JP5586551B2 - Computer system and job control method - Google Patents

Description

  Embodiments described herein relate generally to a computer system including a quarantine network and a job control method for a server device connected to the network.

  In recent years, it has been considered to operate a quarantine network on the assumption that a personal computer infected with a virus or worm is brought into an in-house network without an awareness of the employee. The quarantine network connects all personal computers attempting to access the corporate network to a special network area (for example, a quarantine zone) prepared for checking the security status. The personal computer in the isolation zone is logically separated from the corporate network. In this state, it is confirmed whether the personal computer meets the security policy. For example, whether the firewall (software) is installed, whether the detection pattern file is the latest, whether prohibited software is installed, and whether the latest OS modification program (patch) is applied Is confirmed. Also, check if your personal computer is infected with a worm or virus and remove it if necessary. Only personal computers for which worms and viruses have been removed and dealt with can be connected to the corporate network.

JP 2010-287932 A

  In this way, by using the quarantine network, it is possible to connect a personal computer brought in from the outside to the in-house network after confirming that it is in a safe state.

  Some computer systems include server devices that provide various services in response to processing requests from client PCs. For example, the server device is periodically inspected to check whether it is in a normal state in terms of security. If it is not in a normal state, it is restored to a normal state by a quarantine process such as applying the latest correction program (patch), as in the personal computer described above. In addition, when an unexpected abnormal setting is detected, it is repaired by an appropriate quarantine process.

  In the case of a server device, unlike a personal computer used by an individual, a job corresponding to a processing request from a client PC may be stored in a queue. Therefore, in the state where jobs are stored in the queue, if correction processing is required, service provision is affected.

  In particular, in the case of an emergency patch related to zero-day attack, it is necessary to make corrections immediately. Therefore, stop providing the service immediately and execute the correction process, or wait for the service to be provided until the correction process is completed. I had to take such a response.

  The problem to be solved by the present invention is a computer capable of providing a service within an allowable range while proceeding with a countermeasure for appropriately removing the abnormality even when an abnormality occurs in a server device that provides the service. A system and a job control method are provided.

  According to the embodiment, there is provided a computer system including a quarantine network that provides a logical normal network and a restricted network and executes a quarantine process on a server device connected to the restricted network. , An acquisition means for acquiring data relating to a queue in the first server device and the second server device, and when there is a failure in the first server device, a queue job of the first server device is sent to the second server device. Transfer enable / disable determining means for determining whether to transfer to the server device, and when the job is transferred to the second server device in accordance with a determination result by the transfer enable / disable determining means, Repair execution instructing means for executing repair on the server device, and the first server device is configured to transfer the job by the transfer permission / inhibition determining means. Is transferred to the second server device, a transfer unit that transfers the job to the second server device, and an instruction from the repair execution instruction unit after the transfer of the job by the transfer unit And a repair execution instructing means for executing repair according to the operation.

The block diagram which shows the structure of the computer system of this embodiment. The figure for demonstrating the quarantine network in this embodiment. The block diagram which shows the function structure of each apparatus in the computer system (quarantine network) of this embodiment. 6 is a flowchart showing MFP processing determination in the present embodiment. The figure for demonstrating the transfer permission judgment processing in this embodiment. The figure for demonstrating the process continuation determination process in this embodiment. The figure for demonstrating the process continuation determination process in this embodiment. The flowchart which shows the POS process determination in this embodiment. The figure for demonstrating the transfer permission judgment processing in this embodiment.

Hereinafter, the present embodiment will be described with reference to the drawings.
FIG. 1 is a block diagram showing the configuration of the computer system of this embodiment. The computer system shown in FIG. 1 is a system constructed in an office, for example, and includes a plurality of personal computers 14 (14-1,..., 14-m) and server devices 20, 23 (23-1, 23-2, 23-1). ..., 23-n) are connected via the network 25. In addition, a quarantine processing boundary device 30, a quarantine network management device 32, and a quarantine device repair device 34 constituting the quarantine network 16 are connected via the network 25.

