Communication requirements generation system and communication requirements generation method

Abstract

To provide a communication requirements generation system capable of easily generating communication requirements.SOLUTION: The communication requirements generation system includes: a storage unit that stores definition information for calculating the logical distance between components that communicate in a predetermined network; a determination unit that, based on the definition information stored in the storage unit, calculates the logical distance between a component and a component to communicate with for each of the multiple communication requirements of components connected to the network, and based on the calculated distance, determines whether the communication requirements require confirmation by a network operator; and an output unit that outputs the communication requirements determined as communication requirements that require confirmation by the network operator.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention generally relates to techniques for generating communication requirements. [Background technology]

[0002] In recent years, with the spread of cloud services, there are an increasing number of situations where objects that need to be protected exist on the Internet. Traditionally, networks (NWs) were defined as trusted inside and untrusted outside, and access was controlled by boundary firewalls (FWs). However, as objects that need to be protected are now scattered in various places, the boundaries between inside and outside have become blurred, and it is becoming difficult to take sufficient measures with traditional access controls. Recently, zero trust, in which internal networks are not unconditionally trusted and access control is performed for communications on internal networks using distributed FWs, etc., has become widespread.

[0003] Furthermore, with the rapid changes in the business environment, companies are being asked to add and modify application programs (APPs) more quickly. Traditionally, APPs have been designed as one large block containing all functions. However, traditional development methods are unable to respond to requests quickly. In this regard, attention is being paid to microservices, which allow for the efficient development of large, complex APPs function by function (component). In microservices, individual components have low dependency relationships, and each service is called via the network.

[0004] As such, the popularity of zero trust and microservices is increasing the number of components connected to networks, and there are more and more cases where a distributed firewall is introduced for each component, placing a greater burden on network operators who have to set communication requirements indicating communications between components in the distributed firewall.

[0005] In this regard, a network requirement generation system that automatically generates communication requirements has been disclosed (see Patent Document 1). [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent No. 7136719 Summary of the Invention [Problem to be solved by the invention]

[0007] According to the network requirement generation system described in Patent Document 1, communication requirements are automatically generated, so the burden of generating communication requirements is reduced. However, there is a problem that the NW operator must check whether or not communication is permitted for all of the generated communication requirements.

[0008] The present invention has been made in consideration of the above points, and aims to propose a communication requirement generation system etc. that can easily generate communication requirements. [Means for solving the problem]

[0009] In order to solve this problem, the present invention provides a component that communicates in a predetermined network. Definition information for calculating a logical distance between components that communicate in the network Security level condition information indicating conditions for determining a security level that indicates the strength of security of and an input unit that inputs information used to determine a security level of a component as information on a component connected to the network; a determination unit that determines a security level of the component from the information on the component connected to the network input by the input unit and security level condition information stored in the storage unit; Connected to a network For each of a plurality of communication requirements related to the component, Calculating a logical distance between the component and a communication partner component of the component based on the definition information stored in the storage unit, and The security level of said component andThe present invention provides a determination unit that determines whether or not a communication requirement requires confirmation by an operator of the network based on the above, and an output unit that outputs a communication requirement that is determined by the determination unit to be a communication requirement requiring confirmation by an operator of the network.

[0010] In the above configuration, whether or not a communication requirement requires confirmation by a network operator is determined according to the logical positional relationship between a component connected to the network and a communication partner component. With the above configuration, for example, a plurality of communication requirements related to components connected to the network are narrowed down to communication requirements requiring confirmation by the network operator, thereby reducing the burden on the network operator of setting communication requirements in the firewall. Effect of the Invention

[0011] According to the present invention, it is possible to improve the convenience of the communication requirement generation system. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiment. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 illustrates an example of a configuration of a communication management system according to a first embodiment. [Diagram 2] FIG. 1 is a diagram illustrating an example of a hardware configuration of a communication requirement generation system according to a first embodiment. [Diagram 3] FIG. 4 is a diagram showing an example of template information according to the first embodiment. [Figure 4] FIG. 4 is a diagram showing an example of security level information according to the first embodiment. [Diagram 5] FIG. 4 is a diagram illustrating an example of node information according to the first exemplary embodiment. [Figure 6] FIG. 2 is a diagram showing an example of a tree structure according to the first embodiment; [Figure 7] FIG. 11 illustrates an example of a communication requirement generation process according to the first embodiment; [Figure 8] FIG. 11 illustrates an example of a communication requirement generation process according to the first embodiment; [Figure 9] FIG. 2 is a diagram showing an example of an input screen according to the first embodiment. [Figure 10] FIG. 2 is a diagram showing an example of an input screen according to the first embodiment. [Figure 11] FIG. 2 is a diagram showing an example of a security cost list according to the first embodiment. [Figure 12] FIG. 11 is a diagram showing an example of a confirmation screen according to the first embodiment. [Figure 13] FIG. 4 is a diagram illustrating an example of FW setting information according to the first embodiment. [Figure 14] FIG. 2 is a diagram illustrating an example of communication management according to the first embodiment. [Figure 15] FIG. 11 illustrates an example of a packet control process according to the second embodiment. [Figure 16] FIG. 13 is a diagram illustrating an example of a tree structure generating process according to the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] (I) First embodiment An embodiment of the present invention will be described in detail below, however, the present invention is not limited to the embodiment.

[0014] The communication requirement generation system of this embodiment determines the security level of a component based on the information of the component. Also, the communication requirement generation system specifies the logical distance between a component connected to the NW and a component with which the component is communicating based on a tree structure in which the logical distance between the components is specified, and identifies and outputs a communication requirement that requires confirmation by a NW operator (e.g., a communication requirement with a high security risk) from among multiple communication requirements based on at least one of the determined security level and the specified logical distance.

[0015] A component is software or hardware communicatively connected to a NW, such as an APP, an APP function, a specified terminal, etc. Component information includes at least one of the business type, the component type, the type of data handled by the component (personal information, confidential information, etc.), and the presence or absence of Internet communication, and the behavior of the component (e.g., resource usage by the component), etc.

