Quarantine network system and quarantine server

Abstract

To provide a quarantine network system and a quarantine server that are capable of enhancing the security of a network including wireless access points.SOLUTION: When a client device TM10 connects to a network via a wireless access point 16, it acquires property information related to wireless communication with the wireless access point 16, and transmits information described in one or more target items included in the property information as acquired information to a quarantine server 14. The quarantine server 14 holds a quarantine management table in which reference information for each security inspection item is registered while the one or more target items are set as security inspection items. When the quarantine server receives acquired information from the client device TM10, it compares the acquired information with the reference information to determine a result of the quarantine.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to a quarantine network system and a quarantine server. [Background technology]

[0002] Patent Document 1 shows a quarantine network system that quarantines devices that apply security policies other than the security policy to which a general-purpose computer should conform. In this system, a quarantine server identifies a security policy to which an embedded device should conform based on ID information received from the embedded device, and transmits an inspection request to the embedded device to inspect whether the embedded device conforms to the identified security policy. In response to the inspection request, the embedded device obtains inspection information for inspecting whether the embedded device conforms to the security policy, inspects itself based on the inspection information, and transmits the inspection result to the quarantine server. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2012-198659 A Summary of the Invention [Problem to be solved by the invention]

[0004] For example, as shown in Patent Document 1, a quarantine network system is known that uses a quarantine server to inspect, isolate, and treat client devices that are subject to quarantine. The quarantine server sets security inspection items for the client devices in advance, and inspects the client devices based on the security inspection items when the client devices connect to the network. If the inspection results are positive, the quarantine server allows the client devices to connect to the network.

[0005] By using such a system, client devices with insufficient security measures can be excluded from the network. However, client devices may connect to the network via a wireless access point. In this case, if the security measures of the wireless access point are insufficient, there may be a risk of information leakage, data tampering, etc., even if the security measures of the client devices are sufficient. As an example, if the wireless access point uses an encryption method with low encryption strength, the security measures may be insufficient.

[0006] The present invention has been made in view of the above, and one of its objects is to provide a quarantine network system and a quarantine server that can improve the security of a network that includes wireless access points.

[0007] The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings. [Means for solving the problem]

[0008] Among the inventions disclosed in this application, a brief outline of a representative embodiment will be described as follows.

[0009] A quarantine network system according to an embodiment includes a client device, a wireless access point that mediates wireless access from the client device to a network, and a quarantine server that inspects the client device and determines whether the client device passes quarantine based on the inspection results. When the client device connects to the network via the wireless access point, the client device acquires property information related to wireless communication with the wireless access point, and transmits information described in one or more target items included in the property information to the quarantine server as acquired information. The quarantine server holds a quarantine management table in which the one or more target items are registered as security inspection items, and when it receives the acquired information from the client device, it compares the acquired information with the standard information to determine whether the quarantine passes. Effect of the Invention

[0010] To briefly explain the effect obtained by the representative embodiment of the invention disclosed in this application, the security of a network including wireless access points can be improved. [Brief description of the drawings]

[0011] [Figure 1] 1 is a schematic diagram illustrating a configuration example of a quarantine network system according to a first embodiment. [Diagram 2] 2 is a schematic diagram illustrating an example of a hardware configuration of a client device appearing in FIG. [Diagram 3] 1, is a diagram showing an example of property information related to wireless communication acquired by a client device. FIG. [Figure 4A] 1, is a schematic diagram showing an example of the configuration of a quarantine management table held by the quarantine server. [Figure 4B] 4B is a diagram showing an example of registered contents of an ID management table associated with the quarantine management table shown in FIG. 4A. FIG. [Diagram 5] 2 is a sequence diagram showing an example of processing contents of the quarantine network system in FIG. 1. [Figure 6] FIG. 1 is a block diagram showing a detailed functional configuration example of a main part of the client device. [Figure 7] FIG. 1 is a block diagram showing a detailed functional configuration example of a main part of a quarantine server. [Figure 8A] FIG. 11 is a schematic diagram showing an example of the configuration of a quarantine management table held by a quarantine server in the quarantine network system according to the second embodiment. [Figure 8B] 8B is a diagram showing an example of registered contents of a level management table accompanying the quarantine management table shown in FIG. 8A. FIG. [Figure 9] 13 is a block diagram showing an example of a detailed functional configuration of a main part of a quarantine server in a quarantine network system according to a second embodiment. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In all the drawings for explaining the embodiment, the same members are generally designated by the same reference numerals, and the repeated description will be omitted.

[0013] (Embodiment 1) <Outline of the Quarantine Network System> Fig. 1 is a schematic diagram showing a configuration example of a quarantine network system according to a first embodiment. The quarantine network system shown in Fig. 1 includes an internal network 11, a gateway 12, a business server 13, a quarantine server 14, an authentication server 15, an authentication switch ASW, a wireless access point 16, and client devices TM10 and TM11. In the specification, the access point is abbreviated as AP. The gateway 12, the business server 13, the quarantine server 14, the authentication server 15, and the authentication switch ASW are connected to the internal network 11.

[0014] The wireless AP 16 mediates wireless access from the client device TM10 to the internal network 11. The authentication switch ASW is connected between the wireless AP 16 or the client device TM11 and the internal network 11. In this example, the client device TM10 is connected to a port P1 of the authentication switch ASW via the wireless AP 16. On the other hand, the client device TM11 is connected to a port Pn of the authentication switch ASW via an Ethernet (registered trademark) cable.

