JP2005044021A - Network security method, network security program, network security system and information management device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To easily construct a high-performance system protecting a network system from a computer virus. <P>SOLUTION: In this network security system, an information management device 301 is connected to a network communication network 101 connected with an information management server 201 performing management by installing prescribed antivirus software and completing disk inspection by the software as connection conditions of a user computer 401 to the network communication network 101, and the user computer 401 storing individual connection condition information about the connection conditions is connected through the information management device 301. The information management device 301 accesses the information management server 201 via the network communication network 101 to acquire the connection conditions, accesses the user computer 401 to acquire the individual connection condition information, and allows the connection of the user computer 401 to the network communication network 101 only when the individual connection condition information satisfies the connection conditions. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network security method, a network security program, a network security system, and an information management apparatus for protecting devices on a network from damage of a computer virus.
[0002]
[Prior art]
With the recent progress of computer network technology, computer systems have become indispensable for organizational activities of companies and the like. Connecting each personal computer to an in-house network is already common sense in organizations such as companies. With such changes in society, the importance of computer system security management is increasing, and security administrators always respond to external threats such as computer viruses and information leaks from inside companies. Needed.
[0003]
However, in many companies, a plurality of computer systems composed of a wide variety of hardware, operating systems, and application software are operating. For this reason, in order to perform the security management, all of such a variety of computer systems must be set correctly, which requires a high level of knowledge and a large amount of work time. Therefore, in practice, it is practically impossible for an administrator to manage all systems in the company and the like, and it can be said that the reality is that the actual management work depends on the user.
[0004]
Furthermore, due to changes in the industrial structure, temporary workers and part-time workers are increasingly in charge of work, and these personnel are increasingly using in-house computer systems. In this case, temporary employees and part-time workers have also increased their opportunities to bring their own personal computers into the company and connect them to the internal network. In other words, in recent years, it can be said that there are increasing opportunities for various miscellaneous personnel to use, for example, an in-house network. Helping with this social background, not only full-time employees but also various employees such as temporary workers and part-time workers bring computer viruses inside the company or take out important corporate information outside the company. Has increased rapidly.
[0005]
In such a social background, many inventions for protecting a network system from computer viruses have been made (for example, Patent Documents 1 to 3).
[0006]
[Patent Document 1]
JP 09-269930 A
[Patent Document 2]
JP 2001-123516 A
[Patent Document 3]
JP 2003-005989 A
[0007]
[Problems to be solved by the invention]
However, the conventional methods for protecting network systems from computer viruses are difficult to construct as a high-performance system simply because the system scale becomes huge and the effectiveness of the system is low. Met.
[0008]
For example, the techniques described in Patent Documents 1 and 2 are extremely large-scale systems that require the network communication network itself to be reconfigured.
[0009]
Moreover, the technique described in Patent Document 3 prevents the expansion of any computer in the network system on the assumption that any computer is infected with a computer virus. For this reason, in a network environment, a question remains about the protection effect against a computer virus.
[0010]
An object of the present invention is to easily construct a high-performance system for protecting a network system from computer viruses.
[0011]
[Means for Solving the Problems]
The present invention defines a network security method, a network security program, a network security system, and an information management device for protecting devices on a network from damage of a computer virus.
[0012]
In other words, the network security method of the present invention is an information management for managing the installation of the prescribed anti-virus software and the fact that the disk has been inspected by the anti-virus software as the connection condition of the user computer to the network communication network. An information management device having a computer configuration that is connected to the network communication network to which a server is connected, and that allows connection from a user computer that stores and saves individual connection condition information related to the connection condition in a storage area. Accessing the information management server via the information management server, obtaining the connection condition from the information management server, accessing the storage area of the user computer, and storing the individual connection condition information stored in the storage area. Step to get And a step of determining whether or not the individual connection condition information satisfies the connection condition, and the user computer only when a determination result that the individual connection condition information satisfies the connection condition is obtained. Connecting to the network communication network (claim 1).
