Information processing device, information processing program, and information processing method

Abstract

This makes it easy to analyze the settings of firewall policies. [Solution] The information processing device according to the present invention comprises: a configuration file that describes a firewall policy that controls packet transmission based on a pre-configured policy; a policy format that shows a policy description pattern; an extraction unit that identifies an authorization record from the configuration file that corresponds to a policy containing authorization information that allows the firewall to transmit packets; and extracts source information and destination information from the authorization record; and a generation unit that generates first communication pattern information relating to a communication pattern permitted between the source and the destination based on the source information and destination information.

Description

[[Technical Field]]

[0001] The present invention relates to an information processing apparatus, an information processing program, and an information processing method. [[Background Art]]

[0002] Conventionally, in an internal network such as a LAN (Local Area Network), in order to detect and block unauthorized access from an external network such as the Internet, a firewall is installed at the boundary between networks to determine whether to permit transmission of packets that have reached the boundary according to predetermined filtering conditions. Firewalls are often provided in the form of software. For example, firewalls are used by being incorporated into routers, proxy servers, and the like. Note that since firewalls require high performance, dedicated hardware is sometimes used (see Patent Document 1). [[Prior Art Literature]] [[Patent Literature]]

[0003] [[Patent Document 1]] Japanese Patent Laid-Open No. 10-70576 [[Summary of the Invention]] [[Means for Solving the Problem]]

[0004] The information processing apparatus according to the present application, based on a configuration file that describes the policy of a firewall that controls packet transmission based on a preset policy, and a policy format indicating a description pattern of the policy, identifies, from the configuration file, a permission record corresponding to the policy including permission information that permits the firewall to transmit packets, and includes: an extraction unit that extracts source information and destination information from the permission record; and a generation unit that generates first communication pattern information related to a communication pattern permitted between the source and the destination based on the source information and the destination information. [Brief explanation of the drawing]

[0005] [Figure 1] Figure 1 is a flowchart illustrating the overview of the processing procedure performed by the information processing device according to this embodiment. [Figure 2] Figure 2 shows an example of the configuration of an information processing device according to the embodiment. [Figure 3] Figure 3 is a diagram illustrating the pretreatment according to the embodiment. [Figure 4] Figure 4 shows an example of subnet list information according to the embodiment. [Figure 5] Figure 5 shows an example of a subnet mask table according to the embodiment. [Figure 6] Figure 6 shows an example of subnet list information with the start and end IP addresses, which have been converted to continuous values ​​according to the embodiment, added. [Figure 7] Figure 7 shows an example of a record included in a configuration file according to the embodiment. [Figure 8] Figure 8 shows an example of a matrix table that illustrates the category-based communication patterns permitted between the source category and the destination category according to the embodiment. [Figure 9] Figure 9 shows an example of an unknown category list information according to the embodiment. [Figure 10] Figure 10 shows an example of the list of unknown categories after adding a new category. [Figure 11] Figure 11 shows an example of a hardware configuration. [Modes for carrying out the invention]

[0006] The following describes in detail, with reference to the drawings, embodiments for implementing the information processing device, information processing program, and information processing method according to the present application (hereinafter referred to as "embodiments"). Note that these embodiments do not limit the information processing device, information processing program, and information processing method according to the present application. Furthermore, the same parts are denoted by the same reference numerals in each of the following embodiments, and redundant descriptions are omitted.

[0007] (Embodiment) [1. Introduction] Traditionally, there has been a demand for technology to analyze configuration files (hereinafter sometimes abbreviated as "configuration files") that describe firewall policies that control packet transmission based on pre-configured policies. Specifically, configuration files contain records corresponding to firewall policies. Furthermore, records corresponding to firewall policies contain information on source and destination pairs that the firewall is permitted to transmit packets through. For example, by analyzing configuration files, it is possible to check whether communication is being conducted in accordance with the security policies of a given organization's network, and therefore, technology for analyzing configuration files is desired.

[0008] In contrast, the format of records corresponding to firewall policies generally differs from one configuration file to another. Furthermore, as shown in Figure 3 below, there are multiple types of records corresponding to firewall policies, and the record format differs for each type. In other words, there are seven different formats for records corresponding to firewall policies, making it difficult to analyze configuration files. Also, configuration files generally contain a huge number of records (e.g., 100,000 lines). Thus, due to the diversity of records corresponding to firewall policies and the enormous number of records contained in configuration files, it has traditionally been difficult to automatically analyze configuration files. For this reason, in the past, configuration files were almost always analyzed by a person visually checking the contents of the configuration file.