[0015] The client device TM10 is, for example, a mobile terminal such as a tablet terminal or a smartphone, and is used by a user 17a. The client device TM11 is, for example, a personal computer, and is used by a user 17b. In the specification, the client devices TM10 and TM11 are collectively referred to as the client device TM, and the users 17a and 17b are collectively referred to as the user 17.

[0016] The authentication switch ASW performs network authentication of the client device TM or the user 17, and based on the authentication result, controls the relay of frames or packets between the client device TM and the internal network 11. The internal network 11 is, for example, an in-house network, and although not shown, has a layer 2 (L2) switch, a layer 3 (L3) switch, etc., which are responsible for relaying frames or packets.

[0017] The gateway 12 is a router or the like, and mediates communication between the internal network 11 and the external network 10. The external network 10 is the Internet or the like. The business server 13 is, for example, a file server, a Web server, or the like, and provides various services required for business.

[0018] The quarantine server 14 inspects the client device TM and judges whether the client device TM has passed quarantine based on the inspection result. Specifically, the quarantine server 14 inspects, for example, the patch application state of the OS (Operating System) of the client device TM and the application state of an antivirus program. Furthermore, as will be described in detail later, the quarantine server 14 inspects the client device TM10 that performs wireless communication, including the security state of the wireless access point 16. At this time, the quarantine server 14 performs the inspection using a quarantine management table 21 stored in the memory 20.

[0019] The authentication server 15 cooperates with the authentication switch ASW to perform network authentication of the client device TM or the user 17. Specifically, although not shown, the authentication server 15 holds an authentication table that defines the account information of the client device TM or the user 17 that is permitted to be authenticated through the network. In response to an authentication judgment request from the authentication switch ASW, the authentication server 15 performs authentication judgment based on the authentication table, and transmits the authentication judgment result to the authentication switch ASW. The authentication server 15 is, for example, a RADIUS (Remote Authentication Dial In User Service) server or the like.

[0020] Fig. 2 is a schematic diagram showing an example of a hardware configuration of the client device TM in Fig. 1. The client device TM shown in Fig. 2 is realized by a computer system including a computer 25, a display 26, a user input interface 27, and the like. The computer 25 includes a processor 30 such as a CPU (Central Processing Unit), a memory 31, a communication interface (IF) 32, and a bus 33 connecting these. The memory 31 is configured, for example, by a combination of a volatile memory such as a DRAM (Dynamic Random Access Memory) or an SRAM (Static Random Access Memory), and a non-volatile memory such as a flash memory, an SSD (Solid State Drive), or an HDD (Hard Disk Drive).

[0021] The memory 31 holds a security inspection program 34, the details of which will be described later. The processor 30 executes the security inspection program 34 to realize a quarantine function in the client device TM. The communication interface 32 is, for example, a wireless LAN interface in the case of the client device TM10 in Fig. 1, and a wired LAN interface in the case of the client device TM11. The client device TM is connected to the authentication switch ASW via the communication interface 32.

[0022] The display 26 is, for example, a liquid crystal display, an organic EL (Electro Luminescence) display, or the like, and displays information based on an image signal from the computer 25. The user input interface 27 is, for example, a touch panel integrated with the display 26, or a keyboard and mouse, or the like, and outputs an input signal based on an operation of the user 17 to the computer 25. Note that the business server 13, the quarantine server 14, and the authentication server 15 shown in Fig. 1 can also be realized using such computers.

[0023] <Quarantine pass / fail determination method> Fig. 3 is a diagram showing an example of property information related to wireless communication acquired by the client device TM10 in Fig. 1. The client device TM10 acquires property information 35 related to wireless communication with the currently connected wireless AP 16 using a security inspection program 34.

[0024] Specifically, when the client device TM10 is equipped with, for example, the Windows (registered trademark) OS, it can acquire property information 35 as shown in Fig. 3 by executing a command such as "netsh wlan show interfaces". The property information 35 includes a number of items indicating setting information, status information, attribute information, and the like related to wireless communication.

[0025] 3, property information 35 includes, as some of the multiple items, target item 36a representing a physical address, i.e., a Media Access Control (MAC) address, and target item 36b representing an SSID (Service Set IDentifier). Furthermore, property information 35 includes, as other of the multiple items, target item 36c representing a wireless type, target item 36d representing authentication, and target item 36e representing encryption.

[0026] The client device TM10 acquires such property information 35 when connecting to the internal network 11 via the wireless AP 16. Then, the client device TM10 transmits information described in one or more target items included in the property information 35, in this example, five target items 36a-36e, as acquired information 37 to the quarantine server 14.

[0027] Fig. 4A is a schematic diagram showing an example of the configuration of the quarantine management table 21 held by the quarantine server 14 in Fig. 1. Fig. 4B is a diagram showing an example of the registered contents of an ID management table accompanying the quarantine management table 21 shown in Fig. 4A. In the quarantine management table 21, as shown in Fig. 4A, the five target items 36a-36e shown in Fig. 3 are set as security inspection items 40a-40e, and standard information 41 for each security inspection item 40a-40e is registered in advance by an administrator. The standard information 41 is information that serves as a criterion for determining whether or not a quarantine has been passed, and is information that is determined based on the administrator's security policy.