[0013]
In addition, the network security program of the present invention is an information management for managing that the prescribed antivirus software is installed and that the disk has been inspected by the antivirus software as a connection condition of the user computer to the network communication network. This information management device is installed in a computer-configured information management apparatus that allows connection from a user computer that is connected to the network communication network to which a server is connected and stores and saves individual connection condition information related to the connection conditions in a storage area. Access the information management server via the network communication network to the device, obtain the connection condition from the information management server, access the storage area of the user computer, and store and save in this storage area Was The determination result that the individual connection condition information is acquired, the function that determines whether the individual connection condition information satisfies the connection condition, and the individual connection condition information satisfies the connection condition is obtained. And a function of connecting the user computer to the network communication network only when it is requested (Claim 2).
[0014]
The information management apparatus according to the present invention is a computer-configured apparatus, and the fact that the prescribed anti-virus software is installed and that the disk has been inspected by this anti-virus software indicates that the user computer for the network communication network Means for connecting to the network communication network to which an information management server to be managed as connection conditions is connected; means for allowing connection from a user computer that stores and saves individual connection condition information relating to the connection conditions in a storage area; Means for accessing the information management server via a network communication network, obtaining the connection condition from the information management server, accessing the storage area of the user computer, and storing the individual storage stored in the storage area; Means for obtaining connection condition information, and the individual connection Means for determining whether or not the condition information satisfies the connection condition, and the user computer is connected to the network communication network only when a determination result that the individual connection condition information satisfies the connection condition is obtained. And means for connecting to the device (claim 3).
[0015]
Such an information management device includes means for encrypting information transmitted from the user computer to the network communication network and decrypting information addressed to the user computer on the network communication network. (Claim 4).
[0016]
Also, the information management apparatus of the present invention comprises means for requesting input of personal authentication information to the user computer when the user computer is connected, and the personal authentication information input from the user computer Means for determining whether or not it matches the personal authentication information of a user under the management of the information management server, and means for connecting the user computer to the network communication network is input from the user computer The user computer may be connected to the network communication network only when it is determined that the personal authentication information matches the personal authentication information of a user managed by the information management server.
[0017]
Further, the information management apparatus of the present invention includes a means for stopping the device in response to a signal generated when the user computer is not used for a specified time, and once the device is stopped, the personal authentication information is stored in the user computer. And a means for obtaining the input again (claim 6).
[0018]
The network security system of the present invention includes a network communication network, a network communication network connected to the network communication network, a specified antivirus software installed, and a disk inspection performed by the antivirus software. An information management server that manages connection conditions of user computers to a communication network, and information that allows connection from a user computer that is connected to the network communication network and stores and saves individual connection condition information related to the connection conditions in a storage area A management device, wherein the information management device accesses the storage device via the network communication network to acquire the connection condition, and accesses the storage area of the user computer to store the storage condition. Before being saved in the area A means for obtaining individual connection condition information, a means for determining whether or not the individual connection condition information satisfies the connection condition, and a determination result that the individual connection condition information satisfies the connection condition are obtained. Means for connecting the user computer to the network communication network only when it is detected.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
An embodiment of the present invention will be described with reference to FIGS.
[0020]
FIG. 1 is a schematic diagram showing an overall configuration of a network security system. In this network security system 1001, a plurality of information management devices 301 are connected to a local network 101 as a network communication network to which an information management server 201 is connected, and user computers are connected via these information management devices 301. 401 and various server computers 501 are connected to the local network 101.
[0021]
The information management server 201 manages that the prescribed anti-virus software is installed and that the disk has been inspected by the anti-virus software as a connection condition of the user computer 401 to the local network 101.
[0022]
The user computer 401 stores and saves individual connection condition information regarding the connection conditions in the storage area 402 (see FIG. 3).
[0023]
The server computer 501 stores and manages information resources in an organization such as a company that constructs the local network 101.
[0024]
The information management apparatus 301 is connected to the local network 101 and allows connection between the user computer 401 and various server computers 501. Such an information management apparatus 301 is a computer-configured device in which a network security program is installed, and allows the user computer 401 and various server computers 501 to be connected to the local network 101 in accordance with the network security program. That is, the information management apparatus 301 accesses the information management server 201 via the local network 101 according to the network security program, acquires a connection condition from the information management server 201, and the user computer 401. A function (means, step) for accessing the storage area 402 of the storage area 402 and acquiring the individual connection condition information stored in the storage area 402, and a function (means) for determining whether the individual connection condition information satisfies the connection condition Step) and a function (means, step) for connecting the user computer 401 to the local area network 101 only when a determination result that the individual connection condition information satisfies the connection condition is obtained.