[0009] In contrast, the information processing device according to the embodiment identifies permission records from the configuration file that correspond to policies containing permission information that permits the firewall to transmit packets, based on a configuration file that describes firewall policies that control packet transmission based on pre-configured policies and a policy format that shows policy description patterns. From these permission records, it extracts source information and destination information. The information processing device also generates first communication pattern information regarding permitted communication patterns between the source and destination based on the source and destination information. As a result, the information processing device can automatically extract source and destination information that permits communication through the firewall from a vast number of records (e.g., 100,000 lines) contained in the configuration file. Therefore, the information processing device can easily analyze the configuration of firewall policies.

[0010] Here, an overview of the processing procedure performed by the information processing device 100 according to the embodiment will be described using Figure 1. Figure 1 is a flowchart outlining the processing procedure performed by the information processing device 100 according to the embodiment. In Figure 1, the information processing device 100 performs preprocessing (step S101). Next, the information processing device 100 performs configuration file analysis (step S102). For example, the analysis of the configuration file includes the process of identifying permission records from among multiple records contained in the configuration file, which contain permission information indicating that the firewall is permitted to communicate between the source and the destination. The analysis of the configuration file also includes the process of extracting source information and destination information from the permission records. For example, the information processing device 100 performs the configuration file analysis using ETL (Extract, Transform, Load) technology. Next, the information processing device 100 performs the process of creating an unknown category list (step S103).

[0011] [2. Configuration of the Information Processing Device] Figure 2 shows an example of the configuration of an information processing device 100 according to the embodiment. The information processing device 100 according to the embodiment includes a communication unit 110, a storage unit 120, and a control unit 130.

[0012] (Communications Department 110) The communication unit 110 is connected to the network N by wire or wireless connection and is used by an administrator who manages the network, including network devices such as firewalls, to send and receive information with or to network devices such as firewalls. For example, the communication unit 110 can be implemented by a NIC (Network Interface Card) or an antenna.

[0013] (Storage unit 120) The storage unit 120 is implemented by, for example, a semiconductor memory element such as RAM (Random Access Memory) or flash memory, or a storage device such as a hard disk or optical disc. Specifically, the storage unit 120 stores an information processing program according to the embodiment. The storage unit 120 also stores information regarding a policy format that indicates a description pattern of the firewall policy. Furthermore, the storage unit 120 stores subnet list information, a subnet mask table, and subnet list information with the start and end IP addresses converted to continuous values ​​added.

[0014] (Control unit 130) The control unit 130 is a controller, and is realized, for example, by executing various programs stored in the memory device inside the information processing device 100 using RAM as the working area, using a CPU (Central Processing Unit) or MPU (Micro Processing Unit), etc. Alternatively, the control unit 130 is a controller and can be realized, for example, by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array).

[0015] The control unit 130 includes an acquisition unit 131, an extraction unit 132, an identification unit 133, and a generation unit 134 as functional units, and may implement or execute the information processing operations described below. Note that the internal configuration of the control unit 130 is not limited to the configuration shown in FIG. 2, and any other configuration may be used as long as it can perform the information processing described later. Furthermore, each functional unit represents a function of the control unit 130, and does not necessarily need to be physically distinguished from one another.

[0016] (Acquisition Unit 131) The acquisition unit 131 executes preprocessing. FIG. 3 is a diagram for explaining preprocessing according to the embodiment. The subnet list information shown in FIG. 3 is list information of addresses corresponding to each of all subnets used by a predetermined organization (hereinafter may be referred to as "subnet addresses"). The subnet mask table is a table that associates mask lengths, mask values, the number of IP addresses, and the result of dividing the number of IP addresses by 256.

[0017] In Figure 3, the acquisition unit 131 obtains subnet list information by referring to the storage unit 120. The acquisition unit 131 also obtains one subnet address from the subnet list information, for example, represented by "XX.X.120.0 / 22". From the acquired subnet address "XX.X.120.0 / 22", the acquisition unit 131 identifies "XX.X.120.0", which has the smallest numerical value in the IP address, as the starting IP address among the 256 IP addresses included in the subnet corresponding to "XX.X.120.0" before the "22" indicating the mask length, as the starting IP address. When the acquisition unit 131 identifies "XX.X.120.0" as the starting IP address, it converts "XX.X.120.0" to the continuous value "XXXXXX120000". Specifically, the acquisition unit 131 converts each of the numbers separated by "." in "XX.X.120.0" (hereinafter, each number will be referred to as an "octet"), namely "XX", "X", "120", and "0", into three-digit numbers, namely "XXX", "XXX", "120", and "000", respectively, and then generates the continuous value "XXXXXX120000" by removing the ".".

