WO2018008124A1

WO2018008124A1 - Computer, computer system, and security control method

Info

Publication number: WO2018008124A1
Application number: PCT/JP2016/070136
Authority: WO
Inventors: 春霖陳; 吉田　賢一; 基久福原; 史一坂倉
Original assignee: 株式会社日立製作所
Priority date: 2016-07-07
Filing date: 2016-07-07
Publication date: 2018-01-11

Abstract

A computer having a processor, a memory and a network interface. The memory holds a plurality of lists in which a definition for controlling the use of computer resources is preset and a profile in which connection information for specifying a network, to which the network interface is connected, is predefined for each network. When the network interface connects to a network, the processor acquires the connection information of the network, compares the connection information and the profile to determine whether or not there is a matching profile. When there is a profile that matches the acquired connection information, the processor selects a list that corresponds to the profile, and controls use of the computer resource defined in the list.

Description

Computer, computer system and security control method

The present invention relates to a security control method for a computer connected to a network.

The importance of corporate information security is increasing day by day, and technology that uses remote desktop technology and thin client terminal devices to manage information to be protected within the corporate network is known. The auxiliary storage device inside the thin client terminal is set to write-disabled, screen information is transmitted from the virtual desktop, and the thin client terminal displays the screen information. Therefore, no information remains in the thin client terminal. Yes.

The thin client terminal is a dedicated terminal in which the storage device is set to be non-writable and, in addition, the thin client terminal itself has a restriction on software to be started and an access restriction on an interface such as a USB to prevent viruses. .

A function of Windows OS that has a lock-down function. Use the PC as a thin client terminal by setting the auxiliary storage device in the PC to be writable, restricting software to be started, and restricting access to the interface. Is possible. It is also possible to change the restriction definition by controlling the lockdown function remotely from the management server.

In the prior art (Patent Document 1), a technique for terminal authentication of a thin client terminal using a white list is disclosed.

International Publication No. 2015/049825

In order to meet the needs of BYOD (Bring Your Own Device), when an employee uses a Windows OS lockdown function on a personally owned PC as a thin client terminal, it can be used internally or externally. Depending on the location and network connection environment, it is necessary to switch functions such as a thin client terminal in the company and a personal PC at home.

When controlling the lockdown function from the in-house management server, the personal PC can be controlled from the management server only after connecting to the in-house network environment. However, if the personal PC is not connected to the home or in-house network, it cannot be controlled from the management server. Even if a personal PC is connected to the management server from outside the company via a VPN (Virtual Private Network) or the like, the state of the PC before connecting to the management server cannot be controlled. For this reason, there is a risk in terms of security while being connected to the in-house network from outside the home PC and controlled from the management server.

The above prior art (Patent Document 1) is a technique for terminal authentication of a thin client terminal using a white list, and there is a problem that the function of a personal PC cannot be controlled according to the place of use and form.

Therefore, the present invention has been made in view of the above problems, and an object of the present invention is to switch the access of software to be started or an auxiliary storage device or the access restriction of I / O according to the use place and connection form of a computer. To do.

The present invention is a computer having a processor, a memory, and a network interface, and the memory specifies a plurality of lists in which definitions for controlling use of resources of the computer are preset, and a network to which the network interface is connected. Connection information to be stored for each network is stored in advance, and when the network interface is connected to the network, the processor acquires the connection information of the network, and the connection information and the profile To determine whether there is a matching profile, and if there is a profile that matches the acquired connection information, select the list corresponding to the profile and define it in the list Control the use of computer resources .

According to the present invention, even in an environment where the computer cannot connect to the server, the security environment (for example, lockdown function) to be applied is switched according to the list, and the application or I / O to be activated is switched according to the usage location or connection form. It becomes possible to change the access restriction to the O device.

