Internet and transmitting only appropriate packets.
[0032]
The client 3 is an information terminal such as a personal computer, performs information communication with other network devices other than the client 3 connected to the LAN 6, and further connects to an external network such as the Internet via the router 5. Performs information communication with network devices on the external network.
[0033]
The HUB 4 is a LAN cable concentrator and is installed at a connection point between the LAN 6 and the client 3 and plays a role as a relay point of the network.
[0034]
The dynamic address assignment server 1 is a server that dynamically manages the address of each client connected in the LAN 6. The dynamic address assignment server 1 includes a database, stores an assignment address management table 11 that stores a countermeasure status for security of the client in correspondence with the MAC address of the client, and the assignment address management table 11 further includes: Accumulate detailed information on IP addresses.
[0035]
The dynamic address assignment server 1 receives a dynamic address assignment request from a client connected to the LAN 6. Upon receiving this request, the dynamic address assignment server 1 searches whether the MAC address of the client that has made the dynamic address assignment request is registered in the assignment address management table 11. Based on the result of this search operation, an appropriate IP address and network setting are returned to the client that made the dynamic address assignment request.
[0036]
The safety inspection server 2 is a server that inspects the safety of a client or server connected to the LAN 6 and has the following two inspection methods.
[0037]
The first inspection method is a passive inspection in which the contents of a packet sent from the client to the safety inspection server 2 are inspected to check whether or not the packet contains an illegal packet using safety. It is.
[0038]
The second inspection method is an active inspection in which the safety inspection server 2 transmits an inspection packet to a target client and detects the presence or absence of safety based on the response.
[0039]
The safety inspection server 2 inspects whether or not the client to be inspected is safe, and if no problem is detected, the dynamic address assignment server 1 sends the MAC address of the client to be inspected, A message including information indicating that the security measures for the client are completed is transmitted.
[0040]
(Operation of implementation)
Next, the overall operation of this embodiment will be described with reference to the block diagrams of FIGS. 1 to 7 and the flowcharts of FIGS.
[0041]
First, in order to connect to the LAN 6, the client 3 and the HUB 4 are connected by a LAN cable (FIG. 1).
[0042]
The client 3 is connected to the LAN 6 and does not have its own IP address necessary for information communication through the LAN 6. Furthermore, since it does not have network setting information such as the IP address of the default gateway or the IP address of the name server, an address assignment request message is transmitted to the dynamic address assignment server 1.
[0043]
Upon receiving the address assignment request from the client 3, the dynamic address assignment server 1 first reads out the MAC address of the client 3 that has transmitted the address assignment request using an address assignment request message (step S101 in FIG. 8). ).
[0044]
Next, the dynamic address assignment server 1 searches whether the read MAC address of the client 3 is registered in the assignment address management table 11 (step S103 in FIG. 8).
[0045]
If the MAC address of the client 3 is not registered as a result of searching the assigned address management table 11 in step S105, the dynamic address assignment server 1 transmits a dynamic address assignment request to the assigned address management table 11 in step S107. The MAC address of the client 3 to be registered is registered, and the value of the security check corresponding to the registered MAC address is set to “NG” and registered in the assigned address management table 11.
[0046]
If the MAC address of the client 3 is registered as a result of searching the assigned address management table 11 in step S105, the dynamic address assignment server 1 searches for a security check corresponding to the MAC address of the client 3 in step S111. I do.
[0047]
As a result of the search in step S113, the MAC address of the client 3 is registered, but if the value of the security check corresponding to the registered MAC address is “NG”, the dynamic address assignment server 1 in step S115. Sets the IP address of the client 3 to be accommodated in the same segment as the security inspection server 2.
[0048]
After setting the IP address in step S115, in step S117, the dynamic address assignment server 1 sets the TTL (Time To Live: address valid period) value of the IP address of the client 3 set in step S115 to a short value. . In the case of FIG. 3, 300 seconds.