[0018] Furthermore, the acquisition unit 131 refers to the storage unit 120 to obtain the subnet mask table. The acquisition unit 131 also refers to the subnet mask table to obtain the mask value "255.255.252.0" corresponding to the mask length "22" of the acquired subnet address, the number of IP addresses "1024", and the value "4" which is the result of dividing the number of IP addresses by 256. The acquisition unit 131 identifies the third octet of the acquired subnet address as the target octet because the value of the third octet of the mask value "255.255.252.0" is "252" and is less than "255". Furthermore, if the acquisition unit 131 identifies the third octet as the target octet, it counts up the target octet based on the value "4", which is the result of dividing the number of IP addresses by 256. Specifically, the acquisition unit 131 calculates "XX.X.120.0", "XX.X.121.0", "XX.X.122.0", and "XX.X.123.0" by increasing the value of the third octet by "4", including "XX.X.120.0" which was identified as the starting IP address. Furthermore, the acquisition unit 131 identifies "XX.X.123.255" as the ending IP address from among the 256 IP addresses in the subnet corresponding to "XX.X.123.0", which has the largest value of the third octet among "XX.X.120.0", "XX.X.121.0", "XX.X.122.0", and "XX.X.123.0", as it has the largest number included in the IP address. When the acquisition unit 131 identifies "XX.X.123.255" as the termination IP address, it converts "XX.X.123.255" into a continuous value "XXXXXX123255". Specifically, the acquisition unit 131 converts each of the numbers separated by "." in "XX.X.123.255", namely "XX", "X", "123", and "255", into three-digit numbers "XXX", "XXX", "123", and "255", respectively, and then generates the continuous value "XXXXXX123255" by removing the ".".

[0019] In this way, for each subnet address included in the subnet list information, the acquisition unit 131 calculates the starting IP address with the smallest numerical value in the IP address and the ending IP address with the largest numerical value in the IP address from among the multiple IP addresses included in the subnet corresponding to the subnet address. Furthermore, when the acquisition unit 131 calculates the starting IP address and ending IP address, it generates starting IP address information (corresponding to the starting IP address converted to a sequential value as described above) and ending IP address information (corresponding to the ending IP address converted to a sequential value as described above). Furthermore, when the acquisition unit 131 generates starting IP address information (corresponding to the starting IP address converted to a sequential value as described above) and ending IP address information (corresponding to the ending IP address converted to a sequential value as described above), it generates subnet list information by adding the starting IP address information (corresponding to the starting IP address converted to a sequential value as described above) and ending IP address information (corresponding to the ending IP address converted to a sequential value as described above) to the subnet list information. When the acquisition unit 131 generates subnet list information with the start and end IP addresses converted to continuous values ​​added, it stores the subnet list information with the start and end IP addresses converted to continuous values ​​added in the storage unit 120.

[0020] An example of subnet list information 121 according to the embodiment will be explained using Figure 4. Figure 4 is a diagram showing an example of subnet list information 121 according to the embodiment. In the example shown in Figure 4, subnet list information 121 includes information on items such as "network address", "bitmask", "subnet", "category ID", and "category".

[0021] "Network Address" indicates the address corresponding to the network portion of the subnet address. "Bitmask" indicates the mask length of the subnet. "Subnet" indicates the address corresponding to the subnetwork (also called the subnet address). "Category ID" indicates identification information that identifies the category of the subnetwork. "Category" indicates the category of the subnetwork.

[0022] In this embodiment, the category refers to category information (information like tags) that indicates categories pre-associated with subnetworks by users who operate and maintain the IT infrastructure. Specifically, the category information may be information indicating the purpose of the subnetwork. For example, the category information may be information indicating that it is for a cloud database purpose, or information indicating that it is for a management purpose, etc.