It is a block diagram which shows a 1st Example of this invention and shows an example of the software configuration of a computer. It is a figure which shows a 1st Example of this invention and shows an example of the list | wrist used in private PC mode. It is a figure which shows a 1st Example of this invention and shows an example of the list | wrist used in in-house VDI terminal mode. It is a figure which shows a 1st Example of this invention and shows an example of the list | wrist used in an external VDI terminal mode. It is a flowchart which shows a 1st Example of this invention and shows an example of the starting process of a computer. It is a figure which shows the 1st Example of this invention and shows an example of a structure of a light filter. It is a figure which shows a 1st Example of this invention and shows an example of the internal structure of a profile. It is a sequence diagram which shows a 1st Example of this invention and shows an example of the connection process of wireless LAN communication. It is a flowchart which shows the 2nd Example of this invention and shows an example of a starting process. It is a block diagram which shows the 3rd Example of this invention and shows an example of an internal structure of an authentication device. It is a block diagram which shows the 4th Example of this invention and shows an example of a VDI structure. It is a block diagram which shows the 4th Example of this invention and shows an example of a structure of a computer. It is a block diagram which shows the modification of the 4th Example of this invention, and shows an example of a structure of a computer system. It is a figure which shows the 5th Example of this invention and shows an example of the production | generation of a list | wrist. It is a figure which shows the 5th Example of this invention and shows an example of the production | generation of a list | wrist.

Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings.

In the following description, the information of the present invention will be described using expressions such as “aaa table”, “aaa list”, “aaaDB”, “aaa queue”, etc., but these information are not necessarily limited to tables, lists, DBs, queues, It may be expressed by other than the data structure. Therefore, “aaa table”, “aaa list”, “aaaDB”, “aaa queue”, etc. may be referred to as “aaa information” to indicate that they are not dependent on the data structure.

Furthermore, in describing the contents of each information, the expressions “identification information”, “identifier”, “name”, “name”, and “ID” are used, but these can be replaced with each other.

In the following description, there is a case where “program” is used as the subject. However, since the program performs processing determined by being executed by the processor using the memory and the communication port (communication control device), the processor is used as the subject. The explanation may be as follows. Further, the processing disclosed with the program as the subject may be processing performed by a computer such as a management server or an information processing apparatus. Further, part or all of the program may be realized by dedicated hardware.

Various programs may be installed in each computer by a program distribution server or a storage medium that can be read by the computer. In this case, the program distribution server includes a CPU and storage resources, and the storage resources further store a distribution program and a program to be distributed. When the distribution program is executed by the CPU, the CPU of the program distribution server distributes the distribution target program to other computers.

FIG. 1 is a block diagram showing an example of the configuration of the computer 1. The computer 1 includes at least a CPU 70, a chip set 71, a main memory 75, and an auxiliary storage device 74. The computer 1 has a wireless LAN 77 and a wired LAN 76 as a network interface, for example, and can also have an external interface 72, an authentication device interface 73, and the like, for example.

The external interface 72 is an interface capable of connecting an external device such as a USB, and the authentication device interface 73 is a smart card reader / writer, a biometric authentication interface, or the like.

The auxiliary storage device 74 includes a nonvolatile semiconductor memory, a hard disk drive, a nonvolatile storage device such as an SSD (Solid State Drive).

The computer 1 of the present invention can switch available computer resources according to the network connection state as will be described later. The network interface of the wireless LAN 77 can communicate with the internal access point 51, the external access point 52, or the home access point 53.

The in-house access point 51 is connected to the in-house server 63 via the in-house network 61. The external access point 52 is connected to the gateway 62 via the network 60 and is connected to the internal server 63 via the internal network 61 after performing predetermined authentication. The home access point 53 is connected to the network 60 and can use a web site (not shown).

The software running on the computer 1 includes the OS 2, the application 3 running on the OS 2, the profile 5 used by the OS 2, the lockdown software 4 included in the OS 2, and a plurality of lists 1 used by the lockdown software 4 ( 11), list 2 (12), list 3 (13), and list N (19).