[0016] The logical distance between components is not the physical distance between the components (the number of passes through switches, routers, etc.), but a value calculated by taking into account the number of nodes between the components and the security cost of each node. A node is each component when the logical structure of components within an enterprise is expressed in a tree structure, such as a company, department, or system. The security cost is a value for evaluating security risk, and is, for example, a numerical value defined corresponding to the security level, which is added when communication between components passes through each node. The security level is the degree of security strength of each node, determined according to the characteristics of each node.

[0017] According to the above configuration, for example, a communication requirement that is identified as being logically distant between a component connected to the network and a communication partner component is output, so that the network operator can easily select whether or not to communicate with a communication requirement that has a high security risk, thereby reducing the burden on the network operator of configuring the distributed FW.

[0018] Here, if the security level of the components connected to the network is freely set by the component developers, the settings of the distributed firewall will no longer be suitable for the company's security policy.

[0019] In this regard, the present communication requirement generation system determines the security level of the communication requirement based on the component information entered by the component developer. The communication requirement generation system identifies the communication requirement that requires confirmation by the NW operator based on the security level and logical distance. With the above configuration, the security level of the component connected to the NW is automatically set, so that it is possible to avoid a situation where the distributed FW settings are not suitable for the company's security policy.

[0020] In addition, even if the security level of the components connected to the network is determined, there is still the problem of having to reflect the security level in relation to the communication requirements and determine what should be set in the distributed firewall.

[0021] In this regard, the communication requirement generation system calculates the security cost between the component connected to the NW and the communication partner of the component after taking into consideration the security level of the component, and judges whether each communication requirement is a communication requirement that requires confirmation by the NW operator. According to the above configuration, the security cost between the component and the communication partner, calculated based on the security level of the component, is taken into consideration and the communication requirement that requires confirmation by the NW operator is judged, so that the NW operator can easily check the communication requirements that reflect the security level.

[0022] In this specification, the designations "first," "second," "third," and the like are used to identify components and do not necessarily limit the number or order. Furthermore, numbers for identifying components are used in different contexts, and a number used in one context does not necessarily indicate the same configuration in another context. Furthermore, a component identified by a certain number is not prevented from also having the function of a component identified by another number.

[0023] Next, an embodiment of the present invention will be described based on the drawings. The following description and drawings are examples for explaining the present invention, and are omitted and simplified as appropriate for clarity of explanation. For example, a component is written as APP, a distributed FW is written as FW, and a virtual NW is written as NW. The present invention can also be implemented in various other forms. Unless otherwise specified, each component may be singular or plural. In the following description, the same elements in the drawings are given the same numbers, and the description is omitted as appropriate.

[0024] FIG. 1 is a diagram showing an example of a configuration of a communication management system 100 according to the present embodiment.

[0025] The communication management system 100 is a system for managing communications by APPs connected to a predetermined NW, and includes a communication requirement generating system 110, a communication requirement receiving unit 120, and a communication requirement setting unit .

[0026] The communication requirement generation system 110 is a physical machine, a virtual machine, a cloud system, or the like, and includes an input unit 111, a determination unit 112, a judgment unit 113, an output unit 114, and a storage unit 115. The hardware configuration of the communication requirement generation system 110 will be described in detail with reference to FIG. 2.

[0027] The input unit 111 inputs various information instructed by an APP developer, and various information instructed by a NW operator. For example, the input unit 111 inputs APP information 116, which is information about the security level of an APP, and APP images 117, such as a virtual machine file and a container image. The template information related to the input of the APP information 116 will be described in detail with reference to FIG. 3.

[0028] The determination unit 112 determines the security level of the APP from at least one of the APP information 116 and the information indicating the behavior of the APP, using the security level information 118. The following mainly describes an aspect in which the security level of the APP is determined using the APP information 116.

[0029] Here, the information indicating the behavior of an APP includes the traffic volume of packets received or transmitted by the APP, the number of TCP (Transmission Control Protocol) connections, the amount of resources (CPU, memory, disk, etc.) used by the APP, etc. The amount of resources may be a predicted value when a component is newly added, and may be an actual measured value when a component is moved. Additionally, the determination unit 112 may determine that the larger the amount of resources is, the more important the APP is, and set the security level of the APP higher. The security level information 118 will be described in detail with reference to FIG. 4.

[0030] The determination unit 113 uses the node information 119 and the like to convert the communication requirements 150 (input) accepted by the communication requirement acceptance unit 120 into communication requirements 160 (output) that require confirmation by the NW operator. For example, the determination unit 113 compares the security cost of each communication requirement with the communication cost that is unconditionally permitted, and deletes the communication requirements that are determined to have a small security cost by assuming that they have been unconditionally permitted in advance, and sets the communication requirements that are determined to have a large security cost as the communication requirements 160. The node information 119 will be described in detail with reference to Figs. 5 and 6.

[0031] Here, as shown in communication requirement 150 and communication requirement 160, a communication requirement is composed of an item number (#), source, destination, and service information. The item number information is identification information for identifying a communication requirement. The source information is information (name, IP address, etc.) indicating the source of the communication. The destination information is information (name, IP address, etc.) indicating the destination (destination) of the communication. The service information is information identifying the service used in the communication (for example, the L4 protocol (TCP / UDP), which is the protocol of the fourth layer of the OSI reference model, and a port number).

[0032] The output unit 114 outputs the information of the communication requirement 160 converted by the determination unit 113. A final decision (e.g., input of whether or not to permit communication of the communication requirement) is made by a NW operator on the basis of the output information of the communication requirement 160. Then, the output unit 114 outputs the communication requirement on which the final decision has been made by the NW operator to the communication requirement setting unit 130.

[0033] The communication requirement reception unit 120 receives at least one of a communication requirement 121 (user) generated by a user and a communication requirement 122 (system) generated by a predetermined system. The communication requirement reception unit 120 transmits the received communication requirement 121 and / or the communication requirement 122 as a communication requirement 150 to the communication requirement generation system 110.

[0034] The communication requirement setting unit 130 includes a host 131 and a FW setting system 132. The host 131 is software and / or hardware that realizes a predetermined NW (e.g., a virtual NW) and a predetermined FW (e.g., a distributed FW). The host 131 may be a cloud service, a hypervisor, a runtime, or the like. The FW setting system 132 sets the communication requirements output by the communication requirement generation system 110 in FW setting information (described later) that the host 131 refers to when controlling communication.