  The personal computer 14 (14-1,..., 14-m) outputs a processing request for the service provided by the server devices 20 and 23 to the server devices 20 and 23 via the network 25.

  The server devices 20 and 23 (23-1, 23-2,..., 23-n) provide services according to processing requests from the personal computer 14 or an operation unit provided in the device main body. The server devices 20 and 23 receive processing requests from a plurality of personal computers 14 and operation units, manage jobs according to the processing requests using a queue, and sequentially process the jobs.

  The server devices 20 and 23 in the present embodiment will be described as, for example, an MFP (Multi Function Peripheral). Server devices (MFPs) 20 and 23 include a processor (CPU: Central Processing Unit) that performs processing such as data control and calculation, and a RAM (Random Access Memory) that temporarily stores data to be processed by the processor. A ROM (Read Only Memory) for storing processing programs, a network interface (I / F) for inputting / outputting data via the network 25, and the like.

  The server devices 20 and 23 are provided with an image reading unit, a printing unit, and a FAX unit. In response to a processing request from the personal computer 14, the server devices 20 and 23 provide services based on a scanner function, a printer function, and a FAX function under the control of the processor. provide. For example, in response to an instruction from the personal computer 14, the server devices 20 and 23 scan a paper medium on which a document or the like is recorded by a scanner function, read and output image data (scanned image), or use a printer function. Documents can be printed. A document can be transmitted by FAX by the FAX function.

  The server devices 20 and 23 are arranged in a distributed manner, for example, for each office department or floor. Usually, the employee designates one of the server devices 20 and 23 installed near the user's seat from the personal computer 14 and outputs a processing request.

  The quarantine processing boundary device 30 is realized by, for example, a wireless AP, a wired switch, a gateway server, and the like, and is connected to a device (personal computer 14 or server device) connected to the network 25 under the control of the quarantine network management device 32. 20, 23) are connected to either a logical normal network (hereinafter also referred to as a secure zone) or a restricted network (hereinafter also referred to as an isolation zone). The quarantine processing boundary device 30 switches the communication path between the device connected (isolated) to the quarantine zone and other devices for quarantine processing (quarantine network management device 32, quarantine device repair device 34, other devices). Do. The quarantine processing boundary device 30 controls only the data necessary for the quarantine processing of the devices connected (isolated) to the quarantine zone so as to communicate with other devices.

  The quarantine network management device 32 is realized by, for example, a NAP (Network Access Protection) server or Active Directory, and manages the quarantine network 16 by controlling the quarantine processing boundary device 30 and the quarantine device repair device 34. The quarantine network management device 32 detects the status of the server devices 20 and 23 connected to the network 25 as a target of quarantine processing, switches the connection of the target device of the quarantine processing from the secure zone to the quarantine zone, and enters the quarantine zone. It controls the repair or the like of the connected (isolated) device via the isolated device repair device 34. In addition, the quarantine network management device 32 according to the present embodiment acquires data related to each queue (job waiting for processing) from the server devices 20 and 23 connected to the network 25. The quarantine network management device 32 performs control for transferring the job of the server device connected (isolated) to the quarantine zone based on the queue state of the server devices 20 and 23 to another server device.

  The quarantine device repair device 34 executes quarantine processing on the device quarantined in the quarantine zone in accordance with an instruction from the quarantine network management device 32, and executes processing for repairing a security abnormality. The quarantine device repair device 34 performs repairs according to the abnormality detected from the device by the quarantine network management device 32, for example, applying the latest correction program (patch), or updating the firewall detection pattern file.

FIG. 2 is a diagram for explaining the quarantine network 16 in the present embodiment.
The quarantine network 16 constructs the secure zone 10 and the isolation zone 12 by the quarantine processing boundary device 30 and the quarantine network management device 32. In the following description, it is assumed that an abnormal setting that is a security threat is detected in the server device 20 and is subject to quarantine processing (repair). Hereinafter, the server device 20 to be isolated will be described.