In FIG. 1, there is one type of application 3, but it can also be composed of a plurality of applications. In FIG. 1, the lockdown software 4 is described as being configured inside the OS 2 and provided as part of the functions of the OS 2, but operates on the OS 2 like one application 3. Configuration is also possible.

As will be described later, the lockdown software 4 switches the operation mode of the computer 1 according to the lists 2 (11) to N (19) corresponding to the connection state of the network, and restricts usable computer resources.

In the first embodiment, when the wireless LAN 77 of the computer 1 is connected to the home access point 53, the lockdown software 4 of the OS 2 selects the list 1 (11) and uses the computer 1 personally. Operate in personal PC mode.

When the wireless LAN 77 of the computer 1 is connected to the in-house access point 51, the lockdown software 4 selects the list 2 (12) and operates the computer 1 as an in-house VDI (Virtual Desktop Infrastructure) terminal. Hereinafter, the in-house VDI terminal mode is assumed.

Furthermore, when the wireless LAN 77 of the computer 1 is connected to the external access point 52, the lockdown software 4 selects the list 3 (13) and operates the computer 1 as an external VDI terminal. Hereinafter, the external VDI terminal mode is assumed.

Here, with the VDI terminal, the application is executed by the in-house server 63, and screen information such as a processing result is transferred and displayed on the output device of the computer 1. In the VDI terminal, the operation information such as the input device is transferred from the computer 1 to the in-house server 63, and the in-house server 63 executes processing by the application based on the operation information, and transfers the processing result screen information to the computer 1. The character information and numerical information processed by the in-house server 63 are not transferred to the computer 1.

In addition, about the structure which implement | achieves a VDI terminal, since what is necessary is just to apply well-known or well-known techniques, such as VMware Horizon View, it does not elaborate here.

The OS 2 and the application 3 are executed by the CPU 70 after being read from the auxiliary storage device 74 shown in FIG. Further, the profile 5 and the lists 1 to N as various information are stored in the main memory 75 and referred to by the OS 2 and the application 3 (lockdown software 4).

FIG. 2 is a diagram showing an example of list 1 (11) used in the personal PC mode. The list 1 (11) includes a permitted application 20, an I / O permission 30, and a write filter 40.

The permitted application 20 stores a plurality of application information, that is, application 1 (21), application 2 (22), application 3 (23), and application M (29), and these applications are in the personal PC mode. It is information that it can be activated.

On the other hand, for applications not listed in list 1, lockdown software 4 refuses to start.

In the I / O permission 30, a USB access permission 31 is stored as access permission information of the external IF 72, and this is information that permits access to a USB device connected to the computer 1.

When an I / O device that is not permitted by the I / O permission 30 is connected, the lockdown software 4 blocks access to the I / O device.

In the write filter 40, the write permission 41, which is the write permission information of the auxiliary storage device 74, is stored. This is information that the auxiliary storage device 74 in the computer 1 can be written.

In the personal PC mode, access to the USB device connected to the computer 1 is permitted, writing to the auxiliary storage device 74 is permitted, and applications 1 to M can be started.

In other words, the list 1 (11) in the personal PC mode is a list in which use of all resources of the computer 1 is permitted.

FIG. 3 is a diagram showing an example of the list 2 used in the in-house VDI terminal mode. The list 2 (12) is composed of a permitted application 20, an I / O permission 30, and a write filter 40.

In the permitted application 20, a plurality of application information, that is, application 1 (21) and application 2 (22) are stored, and information indicating that these applications can be activated.

In the I / O permission 30, USB access disabled 32, which is access permission information of the external IF 72, is stored, and this is information that prohibits the computer 1 from accessing the USB device.

In the write filter 40, the write permission information 42 of the auxiliary storage device 74 in the computer 1 is stored, which means that writing to the auxiliary storage device 74 in the computer 1 is prohibited. is there.