[0035] FIG. 2 is a diagram showing an example of a hardware configuration of the communication requirement generation system 110. As shown in FIG.

[0036] The communication requirement generation system 110 is communicably connected to a user terminal 202, a NW device 203, a FW setting system 132, etc., via a NW 201. The user terminal 202 is a terminal operated by an APP developer, a NW operator, etc. The NW device 203 is a device that provides a predetermined NW, a host 131, etc. The NW device 203 may be a device that constitutes the NW 201.

[0037] The communication requirement generation system 110 includes a processor 211 , a memory 212 , a storage device 213 , an input IF 214 , an output IF 215 , and a communication IF 216 .

[0038] The processor 211 is a device that performs arithmetic processing. The processor 211 is, for example, a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), an artificial intelligence (AI) chip, or the like.

[0039] The memory 212 is a device that stores programs, data, etc. The memory 212 is, for example, a read only memory (ROM), a random access memory (RAM), etc. The ROM is, for example, a static random access memory (SRAM), a non-volatile RAM (NVRAM), a mask read only memory (mask ROM), a programmable ROM (PROM), etc. The RAM is, for example, a dynamic random access memory (DRAM), etc.

[0040] The storage device 213 is a hard disk drive, a flash memory, a solid state drive (SSD), an optical storage device, etc. The optical storage device is a compact disc (CD), a digital versatile disc (DVD), etc. The programs, data, etc. stored in the storage device 213 are read into the memory 212 as needed.

[0041] The input IF 214 is a user interface that accepts information from a user, and is connected to input devices such as a keyboard 221, a mouse 222, a card reader, and a touch panel.

[0042] The output IF 215 is a user interface that outputs various types of information (display output, audio output, print output, communication, etc.) The output IF 215 is connected to output devices such as a display device 231, an audio output device (speaker), a printer, and a communication device.

[0043] The communication IF 216 is a communication interface that communicates with other devices via a communication medium such as the NW 201. The communication IF 216 is, for example, a network interface card (NIC), a wireless communication module, a universal serial bus (USB) module, a serial communication module, or the like.

[0044] Here, the functions of the communication requirement generation system 110 (the input unit 111, the decision unit 112, the judgment unit 113, the output unit 114, the storage unit 115, etc.) may be realized, for example, by the processor 211 reading a program stored in the storage device 213 into the memory 212 and executing it (software), or may be realized by hardware such as a dedicated circuit, or may be realized by a combination of software and hardware. Note that one function of the communication requirement generation system 110 may be divided into multiple functions, or multiple functions may be integrated into one function. Also, some of the functions of the communication requirement generation system 110 may be provided as a separate function, or may be included in another function. Also, some of the functions of the communication requirement generation system 110 may be realized by another computer capable of communicating with the communication requirement generation system 110. For example, the communication requirement generation system 110 may be configured to include a host 131.

[0045] FIG. 3 is a diagram showing an example of template information (template table 300) related to input of the APP information 116. As shown in FIG.

[0046] The template table 300 stores information for generating an input screen for the APP information 116 input via the user terminal 202. More specifically, the template table 300 stores records in which information such as an item number 301 (#), an overview 302, user input content 303, and a security level application example 304 are associated with each other.

[0047] The item number 301 stores identification information for identifying a record (information of user input content 303). The summary 302 stores information indicating a summary of the user input content 303. The user input content 303 stores information for inputting (e.g., inputting in a selectable manner) information used to determine the security level of an APP. The security level application example 304 stores information indicating an example of a security level that is applied when the information of the user input content 303 is selected.

[0048] The configuration of template table 300 is not limited to the above, and some of the above data items may not be included, or other data items may be included. For example, template table 300 may not include summary 302 and security level application example 304.

[0049] FIG. 4 is a diagram showing an example of the security level information 118 (security level table 400).

[0050] The security level table 400 stores information related to security levels. More specifically, the security level table 400 stores records in which the following information is associated: an item number 401 (#), a security level 402, an overview 403, a condition 404, an APP security cost 405, and a communication permission security cost 406.

[0051] Item number 401 stores identification information for identifying a record (information on security level 402). Security level 402 stores information indicating the security level (such as "high", "medium", "low", "1", "2", "3", etc.). Overview 403 stores information indicating an overview of the security level. Condition 404 stores information indicating the conditions that correspond to the security level. APP security cost 405 stores information indicating the value of the security cost assigned to the APP. Communication permission security cost 406 stores information indicating the value (threshold) of the security cost at which communication is permitted unconditionally.

[0052] The configuration of security level table 400 is not limited to the above, and some of the above data items may not be included, or other data items may be included. For example, security level table 400 may not include summary 403.

[0053] FIG. 5 is a diagram showing an example (node ​​table 500) of the node information 119 including information related to the nodes.

[0054] The node table 500 stores information for implementing a tree structure using a relational database (RDB). In this embodiment, an adjacent list model is shown as a data model for expressing a tree structure using an RDB, but a route enumeration model, a closure table model, a nested set model, etc. may also be used. More specifically, the node table 500 stores records in which information on an item number 501 (#), a node 502, a parent node 503, and a security cost 504 are associated with each other.

[0055] In the item number 501, identification information for identifying a record (information of node 502) is stored. In the node 502, information indicating a node is stored. In the parent node 503, information indicating a parent node of the node 502 is stored. In the security cost 504, information indicating a value of a security cost assigned to the node 502 is stored.

[0056] FIG. 6 is a diagram illustrating an example of a tree structure (tree structure 600).

[0057] The tree structure 600 is information indicating the structure of a given network, and is represented by nodes (nodes, vertices) and edges (branches, sides) connecting the nodes, and is a tree having only one root. More specifically, the tree structure 600 includes a root node 601, a branch node 602, and a leaf node 603. The root node 601 is a node located at the top and has no parent node, and is the root of a network structure such as the Internet. The branch node 602 is a node having one or more child nodes, and is a logical group (the higher the node, the wider the group) that groups together APPs such as departments and systems within a company. The leaf node 603 is a node located at the end and has no child nodes, and is an APP, a server device, a user terminal, etc. In this embodiment, a security cost is set for each node, and the number in parentheses for each node in FIG. 6 indicates the security cost.