[0025]
Therefore, in the present embodiment, as an example, a user who accesses the server computer 501 and wants to obtain information resources in an organization such as a company that constructs the local area network 101 uses his / her user computer 401 as the local area network. Instead of connecting directly to the local area network 101, the information management apparatus 301 is interposed to connect to the local area network 101. In practice, the user computer 401 is connected to the information management apparatus 301. As a result, the information management apparatus 301 determines whether or not the user computer 401 may be connected to the local network 101 by the method described above, and determines whether or not the connection can be made according to the determination result.
[0026]
FIG. 2 is a functional block diagram of the information management server 201. The information management server 201 is a server computer having a local network communication function 202 for connecting to the local network 101 and transmitting / receiving information. Such an information management server 201 incorporates hardware resources such as a CPU and a memory (not shown) as a computer, and functions based on a program code that is installed in, for example, an HDD and transferred to the RAM or the like entirely or partially when the program is launched. Each function in the block is realized.
[0027]
Such an information management server 201 has an information management device management function 203 and an encryption / decryption function 204 for managing all the information management devices 301 provided in plural. The information management apparatus management function 203 and the encryption / decryption function 204 will be described later with reference to the flowchart of FIG.
[0028]
The information management server 201 also manages a resource management table 205 that manages resources such as the user computer 401 and various server computers 501, an information management device management table 206 that manages the information management device 301, and an encryption key. An encryption key table 207 is provided.
[0029]
The resource management table 205 defines connection conditions to be requested when the user computer 401 and various server computers 501 are connected to the local area network 101. This connection condition is that the prescribed anti-virus software is installed in such a user computer 401 and various server computers 501, and that the disk has been inspected by this anti-virus software. The resource management table 205 defines the type and version of the virus pattern file supported by the antivirus software, as well as information such as the last date and time when the disk was inspected by such antivirus software.
[0030]
The resource management table 205 also defines personal authentication information regarding users who can connect the user computer 401 to the local network 101. As personal authentication information, for example, an ID number, fingerprint information, retina information, or the like can be used.
[0031]
The resource management table 205 further defines the access authority of the user computer 401 for each server computer 501. That is, the resource management table 205 can access which server computer 501 the user computer 401 specified by the personal authentication information can access, and what information resource in the server computer 501 can be accessed. Define what.
[0032]
The information management device management table 206 defines various information related to the information management device 301 connected to the local area network 101, for example, a device ID 306 (see FIG. 4) that each information management device 301 stores and saves in the nonvolatile memory 305. To do.
[0033]
The encryption key table 207 defines an encryption key list. The encryption key list is a list in which an encryption key is defined for each resource in the local network 101 such as the server computer 501. The information management apparatus 301 receives an encryption key list from the information management server 201 when connecting the user computer 401 to the local network 101.
[0034]
The information management server 201 can maintain the resource management table 205, the information management apparatus management table 206, and the encryption key table 207, that is, the resource management table maintenance function 208, the information management apparatus management table maintenance function 209. , And encryption key table maintenance function 210.
[0035]
FIG. 3 is a functional block diagram of the user computer 401. A user computer 401 is a client computer that operates on an operating system 403 and has a network driver 404 for connecting to the local network 101 via the information management apparatus 301 and transmitting / receiving information. Such a user computer 401 has built-in computer hardware resources such as a CPU and a memory (not shown), and functions based on a program code that is installed in, for example, an HDD and transferred to the RAM or the like entirely or partially when the program is launched. Each function in the block is realized.
[0036]
As a computer program having such a program code, a virus check program 405 and an agent program 406 as anti-virus software are installed in the user computer 401 on the HDD.
[0037]
Having the virus check program 405 is an indispensable condition for connecting the user computer 401 to the local network 101 as defined in the resource management table 205 of the information management server 201. Such a virus check program 405 determines the disk area that constitutes a part of the storage area 402 of the user computer 401, that is, the HDD area, in accordance with the virus pattern file 407 that the user computer 401 stores and saves in the storage area 402. Check for viruses. The user computer 401 has a virus check log file 408 in its storage area 402, and a virus check log by the execution of the virus check program 405 is recorded and saved in the virus check log file 408.