[0028] Security inspection item 40a is an item representing a MAC address. The administrator registers information on the MAC address of wireless AP 16 properly installed in internal network 11 as reference information 41 for security inspection item 40a. Security inspection item 40b is an item representing an SSID. The administrator registers information on the SSID properly set for legitimate wireless AP 16 as reference information 41 for security inspection item 40b.

[0029] Security check item 40c is an item representing a wireless connection method corresponding to target item 36c representing a wireless type. Security check item 40d is an item representing a wireless authentication standard corresponding to target item 36d representing authentication. Security check item 40e is an item representing an encryption method corresponding to target item 36e representing encryption. In this example, the administrator registers ID values ​​based on ID management tables 45a-45c shown in FIG. 4B as standard information 41 for each security check item 40c-40e.

[0030] The ID management table 45a shown in Fig. 4B is a table for wireless connection methods, and an ID value is assigned to each type of wireless connection method. Examples of types of wireless connection methods include IEEE802.11a, b, g, n, and ac, which are also transmission standards for wireless LANs. The transmission standards for wireless LANs specify, for example, the frequency band to be used, the modulation method, the transmission speed, and the like.

[0031] The ID management table 45b shown in Fig. 4B is a table for wireless authentication standards, in which an ID value is assigned to each type of wireless authentication standard. Examples of types of wireless authentication standards include WEP (Wired Equivalent Privacy), WPA (Wi-Fi Protected Access), WPA2, WPA3, etc. In WEP, shared key authentication is performed using a WEP key of, for example, 104 bits. However, it is known that in WEP, the WEP key can be deciphered relatively easily by tapping wireless communication.

[0032] On the other hand, WPA was developed as the successor to WEP, and has been improved in the order of WPA, WPA2, and WPA3, with each generation being equipped with measures against vulnerabilities. For example, WPA3 uses elliptic curve cryptography calculated based on a password or the like to perform a Simultaneous Authentication of Equals (SAE) handshake between the client device TM10 and the wireless AP16, thereby providing authentication with high security strength.

[0033] The ID management table 45c shown in Fig. 4B is a table for encryption methods, and an ID value is assigned to each type of encryption method. Examples of the types of encryption methods include WEP, TKIP (Temporal Key Integrity Protocol), and CCMP (Counter mode with Cipher-block chaining Message authentication code Protocol). In WEP, plaintext is encrypted using an encryption key of 128 bits or the like generated by adding a 24-bit IV (Initial Vector) to the above-mentioned WEP key, and RC4 (Rivest Cipher 4), which is a stream encryption algorithm.

[0034] TKIP uses RC4 as the encryption algorithm, and is a method that provides stronger encryption than WEP by introducing a dynamically changing temporary key (TK) and expanding the number of IV bits, etc. CCMP uses AES (Advanced Encryption Standard), a block cipher encryption algorithm, instead of RC4, to encrypt a counter value with an encryption key, and then uses the encrypted counter value to encrypt plaintext.

[0035] When WEP is used as the wireless authentication standard, WEP is also used as the encryption method. On the other hand, when WPA or WPA2 is used as the wireless authentication standard, it is possible to select either TKIP or CCMP as the encryption method. Also, when WPA3 is used as the wireless authentication standard, it is possible to select either CCMP or GCMP (Galois Counter Mode Protocol), not shown, as the encryption method. GCMP is a standard that extends CCMP to enable parallel calculation by using a Galois field.

[0036] In addition to the standard information 41 of the security inspection items 40a-40e, other additional information may also be registered for each entry in the quarantine management table 21 shown in Fig. 4A. In the example shown in Fig. 4A, the additional information includes information on the access point (AP) name set in the wireless AP 16, information on the manufacturer of the wireless AP 16, and information on the installation location of the wireless AP 16. By registering such additional information in the quarantine management table 21, the administrator can centrally manage information required for the wireless AP 16.

[0037] The quarantine server 14 judges whether the quarantine has passed or failed based on the quarantine management table 21. In detail, when the quarantine server 14 receives the acquired information 37 from the client device TM10, the quarantine server 14 judges whether the quarantine has passed or failed by comparing the acquired information 37 with the reference information 41. In more detail, the quarantine server 14 first compares the acquired information 37 of the target items 36a and 36b with the reference information 41 of the security inspection items 40a and 40b. Then, the quarantine server 14 judges whether an entry having pair information matching the acquired information 37 of the target items 36a and 36b, i.e., the pair information of the MAC address and SSID, is registered in the quarantine management table 21.

[0038] If an entry matching the pair information is not registered in the quarantine management table 21, the quarantine server 14 determines that the quarantine has failed. In this case, the client device TM10 is not permitted to connect to the internal network 11, for example, to access the business server 13. As a result, in order for the client device TM10 to connect to the internal network 11 via the wireless AP 16, at least the wireless AP 16 must be registered in the quarantine management table 21. As a result, the authenticity of the wireless AP 16 can be verified, and for example, connection to the internal network 11 via an illegally brought-in wireless AP 16 can be prevented.

[0039] On the other hand, when an entry matching the pair information is registered in the quarantine management table 21, the quarantine server 14 verifies the remaining security inspection items 40c-40e in the hit entry. Specifically, the quarantine server 14 determines whether the acquired information 37 of the items 36c, 36d, and 36e matches the reference information 41 of the security inspection items 40c, 40d, and 40e, respectively. For example, in FIG. 4A, when the quarantine server 14 receives the MAC address "MA02" and the SSID "SS02" as the acquired information 37, it determines whether the wireless connection method is IEEE802.11ac, the wireless authentication standard is WPA3, and the encryption method is CCMP.