[0049]
In step S119, the dynamic address assignment server 1 sets the IP address of the safety inspection server 2 as the IP address of the default gateway and name server of the segment in which the client 3 is accommodated.
[0050]
In step S127, the dynamic address assignment server 1 transmits the network setting information accommodated in the same segment as the safety inspection server 2 set in steps S115 to S119 to the client 3.
[0051]
In step S 129, the dynamic address assignment server 1 updates the IP address of the client 3 in the assignment address management table 11 and the TTL information set in step S 117 and registers it in the assignment address management table 11.
[0052]
An example of data returned from the dynamic address assignment server 1 to the client 3 when the security check value is “NG” will be described with reference to FIG.
IP address → Same segment as safety inspection server 2. In the case of FIG. 3, 172.2.0.4.
Net mask → Value that is in the same segment as the safety inspection server 2. In the case of FIG. 3, it is 255.255.255.0.
Default gateway → The safety inspection server 2 is set as the default gateway. In the case of FIG. 3, 172.25.0.254.
Name server → The security inspection server 2 is a name server. In the case of FIG. 3, 172.25.0.254.
[0053]
In step S115, the client 3 accommodated in the same segment as the safety inspection server 2 transmits a packet to the safety inspection server 2 set as the default gateway.
[0054]
When the security inspection server 2 receives the packet of the client 3, the security inspection server 2 analyzes the packet and inspects whether an illegal packet with known safety is transmitted. At the same time, the security check is actively performed by communicating with the client 3 for the safety check (FIG. 4).
[0055]
The security inspection server 2 performs a security inspection of the client 3 by transmission / reception with the client 3. As a result, if it is determined that the client 3 has no known safety, the client 3 is notified to the dynamic address assignment server 1. Send a message of safety check completion. The content of the safety inspection completion message includes the MAC address of the client 3 for registration in the assigned address management table 11 and the value of the security check of the client 3.
[0056]
As the value of the security check, “GOOD” is set when security is not detected by the client, and “NG” is set otherwise.
[0057]
The dynamic address assignment server 1 that has received the safety inspection completion message from the safety inspection server 2 updates the value of the security check of the record of the client 3 registered in the assignment address management table 11 (FIG. 5).
[0058]
If the security check value is “NG” in step S113, the TTL value is very short (step S117), so the client 3 sends the IP address or network to the dynamic address assignment server 1 at short intervals. It will re-request address assignment to get the settings.
[0059]
If the security check value of the MAC address of the client 3 registered in the assigned address management table 11 is “GOOD” in step S113, the dynamic address assignment server 1 sends the client 3 the router 5 in step S121. Set the network so that it can be accommodated in the same segment.
[0060]
In step S127, the dynamic address assignment server 1 transmits the network setting information accommodated in the same segment as the router 5 to the client 3, and then updates the contents of the assignment address management table 11 in step S129. At this time, the value of TTL is set to a sufficiently long value. In the case of FIG. 6, it is 864000 seconds.
[0061]
An example of data that is specifically returned will be described with reference to FIG.
IP address → Same segment as router 5. In the case of FIG. 6, it is 172.25.63.10.
Net mask → A value that is the same segment as router 5. In the case of FIG. 6, 255.255.255.0.
Default gateway → Router 5 is the default gateway. In the case of FIG. 6, 172.25.63.254.
Name server → Set an appropriate name server IP address.
[0062]
The client 3 is accommodated in the same segment as the router 5 depending on the IP address and network setting given when the value of the security check is “GOOD”. As a result, communication with the Internet or other clients in the LAN 6 is performed. Is possible (FIG. 7).
[0063]
In step S129, the dynamic address assignment server 1 updates the contents of the assignment address management table 11, waits for the registered TTL to expire, and when the TTL expires, the client 3 again requests the address assignment dynamically It transmits to the address assignment server 1.
[0064]
In the present embodiment, the operation when new safety is discovered will be described below.