In the in-house VDI terminal mode, access to the USB device connected to the computer 1 is prohibited, writing to the auxiliary storage device 74 is also prohibited, and use of the

applications

1 and 2 is permitted. In the in-house VDI terminal mode, applications and data required for business other than the

applications

1 and 2 are processed by the in-house server 63, and access to the USB device and the auxiliary storage device 74 is prohibited and the security level is set high. Yes.

In other words, the list 2 (12) of the in-house VDI terminal mode is a list in which the use of the resources of the computer 1 is most restricted, access to the I / O device is prohibited, and writing to the auxiliary storage device 74 is also possible. This is a mode in which a predetermined application is prohibited and a predetermined application can be started, and a business is performed using the predetermined application.

In the first embodiment, an example of a USB device is shown as control of an I / O device. However, the present invention is not limited to this, and any I / O device that can be connected to and disconnected from the computer 1 may be used. .

FIG. 4 is a diagram showing an example of the list 3 used in the external VDI terminal mode.

List 3 (13) is composed of a permitted application 20, an I / O permission 30, and a write filter 40.

In the permitted application 20, a plurality of pieces of application information, that is, application (1) 21, application 2 (22), and application 3 (23) are stored, and these applications can be activated.

In the I / O permission 30, a USB access permission 31, which is access permission information of the external IF 72, is stored, and this is information that the computer 1 can access the USB device.

In the write filter 40, write permission information 42, which is write permission information of the auxiliary storage device 74, is stored. This is information that writing to the auxiliary storage device 74 in the computer 1 is prohibited.

In the external VDI terminal mode, access to the USB device connected to the computer 1 is permitted, while writing to the auxiliary storage device 74 is prohibited, and use of the

applications

1, 2, and 3 is permitted. In the in-house VDI terminal mode, applications and data required for business other than the

applications

1, 2, and 3 are processed by the in-house server 63, writing to the auxiliary storage device 74 is prohibited, and the security level is compared to the personal PC mode. And set it high.

In the personal PC mode list 1 (11), the in-house VDI terminal mode list 2 (12), and the external VDI terminal mode list 3 (13) in FIGS. Although a configuration including an I / O device to be controlled and a write filter for controlling access such as writing to a directory is shown, the present invention is not limited to this. For example, in the list 1 (11) of the personal PC mode, the list 2 (12) of the in-house VDI terminal mode, and the list 3 (13) of the outside VDI terminal mode, an application that can be activated, an I / O device that controls access, and It only needs to include at least one of the light filters.

FIG. 6 is a diagram showing an example of the configuration of the light filter 40 shown in FIGS.

The write filter 40 includes information indicating that writing to the auxiliary storage device 74 is not possible 42 and exceptionally writable directories (or paths) 43 and 44.

In the illustrated example, writing to the auxiliary storage device 74 is not possible in principle. However, in order to use the OS 2, the directories of “User” (43) and “Appl” 44 are writable directories, and these writable directories even when the principle regarding access to the auxiliary storage device 74 is not writable 42. In 43 and 44, writing is permitted.

FIG. 7 is a diagram illustrating an example of the internal configuration of the profile 5. The profile 5 is an information group in which information for specifying the connection destination of the computer 1 by the wireless LAN 77 (or wired LAN 76) is set in advance. In the first embodiment, the in-house profile 1 (210) and the outside profile 2 ( 220).

Profile 1 (210) is a profile when connected to the internal access point 51 of the internal network 61. Profile 1 (210) includes a mode 217 indicating the type of profile 1, a network type 211 of profile 1, an ESSID 212 of an access point used in the network, a cipher 213 used in the access point, and an access point. Information including a VPN 215 used at the access point, and a connection destination 216 for storing the IP address of the access point.

Profile 2 (220) is a profile when connected to the external access point 52 of the external network. Profile 1 (210) is a mode 227 indicating the type of profile 2, network type 221 of profile 2, ESSID 222 used in the network, encryption 223 used in the access point, and IP used in the access point. An address 224, a VPN 225 used in the network, and a connection destination 226 that stores the IP address of the access point.