[0040] If any of the security inspection items 40c-40e are determined to be inconsistent, the quarantine server 14 determines that the quarantine has failed, and if no of the security inspection items 40c-40e are determined to be inconsistent, the quarantine server 14 determines that the quarantine has passed. If the quarantine has failed, the client device TM10 is not permitted to connect to the internal network 11. On the other hand, if the quarantine has passed and, furthermore, if network authentication by the authentication server 15 is also permitted, the client device TM10 is permitted to connect to the internal network 11.

[0041] By using these security inspection items 40c, 40d, and 40e, it is possible to verify that the wireless connection method, wireless authentication standard, and encryption method used during wireless communication satisfy the security policy defined in the quarantine management table 21. As a result, confidentiality of the wireless communication path can be ensured. In this way, by verifying the authenticity of the wireless AP 16 and the confidentiality of the wireless communication path, network security can be improved.

[0042] It should be noted that the security inspection items for verifying the authenticity of the wireless AP 16 do not necessarily need to be both security inspection items 40a and 40b, i.e., both the MAC address and the SSID, and may be only one of them. However, the MAC address may be spoofed in some cases, and the SSID may be changed arbitrarily by the administrator. Therefore, in order to perform a more reliable verification, it is desirable to set both the MAC address and the SSID as the security inspection items 40a and 40b.

[0043] Similarly, the security inspection items for verifying the confidentiality of the wireless communication path do not necessarily need to be all of the security inspection items 40c, 40d, and 40e, i.e., all of the wireless connection method, wireless authentication standard, and encryption method, but may include at least one of the security inspection items 40c, 40d, and 40e. In this case, which security inspection item is applied may differ depending on the security policy of the administrator. Accordingly, the quarantine management table 21 is preferably configured so that the administrator can arbitrarily select whether or not to apply each of the security inspection items 40a-40e.

[0044] Furthermore, the types of security inspection items are not necessarily limited to the security inspection items 40a-40e shown in Fig. 4A. That is, the security inspection items may be items for which information can be acquired by the client device TM10 in the same manner as in Fig. 3. As an example, if the model of the wireless AP 16 can be acquired by the client device TM10, this may be set as a security inspection item. In this case, the model of the wireless AP 16 may identify the wireless connection method, wireless authentication standard, and encryption method.

[0045] <Operation of the Quarantine Network System> Fig. 5 is a sequence diagram showing an example of the processing contents of the quarantine network system in Fig. 1. First, as a premise, the authentication switch ASW performs network restriction in advance so as to permit only access from the client device TM10 to the quarantine server 14 (step S10a). Specifically, the authentication switch ASW assigns a VLAN that permits only access to the quarantine server 14 to the client device TM10 that is not permitted to perform network authentication, for example, by using an authentication VLAN (Virtual Local Area Network) function or the like.

[0046] In addition, the administrator registers in advance standard information 41 based on the security policy, etc., in the quarantine management table 21 in the quarantine server 14 as shown in Fig. 4A (step S10b). On this premise, the quarantine network system executes the processes from step S11 onward shown in Fig. 5.

[0047] First, the client device TM10 requests connection to the internal network 11 via the wireless AP 16 and the authentication switch ASW (step S11). At this time, the authentication switch ASW transmits the network connection request to the quarantine server 14 by the above-mentioned authentication VLAN function or a preset redirect function or the like. In response to the network connection request from the client device TM10, the quarantine server 14 requests the client device TM10 to execute the security inspection program 34 (step S12). Note that the network connection request means a connection request in a state in which connection to the internal network 11 is restricted.

[0048] In step S12, the quarantine server 14 makes the client device TM10 download the security inspection program 34 if it has not been downloaded yet. Specifically, the quarantine server 14 holds, for example, an executable file of the security inspection program in the memory 20. The quarantine server 14 displays a link or button for downloading the executable file in the memory 20 to the client device TM10 on the display 26 of the client device TM10, for example, a Web screen. When the user 17a selects the link or the like, the client device TM10 downloads the executable file from the quarantine server 14 to the memory 31 of the client device TM10.

[0049] Next, the client device TM10 starts the security inspection program 34 held in the memory 31 (step S13). At this time, the client device TM10 may automatically start the downloaded security inspection program 34 after downloading the execution file of the security inspection program 34 in step S12.

[0050] The download and start of the security inspection program 34 in steps S12 and S13 may be performed every time a network connection request is made from the client device TM10 in step S11. Alternatively, the quarantine server 14 may cause the client device TM10 to download the program when it receives the first network connection request from the client device TM10. In this case, when the quarantine server 14 receives the second or subsequent network connection request from the client device TM10, it may cause the client device TM10 to execute the downloaded security inspection program 34 unless an update or the like is made to the security inspection program 34.

[0051] Furthermore, the download source of the executable file of the security inspection program 34 does not have to be the quarantine server 14, but may be the business server 13, such as a file server, connected to the internal network 11. That is, the quarantine server 14 only needs to know the link to the download source. Thereafter, the client device TM10, more specifically, the processor 30 of the client device TM10 executes the security inspection program 34 to perform the processes of the following steps S14, S15, S18a-1, S18a-2, and S18b.