[0058] 7 and 8 are diagrams illustrating an example of the communication requirement generation process.

[0059] In step S701, the input unit 111 inputs the APP information 116 of the APP connected to a predetermined NW via an input device, the user terminal 202, or the like.

[0060] In step S702, the input unit 111 inputs an APP image 117 of an APP connected to a predetermined NW via an input device, the user terminal 202, or the like.

[0061] For example, an APP developer inputs APP information 116 and APP image 117 via an input screen displayed on user terminal 202. Input unit 111 receives the APP information 116 and APP image 117 from user terminal 202, and stores (stores) the received APP information 116 and APP image 117. The input screen for inputting APP information 116 and APP image 117 will be described in detail with reference to FIG. 9.

[0062] In step S703, the input unit 111 inputs the communication requirements 150 of the APP via an input device, the communication requirement receiving unit 120, the user terminal 202, etc. For example, an APP developer inputs the communication requirements 150 via an input screen displayed on the user terminal 202, and the input unit 111 receives the communication requirements 150 from the user terminal 202. The input screen for inputting the communication requirements 150 will be described in detail with reference to FIG.

[0063] In step S704, the input unit 111 determines whether or not a security level (for example, the value of the security level 402 in the security level table 400) is defined. If the input unit 111 determines that the security level is not defined, the process proceeds to step S705, and if the input unit 111 determines that the security level is defined, the process proceeds to step S706.

[0064] In step S705, the input unit 111 inputs a security level via an input device, the user terminal 202, etc. For example, the NW operator inputs a value of the security level 402 in the security level table 400 via the user terminal 202, and the input unit 111 stores the input value in the security level 402 in the security level table 400.

[0065] In step S706, the input unit 111 determines whether or not a security level determination condition (e.g., the value of the condition 404 in the security level table 400) that is a condition used to determine the security level is defined. If the input unit 111 determines that the security level determination condition is not defined, the process proceeds to step S707, and if the input unit 111 determines that the security level determination condition is defined, the process proceeds to step S708.

[0066] In step S707, the input unit 111 inputs a judgment condition for a security level. For example, the NW operator inputs a value (condition, function, etc.) of the condition 404 in the security level table 400 via the user terminal 202, and the input unit 111 stores the input value in the condition 404 in the security level table 400.

[0067] In step S708, the input unit 111 determines whether or not a security cost corresponding to the security level (for example, the value of the APP security cost 405 and the communication permission security cost 406 in the security level table 400) is defined. If the input unit 111 determines that a security cost corresponding to the security level is not defined, the process proceeds to step S709, and if the input unit 111 determines that a security cost corresponding to the security level is defined, the process proceeds to step S710.

[0068] In step S709, the input unit 111 inputs a security cost corresponding to the security level. For example, the NW operator inputs values ​​of the APP security cost 405 and the communication permission security cost 406 in the security level table 400 via the user terminal 202, and the input unit 111 stores the input values ​​in the APP security cost 405 and the communication permission security cost 406 in the security level table 400.

[0069] In step S710, the determination unit 112 determines (judges) the security level of the APP based on the APP information 116 and the security level table 400.

[0070] For example, the determination unit 112 reads out the APP information 116 of an APP connected to a specified network, identifies a record in the security level table 400 in which the read out APP information 116 satisfies the condition 404 in the security level table 400, reads out the value of the security level 402 of the identified record, and determines the read out value as the security level of the APP.

[0071] In step S711, the input unit 111 determines whether or not a tree structure (for example, the values ​​of the node 502 and the parent node 503 in the node table 500) is defined. If the input unit 111 determines that the tree structure is not defined, it proceeds to step S712, and if it determines that the tree structure is defined, it proceeds to step S713.

[0072] In step S712, the input unit 111 inputs the tree structure via an input device, the user terminal 202, etc. For example, the NW operator inputs values ​​of the node 502 and the parent node 503 in the node table 500 for each node in the tree structure via the user terminal 202. The input unit 111 stores the input values ​​in the node 502 and the parent node 503 in the node table 500.

[0073] In step S713, the input unit 111 inputs the position of the APP as a node in the tree structure via an input device, the user terminal 202, etc., in order to define the APP connected to the predetermined NW in the tree structure. For example, the NW operator inputs values ​​of the node 502 and the parent node 503 in the node table 500 via the user terminal 202 so that the APP indicates a node in the tree structure 600. The input unit 111 stores (adds) a record in which the input values ​​are set in the node 502 and the parent node 503 in the node table 500. At this time, the input unit 111 may specify a record in the security level table 400 corresponding to the security level based on the security level of the APP determined in step S710, read the value of the APP security cost 405 of the specified record, and store the read value in the security cost 504 of the added record.

[0074] In step S714, the input unit 111 determines whether or not the security cost of each node (for example, the value of the security cost 504 in the node table 500) is defined. If the input unit 111 determines that the security cost of each node is not defined, the process proceeds to step S715, and if the input unit 111 determines that the security cost of each node is defined, the process proceeds to step S801.

[0075] In step S715, the input unit 111 inputs the security cost of each node via an input device, the user terminal 202, or the like. For example, the NW operator inputs the values ​​of the security cost 504 of the node table 500 for the root node 601 and the branch node 602 via the user terminal 202. The input unit 111 stores the input value in the security cost 504 of the record in the node table 500. In addition, the input unit 111 determines the value of the security cost 504 of the node table 500 for the leaf node 603 based on the security level of the leaf node 603, and stores the determined value in the security cost 504 of the node table 500. For example, the input unit 111 identifies a record in the security level table 400 corresponding to the security level based on the security level of the APP (leaf node 603) determined in step S710, and executes a process of determining the value of the APP security cost 405 of the identified record as the security level of the leaf node 603 for each leaf node 603.

[0076] In step S801, the determination unit 113 repeats steps S802 to S804 until the security costs of all communication requirements 150 are calculated.

[0077] In step S802, the determination unit 113 extracts one of the communication requirements 150 input by the user.