FIG. 5 is a flowchart showing an example of the startup process of the computer 1.

When the computer 1 is turned on and the OS 2 is started (100), the lockdown software 4 of the OS 2 first applies the list 1 and starts in the personal PC mode shown in FIG. 2 (101).

Next, when the OS 2 receives a predetermined radio wave from the wireless LAN 77 and connects to the access point (102), the lockdown software 4 acquires the connection destination information and then checks the profile 5 (103). The connection destination information (connection information) can include the SSID or IP address of the connection destination or the presence or absence of a VPN.

The lockdown software 4 determines whether the information of the access point currently connected to the wireless LAN 77 matches the in-house profile shown in FIG. 7 (104). If the information of the access point currently connected to the wireless LAN 77 matches the profile 1 (210), the lockdown software 4 proceeds to step 105 and applies the list 2 (12) shown in FIG. The computer 1 is operated in the in-house VDI terminal mode.

If the information of the access point currently connected to the wireless LAN 77 does not match the profile 1 (210), the process proceeds to step 106.

In step 106, the lockdown software 4 determines whether or not the information of the access point currently connected to the wireless LAN 77 matches the external profile 2 (220) shown in FIG.

If the information of the access point currently connected to the wireless LAN 77 matches the profile 2 (220), the lockdown software 4 proceeds to step 107 and applies the list 3 (13) shown in FIG. The computer 1 is operated in the external VDI terminal mode.

On the other hand, if the information of the access point currently connected to the wireless LAN 77 does not match the profile 2 (220), the lockdown software 4 maintains the list 1 (11) set in step 101, and the computer 1 Is operated in the personal PC mode.

In the above steps 102 to 105, receiving the wireless LAN radio wave of the in-house access point 51 indicates that the computer 1 exists at a position (building) where the in-house network can be accessed. According to the first embodiment, the position feature is used to determine whether the lockdown software 4 is in-house, outside the company, or the other by radio wave reception of the wireless LAN.

Note that wired LAN information can be added as the profile 5. For example, it is possible to determine and control that the computer 1 is located in the company by domain authentication. Alternatively, when the computer 1 is equipped with a GPS, position information may be used as the profile 5, and internal / external determination may be performed from the position information measured by the GPS and the profile 5.

FIG. 8 is a diagram illustrating a connection sequence of wireless LAN communication.

Hereinafter, an example of the process in which the computer 1 receives the wireless LAN radio wave from the access point in step 102 of FIG. 5 will be described.

The access points (51 to 53 in FIG. 1) transmit beacons 91 at regular intervals. When the computer 1 receives the beacons 91, when the lockdown software 4 refers to the profile 5 and the setting information matches, the SSID The mutual check 92, the mutual authentication 93, and the mutual connection request 94 are performed, and the connection of the data link layer is completed. Thereafter, communication in the IP layer becomes possible by communication 95 in the network layer.

The process of receiving the wireless LAN radio wave in step 102 shown in FIG. 5 can be performed on condition that, for example, the computer 1 makes an interconnection request 94 and the connection of the data link layer is completed. As another example, for example, a point in time when the SSID mutual check 92 and the mutual authentication 93 are completed can be used as a condition.

As described above, according to the first embodiment, even in an environment where the computer 1 cannot connect to the in-house server 63, the lockdown software 4 switches the list to be applied, and the mode according to the usage location and the connection form with the network. It becomes possible to change to.

The lockdown software 4 can change whether to access the application 3 and the auxiliary storage device 74 that are activated according to the selected mode, and the restrictions on I / O access to the external interface 72, and can change the internal server In an environment where connection to the computer 63 is not possible, the security of the in-house server 63 and the computer 1 can be ensured.