[0052] In step S14, the client device TM10 acquires property information 35 related to wireless communication with the wireless AP 16 as shown in FIG. 3. Then, the client device TM10 transmits information described in the predetermined target items 36a-36e included in the property information 35 as acquired information 37 to the quarantine server 14 (step S15). The quarantine server 14 receives the acquired information 37 from the client device TM10, and as described in FIG. 3 and FIG. 4A, compares the acquired information 37 with the reference information 41 registered in the quarantine management table 21 to determine whether the quarantine has passed or failed (step S16). Then, the quarantine server 14 transmits the result of the quarantine pass or fail determination to the client device TM10 (step S17).

[0053] If the pass / fail judgment result received in step S17 is pass, the client device TM10 notifies the user 17a that the quarantine has been passed by, for example, displaying a message stating "quarantine has been passed" on the display 26 (step S18a-1). Furthermore, the client device TM10 transmits a network authentication request to the authentication switch ASW (step S18a-2).

[0054] In step S18a-2, for example, when Web authentication is used, the client device TM10 displays an account input screen or the like on the display 26 in response to the response from the authentication switch ASW, and has the user 17a input account information. Then, the client device TM10 transmits a network authentication request based on the input account information to the authentication switch ASW. Note that the network authentication request may be transmitted using an OS or the like instead of the security inspection program 34 of the client device TM10.

[0055] The authentication switch ASW that has received the network authentication request performs network authentication processing (step S18a-3). In detail, the authentication switch ASW transmits, for example, a request to determine whether or not to permit network authentication based on the received account information to the authentication server 15. Then, the authentication switch ASW receives a determination result of the network authentication from the authentication server 15, and transmits the determination result to the client device TM10 (step S18a-4).

[0056] Furthermore, in step S18a-3, if the network authentication is determined to be permitted, the authentication switch ASW removes the network restriction on the client device TM10. Specifically, the authentication switch ASW assigns a VLAN with the network restriction removed to the client device TM10, for example, using an authentication VLAN function or the like. As a result, the client device TM10 becomes able to access, for example, the business server 13 or the like. On the other hand, if the network authentication is determined to be not permitted, the authentication switch ASW does not remove the network restriction. Note that the network authentication is not limited to Web authentication, and may be MAC address authentication, authentication using a digital certificate, or the like.

[0057] On the other hand, if the pass / fail judgment result received in step S17 is a fail, the client device TM10 notifies the user 17a of the quarantine failure, for example, by displaying a message on the display 26 stating that "quarantine for wireless AP has failed" (step S18b). Also, in this example, when the quarantine has failed, the client device TM10 does not transmit a network authentication request to the authentication switch ASW, unlike when the quarantine has passed. As a result, network authentication is not performed, and the network restriction is not lifted.

[0058] However, the method is not limited to this, and for example, a method may be used in which the authentication switch ASW does not release the network restriction regardless of the presence or absence of a network authentication request. That is, the authentication switch ASW can recognize that the quarantine for the client device TM10 has failed by the processing of step S17. In this case, even if the authentication switch ASW subsequently receives a network authentication request from the client device TM10, it does not perform the network authentication processing in step S18a-3.

[0059] Also, in step S18b, the client device TM10 may notify the administrator of the quarantine failure by email or the like in addition to the user 17a. In this case, the client device TM10 may notify the user 17a and the administrator, including the cause of the quarantine failure. As a specific example, assume that the entry "2" is hit in FIG. 4A, and the encryption method standard information 41 is CCMP.

[0060] If the quarantine server 14 receives TKIP as the acquired information 37 of the target item 36e, it determines that the quarantine has failed, and in step S17 transmits information to the client device TM10 indicating that "the encryption method is not CCMP, so the quarantine has failed." The user 17a who has referred to this information may be able to deal with the problem by, for example, changing the encryption method setting of the communication IF 32 of the client device TM10, more specifically, the wireless LAN slave device, to CCMP.

[0061] On the other hand, the root cause of the quarantine failure may be, for example, a setting defect in the wireless AP 16. As a specific example, the wireless AP 16 may be set to use both CCMP and TKIP, and TKIP may be selected between the wireless AP 16 and the client device TM10, even though the encryption method should be set to CCMP only. In order to allow the administrator to verify the possibility of such a setting defect, it is desirable for the quarantine server 14 to notify the administrator of the cause of the quarantine failure. The notification to the administrator may be performed by the client device TM10.

[0062] <Modification of Quarantine Network System> Here, the authentication switch ASW is used to restrict network access, but instead, network access may be restricted by a personal firewall method, an authentication Dynamic Host Configuration Protocol (DHCP) method, an ARP (Address Resolution Protocol) spoofing method, etc. In this case, the authentication switch ASW is not required in FIG. 1.

[0063] The personal firewall method is a method that uses a personal firewall installed in the client device TM10 to restrict connection to the internal network 11. When this method is used, the quarantine server 14 determines whether the quarantine has passed or failed using the quarantine management table 21, as in step S16, and transmits the pass / fail determination result to the client device TM10 in step S17.