[0038]
In response to a request from the information management apparatus 301, the agent program 406 receives individual connection condition information unique to the user computer 401 that installs the agent program 406, that is, whether or not the virus check program 405 is installed, and a virus pattern file 407. The type and version of the virus pattern stored in the memory and the contents of the virus check log file 408 are returned to the information management apparatus 301.
[0039]
FIG. 4 is a functional block diagram of the information management apparatus 301. The information management apparatus is a computer-configured device that determines whether or not the local network 101 and the user computer 401 can be connected. Accordingly, the information management apparatus 301 is connected to the local network 101 and transmits / receives information to / from the local network side communication function 302 and the connected user computer 401 to / from the user computer side. A communication function 303. Such an information management device 301 incorporates a hardware resource as a computer such as a CPU and a memory (not shown). For example, each function in the functional block based on a program code (network security program) stored as firmware in the memory. Is realized. Alternatively, for example, a configuration in which each function in the functional block is realized based on a program code that is installed in the HDD and transferred to the RAM or the like entirely or partially when the program is started up may be used.
[0040]
The information management apparatus 301 has an information management server communication function 304. The information management server communication function 304 is a function for executing communication with the information management server 201 via the local area network 101. In the information management apparatus 301, the information management server 201 that performs communication is specified by the information management server address 307 stored and saved in the nonvolatile memory 305. The functions realized by the information management server communication function 304 will be described below.
[0041]
First, the information management apparatus 301 requests the connected user computer 401 to input personal authentication information, for example, a password, when the information management server communication function 304 is executed (when the user computer 401 is connected). And means for requesting the user computer 401 to input personal authentication information). The personal authentication information input from the user computer is transmitted to the information management server 201. Then, the information management server 201 refers to the resource management table 205, determines whether or not the personal authentication information is registered in the resource management table 205, and returns the result to the information management apparatus 301. The information management apparatus 301 inputs from the user computer 401 based on a response from the information management server 201 as to whether or not the personal authentication information input from the connected user computer 401 is registered in the resource management table 205. It is determined whether the personal authentication information thus obtained matches the personal authentication information of the user under the management of the information management server 201 (the personal authentication information input from the user computer 401 is under the management of the information management server 201) Means for determining whether or not it matches the personal authentication information of the user). If the response from the information management server 201 is that the corresponding personal authentication information is not registered in the resource management table 205, the information management apparatus 301 accesses the connected user computer 401 to the local network 101. I refuse.
[0042]
The information management apparatus 301 uses the information management server communication function 304 to request the information management server 201 for connection conditions relating to the connected user computer 401. In response to this request, the information management server 201 refers to the resource management table 205, and among the various information registered in the resource management table 205, the connection to be requested when the user computer 401 is connected to the local area network 101. The conditions are returned to the information management apparatus 301. This connection condition is that the prescribed anti-virus software is installed in the user computer 401 and that the disk has been inspected by the anti-virus software. More specifically, the information management apparatus 301 is provided with the type and version of the virus pattern file supported by the antivirus software and the last date and time when the disk was inspected by such antivirus software. The information management apparatus 301 temporarily registers the provided connection condition in the storage area.
[0043]
The information management device 301 uses the information management server communication function 304 to transmit a device ID 306 to be stored in the nonvolatile memory 305 to the information management server 201. When the information management server 201 receives the device ID 306, the information management server 201 can recognize which information management device 301 has established communication by referring to the information management device management table 206.
[0044]
The information management apparatus 301 uses the information management server communication function 304 to acquire an encryption key and a communication permission resource from the information management server 201. The acquired encryption key is stored in the encryption key list 308 in the storage area, and the communication permission resource is stored in the communication permission resource list 309 in the storage area. Then, the information management apparatus 301 includes an encryption / decryption function 310 using the encryption key stored in the encryption key list 308 and a communication destination management function with reference to the communication permission resource list stored in the communication permission resource list 309. 311 can be executed. The encryption / decryption function 310 and the communication destination management function 311 will be described below.