  The quarantine network management device 32 switches the connection from the secure zone 10 to the quarantine zone 12 in order to perform the quarantine process on the quarantine target server device 20 when an abnormality is detected in the quarantine target server device 20. 14 and server device 23. In the quarantine network 16 of the present embodiment, when the quarantine target server device 20 is repaired by quarantine processing, the processing timing for the queue (processing waiting job) of the quarantine target server device 20 and the repair timing are adjusted. . When giving priority to job processing, the job of the server device 20 to be isolated is transferred to one of the server devices 23 selected from the server device group 22 in the secure zone 10 and executed at the transfer destination. Thereafter, the quarantine process (repair) for the quarantine target server device 20 is executed by the quarantine device repair device 34.

FIG. 3 is a block diagram showing a functional configuration of each device in the computer system (quarantine network 16) of the present embodiment.
As shown in FIG. 3, the isolation target server device 20 includes a normal job processing management unit 40, a job processing execution unit 41, an emergency job processing management unit 42, an emergency job processing determination unit 43, and a repair execution processing unit. 44 functions are provided. By executing the job control program recorded in the memory by the processor of the isolation target server device 20, the normal job processing management unit 40, the job processing execution unit 41, the emergency job processing management unit 42, and the emergency job processing determination unit 43 is realized. Further, the repair execution processing unit 44 is realized by executing the quarantine program.

  The normal job processing management unit 40 manages job processing in response to a processing request input from the normal personal computer 14. The normal time job processing management unit 40 manages processing requests from a plurality of personal computers 14 in a queue.

  The job processing execution unit 41 is under the management of the normal time job processing management unit 40 and responds to a processing request input from the personal computer 14 (for example, printing a document using a printer function, scanning a document using a scanner function). Etc.).

  The emergency job processing management unit 42 performs normal job processing according to the processing determination by the emergency job processing determination unit 43 when the quarantine network management device 32 detects a security abnormality from the isolation target server device 20. Controls whether a job managed by the management unit 40 is executed before quarantine processing (repair), executed after quarantine processing (repair), or job execution is stopped.

  The emergency job processing determination unit 43, when the server device 20 to be isolated is isolated in the isolation zone 12, the job contents managed by the normal job processing management unit 40 (for example, sensitivity of processing data) Depending on the determination result by the transfer determination processing unit 52 of the quarantine network management device 32 (for example, the presence or absence of a job transfer destination device, the load status of the job transfer destination), processing for a job managed by the normal job processing management unit 40 is performed. judge. That is, it is determined whether to execute the job before the quarantine process (repair), to execute the job after the quarantine process (repair), or to cancel the job execution.

Repair execution unit 44 after handling for a job which is managed by the normal job processing management unit 40 is determined, it executes a restoration processing instructed from quarantine equipment repair apparatus 34.

  In addition, the quarantine network management device 32 is provided with functions of a service central control management unit 50, a transfer determination information management unit 51, a transfer determination processing unit 52, and a repair execution instruction unit 53.

  The service central control management unit 50 performs control for adjusting the processing timing for the queue (job waiting for processing) and the repair timing for the isolation target server device 20 in which an abnormality to be quarantined is detected. Do. The service central control management unit 50 controls the job transfer of the isolation target server device 20 by the transfer determination information management unit 51 and the transfer determination processing unit 52, and controls the repair of the isolation target server device 20 by the repair execution instruction unit 53. . The service central control management unit 50 acquires data related to queues (jobs waiting for processing) from each of the isolation target server device 20 and the server device 23 (normal job processing management unit) connected via the network 25, and This is provided to the transfer determination information management unit 51. The data related to the queue (job waiting for processing) includes the processing content and data size of the job waiting for processing.

  The transfer determination information management unit 51 manages data related to queues (jobs waiting to be processed) acquired from the server device 20 to be isolated and the server device 23 by the service central control management unit 50.