[0023] An example of a subnet mask table 122 according to the embodiment will be explained using Figure 5. Figure 5 is a diagram showing an example of a subnet mask table 122 according to the embodiment. In the example shown in Figure 5, the subnet mask table 122 includes information on items such as "mask length", "mask value", "number of IPs", and "result of division by 256".

[0024] "Mask Length" indicates the mask length of the subnet mask. "Mask Value" indicates the mask value of the subnet mask. "Number of IPs" indicates the number of IP addresses included in the subnet corresponding to the subnet mask. "Result Divided by 256" indicates the number obtained by dividing the number of IP addresses included in the subnet corresponding to the subnet mask by 256.

[0025] An example of subnet list information 123 with the start IP address and end IP address converted to a continuous value according to the embodiment will be explained using Figure 6. Figure 6 is a diagram showing an example of subnet list information 123 with the start IP address and end IP address converted to a continuous value according to the embodiment. The subnet list information 123 shown in Figure 6 is the subnet list information 121 shown in Figure 4 with information on items such as "start IP address" and "end IP address" added. "Start IP address" indicates the value obtained by converting the start IP address in the subnet corresponding to the subnet address to a continuous value. "End IP address" indicates the value obtained by converting the end IP address in the subnet corresponding to the subnet address to a continuous value.

[0026] Furthermore, the acquisition unit 131 acquires a configuration file that describes the firewall policy for controlling packet transmission based on a pre-configured policy. For example, the acquisition unit 131 acquires the configuration file from a firewall device (e.g., an information device on which the firewall is installed). Alternatively, the acquisition unit 131 may acquire the configuration file from an information processing device used by an administrator who manages the firewall.

[0027] This section describes the configuration file that describes the firewall policy (hereinafter sometimes abbreviated as "configuration file"). The configuration file is a file that describes the firewall policy that controls packet transmission based on pre-configured policies. Specifically, the configuration file contains multiple records (for example, 100,000 lines of records). Each of the multiple records contained in the configuration file is text data containing multiple strings separated by, for example, tabs. The configuration file also contains records corresponding to the firewall policy. The records corresponding to the firewall policy describe the firewall policy. The records corresponding to the firewall policy are written according to a policy format that indicates the description pattern of the firewall policy.

[0028] An example of records included in a configuration file according to the embodiment will be explained using Figure 7. Figure 7 is a diagram showing an example of records included in a configuration file according to the embodiment. Specifically, each line of the records shown in Figure 7 is a record corresponding to a firewall policy included in the configuration file. Furthermore, each record corresponding to a firewall policy is text data containing multiple strings separated by tabs, etc. In Figure 7, each of the multiple strings separated by tabs, etc. is divided into columns to make it easier to explain the format of the records corresponding to firewall policies. Note that the records shown in Figure 7 are a selection of records extracted from the many records included in the configuration file (for example, 100,000 lines of records). In other words, the configuration file contains many records other than those shown in Figure 7.

[0029] As shown in Figure 7, there are several types of records that correspond to firewall policies, and the record format differs for each type. In the record types shown in Figure 7, the uppercase string "IP" indicates that the source or destination is specified on a subnetwork basis. The string "host" indicates that the source or destination is specified on a terminal device basis. The string "object" indicates that the source or destination is specified on a predefined group basis (hereinafter referred to as "object group"). The string "any" indicates that the source or destination is specified as any of all subnetworks (or terminal devices belonging to them) or any of all terminal devices. Hereafter, the relationship between the source and destination specified in each record may be expressed using a hyphen, such as <source>-<destination>. Specifically, for example, an "IP-IP record" means a record in which the source is specified on a subnetwork basis and the destination is set on a subnetwork basis. For the sake of explanation, these expressions are used for convenience, but these expressions do not limit the technical scope of the present invention, and those skilled in the art will understand that they may use synonymous terms as they see fit.

[0030] For example, the record type identified by the string "IP-IP" shown in the second row of Figure 7 (hereinafter sometimes abbreviated as "IP-IP record") is a record that defines the firewall policy when the source and destination are subnets. Here, the policy format of an IP-IP record is explained. For example, an IP-IP record contains the string "access-list" in the first column (corresponding to column 1 in the second row of the table shown in Figure 7). An IP-IP record also contains the string "permit" corresponding to permission information or the string "deny" corresponding to denial information in the fourth column (corresponding to column 4 in the second row of the table shown in Figure 7). An IP-IP record also contains the string corresponding to protocol information indicating the protocol type in the fifth column (corresponding to column 5 in the second row of the table shown in Figure 7). An IP-IP record also contains the subnet address of the source in the sixth column (corresponding to column 6 in the second row of the table shown in Figure 7). Furthermore, the IP-IP record includes the destination subnet address in the 8th column (corresponding to column 8 of the 2nd row in the table shown in Figure 7).