[0045]
First, the communication destination management function 311 executed in the information management apparatus 301 will be described. The information management server 201 manages the access authority with respect to each server computer 501 for the connected user computer 401 specified by the inputted personal authentication information among the various information recorded in the resource management table 205. To the device 301. In other words, the information management server 201 searches the communication permission resource list 309 for access authority for each server computer 501 of the connected user computer 401 specified by the personal authentication information, and defines a communication permission resource for defining the access authority. Is provided to the information management apparatus 301. Further, when the information management apparatus 301 receives provision of information regarding a communication permission resource that defines an access right, the information management apparatus 301 temporarily registers information regarding the provided communication permission resource in the communication permission resource list 309. The information management apparatus 301 controls the access authority of the connected user computer 401 based on the information regarding the communication permission resource temporarily registered in the communication permission resource list 309 in this way.
[0046]
Next, the encryption / decryption function 310 executed in the information management apparatus 301 will be described. The information management server 201 provides the encryption key list to the information management apparatus 301 at the same timing as providing information related to the communication permission resource to the information management apparatus 301. Therefore, the information management apparatus 301 temporarily registers the provided encryption key list in the encryption key list 308. Based on the encryption key list temporarily registered in the encryption key list 308 in this way, the information management apparatus 301 changes the data transmitted from the connected user computer 401 to the local network 101 for each resource to which this information is sent. Encrypt with encryption key. The information management apparatus 301 also changes the data addressed to the user computer 401 on the local network 101 for each resource that is the source of this data, based on the encryption key list temporarily registered in the encryption key list 308. Decrypt using the encryption key.
[0047]
The information management apparatus 301 has an agent communication function 312 in addition to the information management server communication function 304 described above. The agent communication function 312 is a function that communicates with the user computer 401 by the user computer side communication function 303 and transmits / receives various information to / from the agent program 406 running on the user computer 401. . That is, the agent communication function 312 of the information management apparatus 301 requests the user computer 401 to provide individual connection condition information specific to the user computer 401. Then, in response to a request from the information management apparatus 301, the user computer 401 uses the active agent program 406 to determine whether or not the virus check program 405 has been installed, and the type of virus pattern stored and saved in the virus pattern file 407. And the version and the contents of the virus check log file 408 are returned to the information management apparatus 301. Therefore, the information management apparatus 301 determines whether or not the individual connection condition information returned from the user computer 401 satisfies the connection condition provided from the information management server 201 temporarily registered in the storage area. As a result of this determination, the information management apparatus 301 determines that the individual connection condition information returned from the user computer 401 satisfies the connection condition provided from the information management server 201, and the connected user The connection of the computer 401 to the local network 101 is permitted.
[0048]
FIG. 5 is a flowchart showing a processing flow of the network security program installed in the information management apparatus.
[0049]
First, as described above, the information management apparatus 301 requests input of personal authentication information, for example, a password from the connected user computer 401 as the information management server communication function 304 is executed. The input personal authentication information is transmitted to the information management server 201. Then, the information management server 201 refers to the resource management table 205, determines whether or not the personal authentication information is registered in the resource management table 205, and returns the result to the information management apparatus 301. The information management apparatus 301 inputs from the user computer 401 based on a response from the information management server 201 as to whether or not the personal authentication information input from the connected user computer 401 is registered in the resource management table 205. It is determined whether the personal authentication information thus obtained matches the personal authentication information of a user under the management of the information management server 201.
[0050]
If the response from the information management server 201 is that the corresponding personal authentication information is not registered in the resource management table 205, the information management apparatus 301 accesses the connected user computer 401 to the local network 101. I refuse.
[0051]
On the other hand, if the response from the information management server 201 indicates that the corresponding personal authentication information is registered in the resource management table 205, the information management device 301 starts the device, that is, the user computer 401 After being connected to the information management apparatus 301 and starting the agent program 406 of the user computer 401 (step S101), the connection condition of the user computer 401 is received from the information management server 201 (step S102). In step S103, the agent program 406 that is running is inquired of the individual connection condition information. When the individual connection condition information is received from the user computer 401, it is determined whether the received individual connection condition information satisfies the connection condition provided from the information management server 201 (step S104).