  Based on the data managed by the transfer determination information management unit 51, the transfer determination processing unit 52 determines the timing of transferring a queue job managed by the isolation target server device 20 to another server device 23, and The job transfer process is executed through the emergency job process determination unit 43 of the server device 20.

  The repair execution instructing unit 53 instructs the isolation device repairing device 34 to execute repair of the isolation target server device 20 under the control of the service central control management unit 50.

The server device 23 is selected by the quarantine network management device 32 as a job transfer destination of the server device 20 to be quarantined, and includes a normal time job processing management unit 60 and a job processing execution unit 61.
The normal time job processing management unit 60 and the job processing execution unit 61 correspond to the normal time job processing management unit 40 and the job processing execution unit 41 of the server device 20 to be isolated, respectively, and basically have the same functions. ing. However, when the job is transferred from the normal time job processing management unit 40 of the server device 20 to be isolated, the normal time job processing management unit 60 is the same as the job according to the processing request input from the other personal computer 14 or the like. Are managed by the queue and processed by the job processing execution unit 61.

Next, the operation of the computer system in this embodiment will be described.
FIG. 4 is a flowchart showing determination of MFP processing for adjusting the processing timing and restoration timing for the queue (job waiting for processing) of the server device 20 to be isolated (MFP) in this embodiment. The server device 20 to be isolated is an MFP as described above, and requests for processing such as document printing (jobs) from a plurality of personal computers 14 (14-1,..., 14-m) connected via the network 25. ) Is entered.

  The quarantine network management device 32 monitors the isolation target server device 20 and the server device 23 connected to the network 25 and checks whether a security abnormality has occurred. When the quarantine network management device 32 detects an abnormality in the quarantine target server device 20, the quarantine network management device 32 transmits a repair instruction for the quarantine target server device 20 to the quarantine processing boundary device 30 and the quarantine network management device 32 (step B1).

  Further, the quarantine network management apparatus 32 instructs the isolation target server device 20 to check whether the target process (job) is under control (step B2). In response to an instruction from the quarantine network management device 32, the emergency job processing determination unit 43 determines whether the queue job is controlled by the normal job processing management unit 40.

  If it is determined that control is impossible (No in Step B3), the emergency job process determination unit 43 stops the MFP process determination process so as to restart the isolation target server device 20 (Step B4). As a result, all the queues managed by the normal job processing management unit 40 are flushed (invalidated). In other words, in the state where an abnormality is detected by the quarantine network management device 32 and control becomes impossible, the execution of the job is abandoned and the process is forcibly terminated in order to avoid an unpredictable failure.

  On the other hand, when it is determined that the control is possible (step B3, Yes), the emergency job processing determination unit 43 notifies the quarantine network management device 32. The quarantine network management device 32 instructs the quarantine processing boundary device 30 to isolate the isolation target server device 20 into the isolation zone 12. In addition, the quarantine network management device 32 transmits data related to the server device 23 that is a job transfer destination candidate of the isolation target server device 20 to the isolation target server device 20 (emergency job processing determination unit 43).

  The quarantine processing boundary device 30 switches the connection of the quarantine target server device 20 from the logical secure zone 10 to the quarantine zone 12 in response to an instruction from the quarantine network management device 32.

  When the connection to the quarantine zone 12 is switched, the emergency job processing determination unit 43 of the quarantine target server device 20 determines the confidentiality (importance) of the data targeted by the job in the queue of the normal time job processing management unit 40. A check is made to determine whether it is higher than a predetermined reference value (step B6).

  For example, in the case of a job for printing a document by the printer function of the server device 20 to be quarantined, the confidentiality of the document to be printed is checked. It is assumed that the confidentiality of a document is indicated in five stages by, for example, a character string or watermark data in the document. Alternatively, the user may specify the confidentiality (for example, five levels) when requesting a document printing process. The emergency job processing determination unit 43 determines that the confidentiality is high, for example, when the confidentiality is 4 or more.