In the example of FIG. 5 described above, the network information connected when the computer 1 is started up and the profile 5 are compared. However, every time the network interface (wireless LAN 77 or wired LAN 76) connects to a new network. The processing after step 101 in FIG. 5 may be performed.

FIG. 9 shows a second embodiment, and is a flowchart showing an example of the startup process of the computer 1. In the second embodiment, the authentication device interface 73 of the first embodiment is used to prohibit connection to the in-house server 63 when the authentication device is not attached or when authentication fails with the authentication device. . Other configurations are the same as those in the first embodiment.

The flowchart of FIG. 9 is obtained by adding steps 108 to 110 to the flowchart shown in FIG. 5 of the first embodiment and replacing step 102 of FIG. 5 with the step 111 of the conditional branch. 1 is the same as FIG.

When the computer 1 is turned on and the OS 2 is started (100), the lockdown software 4 first applies the list 1 (11) and starts in the personal PC mode of FIG.

Next, in the computer 1, the authentication device software is activated (108), and the authentication device interface 73 determines whether an authentication device is mounted (or connected) (109). If the authentication device is not installed by the preset time, the computer 1 terminates the authentication device software (111) and continues to operate in the personal PC mode to which the list 1 (11) in FIG. 2 is applied.

Next, when it is detected that the authentication device is mounted, it is determined whether or not the lockdown software 4 has received the radio wave of the wireless LAN (111). If not received, the operation is continued in the personal PC mode to which the list 1 (11) of FIG. 2 is applied.

The lockdown software 4 checks the profile 5 (103) and determines whether or not the connection destination information matches the in-house profile 1 (210) (104). If the connection destination information matches the in-house profile 1 (210), the lockdown software 4 applies the list 2 (12) and operates as the in-house VDI terminal mode shown in FIG. 3 (105).

On the other hand, if the connection destination information does not match the in-house profile 1 (210), the lockdown software 4 determines in step 106 that the information of the access point currently connected to the wireless LAN 77 is the outside profile 2 shown in FIG. It is determined whether or not it matches (220).

The authentication device mounted on the authentication device interface 73 is a smart card, biometric authentication, or the like, and the authentication device mounting detection (110) is determined by a process (not shown) that detects whether or not the correct authentication device is mounted. Note that the validity of the authentication device may be determined by applying a known or well-known technique and will not be described in detail here.

As described above, according to the third embodiment, when the authentication device is not connected to the authentication device interface 73, the connection to the in-house server 63 is rejected regardless of the position of the computer 1, thereby improving the in-house security. Can be secured.

FIG. 10 is a diagram illustrating an example of an internal configuration of the authentication device 78 according to the third embodiment. The authentication device 78 is a device connected to the authentication device interface 73 shown in FIG.

In FIG. 1 of the first embodiment, the information of list 1 (11) to list N (19) is held in the computer 1, but the authentication device 78 shown in FIG. 11), list 2 (12), and list N (19) are held in an internal nonvolatile storage medium. In the case of the present Example 3, the authentication device 78 is comprised with a smart card etc., for example.

In the third embodiment, the list 1 (11) applied in the personal PC mode is also stored in the authentication device 78. However, the list 1 (11) is stored in the computer 1 because it is the default operation mode. You may make it do. That is, list 1 (11) may be stored in main memory 75, and list 2 (12) and list 3 (13) may be stored in authentication device 78.

The computer 1 can switch the mode by acquiring a list from the main memory 75 or the authentication device 78 according to the connected network.

The fourth embodiment will be described below. FIG. 11 is a block diagram of a VDI configuration showing a fourth embodiment of the present invention.

The computer 1 is connected to the computer 200 via the network 60, and the application 202 and the application 22 are VDI image transfer software. The image of the computer 200 is transferred from the application 202 to the application 22 of the computer 1, and the computer 1 is not shown. An image is displayed on a display and used as a virtual desktop.