[0052]
Here, as described above, the connection condition is the type and version of the virus pattern file supported by the antivirus software, and the last date and time when the disk was inspected by such antivirus software. Such connection conditions are temporarily registered in the storage area. Therefore, when determining whether the individual connection condition information received from the user computer 401 satisfies the connection condition provided from the information management server 201, the virus pattern file in the individual connection condition information received from the user computer 401 is used. 407, check whether the type and version satisfy the connection condition, and then refer to the last disk inspection date collected from the virus check log file 408 in the individual connection condition information received from the user computer 401 Then, it is checked whether this date is later than the last date in the connection condition.
[0053]
As a result of the determination in step S104 as described above, the network security program of the information management apparatus 301 determines that the individual connection condition information received from the user computer 401 satisfies the connection condition provided from the information management server 201. If it is (Y in Step S104), the device ID 306 stored in the nonvolatile memory 305 is transmitted to the information management server 201 (Step S105). On the other hand, if it is determined that the individual connection condition information received from the user computer 401 does not satisfy the connection condition provided from the information management server 201 (N in step S104), the connection to the user computer 401 is established. The impossibility is notified (step S106). In this case, the connection of the connected user computer 401 to the local network 101 is rejected. As a result, the user computer 401 that does not satisfy the connection conditions defined by the information management server 201 cannot be connected to the local network 101, and the system constructed on the local network 101 is protected from computer viruses.
[0054]
Here, when the information management server 201 receives the device ID 306 transmitted from the information management device 301, the information management server 201 transmits the encryption key list and the communication permission resource list. In response to this, the information management apparatus 301 acquires an encryption key list and a communication permission resource list from the information management server 201 (step S107). Thereby, the connected user computer 401 is connected to the local network 101, and for example, the server computer 501 is ready to be accessed.
[0055]
Therefore, the information management apparatus 301 waits for the presence / absence determination of communication from the user computer 401 (step S108). If there is communication from the user computer 401 (Y in step S108), the communication permitted resource list 309 is referred to, and the resource in the local network 101 that the user computer 401 is requesting access to, for example, a server computer 501 The access authority of the user computer 401 is determined (step S109). If there is an access right (Y in step S109), the data (message) transmitted from the user computer 401 is encrypted with the encryption key for the target resource (step S110), and the target resource and the user computer 401 are Can be executed (step S111). On the other hand, if there is no access authority (N in step S109), the user computer 401 is notified that communication is impossible (step S106). In this case, communication with the target resource of the connected user computer 401 is rejected.
[0056]
The information management apparatus 301 also changes the data addressed to the user computer 401 on the local network 101 for each resource that is the source of this data, based on the encryption key list temporarily registered in the encryption key list 308. Decrypt using the encryption key.
[0057]
Here, as described above, in step S <b> 108, the information management apparatus 301 waits for determination of presence / absence of communication from the user computer 401. At this time, the network security program operating on the information management apparatus 301 is in a situation where the user computer 401 is not used for the specified time, that is, when the communication from the user computer 401 is not longer than the specified time (N in step S108). Stop is executed (means for stopping the device in response to a signal generated when the user computer 401 is not used for a specified time). The information management apparatus 301 once again asks the user computer 401 to input the personal authentication information when the device is stopped (when the device is stopped, the information management apparatus 301 stores the personal authentication information in the user computer 401). Means to re-determine input). As a result, when the user of the user computer 401 is temporarily away from the user computer 401, for example, the user computer 401 is used by a third party, and the information resources on the local area network 101 are illegally stolen. Is prevented.
[0058]
In this embodiment, the information management apparatus 301 is an independent hardware resource connected and arranged on the local area network 101. However, in implementation, various functions of the information management apparatus 301 are converted into software, and the user You may install in the computer 401. FIG. In this case, the data flowing on the local area network 101 is data encrypted with the encryption key. For this reason, for example, when other resources are accessed without starting the network security program on the user computer 401 connected to the local network 101, or other resources from the user computer 401 in which the network security program is not installed in the first place. When the user computer is accessed, the data received by the user computer 401 remains encrypted. Thereby, security on the local area network 101 is ensured.