[0064] When the client device TM10 receives a notification from the quarantine server 14 that the quarantine has failed, the client device TM10 controls the personal firewall of the client device TM10 via the security inspection program 34 so as to keep the network restriction in an effective state. On the other hand, when the client device TM10 receives a notification from the quarantine server 14 that the quarantine has passed, the client device TM10 controls the personal firewall of the client device TM10 via the security inspection program 34 so as to release the network restriction.

[0065] The authentication DHCP method is a method that restricts connection to the internal network 11 using a DHCP server (not shown). When this method is used, the DHCP server, for example, assigns an IP address for inspection to the client device TM10 in advance, and assigns an IP address with the network restriction lifted if the quarantine is passed. When this method is used, the quarantine server 14 may also transmit the pass / fail judgment result to the DHCP server in step S17.

[0066] The ARP spoofing method is a method of restricting connection to the internal network 11 by connecting a sensor device to a normal layer 2 (L2) switch provided in place of the authentication switch ASW, for example. When starting communication, the client device TM10 normally obtains a MAC address corresponding to the IP address of the communication partner by an ARP command. At this time, the sensor device detects the ARP command from the client device TM10, and if the quarantine is unsuccessful, responds to the client device TM10 with its own MAC address, which is not a regular MAC address, etc. When this method is used, the quarantine server 14 may also transmit the pass / fail judgment result to the sensor device in step S17.

[0067] <Modifications of the download / launch method for security inspection programs> 5, the client device TM10 downloads and starts the security inspection program 34 in response to a network connection request in step S11, such as the launch of a web browser, as a trigger. Alternatively, the client device TM10 may download and start the security inspection program 34 by accessing the quarantine server 14 based on a logon script at the time of logon.

[0068] <Variations in Quarantine Timing> 5, quarantine is performed using the security inspection program 34, triggered by a network connection request sent from the client device TM10 to the quarantine server 14. However, the security inspection program 34 may be a resident program that constantly monitors wireless communication. In this case, the client device TM10 can use the security inspection program 34 to execute the processes of steps S14 and S15 not only when connecting to the network, but also when detecting dynamic switching of the wireless AP 16, for example. If the associated quarantine fails, the authentication switch ASW or the security inspection program 34 may block communication from the client device TM10.

[0069] <Security Inspection Program Details> Fig. 6 is a block diagram showing a detailed functional configuration example of the main parts of the client device TM in Fig. 1. The client device TM shown in Fig. 6 includes a property information acquisition unit 50, a pass / fail judgment request unit 51, a judgment result receiving unit 52, and a network authentication request unit 53 in addition to a communication interface 32 such as a wireless LAN interface. Each of these units is realized by the processor 30 of the client device TM executing a security inspection program 34 in the memory 31. That is, the security inspection program 34 causes the computer 25 to function as the property information acquisition unit 50, the pass / fail judgment request unit 51, the judgment result receiving unit 52, and the network authentication request unit 53.

[0070] 5, the property information acquisition unit 50 acquires property information 35 related to wireless communication with the wireless AP 16. The pass / fail judgment request unit 51 transmits a pass / fail judgment request based on the acquired information 37 to the quarantine server 14, using information described in one or more target items included in the acquired property information 35 as acquired information 37, as shown in step S15 in FIG.

[0071] 5, the determination result receiving unit 52 receives the pass / fail determination result of the quarantine from the quarantine server 14. As shown in step S18a-2 in FIG 5, the network authentication request unit 53 transmits a network authentication request to the authentication switch ASW when the pass / fail determination result of the quarantine is pass.

[0072] <Quarantine server details> Fig. 7 is a block diagram showing a detailed functional configuration example of the main parts of the quarantine server 14 in Fig. 1. The quarantine server 14 shown in Fig. 7 includes a connection request receiving unit 55, a pass / fail determining unit 56, and a memory 20. Each of these units is realized, for example, by a processor of the quarantine server 14 executing a quarantine management program (not shown) in the memory 20. However, each of these units is not limited to being implemented by such software, and may be realized by hardware such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC), or may be realized by a combination of software and hardware.

[0073] The memory 20 holds a quarantine management table 21 in which reference information 41 for each security inspection item 40a-40e is registered, as shown in Fig. 4A. The memory 20 also holds an executable file 58 of a security inspection program to be downloaded to the client device TM. Although not shown in the figure, the memory 20 also holds, in detail, ID management tables 45a, 45b, and 45c as shown in Fig. 4B.

[0074] 5, the connection request receiving unit 55 receives a connection request from the client device TM to the internal network 11 via the authentication switch ASW. In response to the connection request, the connection request receiving unit 55 requests the client device TM to execute the security inspection program 34. At this time, as described in step S12, if the security inspection program 34 has not been downloaded to the client device TM, the connection request receiving unit 55 causes the client device TM to download the security inspection program 34.

[0075] Specifically, the connection request receiving unit 55 causes the client device TM to display, for example, a screen for downloading an executable file 58 of the security inspection program stored in the memory 20 to the client device TM, for example, a screen including a link or button to the executable file 58. When the user 17 selects the link or the like, the client device TM downloads the security inspection program 34 from the quarantine server 14 and executes it.

[0076] 5, when the pass / fail determination unit 56 receives the acquired information 37 from the client device TM, the pass / fail determination unit 56 compares the acquired information 37 with the reference information 41 in the quarantine management table 21 to determine whether the quarantine has passed or failed. Then, the pass / fail determination unit 56 transmits the pass / fail determination result to the client device TM via the authentication switch ASW. More specifically, the pass / fail determination unit 56 acquires an ID corresponding to the acquired information 37 based on the ID management tables 45a, 45b, and 45c, and compares the acquired ID with an ID registered as the reference information 41 in the quarantine management table 21.

