Information processing device, information processing program, and information processing method

Abstract

This makes it easy to analyze the settings of firewall policies. [Solution] The information processing device according to the present invention comprises: a configuration file that describes a firewall policy that controls packet transmission based on a pre-configured policy; a policy format that shows a policy description pattern; an extraction unit that identifies an authorization record from the configuration file that corresponds to a policy containing authorization information that allows the firewall to transmit packets; and extracts source information and destination information from the authorization record; and a generation unit that generates first communication pattern information relating to a communication pattern permitted between the source and the destination based on the source information and destination information.

Claims

1. An extraction unit identifies, from the configuration file, a configuration file that describes the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format that shows the description pattern of the policy, an permission record corresponding to the policy that contains permission information that allows the firewall to transmit packets, and extracts source information and destination information from the permission record. A generation unit generates first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient. An information processing device equipped with the following features.

2. The system further includes a specification unit that calculates starting IP address information indicating the starting IP address with the smallest numerical value among multiple IP addresses contained in each subnet address, and ending IP address information indicating the ending IP address with the largest numerical value, and identifies target subnet address information indicating the target subnet address corresponding to the target IP address based on whether or not the target IP address exists in the IP addresses between the starting IP address and the ending IP address. The extraction unit determines whether at least one of the source information or the destination information is an IP address. If the extraction unit determines that at least one of the source information or the destination information is an IP address, the identification unit identifies subnet address information indicating the subnet address corresponding to at least one of the source information or the destination information that is an IP address. The generation unit generates the first communication pattern information which includes subnet address information corresponding to the source information or subnet address information corresponding to the destination information. The information processing apparatus according to claim 1.

3. The generation unit generates the first communication pattern information relating to a subnet address-based communication pattern permitted between the source subnetwork and the destination subnetwork. The information processing apparatus according to claim 1.

4. The extraction unit further extracts from the permission record at least one of the following: destination port number information indicating the destination port number, or protocol information indicating the protocol type. The generation unit further generates the first communication pattern information based on at least one of the destination port number information or the protocol information. The information processing apparatus according to claim 1.

5. The generation unit generates second communication pattern information based on the first communication pattern information, which includes source category information indicating a category corresponding to the source subnetwork and destination category information indicating a category corresponding to the destination subnetwork. The information processing apparatus according to claim 1.

6. The generation unit generates the second communication pattern information relating to category-based communication patterns permitted between the source category corresponding to the source category information and the destination category corresponding to the destination category information. The information processing apparatus according to claim 5.

7. The system further includes a display unit that outputs the second communication pattern information in a table format showing the relationship between the source category and the destination category. The information processing apparatus according to claim 6.

8. An extraction procedure that, based on a configuration file describing the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format indicating the description pattern of the policy, identifies an authorization record corresponding to the policy that contains authorization information allowing the firewall to transmit packets from the configuration file, and extracts source information and destination information from the authorization record. A generation procedure for generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, An information processing program that causes a computer to execute something.

9. An information processing method implemented by a program executed by an information processing device, An extraction step of identifying an authorization record corresponding to the policy, which contains authorization information that allows the firewall to transmit packets, from the configuration file, based on a configuration file that describes the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format that shows the description pattern of the policy, and extracting source information and destination information from the authorization record. A generation step of generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, Information processing methods including

Images