[0078] In step S803, the determination unit 113 refers to the node table 500, calculates the security cost of the extracted communication requirement (the security cost between the source APP and the destination APP), and stores the calculated security cost in association with the extracted communication requirement.

[0079] For example, the determination unit 113 identifies the shortest path between APPs using a predetermined algorithm (for example, breadth-first search and bidirectional search) based on the tree structure 600. Next, the determination unit 113 calculates the sum of security costs of nodes included in the path, and stores the calculated value as the security cost of the communication requirement. More specifically, when the source of the extracted communication requirement is "application C" and the destination is "DNS", the determination unit 113 identifies the path "application C → Z system → Y department → X company → DNS". Then, the determination unit 113 calculates the sum of the security costs of each node, "10 (= 1 + 1 + 2 + 5 + 1)", and registers the calculated value in a security cost list. The security cost list will be described in detail with reference to FIG. 11.

[0080] In step S804, the determination unit 113 determines whether or not there is a communication requirement for which the security cost has not been calculated. If the determination unit 113 determines that there is a communication requirement, the process proceeds to step S802. If the determination unit 113 determines that there is no communication requirement, the process proceeds to step S805.

[0081] In step S805, the determination unit 113 identifies a security cost value "N" for which communication is unconditionally permitted, corresponding to the security level of the APP connected to the specified NW. For example, based on the security level of the APP determined in step S710, the determination unit 113 identifies a record in the security level table 400 corresponding to the security level, reads the value of the communication permission security cost 406 of the identified record, and sets the read value to "N."

[0082] In step S806, the determination unit 113 repeats steps S807 to S811 until it has determined whether or not all communication requirements 150 have been output.

[0083] In step S807, the determination unit 113 extracts one of the communication requirements 150 input by the user.

[0084] In step S808, the determination unit 113 refers to the security cost value "M" of the extracted communication requirement (the value registered in the security cost list in step S803).

[0085] In step S809, the determination unit 113 determines whether or not "M">"N" is satisfied (whether or not it is a communication requirement that requires confirmation from the NW operator). If the determination unit 113 determines that it is satisfied, the process proceeds to step S810, and if it determines that it is not satisfied, the process proceeds to step S811.

[0086] In step S810, the determination unit 113 registers the communication requirement extracted in step S807 in a communication requirement list. The communication requirement list will be described in detail with reference to FIG.

[0087] In step S811, the determination unit 113 determines whether there is a communication requirement for which the output presence / absence determination has not been made. If the determination unit 113 determines that there is a communication requirement, the process proceeds to step S807. If the determination unit 113 determines that there is no communication requirement, the process proceeds to step S812.

[0088] In step S812, the determination unit 113 outputs the communication requirement list to the user terminal 202 of the NW operator.

[0089] In step S813, the input unit 111 inputs permission or denial of the communication requirement via an input device, the user terminal 202, or the like. For example, the NW operator checks the communication requirement list and inputs a permission or denial value for each communication requirement via the user terminal 202, and the input unit 111 stores the input value in association with the communication requirement. Note that a confirmation screen for confirming each communication requirement in the communication requirement list will be described in detail with reference to FIG. 12.

[0090] FIG. 9 is a diagram showing an example of an input screen (input screen 900) for inputting the APP information 116 and the APP image 117. As shown in FIG.

[0091] The input screen 900 is provided with an input field 910 for inputting the APP information 116, and an input field 920 for inputting the APP image 117. The input field 910 is provided so that the APP developer can select the content stored in the user input content 303 of the template table 300. The APP image 117 is provided so that the APP developer can upload the APP image 117.

[0092] Via the above-mentioned input screen 900, the APP developer inputs the APP information 116 and the APP image 117.

[0093] FIG. 10 is a diagram showing an example of an input screen (input screen 1000) for inputting the communication requirement 150. As shown in FIG.

[0094] The input screen 1000 is provided with an input field 1010 for manually inputting the communication requirement 121, and an input field 1020 for inputting the communication requirement 122 generated by a predetermined system.

[0095] In the input field 1010, information on an item number 1011 (#), a source 1012, a destination 1013, and a service 1014 are entered. Identification information for identifying a record (communication requirement) is automatically entered in the item number 1011. Information (name, IP address, etc.) indicating the source of the communication is entered in the source 1012. Information (name, IP address, etc.) indicating the destination (destination) of the communication is entered in the destination 1013. Information (e.g., L4 protocol and port number) identifying the service used in the communication is entered in the service 1014.

[0096] The APP developer inputs the communication requirements 150 via the input screen 1000 described above.

[0097] FIG. 11 shows an example of a security cost list (security cost table 1110) and an example of a communication requirement list (communication requirement table 1120).

[0098] The security cost table 1110 is a table in which security costs are assigned to the communication requirements 150. The communication requirement table 1120 is a table for storing communication requirements with security costs higher than a threshold value set corresponding to the security level of the APP (communication requirements with high security risks, in other words, communication requirements that require confirmation by a NW operator).

[0099] For example, when the security cost of each communication requirement is calculated and stored as shown in security cost table 1110, when the threshold value corresponding to the security level of the APP is "10", a communication requirement with a security cost greater than "10" is selected as shown in communication requirement table 1120.

[0100] FIG. 12 is a diagram showing an example of a confirmation screen (confirmation screen 1200) for a NW operator to confirm the communication requirements output by the communication requirement generation system 110. As shown in FIG.

[0101] The confirmation screen 1200 is provided with a display field 1210 for displaying the communication requirements generated by the communication requirement generation system 110, and an input field 1220 for inputting the results of the NW operator's confirmation of the communication requirements. For example, the input field 1220 stores "permit" indicating that the communication of the communication requirement is permitted, or "reject" indicating that the communication of the communication requirement is rejected.

[0102] The communication requirements confirmed by the NW operator on the confirmation screen 1200 are passed to the FW setting system 132 via the NW operator (manually) or without the intervention of the NW operator (automatically).

[0103] FIG. 13 is a diagram showing an example of FW setting information (FW setting table 1300) set in the host 131 by the FW setting system 132. As shown in FIG.

[0104] The FW setting table 1300 stores information (rules) to be set in the FW. More specifically, the FW setting table 1300 stores records in which information such as an item number 1301 (#), a source 1302, a destination 1303, a service 1304, and an action 1305 is associated with each other.