  Here, when it is determined that the confidentiality of the data targeted for the job is high (No in step B7), the emergency job processing determination unit 43 determines that the job cannot be transferred to another server device 23 and determines the MFP processing. Processing is stopped (step B4). In other words, when a job is transferred to another server device 23 in a state where there is a security problem in the server device 20 to be quarantined, the job executed in this server device 23 is not executed normally, for example, a highly sensitive document Is prevented from being executed illegally, such as being recorded at the transfer destination or output to the outside. Further, since the server device 20 to be isolated is not normal, a job for a highly confidential document is not executed.

  On the other hand, when it is determined that the confidentiality of the data to be processed by the job is low (Yes in Step B7), the emergency job processing determination unit 43 is a server that is a transfer destination candidate for the job received from the quarantine network management device 32. Based on the data related to the device 23, it is determined whether there is a transfer destination candidate. That is, it is determined whether there is a server device 23 that can be executed instead of the job of the server device 20 to be isolated in the secure zone 10. Here, it is not necessary that the server device 23 is the same as the server device 20 to be isolated, as long as it can be executed instead of the job.

  Here, when there are a plurality of job transfer destination candidates, the emergency job processing determination unit 43 selects the server device 23 as the transfer destination according to a predetermined condition. For example, a server device 23 that is predetermined with respect to the server device 20 to be quarantined (eg, the installation location is close), a server device 23 in a predetermined order (rotation) with respect to the plurality of server devices 23, or a load The server device 23 or the like that is in a small state (the number of jobs in the queue is small) is selected.

  When there is a transfer destination candidate (step B9, Yes), the transfer determination processing unit 52 of the quarantine network management device 32 performs transfer permission determination processing for the server device 23 selected by the emergency job processing determination unit 43. Is executed (step B10). In the transfer permission / inhibition determination process, the job managed in the queue by the normal time job processing management unit 40 is transferred to the server device 23 and executed, or is executed as it is in the isolation target server device 20 without transferring the job. Determine whether. Here, the determination is made based on the time required to complete the job processing.

  For example, as shown in FIG. 5A, the transfer determination processing unit 52 determines the time required for execution in the isolation target server device 20 as shown in FIG. 5A and the server as shown in FIG. The time required for execution by transferring to the device 23 is compared.

  In FIG. 5A, as the time required for execution in the isolation target server device 20, for example, the estimated processing time required for processing of a queue (other job) before the target job, and the target job It is obtained by adding a single processing time required for single execution and a preset allowable time parameter (parameter k (unit: time)). The single processing time required for executing a single job is calculated based on the processing content and the data size. The allowable time parameter is set to an allowable time for a processing time that is increased by transferring a job. Here, the total of the estimated processing time and the single processing time is T1, and the time indicated by the allowable time parameter is k.

  In FIG. 5B, as the time required for transfer to the server device 23 and execution, for example, a queue (others) waiting for processing before the transferred job managed by the transfer destination server device 23 The estimated processing time required for processing the job), the estimated transfer time required for job transfer from the server device 20 to be isolated to the server device 23, and the single processing time required for executing the target job alone are obtained. . The estimated transfer time can be calculated based on the throughput information collected when the server device 23 is selected as the transfer destination. Here, the total of the estimated processing time, the estimated transfer time, and the single processing time is T2.

  If (T1 + k) <T2, the transfer determination processing unit 52 determines that the job is to be executed by the server 20 to be isolated without transferring the job. If (T1 + k)> = T2, the transfer determination processing unit 52 determines that the job is to be executed. It is determined that the data is transferred and executed by the server device 23.

  Originally, because an abnormality has occurred in the server device 20 to be quarantined, it should be immediately transferred to the quarantine process (repair). Therefore, if the job can be executed at the transfer destination within a time that takes into account the allowable time, Judge that it is to be transferred.