[0059]
【The invention's effect】
Since the present invention is configured as described above, a high-performance system for protecting a network system from computer viruses can be easily constructed.
[Brief description of the drawings]
FIG. 1 is a schematic diagram showing an overall configuration of a network security system.
FIG. 2 is a functional block diagram of an information management server.
FIG. 3 is a functional block diagram of a user computer.
FIG. 4 is a functional block diagram of the information management apparatus.
FIG. 5 is a flowchart showing a processing flow of a network security program installed in the information management apparatus.
[Explanation of symbols]
101 Network communication network (local network)
201 Information management server
301 Information management device
401 User computer
402 storage area
404 Antivirus software (virus check program)

Claims (7)

The network communication network to which the information management server that manages the installation of the specified antivirus software and the disk inspection by the antivirus software as a connection condition of the user computer to the network communication network is connected. An information management device having a computer configuration that is connected and allows connection from a user computer that stores and saves individual connection condition information related to the connection condition in a storage area,
Accessing the information management server via the network communication network and obtaining the connection condition from the information management server;
Accessing the storage area of the user computer and obtaining the individual connection condition information stored and stored in the storage area;
Determining whether the individual connection condition information satisfies the connection condition;
Connecting the user computer to the network communication network only when a determination result is obtained that the individual connection condition information satisfies the connection condition;
Network security method to run. The network communication network to which the information management server that manages the installation of the specified antivirus software and the disk inspection by the antivirus software as a connection condition of the user computer to the network communication network is connected. Connected and installed in an information management apparatus of a computer configuration that allows connection from a user computer that stores and saves individual connection condition information related to the connection condition in a storage area.
A function of accessing the information management server via the network communication network and acquiring the connection condition from the information management server;
A function of accessing the storage area of the user computer and acquiring the individual connection condition information stored and stored in the storage area;
A function of determining whether the individual connection condition information satisfies the connection condition;
A function of connecting the user computer to the network communication network only when a determination result is obtained that the individual connection condition information satisfies the connection condition;
A network security program that runs The network communication network to which the information management server that manages the installation of the specified antivirus software and the disk inspection by the antivirus software as a connection condition of the user computer to the network communication network is connected. Means for connecting;
Means for allowing connection from a user computer that stores and saves individual connection condition information related to the connection condition in a storage area;
Means for accessing the information management server via the network communication network and acquiring the connection condition from the information management server;
Means for accessing the storage area of the user computer and acquiring the individual connection condition information stored and stored in the storage area;
Means for determining whether the individual connection condition information satisfies the connection condition;
Means for connecting the user computer to the network communication network only when a determination result that the individual connection condition information satisfies the connection condition is obtained;
An information management apparatus having a computer configuration. 4. The information management apparatus according to claim 3, further comprising means for encrypting information transmitted from the user computer to the network communication network and decrypting information addressed to the user computer on the network communication network. Means for requesting input of personal authentication information to the user computer when the user computer is connected;
Means for determining whether the personal authentication information input from the user computer matches personal authentication information of a user under the management of the information management server, and the user computer is connected to the network communication network. Means for connecting the user computer to the network communication only when it is determined that the personal authentication information input from the user computer matches the personal authentication information of a user under the management of the information management server. Connect to the net,
The information management device according to claim 3 or 4. Means for stopping the device in response to a signal generated when the user computer is not used for a specified time;
Once the device has been stopped, means for requesting the user computer to input personal authentication information again;
An information management apparatus according to claim 5. A network communication network;
An information management server that is connected to the network communication network and manages that the prescribed anti-virus software is installed and that the disk has been inspected by the anti-virus software as a connection condition of the user computer to the network communication network When,
An information management device that is connected to the network communication network and allows connection from a user computer that stores and saves individual connection condition information related to the connection condition in a storage area;
The information management device comprises:
Means for accessing the storage device via the network communication network to obtain the connection condition;
Means for accessing the storage area of the user computer and obtaining the individual connection condition information stored and stored in the storage area;
Means for determining whether the individual connection condition information satisfies the connection condition;
Means for connecting the user computer to the network communication network only when a determination result that the individual connection condition information satisfies the connection condition is obtained;
A network security system comprising:

Images