[0105] The item number 1301 stores identification information for identifying a record (rule). The source 1302 stores information (such as a name and an IP address) indicating the source of communication. The destination 1303 stores information (such as a name and an IP address) indicating the destination (destination) of communication. The service 1304 stores information for identifying a service used in communication (for example, an L4 protocol and a port number). The action 1305 stores information indicating whether to permit or deny communication when the information of the source 1302, destination 1303, and service 1304 match. In this embodiment, "permit" is set for communication with a communication requirement having a security cost equal to or lower than a threshold value set corresponding to the security level of the APP, and the result of a final decision made by the NW operator ("permit" or "deny") is set for communication with a communication requirement having a security cost higher than the threshold value.

[0106] In the FW setting table 1300, a rule for rejecting all communications is set in the last record (rule), thereby implementing a whitelist-based FW.

[0107] FIG. 14 is a diagram illustrating an example of communication management.

[0108] In the communication management system 100, an entire virtual NW 1400 is realized by the host 131. As shown in the entire virtual NW 1400, an APP 1420 (component) runs on a specific machine 1410. The specific machine 1410 is connected to a specific NW 1430. The machine 1410 is a physical computer or a virtual computer, such as a physical server, a virtual machine, a container, or a mobile terminal. The NW 1430 is an example of a specific NW, and may be the same as the NW 201 or may be different.

[0109] The host 131 sets a distributed FW 1440 for each APP 1420 added or changed to the NW 1430, and manages communication between the APPs 1420. In the following, a method of managing communication will be described using an example in which a source APP 1420A transmits data to a destination APP 1420B. In this case, a FW setting table 1300 used by the host 131A that provides the distributed FW 1440 of the source APP 1420A and a FW setting table 1300 used by the host 131B that provides the distributed FW 1440 of the destination APP 1420B are provided. In addition, it is assumed that a rule for the distributed FW 1440 is input to the FW setting table 1300 by the user terminal 202 or the FW setting system 132 in response to an instruction from the NW operator 1450. In addition, the updated contents of the FW setting table 1300 of one host 131 are applied to the FW setting table 1300 of all the hosts 131.

[0110] Here, when source APP 1420A transmits data to destination APP 1420B, source APP 1420A passes a packet (divided data) to host 131A. At this point, no control of the packet is performed. Host 131A refers to its own FW setting table 1300 to determine whether the packet may be forwarded, and if it is determined that the packet may be forwarded, it performs packet forwarding processing, and if it is determined that the packet should not be forwarded, it blocks the packet. In the packet forwarding processing, host 131A forwards the packet based on the routing table.

[0111] The forwarded packet reaches host 131B via NW 1430 (L3 switch, L2 switch, etc.). Host 131B refers to its own FW setting table 1300 to determine whether the packet may be passed to destination APP 1420B. If host 131B determines that forwarding is permitted, it passes the packet to destination APP 1420B, and if it determines that forwarding is not permitted, it blocks the packet. Note that host 131B makes the same determinations as host 131A, and therefore packets are not generally blocked when passing through host 131B.

[0112] According to this embodiment, a highly convenient communication requirement generation system can be provided.

[0113] (II) Second embodiment The first embodiment is configured to register FW setting information (rules) for all input communication requirements, but the present embodiment is mainly different in that it is configured to register FW setting information for communication requirements with high security risks. In this embodiment, the configuration different from the first embodiment will be mainly described, and the description of the same configuration as the first embodiment will be omitted.

[0114] 15 is a diagram showing an example of packet control processing. The packet control processing is executed when the host 131 receives a packet. In the following, an example will be described in which the host 131A receives a packet from the source APP 1420A.

[0115] In step S1501, host 131A checks the source and destination of a packet transmitted from source APP 1420A to destination APP 1420B. For example, host 131A checks the IP address of source APP 1420A and the IP address of destination APP 1420B of the packet.

[0116] In step S1502, the host 131A calculates the security cost "M" between the source and destination. This process is similar to step S803, so a description thereof will be omitted.

[0117] In step S1503, the host 131A judges whether or not "M" > "N" is satisfied. If the host 131A judges that the condition is satisfied, it judges whether the packet may be forwarded by referring to its own FW setting table 1300, and if it judges that the packet may be forwarded, it performs packet forwarding processing, and if it judges that the packet may not be forwarded, it blocks the packet. On the other hand, if the host 131A judges that the condition is not satisfied, it performs packet forwarding processing.

[0118] In this embodiment, a security cost is calculated for each communication, and FW setting information is referenced when the calculated security cost is greater than a threshold value. This eliminates the need to register FW setting information with a security cost less than the threshold value, and makes it possible to avoid a situation in which the FW setting information becomes enormous.

[0119] (III) Third embodiment In the first embodiment, the NW operator registers all the information of the tree structure, but in the present embodiment, a part of the information of the tree structure is automatically registered. In the present embodiment, the configuration different from the first embodiment will be mainly described, and the description of the same configuration as the first embodiment will be omitted.

[0120] 16 is a diagram showing an example of the tree structure generation process, which is executed in place of step S712.

[0121] In step S1601, the input unit 111 reads information from a directory service. The information from the directory service is, for example, data from a tool (such as Active Directory) that manages resources such as users and PCs within a company.

[0122] In step S1602, the input unit 111 generates a tree structure (table and diagram) based on the directory service information read in step S1601.

[0123] In step S1603, the input unit 111 outputs the tree structure generated in step S1602 to the user terminal 202.

[0124] In step S1604, the input unit 111 modifies the tree structure in response to an instruction from the user terminal 202, and stores the modified tree structure.

[0125] In this embodiment, the information of the directory service is read and the tree structure data used in this system is generated, so that the burden on the NW operator who defines the tree structure can be reduced.

[0126] (IV) Supplementary Note The above-described embodiment includes, for example, the following contents.

[0127] In the above embodiment, the present invention is described as being applied to a communication requirement generation system, but the present invention is not limited to this and can be widely applied to various other systems, devices, methods, and programs.