FIG. 12 is a block diagram showing an example of the configuration of the computer 200. The computer 200 includes a CPU 231, a chip set 233, a main memory 232, an auxiliary storage device 234, a wireless interface 235 connected to a wireless network, and a wired interface 236 connected to a wired network.

The main memory 232 is loaded with the OS 205, the application 202 operating on the OS 205, the profile 203, the lockdown software 204, a plurality of lists 206, and a list 207.

In FIG. 12, the application 202 is one type, but it can also be configured by a plurality of applications. In FIG. 12, the lock-down software 204 is described as being included in the OS 205 and functioning as a part of the OS 205. However, a configuration that operates on the OS 205 as a single application is also possible. .

The lockdown software 204 refers to the information defined in the

lists

206 and 207 and sets the operation mode of the computer 200.

In the fourth embodiment, an example in which the computer 200 functions as a VDI server and provides an image to the computer 1 is shown. However, the in-house server 63 in FIG. 1 may have the same function as the computer 200.

FIG. 13 is a block diagram illustrating an example of a configuration of a computer system showing a modification of the fourth embodiment.

13 is a computer system in which the computer 1 and the computer 200 shown in FIGS. 11 and 12 are connected to the centralized management server 300 via a network 60. The computer system shown in FIG.

The computer 1 holds the list 1 (11) and the list 2 (12) and executes the management software 303, and the computer 200 holds the list 206 and the list 207 and executes the management software 304. The computer 1 has the same configuration as that of the first embodiment.

The central management server 300 executes management software 305 that manages the database 301. The central management server 300 is configured with the same resources as the computer 200 shown in FIG.

The management software 305 of the centralized management server 300 manages the information of list 1 (11), list 2 (12), list 206, and list 207 in the database 301, communicates with the management software 303 of the computer 1, and List 1 (11) and list 2 (12) can be rewritten.

Further, the management software 305 in the central management server 300 can communicate with the management software 304 of the computer 200 to rewrite the list 206 and the list 207 of the computer 200.

Further, the management software 305 operating on the central management server 300 may distribute the list 1 (11), list 2 (12), list 206, and list 207 managed by the database 301 to the

computer

1 or 200. .

For example, the computer 1 stores the list 1 (11) and the list 2 (12) received from the central management server 300 in the main memory 75, and switches between the personal PC mode and the in-house VDI terminal mode as in the first embodiment. You may do it.

FIG. 14A and FIG. 14B are diagrams showing an example of list generation performed by the computer 1 according to the fifth embodiment of the present invention.

In FIG. 1 of the first embodiment, list 1 (11) to list N (19) are held in the computer 1. The computer 1 receives, for example, lists 1 (11) to N (19) set individually in advance and a list A1 (33) created separately, and creates new ones from predetermined relational expressions (XOR, OR), etc. A list can be generated.

FIG. 14A shows an example in which a new list A1 '(45) is generated by performing an XOR operation on the contents of the list 1 (11) held by the computer 1 and the input list A1 (33).

In FIG. 14B, the computer 1 performs an OR operation on the contents of the generated list A1 ′ (45) and the list 2 (12) held by the computer 1 to generate a new list A2 (46). An example is shown.

As described above, the computer 1 can automatically generate a new list by registering an existing list or a created list and a relational expression, and set the operation mode of the computer 1. .

<Summary>
In each of the above embodiments, the management computer (in-house server 63, centralized management server 300, computer 200) has an input / output device. Examples of input / output devices include a display, a keyboard, and a pointer device, but other devices may be used. As an alternative to the input / output device, a serial interface or an Ethernet interface is used as the input / output device, and a display computer having a display or keyboard or pointer device is connected to the interface, and the display information is transmitted to the display computer. By receiving the input information from the display computer, the display computer may perform the display, or the input may be replaced by the input / output device by receiving the input.