  When it is determined that the job is to be transferred (Yes in step B11), the transfer determination processing unit 52 notifies the emergency job processing determination unit 43. The emergency job processing management unit 42 transfers the target job managed by the normal job processing management unit 40 to the server device 23 (normal job processing management unit 60) selected as the transfer destination ( Step B12).

  The service central control management unit 50 instructs the quarantine process (repair) according to the abnormality to the quarantine target server device 20 through the repair execution instructing unit 53 after the job transfer is completed by the quarantine target server device 20. In response to an instruction from the repair execution instructing unit 53, the isolated device repair device 34 performs repair according to an abnormality occurring in the isolation target server device 20, for example, applying a latest correction program (patch). It is executed by the processing unit 44. The repair execution processing unit 44 executes the repair under the control of the isolation device repair device 34.

  On the other hand, when determining that the job is not to be transferred (step B11, No), the transfer determination processing unit 52 executes a process continuation determination process (step B13). In the process continuation determination process, whether the job managed in the queue by the normal time job process management unit 40 is processed before the repair, processed after the repair, or the process is predicted is to be processed. Judgment is made on the basis of the processing time expectation limit value (hereinafter referred to as the expectation limit value) and the processing continuation flag that are set for the time and the job and are used exclusively for isolation processing (emergency). The expected limit value and the processing continuation flag may be included in, for example, processing data to be processed by the job, or may be set in advance by the administrator of the quarantine network management device 32.

  The expected limit value indicates an allowable limit of time required for job processing. The expected limit value may be specified by the user at the time of processing request, or when data such as the normal processing time expected value T has already been recorded, a fixed value is added to the processing time expected value T. The value may be replaced by a value (T + 600 (sec) or the like). The processing continuation flag indicates whether the job processing is to be continued or the processing is to be stopped when the time indicated by the expected limit value exceeds when the job processing is continued.

  For example, it is assumed that the normal job processing management unit 40 manages jobs as shown in FIG. That is, jobs A, B, C, D, E, F, and G exist in the queue. The transfer determination processing unit 52 uses the jobs A to G based on the single processing times ta, tb, tc, td, te, tf, and tg of the jobs A, B, C, D, E, F, and G, respectively. The expected time required for the process is calculated.

  As shown in FIG. 7A, when job E is targeted, the expected time T required to process job E is the single processing time ta, tb, tc, td of each job up to job E in the queue. , Te. The transfer determination processing unit 52 compares the expected time T with the expected limit value Te set for the job E.

  As a result, if T <Te, the job processing is expected to be completed before the time indicated by the expected limit value Te elapses, so it is determined that the job processing is executed before the repair (step B14 (Yes), Step B15, (Step B16 (Yes)).

  When T> = Te and the processing continuation flag indicates that the job processing is continued, it is determined that the job processing is to be executed after the repair (step B14 (Yes), step B15, (step B16 (No)). 7B, since the processing continuation flag for job E is “◯” (indicating continuation of job processing), for job E, job E is executed after repair.

  If T> = Te and the processing continuation flag indicates that the job processing is to be stopped, it is determined that the job processing is to be stopped (No in step B14).

  When it is determined that the job processing is to be executed before the repair (Yes in Step B16), the emergency job processing management unit 42 causes the job processing execution unit 41 to execute the corresponding job by the normal job processing management unit 40. (Step B19). When the job processing is completed, the emergency job processing determination unit 43 notifies the quarantine network management device 32 of the job processing.

  The quarantine network management device 32 (service central control management unit 50) performs a quarantine process (repair) according to an abnormality to the quarantine target server device 20 through the repair execution instruction unit 53 after the job processing by the quarantine target server device 20 is completed. ) To the isolation device repair device 34. In response to an instruction from the repair execution instructing unit 53, the isolation device repairing apparatus 34 causes the repair execution processing unit 44 to perform repair according to the abnormality occurring in the isolation target server device 20 (step B20). The repair execution processing unit 44 executes the repair under the control of the isolation device repair device 34.