[0065]
Referring to FIG. 10, when the safety inspection server 2 obtains new safety information, the safety inspection rule stored in the safety database 12 of the safety inspection server 2 is updated. The safety inspection server 2 that has updated its own safety inspection rule again sends a safety inspection completion message to the dynamic address assignment server 1 in order to perform the safety inspection of the client connected to the LAN 6 again. Send.
[0066]
At this time, the safety inspection server 2 sets the MAC address of the safety inspection completion message to be transmitted to the broadcast address (FF-FF-FF-FF), and sets the security check value to “NG”. Upon receiving this message, the dynamic address assignment server 1 modifies the security check values of all records in the assignment address management table 11 to “NG” at once. (FIG. 10).
[0067]
When the TTL expires, the client 3 transmits an address assignment request to the dynamic address assignment server 1 again (step S101 in FIG. 8). Since the value of the security check in the assigned address management table 11 is “NG”, the dynamic address assignment server 1 is accommodated in the same segment as the security inspection server 1 for the client 3 in step S113 of FIG. Such network setting information is returned (FIG. 11).
[0068]
The safety inspection server 2 stores the modified difference in itself when the modified difference for the new safety is distributed via the network. The client 3 is accommodated in the same segment as the safety inspection server 2 and uses this correction difference to make a correction for safety.
[0069]
After making a correction to the safety, the safety inspection server 2 performs a safety inspection of the client 3 by sending and receiving to and from the client 3, and as a result, if it is found that the new safety correction of the client 3 has been completed, A message indicating the completion of the security check of the client 3 is transmitted to the dynamic address assignment server 1. The content of the security check completion message includes the MAC address of the client 3 for registration in the assigned address management table 11 and a value in which the security check of the client 3 is set to “GOOD”.
[0070]
The client 3 is accommodated in the same segment as the router 5 depending on the IP address and network setting given when the value of the security check is “GOOD”. As a result, communication with the Internet or other clients in the LAN 6 is performed. Is possible (FIG. 7).
[0071]
【The invention's effect】
The present invention can isolate a client having a vulnerability on a network from a LAN or the Internet by accommodating the client in a segment that is logically separated, so that the effect of preventing the spread of damage such as viruses and worms can be prevented. There is.
[0072]
In addition, since the present invention performs a security check for a client whose security is unknown, in a state where the client is accommodated in a logically separated segment, there is an effect of always providing a secure network environment to the client. is there.
[0073]
In addition, the present invention registers information on the presence / absence of security of a client connected to a network in a given address management table included in the dynamic address granting server, and the registered information on presence / absence of safety as a safety inspection server. However, the safety inspection server can effectively re-inspect safety if necessary.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an embodiment of the present invention.
FIG. 2 is a block diagram showing an address assignment request from the client 3 to the dynamic address assignment server 1 in the embodiment of the present invention.
FIG. 3 is a diagram showing a reply to an address assignment request from the client 3 to the dynamic address assignment server 1 in the embodiment of the present invention.
FIG. 4 is a block diagram showing communication between the safety inspection server 2 and the client 3 in the embodiment of the present invention.
FIG. 5 is a block diagram showing message transmission of safety inspection completion from the safety inspection server 2 in the embodiment of the present invention.
FIG. 6 is a block diagram showing an address assignment request from the client 3 to the dynamic address assignment server 1 in the embodiment of the present invention.
FIG. 7 is a block diagram showing communication between the client 3 and an external network in the embodiment of the present invention.
FIG. 8 is a flowchart showing a flow of processing in the embodiment of the present invention.
FIG. 9 is a flowchart showing the flow of processing in the embodiment of the present invention.
FIG. 10 is a block diagram showing message transmission of safety inspection completion from the safety inspection server 2 in the embodiment of the present invention.
FIG. 11 is a block diagram showing an address assignment request from the client 3 to the dynamic address assignment server 1 in the embodiment of the present invention.
FIG. 12 is a block diagram showing a conventional network system configuration using a server that dynamically assigns an IP address.