Hereinafter, a set of one or more computers that manage the information processing system and display the display information of the present invention may be referred to as a management system. When the management computer displays display information, the management computer is a management system, and a combination of the management computer and the display computer is also a management system. In addition, in order to increase the speed and reliability of the management process, a plurality of computers may realize processing equivalent to that of the management computer. In this case, the plurality of computers (if the display computer performs the display, display (Including computers) is the management system.

In addition, this invention is not limited to the above-mentioned Example, Various modifications are included. For example, the above-described embodiments are described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. In addition, any of the additions, deletions, or substitutions of other configurations can be applied to a part of the configuration of each embodiment, either alone or in combination.

In addition, each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. In addition, each of the above-described configurations, functions, and the like may be realized by software by the processor interpreting and executing a program that realizes each function. Information such as programs, tables, and files for realizing each function can be stored in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

Also, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

Claims

A computer having a processor, a memory and a network interface,
The memory is
A plurality of lists in which definitions for controlling use of the computer resources are preset;
Connection information for specifying a network to which the network interface is connected holds a profile defined in advance for each network, and
The processor is
When the network interface is connected to the network, the network connection information is acquired, the connection information is compared with the profile to determine whether a matching profile exists, and the acquired connection information When there is a matching profile, the computer selects the list corresponding to the profile and controls use of computer resources defined in the list.
The computer according to claim 1,
The list is
The computer includes at least one of an application that can be started by the computer, a directory that can be written by the computer, and an I / O device that can be used by the computer as resources of the computer.
The computer according to claim 2,
The list is
A first list corresponding to a first mode in which all of the computer resources are available;
And a second list corresponding to a second mode for prohibiting access to the I / O device.
The computer according to claim 3, wherein
The calculator is
An authentication device that can be connected;
The processor is
A computer that selects the second list when the authentication device is connected, and switches the mode of the computer by selecting the first list when the authentication device is not connected.
The computer according to claim 1,
The calculator is
An authentication device that can be connected; and storing the list in the authentication device;
The computer, wherein the processor selects the list from the memory and the authentication device.
A computer having a processor, a memory and a network interface;
A computer system including a central management server connected to the computer via a network,
The central management server
Managing a plurality of lists in which definitions for controlling the use of the computer resources are preset;
The calculator is
In the memory, connection information for specifying a network to which the network interface is connected holds a profile defined in advance for each network,
The processor receives the list from the centralized management server and stores the list in the memory. When the network interface is connected to the network, the processor acquires connection information of the network and compares the connection information with the profile. If there is a profile that matches the acquired connection information, the list corresponding to the profile is selected, and the computer resources defined in the list are selected. A computer system characterized by controlling the use of a computer.
A security control method for controlling security by a computer having a processor, a memory and a network interface,
The computer includes a plurality of lists in which definitions for controlling use of resources of the computer are set in advance, and a profile in which connection information for specifying a network connected to the network interface is defined in advance for each network. In memory,
The processor obtains connection information of the network when the network interface is connected to the network;
The processor compares the acquired connection information with the profile to determine whether a matching profile exists,
When there is a profile that matches the acquired connection information, the processor selects the list corresponding to the profile, and controls use of computer resources defined in the list. Security control method.
The security control method according to claim 7, comprising:
The list includes at least one of an application that can be started by the computer, a directory that can be written by the computer, and an I / O device that can be used by the computer as resources of the computer. Control method.
The security control method according to claim 8, comprising:
The list includes a first list corresponding to a first mode in which all of the resources of the computer can be used, and a second list corresponding to a second mode in which access to the I / O device is prohibited. A security control method comprising:
The security control method according to claim 9, comprising:
The calculator is
An authentication device that can be connected;
The processor selects the second list when the authentication device is connected, and switches the mode of the computer by selecting the first list when the authentication device is not connected. How to control security.
The security control method according to claim 7, comprising:
The calculator is
An authentication device that can be connected; and storing the list in the authentication device;
The security control method, wherein the processor selects the list from the memory and the authentication device.