[0077] <Main Effects of the First Embodiment> As described above, in the method of the first embodiment, information regarding wireless communication with the wireless AP 16 is acquired by the client device TM, and the acquired information is verified by the quarantine server 14. This makes it possible to realize not only quarantine of the client device TM, but also quarantine of the wireless AP 16, and to verify the authenticity of the wireless AP 16 and the confidentiality of the wireless communication path. As a result, it becomes possible to improve the security of the network including the wireless AP 16.

[0078] (Second embodiment) <Quarantine pass / fail determination method> FIG. 8A is a schematic diagram showing a configuration example of a quarantine management table 21b held by a quarantine server 14 in a quarantine network system according to the second embodiment. FIG. 8B is a diagram showing an example of registration contents of a level management table associated with the quarantine management table 21b shown in FIG. 8A. The configuration of the quarantine network system according to the second embodiment is the same as the configuration shown in FIG. 1. However, the quarantine server 14 holds a quarantine management table 21b as shown in FIG. 8A in the memory 20. Further, the quarantine server 14 also holds level management tables 65a, 65b, 65c as shown in FIG. 8B in the memory 20.

[0079] The level management tables 65a, 65b, 65c shown in FIG. 8B define the relationship between the information that can be registered within each security inspection item representing the wireless connection method, wireless authentication standard, and encryption method, and the permission level. The level management table 65a is for the wireless connection method and is preset, for example, such that the permission level increases in the order of IEEE802.11a < b < g < n < ac. The level management table 65b is for the wireless authentication standard and is preset, for example, such that the permission level increases in the order of WEP < WPA < WPA2 < WPA3. The level management table 65c is for the encryption method and is preset, for example, such that the permission level increases in the order of WEP < TKIP < CCMP.

[0080] Also, different from the quarantine management table 21 shown in FIG. 4A, in the quarantine management table 21b shown in FIG. 8A, the reference permission level instead of the ID is registered as the reference information 61 within the security inspection items 60c - 60e representing the wireless connection method, wireless authentication standard, and encryption method. The quarantine server 14 executes the processes of steps S15 and S16 shown in FIG. 5 using such a quarantine management table 21b and level management tables 65a, 65b, 65c.

[0081] In detail, when the quarantine server 14 receives the acquired information 37 from the client device TM10, it acquires the permission level of the acquired information 37 based on the level management tables 65a, 65b, and 65c. Then, the quarantine server 14 judges whether the quarantine has passed or failed by comparing the acquired permission level with the reference permission level in the quarantine management table 21b. Specifically, for example, if the acquired permission level is equal to or higher than the reference permission level, the quarantine server 14 judges the quarantine to have passed, and if the acquired permission level is lower than the reference permission level, the quarantine server 14 judges the quarantine to have failed.

[0082] As a specific example, assume that the quarantine server 14 receives the MAC address "MA02", the SSID "SS02", and the encryption method "CCMP" as the acquired information 37. For simplicity of explanation, the wireless connection method and the wireless authentication standard are ignored. In this case, the quarantine server 14 acquires "Level 4" as the permission level corresponding to "CCMP" based on the level management table 65c. Meanwhile, in the quarantine management table 21b, the entry "2" is hit, and "Level 2" is registered as the standard permission level for the encryption method.

[0083] The quarantine server 14 judges that the quarantine has been passed because the permission level "Level 4" acquired based on the level management table 65c is higher than the reference permission level "Level 2" registered in the quarantine management table 21b. On the other hand, if the quarantine server 14 receives "WEP" as the encryption method acquisition information 37, the permission level for "WEP" is "Level 1", so it judges that the quarantine has been failed.

[0084] <Quarantine server details> Fig. 9 is a block diagram showing a detailed functional configuration example of the main parts of the quarantine server 14 in the quarantine network system according to the second embodiment. The quarantine server 14 shown in Fig. 9 differs from the configuration example shown in Fig. 7 in the following points. As a first difference, the memory 20 holds the quarantine management table 21b shown in Fig. 8A, and further holds each level management table 65 shown in Fig. 8B. As a second difference, a pass / fail determination unit 56b different from that in Fig. 7 is provided.

[0085] As described above, when the pass / fail determination unit 56b receives the acquisition information 37 from the client device TM, the pass / fail determination unit 56b obtains the permission level of the acquisition information 37 based on the level management table 65. Then, the pass / fail determination unit 56b determines whether the quarantine has passed or failed by comparing the obtained permission level with the reference permission level in the quarantine management table 21b.

[0086] <Main Effects of the Second Embodiment> As described above, the method of the second embodiment can provide the same effects as those described in the first embodiment. Furthermore, compared to the method of the first embodiment, the management of the quarantine management table 21b by the administrator and the pass / fail judgment process of the quarantine by the quarantine server 14 can be simplified. That is, for example, it is possible to register multiple IDs as the reference information 41 for each security inspection item 40c-40e in FIG. 4A. In this case, the management of the table by the administrator becomes complicated, and further, in the pass / fail judgment process, one ID obtained from the acquired information 37 needs to be compared with multiple IDs. The method of the second embodiment can solve such problems.