  If it is determined that the job processing is to be executed after the restoration (step B16, No), the emergency job processing management unit 42 causes the normal job processing management unit 40 to temporarily store the corresponding job. The job is stored in a reliable place (secure). For example, a TPM mechanism or a security HDD can be used.

  When the job is stored by the quarantine target server device 20, the quarantine network management device 32 (service central control management unit 50) performs a quarantine process (repair) according to an abnormality to the quarantine target server device 20 through the repair execution instruction unit 53. To the isolation device repair device 34. In response to the instruction from the repair execution instructing unit 53, the isolation device repairing apparatus 34 causes the repair execution processing unit 44 to perform repair according to the abnormality occurring in the isolation target server device 20 (step B17).

  When the repair execution processing unit 44 completes the repair, the normal job processing management unit 40 returns the temporarily stored job to the original state (normalization), and then the job processing execution unit 41 executes the job processing. .

  In this way, by adjusting the processing timing and the restoration timing for the queue (job waiting for processing) of the server device 20 to be isolated according to the results of the transfer permission determination processing and the processing continuation determination processing, While proceeding with measures to eliminate abnormalities, job processing can be executed within an allowable range and service provision can be continued.

  In the above description, the transfer permission determination process and the process continuation determination process are described as being executed in the quarantine network management device 32 (transfer determination processing unit 52). It may be executed by the emergency job processing determination unit 43). The emergency job processing determination unit 43 of the server device 20 to be quarantined may acquire the data related to the job of the other server device 23 necessary for the processing from the quarantine network management device 32 and execute the same processing as described above. .

  In the above description, the server devices 20 and 23 are described as MFPs. Since the job processing content and the data size to be processed differ for each job, the above-described single processing time, expected limit value, etc. Every one is different. In contrast, in a computer system in which the size of data to be processed by a job is uniform and quick response is required, the above-described processing can be simplified and executed. For example, in a POS (Point of Sales) system, processing data is the same size, and responsiveness is important. Hereinafter, a case where the POS system is targeted will be described.

  FIG. 8 is a flowchart showing POS processing determination for adjusting the processing timing for the queue of the server device 20 to be isolated and the repair timing when the POS system in this embodiment is targeted. For example, the server device 20 to be isolated is a store server, and POS data including sales information from a plurality of POS terminals (personal computers 14 (14-1,..., 14-m)) connected via the network 25. Is entered.

  The processing of steps A1 to A5 shown in FIG. 8 is executed in the same manner as steps B1 to B5 of the MFP processing determination processing shown in FIG. 4 (detailed description is omitted). In the POS system, the data is uniform and there is no difference in the importance (sensitivity), so the processing related to the confidentiality in the flowchart of FIG. 4 can be omitted.

  Further, the processes of steps A6 to A7 and A10 to A12 are executed in the same manner as steps B8 to B12 of the MFP process determination process shown in FIG. 4 (detailed description is omitted). However, in the POS system, the job data is uniform (the same cell size and the same size), so the determination in the transfer availability determination process can be simplified. That is, a fixed threshold value k is set for the queue order, and this threshold value k is simply compared with the target job queue order for determination.

  For example, as shown in FIG. 9, in the normal job processing management unit 40, jobs A, B, C, D, E, F, and G exist in the queue. Here, as shown in FIG. 9, if a threshold value k is set, the threshold value k is compared with the target job (for example, job E), and the target job queue (jth from the head) is compared. If j <k, the job is processed in the isolation target server device 20 (step A11, No), and if j> = k (step A11, Yes), it is determined that the job is transferred to another POS system.

  Steps A8 and A9 are executed in the same manner as steps B17 and B18 of the MFP process determination process shown in FIG. 4 (detailed description is omitted).

  In the POS system, since the responsiveness is emphasized, it is assumed that the job process is not continued after the repair process is completed. If there is no transfer destination candidate (Yes in step A7), and the transfer availability determination process If it is determined that transfer is impossible (No in step A11), the job processing may be terminated.