[0031] Furthermore, the record type shown in the third row of Figure 7, identified by the string "IP-host" (hereinafter sometimes abbreviated as "IP-host record"), is a record that defines the firewall policy when the source is a subnetwork and the destination is a terminal device. Here, the policy format of the IP-host record is explained. For example, the IP-host record contains the string "access-list" in the first column (corresponding to column 1 in the third row of the table shown in Figure 7). The IP-host record also contains the string "permit" corresponding to permission information or the string "deny" corresponding to denial information in the fourth column (corresponding to column 4 in the third row of the table shown in Figure 7). The IP-host record also contains the string corresponding to protocol information indicating the protocol type in the fifth column (corresponding to column 5 in the third row of the table shown in Figure 7). The IP-host record also contains the subnet address of the source in the sixth column (corresponding to column 6 in the third row of the table shown in Figure 7). Furthermore, the IP-host record includes the IP address of the destination terminal device in the 9th column (corresponding to column 9 of the 3rd row in the table shown in Figure 7). Thus, the IP-host record differs from the IP-IP record, which includes destination information in the 8th column, in that, for example, the 9th column contains destination information.

[0032] Furthermore, the record type shown in the fourth row of Figure 7, identified by the string "host-IP" (hereinafter sometimes abbreviated as "host-IP record"), is a record that defines the firewall policy when the source is a terminal device and the destination is a subnetwork. Here, the policy format of the host-IP record is explained. For example, the host-IP record contains the string "access-list" in the first column (corresponding to column 1 in the fourth row of the table shown in Figure 7). The host-IP record also contains the string "permit" corresponding to permission information or the string "deny" corresponding to denial information in the fourth column (corresponding to column 4 in the fourth row of the table shown in Figure 7). The host-IP record also contains the string corresponding to protocol information indicating the protocol type in the fifth column (corresponding to column 5 in the fourth row of the table shown in Figure 7). The host-IP record also contains the IP address of the source terminal device in the seventh column (corresponding to column 7 in the fourth row of the table shown in Figure 7). Furthermore, the host-IP record includes the destination subnet address in the 8th column (corresponding to column 8 of the 4th row in the table shown in Figure 7). Thus, the host-IP record differs from the IP-IP record and IP-host record, which include source information in the 6th column, in that, for example, the host-IP record includes source information in the 7th column. Also, the host-IP record differs from the IP-host record, which includes destination information in the 9th column, in that, for example, the host-IP record includes destination information in the 8th column.

[0033] Furthermore, the record type shown in the 5th row of Figure 7, identified by the string "host-host" (hereinafter sometimes abbreviated as "host-host record"), is a record that defines the firewall policy when the source and destination are terminal devices. Here, the policy format of the host-host record is explained. For example, the host-host record contains the string "access-list" in the first column (corresponding to column 1 in the 5th row of the table shown in Figure 7). The host-host record also contains the string "permit" corresponding to permission information or the string "deny" corresponding to denial information in the 4th column (corresponding to column 4 in the 5th row of the table shown in Figure 7). The host-host record also contains the string corresponding to protocol information indicating the protocol type in the 5th column (corresponding to column 5 in the 5th row of the table shown in Figure 7). The host-host record also contains the IP address of the source terminal device in the 7th column (corresponding to column 7 in the 5th row of the table shown in Figure 7). Furthermore, the host-host record includes the IP address of the destination terminal device in the 9th column (corresponding to column 9 of the 5th row in the table shown in Figure 7). Thus, the host-host record differs from IP-IP records and IP-host records, which include source information in the 6th column, for example, in that the host-host record includes source information in the 7th column. Also, the host-host record differs from IP-IP records and host-IP records, which include destination information in the 8th column, for example, in that the host-host record includes destination information in the 9th column.