[0128] In the above-described embodiment, a part or all of the programs may be installed from a program source into a device such as a computer that realizes the communication requirement generation system. The program source may be, for example, a program distribution server connected via a network or a computer-readable recording medium (e.g., a non-transitory recording medium). In the above description, two or more programs may be realized as one program, and one program may be realized as two or more programs.

[0129] Furthermore, in the above-described embodiments, the configuration of each table is an example, and one table may be divided into two or more tables, or all or part of two or more tables may be one table.

[0130] In the above embodiment, for convenience of explanation, the information related to the communication requirement generation system is explained using a table, but the data structure is not limited to a table. The information related to the communication requirement generation system may be expressed by a data structure other than a table, such as XML (Extensible Markup Language), YAML (YAML Ain't a Markup Language), a hash table, a tree structure, etc.

[0131] Furthermore, the screens shown and described in the above embodiment are merely examples, and any design may be used as long as the information received is the same.

[0132] Furthermore, the screens shown and described in the above embodiment are merely examples, and any design may be used as long as the information presented is the same.

[0133] In the above-described embodiment, the output of information is not limited to display on a display. The output of information may be audio output from a speaker, output to a file, printing on a paper medium or the like by a printing device, projection on a screen or the like by a projector, or other form.

[0134] In addition, in the above description, information such as programs, tables, files, etc. that realize each function can be placed in a storage device such as a memory, a hard disk, or an SSD (Solid State Drive), or in a recording medium such as an IC card, an SD card, or a DVD.

[0135] The above-described embodiment has the following characteristic configurations, for example.

[0136] (1) The communication requirement generation system (e.g., the communication requirement generation system 110) includes a storage unit (a storage unit 115, a function of the communication requirement generation system 110, a server device, a cloud system, etc.) that stores definition information (e.g., node information 119) for calculating logical distances (the number of nodes involved in communication, the path involved in communication, etc.) between components (a component, an APP, a function of an APP, a specified terminal, an APP 1420, etc.) that communicate in a specified network (a NW 1430, etc.), and for each of a plurality of communication requirements related to components connected to the above network, calculates a logical distance between the above components and the above components based on the definition information stored in the storage unit. The communication requirement generating system includes a determination unit (determination unit 113, a function of the communication requirement generating system 110, a server device, a cloud system, etc.) that calculates a logical distance between a component and a communication partner component of the component and determines whether or not the communication requirement is one that requires confirmation by the operator of the network based on the calculated distance (for example, whether or not the number of nodes involved in the communication exceeds a predetermined value, whether or not a predetermined node such as the Internet is included in the path related to the communication, etc.), and an output unit (output unit 114, a function of the communication requirement generating system 110, a server device, a cloud system, etc.) that outputs the communication requirement determined by the determination unit to be one that requires confirmation by the operator of the network.

[0137] In the above configuration, whether or not a communication requirement requires confirmation by a network operator is determined according to the logical positional relationship between a component connected to the network and a communication partner component. With the above configuration, for example, a plurality of communication requirements related to components connected to the network are narrowed down to communication requirements requiring confirmation by the network operator, thereby reducing the burden on the network operator of setting communication requirements in the firewall.

[0138] (2) The network system includes a determination unit (determination unit 112, a function of communication requirement generation system 110, a server device, a cloud system, etc.) that determines a security level indicating the strength of security of a component that communicates in the network, and an input unit (input unit 111, a function of communication requirement generation system 110, a server device, a cloud system, etc.) that inputs information used to determine the security level of the component (e.g., at least one of APP information 116 and information indicating the behavior of the APP) as information of the component connected to the network, the storage unit stores security level condition information (e.g., the value of condition 404) that indicates a condition for determining the security level of the component that communicates in the network, the determination unit determines the security level of the component from the information of the component connected to the network input by the input unit and the security level condition information stored in the storage unit (e.g., see step S710), and the determination unit determines, for each of a plurality of communication requirements related to the component, whether or not it is a communication requirement that requires confirmation by the operator of the network based on the security level of the component (e.g., see steps S806 to S811).

[0139] According to the above configuration, for example, the communication requirements to be confirmed with the network operator are determined based on a security level determined to satisfy the company's security policy, thereby making it possible to avoid a situation in which the firewall settings are incompatible with the company's security policy.

[0140] (3) The storage unit stores, for each security level, first security cost information (e.g., the value of APP security cost 405) indicating a security cost set for a component connected to the network, and threshold value information (e.g., the value of communication permission security cost 406) indicating a threshold for determining whether or not to permit communication of the component. The storage unit stores node information (e.g., the values ​​of node 502 and parent node 503) indicating nodes that are components when a logical structure related to communication via the network is expressed in a tree structure, and second security cost information (e.g., the value of security cost 504) indicating a security cost set for the node in the tree structure. The judgment unit stores the security cost information determined by the determination unit. The method reads out from the memory unit first security cost information and threshold information corresponding to the security levels of components connected to the network, and for each of a plurality of communication requirements related to the component, identifies a node related to communication between the component and a component with which the component is communicating based on the node information stored in the memory unit, calculates the security cost of the communication requirement by adding up the security costs of the identified nodes based on the first security cost information and the second security cost information stored in the memory unit, and determines that a communication requirement whose calculated security cost exceeds the threshold of the threshold information is a communication requirement that requires confirmation by the operator of the network (for example, see Figure 8).

[0141] In the above configuration, the security cost and threshold value corresponding to the security level of the component connected to the network and the security cost of the node related to the communication of the component in the tree structure are taken into consideration to determine the communication requirements to be confirmed with the network operator. With the above configuration, for example, it is possible to set a firewall corresponding to the security level of the component connected to the network.

[0142] (4) The communication requirement generation system includes a host (e.g., host 131) that controls communication between components in the network, and the communication requirements of components connected to the network, for which an operator of the network has confirmed whether or not to permit communication, are set in firewall setting information (e.g., FW setting table 1300) of the components, and when the host receives a packet from the component, it controls communication between the component and the communication partner component based on the setting information.

[0143] According to the above configuration, packets are transferred based on the firewall setting information of the component, so that a firewall for each component that matches the security policy of the company can be realized, for example.