  In this way, a system that handles data, such as a POS system, continues to provide services by executing job processing within an allowable range while proceeding with countermeasures to eliminate security abnormalities through simplified processing. can do.

  Further, the present invention is not limited to the above-described embodiments as they are, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

  Further, the processing described in the above-described embodiment is a recording medium such as a magnetic disk (flexible disk, hard disk, etc.), optical disk (CD-ROM, DVD, etc.), semiconductor memory, etc., as a program that can be executed by a computer. And can be provided to various devices. It is also possible to transmit to a variety of devices by transmitting via a communication medium. The computer reads the program recorded on the recording medium or receives the program via the communication medium, and the operation is controlled by this program, thereby executing the above-described processing.

  DESCRIPTION OF SYMBOLS 10 ... Secure zone, 12 ... Isolation zone, 20 ... Isolation object server apparatus, 23 (23-1, 23-2, ..., 23-n) ... Server apparatus, 30 ... Quarantine processing boundary device, 32 ... Quarantine network management device 34 ... Isolated device repair device, 40 ... Normal job processing management unit, 41 ... Job processing execution unit, 42 ... Emergency job processing management unit, 43 ... Emergency job processing determination unit, 44 ... Repair execution processing unit, 50 ... Service central control manager 51 ... Transfer judgment information manager 52 ... Transfer judgment processor 53 ... Repair execution instruction part 60 ... Normal job process manager 61 ... Job process execution part

Claims (6)

A computer system having a quarantine network for providing a logical normal network and a restricted network and executing a quarantine process on a server device connected to the restricted network,
Quarantine network management device
An acquisition means for acquiring data relating to a queue in the first server device and the second server device;
Transferability determination means for determining whether to transfer a job of the queue of the first server device to the second server device when there is a failure in the first server device;
According to a determination result by the transfer enable / disable determining unit, a repair execution instructing unit that executes a repair on the first server device when the job is transferred to the second server device;
The first server device is:
Transfer means for transferring the job to the second server device when the transfer permission determination means determines that the job is transferred to the second server device;
A computer system comprising: a repair execution instructing unit that executes a repair in accordance with an instruction from the repair execution instructing unit after the transfer of the job by the transfer unit. The transfer permission / inhibition determining means includes:
The first time required when the job is executed by the first server device is the estimated processing time of the queue before the job, the single processing time required for execution of the job, and a preset allowable time. Calculated based on
A second time required to transfer and execute the job to the second server device, an estimated processing time of the queue of the second server device, an estimated transfer time required to transfer the job, Calculate based on the single processing time,
The computer system according to claim 1, wherein the determination is made by comparing the first time and the second time.   The quarantine network management apparatus sets in advance a time required to execute the job and the job in advance when the transfer permission determination unit determines that the job is not transferred to the second server device. The computer system according to claim 2, further comprising a process continuation determining unit that determines whether to execute the job before or after the repair based on an expected limit value until the completed process is completed. The computer system according to claim 1, wherein the transfer enable / disable determining unit determines based on a comparison result between a threshold set for the queue order and the queue order of the job. The quarantine network management device further includes a confidentiality check unit that determines whether or not to transfer the job to the second server device based on the confidentiality of the data to be processed by the job.
2. The computer system according to claim 1, wherein the transfer enable / disable determining unit determines whether to transfer the job to the second server device when it is determined to be transferred by the confidentiality checking unit. A job control method in a computer system having a quarantine network that performs a quarantine process on a server device connected to the restricted network by providing a logical normal network and a restricted network,
Quarantine network management device
Obtaining data relating to queues in the first server device and the second server device;
If there is a failure in the first server device, a to whether the transfer possibility determination transfer job in the queue of the first server device to the second server device,
If the job is transferred to the second server device in response to the transfer permission determination, the repair for the first server device is executed,
The first server device is:
If it is determined by the transfer permission determination that the job is transferred to the second server device, the job is transferred to the second server device;
A job control method for executing repair after transferring the job.

Images