[0034] Furthermore, the record type shown in row 6 of Figure 7, identified by the string "object-object" (hereinafter sometimes abbreviated as "object-object record"), is a record that defines the firewall policy when the source and destination are object groups. Here, the policy format of the object-object record is explained. For example, the object-object record contains the string "access-list" in the first column (corresponding to column 1 in row 6 of the table shown in Figure 7). The object-object record also contains the string "permit" corresponding to permission information or the string "deny" corresponding to denial information in the fourth column (corresponding to column 4 in row 6 of the table shown in Figure 7). The object-object record also contains the string corresponding to protocol information indicating the protocol type in the fifth column (corresponding to column 5 in row 6 of the table shown in Figure 7). The object-object record also contains the name of the source object group in the seventh column (corresponding to column 7 in row 6 of the table shown in Figure 7). Additionally, the object-object record includes the name of the destination object group in the 9th column (corresponding to column 9 in row 6 of the table shown in Figure 7).

[0035] Here, an object group refers to a group of objects predetermined by the user. Here, an object includes at least one of either a subnetwork or a terminal device. For example, an object group may be a group of subnetworks predetermined by the user. Alternatively, an object group may be a group of terminal devices predetermined by the user. Furthermore, an object group may be a group that includes a pair of subnetworks and terminal devices predetermined by the user. In addition, a given object group may include other object groups different from the given object group. For example, an object group is a group of subnetworks selected by the user from among all subnetworks used in a given organization. For example, a given organization uses four types of subnetworks: subnetwork A, subnetwork B, subnetwork C, and subnetwork D. In this case, an object group may be a pair of two or more subnetworks selected from subnetwork A, subnetwork B, subnetwork C, and subnetwork D. For example, the first object group may be a group of subnetworks A and subnetwork B. Alternatively, the second object group may be a group of subnetworks A, subnetwork B, and subnetwork C. Furthermore, the third object group may be the group consisting of subnetwork A, subnetwork B, subnetwork C, and subnetwork D.

[0036] Although not shown in the diagram, the configuration file includes records that define object groups. Each record that defines an object group includes a string indicating that it is a record that defines an object group. For example, the string indicating that it is a record that defines an object group is a string indicating the name of the object group. The record that defines an object group also includes information that associates the string indicating the name of the object group (which is the string indicating that it is a record that defines an object group) with the subnet addresses of each of the multiple subnetworks included in the object group.

[0037] (Extraction part 132) The extraction unit 132 performs analysis processing of the configuration file. Specifically, based on the configuration file which describes the firewall policy that controls packet transmission based on a pre-configured policy, and the policy format which shows the policy description pattern, the extraction unit 132 identifies permission records from the configuration file that correspond to policies containing permission information that allows the firewall to transmit packets, and extracts source information and destination information from the permission records.

[0038] More specifically, when the configuration file is acquired by the acquisition unit 131, the extraction unit 132 refers to the storage unit 120 to acquire the policy format. For example, the extraction unit 132 refers to the storage unit 120 to acquire multiple different policy formats corresponding to each of multiple different record types. Also, when the extraction unit 132 acquires the policy format, it extracts records corresponding to the firewall policy from the configuration file based on the configuration file acquired by the acquisition unit 131 and the acquired policy format. More specifically, records corresponding to the firewall policy include a string (hereinafter sometimes referred to as a "keyword") that indicates that the record corresponds to the firewall policy. The extraction unit 132 uses the string that indicates that the record corresponds to the firewall policy as a search query to extract records corresponding to the firewall policy from among multiple records contained in the configuration file. The extraction unit 132 extracts records corresponding to the firewall policy by extracting records containing the string that indicates that the record corresponds to the firewall policy from among multiple records contained in the configuration file. In the example shown in Figure 7, the record corresponding to the firewall policy includes the string "access-list" in the first column of the record as a string indicating that it is a record corresponding to the firewall policy. The extraction unit 132 extracts the record corresponding to the firewall policy by extracting records containing the string "access-list" from among multiple records contained in the configuration file. Note that the keywords used may differ depending on the company that provides the firewall as a product (hereinafter referred to as "vendor") and the software installed in the product. For example, "policy" may be used as a keyword synonymous with "access-list". Also, "forward" or "allow" may be used as a keyword synonymous with "permit". Furthermore, "group address" may be used as a keyword synonymous with "object-group".As the keywords differ depending on the firewall being targeted, you may choose the most appropriate keywords for each case.