[0087] The invention made by the present inventor has been specifically described above based on the embodiments, but the present invention is not limited to the above-mentioned embodiments and can be modified in various ways without departing from the gist of the invention. For example, the above-mentioned embodiments have been described in detail to easily explain the present invention, and the present invention is not necessarily limited to those having all of the configurations described. In addition, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0088] For example, the various programs described above may be stored in a non-transitory, tangible, computer-readable recording medium and then supplied to a computer. Examples of such recording media include magnetic recording media such as hard disk drives, optical recording media such as DVDs (Digital Versatile Discs) and Blu-ray Discs, and semiconductor memories such as flash memories. [Explanation of symbols]

[0089] 11: internal network, 14: quarantine server, 16: wireless access point, 20, 31: memory, 21, 21b: quarantine management table, 25: computer, 34: security inspection program, 35: property information, 36a-36e: target items, 37: acquired information, 40a-40e, 60c-60e: security inspection items, 41, 61: standard information, 50: property information acquisition unit, 51: pass / fail judgment request unit, 52: judgment result receiving unit, 53: network authentication request unit, 55: connection request receiving unit, 56, 56b: pass / fail judgment unit, 65: level management table, ASW: authentication switch, TM: client device

Claims

1. A client device; a wireless access point that mediates wireless access from the client device to a network; a quarantine server that inspects the client device and determines whether the client device passes quarantine based on the inspection result; A quarantine network system comprising: The client device includes: When connecting to the network via the wireless access point, property information regarding wireless communication with the wireless access point is acquired; Transmitting information described in one or more target items included in the property information to the quarantine server as acquired information; The quarantine server includes: a quarantine management table is maintained in which the one or more target items are set as security inspection items and standard information for each of the security inspection items is registered; when receiving the acquired information from the client device, the acquired information is compared with the reference information to determine whether the quarantine has been passed or not. Quarantine network system.

2. 2. The quarantine network system according to claim 1, The security inspection item includes an item representing a MAC address or an SSID of the wireless access point. Quarantine network system.

3. 2. The quarantine network system according to claim 1, The security inspection item includes an item representing at least one of a wireless connection method, a wireless authentication method, and an encryption method; Quarantine network system.

4. 4. The quarantine network system according to claim 3, The quarantine server includes: a level management table that defines the relationship between information that can be registered in the security inspection items and permission levels; A standard permission level is registered in the standard information in the quarantine management table, When receiving the acquired information from the client device, the permission level of the acquired information is acquired based on the level management table; comparing the acquired permission level with the reference permission level in the quarantine management table; Quarantine network system.

5. 2. The quarantine network system according to claim 1, The client device is implemented as a computer, the quarantine server requests the client device to execute a security inspection program when the client device requests connection to the network; The client device executes the security inspection program, a property information acquisition unit for acquiring the property information; a pass / fail judgment request unit that transmits a request for a quarantine pass / fail judgment based on the acquired information included in the property information to the quarantine server; A judgment result receiving unit that receives a quarantine pass / fail judgment result from the quarantine server; Functions as Quarantine network system.

6. 6. The quarantine network system according to claim 5, an authentication switch connected between the wireless access point and the network, for performing network authentication of the client device; By executing the security inspection program, the client device further functions as a network authentication request unit that transmits a network authentication request to the authentication switch when the quarantine pass / fail judgment result received by the judgment result receiving unit is pass. Quarantine network system.

7. A quarantine server that inspects a client device that connects to a network via a wireless access point and determines whether the client device passes quarantine based on the inspection result, The client device acquires property information related to wireless communication with the wireless access point, and transmits information described in one or more target items included in the property information to the quarantine server as acquired information, The quarantine server includes: a memory for holding a quarantine management table in which the one or more target items are security inspection items and standard information for each of the security inspection items is registered; a pass / fail determination unit that, when receiving the acquired information from the client device, compares the acquired information with the reference information to determine whether the quarantine has been passed or not; Equipped with Quarantine server.

8. The quarantine server according to claim 7, The security inspection item includes an item representing a MAC address or an SSID of the wireless access point. Quarantine server.

9. The quarantine server according to claim 7, The security inspection item includes an item representing at least one of a wireless connection method, a wireless authentication method, and an encryption method; Quarantine server.

10. The quarantine server according to claim 9, the memory holds a level management table that defines a relationship between information that can be registered in the security inspection items and permission levels; A standard permission level is registered in the standard information in the quarantine management table, the pass / fail determination unit, upon receiving the acquired information from the client device, acquires the permission level of the acquired information based on the level management table, and compares the acquired permission level with the reference permission level in the quarantine management table. Quarantine server.

11. The quarantine server according to claim 7, a connection request receiving unit that receives a connection request from the client device to the network and requests the client device to execute a security inspection program in response to the connection request; The security inspection program includes: a property information acquisition unit for acquiring the property information; a pass / fail judgment request unit that transmits a request for a quarantine pass / fail judgment based on the acquired information included in the property information to the quarantine server; A judgment result receiving unit that receives a quarantine pass / fail judgment result from the quarantine server; This is a program to function as a Quarantine server.

12. The quarantine server according to claim 11, The security inspection program includes: a network authentication request unit that transmits a network authentication request to an authentication switch when the quarantine pass / fail judgment result received by the judgment result receiving unit is pass; This is a program to further improve the functioning of the Quarantine server.

Images