[0144] (5) When the host receives a packet from the component, it identifies the communication partner component of the component that is the destination of the packet, and identifies the node involved in the communication between the component and the communication partner component based on the node information stored in the memory unit, and calculates the security cost of the communication by adding up the security costs of the identified nodes based on first security cost information corresponding to the security level of the component and second security cost information stored in the memory unit, and when the calculated security cost of the communication exceeds the threshold of threshold information corresponding to the security level of the component, it forwards the packet to the communication partner of the component based on the setting information or blocks the packet (e.g., see Figure 15).

[0145] In the above configuration, the setting information is referenced when the security cost of communication is greater than a threshold value. Therefore, for example, there is no need to set rules in the setting information that have security costs less than the threshold value, and it is possible to avoid a situation in which the number of rules in the setting information becomes enormous.

[0146] (6) If the node information is not stored by the memory unit, the determination unit reads information from the directory service, outputs the read information to the user terminal, receives the information modified in the user terminal as node information, and the memory unit stores the node information received by the determination unit (see, for example, FIG. 16).

[0147] In the above configuration, for example, since the node information is generated from information of a directory service, the burden of inputting the node information can be reduced.

[0148] (7) The output unit outputs a screen (e.g., input screen 900) for selectively inputting at least one of the following information about the components connected to the network: the type of business in which the components are used, the type of the components, the type of data handled by the components, and whether or not the components communicate via the Internet.

[0149] In the above configuration, for example, a screen is displayed that allows the network operator to select and input information about a component, so that the network operator can easily input information about the component.

[0150] (8) The output unit outputs a screen (for example, a confirmation screen 1200) for inputting whether or not to permit communication of the communication requirement determined by the determination unit.

[0151] In the above configuration, a screen for inputting whether or not to permit communication of the communication requirement is output, so that, for example, a network operator can easily set whether to permit or deny communication of the communication requirement.

[0152] Furthermore, the above-described configurations may be modified, rearranged, combined, or omitted as appropriate without departing from the spirit and scope of the present invention.

[0153] It should be understood that items listed in the format "at least one of A, B, and C" can mean (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C). Similarly, items listed in the format "at least one of A, B, or C" can mean (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C). [Explanation of symbols]

[0154] 110: communication requirement generation system, 111: input section, 112: decision section, 113: judgment section, 114: output section, 115: memory section.

Claims

1. a storage unit that stores definition information for calculating a logical distance between components communicating in a predetermined network, and security level condition information indicating conditions for determining a security level that indicates a strength of security of the components communicating in the network; an input unit for inputting information used to determine a security level of a component connected to the network; a determination unit that determines a security level of the component based on information of the component connected to the network input by the input unit and security level condition information stored in the storage unit; a determination unit that calculates a logical distance between each of a plurality of communication requirements related to components connected to the network based on definition information stored in the storage unit and a component that is a communication partner of the component, and determines whether or not the communication requirement requires confirmation by an operator of the network based on the calculated distance and a security level of the component; an output unit that outputs a communication requirement that is determined by the determination unit to be a communication requirement requiring confirmation by an operator of the network; Equipped with Communication requirements generation system.

2. the storage unit stores, for each security level, first security cost information indicating a security cost set for a component connected to the network, and threshold information indicating a threshold for determining whether or not to permit communication of the component; the storage unit stores node information indicating nodes that are components when a logical structure related to communication via the network is expressed as a tree structure, and second security cost information indicating a security cost set for the node in the tree structure; The determination unit reads, from the storage unit, first security cost information and threshold value information corresponding to the security level of the component connected to the network determined by the determination unit, and for each of a plurality of communication requirements related to the component, Identifying a node involved in communication between the component and a communication partner component of the component based on the node information stored in the storage unit; calculating a security cost of a communication requirement by adding up security costs of the identified nodes based on the first security cost information and the second security cost information stored in the storage unit; determining that a communication requirement whose calculated security cost exceeds a threshold of the threshold information is a communication requirement that requires confirmation by an operator of the network; The communication requirement generation system according to claim 1 .

3. a host for controlling communication between components in the network; A communication requirement of a component connected to the network, for which it has been confirmed by an operator of the network whether or not to permit communication, is set in configuration information of a firewall of the component; When the host receives a packet from the component, the host controls communication between the component and the communication partner component based on the setting information. The communication requirement generation system according to claim 2 .

4. When the host receives a packet from the component, Identifying a communication partner component of the component that is the destination of the packet, and identifying a node involved in communication between the component and the communication partner component based on node information stored in the storage unit; calculating a security cost of communication by adding up security costs of the identified nodes based on first security cost information corresponding to the security level of the component and second security cost information stored in the storage unit; when the calculated security cost of the communication exceeds a threshold value of threshold information corresponding to a security level of the component, the packet is forwarded to a communication partner of the component or the packet is blocked based on the setting information; The communication requirement generation system according to claim 3 .

5. when the node information is not stored by the storage unit, the determination unit reads information of a directory service, outputs the read information to a user terminal, and receives information corrected in the user terminal as the node information; The storage unit stores the node information received by the determination unit. The communication requirement generation system according to claim 2 .

6. the output unit outputs a screen for selectively inputting at least one of the following information about the components connected to the network: a type of business in which the components are used; a type of the components; a type of data handled by the components; and whether or not the components communicate via the Internet. The communication requirement generation system according to claim 1 .

7. the output unit outputs a screen for inputting whether or not to permit communication of the communication requirement determined by the determination unit. The communication requirement generation system according to claim 1 .

8. a storage unit stores definition information for calculating a logical distance between components communicating in a predetermined network, and security level condition information indicating a condition for determining a security level indicating a security strength of the components communicating in the network; an input unit inputs information used for determining a security level of a component connected to the network; a determination unit determining a security level of the component based on information of the component connected to the network input by the input unit and security level condition information stored in the storage unit; a determination unit, for each of a plurality of communication requirements related to a component connected to the network, calculating a logical distance between the component and a communication partner component of the component based on definition information stored in the storage unit, and determining whether or not the communication requirement requires confirmation by an operator of the network based on the calculated distance and a security level of the component; an output unit outputs the communication requirement determined by the determination unit to be a communication requirement requiring confirmation by an operator of the network; A method for generating communication requirements.

Images