[Explanation of symbols]
1 Dynamic address assignment server
2 Safety inspection server
3 Client
4 HUB
5 routers
6 LAN
7 Internet
11 Assigned address management table
12 Safety database
13 IP address: segment of 172.25.0.4
14 IP address: segment of 172.25.63.10.
21 Conventional dynamic address assignment server

Claims (10)

A computer communication network constructed using a client server system,
An address assignment server connected to the network, assigning an identification number for identifying a communication partner on the network to a client connected to the network, and storing the presence or absence of a security hole of the client in a database; And
The addressing server receives an identification number assignment request from a client not assigned the identification number, and searches the database in response to the request;
As a result of the search, if the client has a security hole or if it is unknown whether there is a security hole in the client that sent the identification number assignment request, the client was logically closed on the network. A network that assigns an identification number to be accommodated in a segment. A computer communication network constructed using a client server system,
An address assignment server connected to the network, assigning an identification number for identifying a communication partner on the network to a client connected to the network, and storing the presence or absence of a security hole of the client in a database; The addressing server receives an identification number assignment request from a client not assigned the identification number, and searches the database in response to the request;
A security check that analyzes whether there is a security hole at the transmission source of the packet from information included in a packet connected to the network and received via the network, and notifies the address assignment server of the result of the analysis server,
Comprising
The security check server is housed in a logically closed segment on the network;
The address assignment server assigns an identification number for accommodating the client in the same segment as the security inspection server when the presence or absence of a security hole of the client that transmitted the identification number assignment request is unknown.
The client connects to the network using the identification number, sends a packet to the security check server,
The safety inspection server analyzes the packet, notifies the result of the analysis to the address assignment server,
The address assigning server is a network for storing presence / absence of security holes of the client in a database based on the contents of the notification. In the network according to claim 1 or 2,
The address assignment server sets a valid time to the identification number,
The network in which the client transmits an identification number assignment request again when the valid time expires. In the network according to any one of claims 1 to 3,
When the address assignment server receives information on a new security hole, the network updates the database based on the information so that all clients stored in the database have a security hole. In the network according to any one of claims 1 to 4,
The address assignment server is a network that provides a normal network connection identification number when the client does not have a security hole. A program for executing a method of executing a computer network by a computer,
Assigning an identification number for identifying a communication partner on the network to a client connected to the network;
Storing the presence or absence of security holes in the client in a database;
Receiving an identification number assignment request from a client not assigned the identification number;
Searching the database in response to the request;
As a result of the search, if the client has a security hole or if it is unknown whether there is a security hole in the client that sent the identification number assignment request, the client is logically closed on the network. A program for executing by a computer a method comprising the step of assigning an identification number to be accommodated in a segment. A program for executing a method of executing a computer network by a computer, wherein an identification number for identifying a communication partner on the network is assigned to a client connected to the network;
Storing the presence or absence of security holes in the client in a database;
Receiving an identification number assignment request from a client not assigned the identification number;
Searching the database in response to the request;
Analyzing the presence / absence of a security hole at the transmission source of the packet from information included in the packet received via the network;
Notifying the address assignment server of the result of the analysis;
Assigning an identification number for accommodating the client in a logically closed segment if it is unknown whether there is a security hole in the client that sent the identification number assignment request;
The client connects to the network using the identification number;
Sending a packet to the safety inspection server;
Analyzing the packet;
Notifying the address assignment server of the result of the analysis;
Storing the presence or absence of security holes of the client in a database based on the content of the notification;
A program for executing a method comprising: The program according to claim 6 or 7,
Setting an effective time for the identification number;
A program for executing, by a computer, a method comprising the step of transmitting an identification number assignment request again when the valid time expires. In the program according to any one of claims 6 to 8,
A method comprising: receiving information about a new security hole and updating the database based on the information so that all clients stored in the database have security holes. A program to run. The program according to any one of claims 6 to 9,
A program for executing, by a computer, a method comprising a step of providing a normal network connection identification number when the client has no security hole.

Images