[0039] Furthermore, when the extraction unit 132 extracts records corresponding to firewall policies, it identifies the permitted records from among the extracted records that correspond to policies containing permission information allowing the firewall to transmit packets. More specifically, permitted records contain a string corresponding to permission information allowing the firewall to transmit packets. In addition to permitted records, among the records corresponding to firewall policies, there are also disallowed records corresponding to policies containing disallowed information that does not allow the firewall to transmit packets. Disallowed records contain a string corresponding to disallowed information that does not allow the firewall to transmit packets. The extraction unit 132 identifies permitted records by using the string corresponding to the permission information as a search query and identifying records containing the string corresponding to the permission information from among the extracted records. In the example shown in Figure 7, the permitted record contains the string "permit" in the fourth column of the record as the string corresponding to the permission information. The extraction unit 132 extracts permitted records by extracting records containing the string "permit" from among the extracted records. In Figure 7, the extraction unit 132 identifies eight records, including IP-IP records, IP-host records, host-IP records, host-host records, and object-object records, as permitted records from among the ten records corresponding to the firewall policy.

[0040] Furthermore, when the extraction unit 132 identifies an authorized record, it identifies a policy format that matches the format of the authorized record based on the authorized record and the policy format. For example, the extraction unit 132 identifies a policy format that matches the format of the authorized record by comparing the authorized record with each of several different policy formats. Also, when the extraction unit 132 identifies a policy format that matches the format of the authorized record, it extracts the source information and destination information from the authorized record. More specifically, the extraction unit 132 extracts the source information and destination information from the authorized record based on the policy format that matches the format of the authorized record and the authorized record itself. For example, the extraction unit 132 extracts the source information and destination information from the authorized record by comparing the policy format that matches the format of the authorized record with the authorized record itself.

[0041] For example, if the extraction unit 132 identifies an IP-IP record as an authorized record, it identifies the policy format of the IP-IP record. The extraction unit 132 then compares the policy format of the IP-IP record with the IP-IP record identified as an authorized record, and extracts the source subnet address as source information from the 6th column of the IP-IP record (corresponding to column 6 of the 2nd row in the table shown in Figure 7). The extraction unit 132 also compares the policy format of the IP-IP record with the IP-IP record identified as an authorized record, and extracts the destination subnet address as destination information from the 8th column of the IP-IP record (corresponding to column 8 of the 2nd row in the table shown in Figure 7).

[0042] Furthermore, if the extraction unit 132 identifies an IP-host record as an authorized record, it identifies the policy format of the IP-host record. The extraction unit 132 then compares the policy format of the IP-host record with the IP-host record identified as an authorized record, and extracts the source subnet address as source information from the 6th column of the IP-host record (corresponding to column 6 in the 3rd row of the table shown in Figure 7). The extraction unit 132 then compares the policy format of the IP-host record with the IP-host record identified as an authorized record, and extracts the destination terminal device's IP address as destination information from the 9th column of the IP-host record (corresponding to column 9 in the 3rd row of the table shown in Figure 7).

[0043] Furthermore, if the extraction unit 132 identifies a host-IP record as an authorized record, it identifies the policy format of the host-IP record. The extraction unit 132 then compares the policy format of the host-IP record with the host-IP record identified as an authorized record, and extracts the IP address of the source terminal device as source information from the 7th column of the host-IP record (corresponding to column 7 of the 4th row in the table shown in Figure 7). The extraction unit 132 then compares the policy format of the host-IP record with the host-IP record identified as an authorized record, and extracts the destination subnet address as destination information from the 8th column of the host-IP record (corresponding to column 8 of the 4th row in the table shown in Figure 7).

[0044] Furthermore, if the extraction unit 132 identifies a host-host record as an authorized record, it identifies the policy format of the host-host record. The extraction unit 132 then compares the policy format of the host-host record with the host-host record identified as an authorized record, and extracts the IP address of the source terminal device as source information from the 7th column of the host-host record (corresponding to column 7 of the 5th row in the table shown in Figure 7). The extraction unit 132 then compares the policy format of the host-host record with the host-host record identified as an authorized record, and extracts the IP address of the destination terminal device as destination information from the 9th column of the host-host record (corresponding to column 9 of the 5th row in the table shown in Figure 7).

[0045] Furthermore, if the extraction unit 132 identifies an object-object record as an authorized record, it identifies the policy format of the object-object record. The extraction unit 132 also compares the policy format of the object-object record with the object-object record identified as an authorized record, and extracts the name of the source object group as source information from the 7th column of the object-object record (corresponding to column 7 of the 6th row in the table shown in Figure 7). The extraction unit 132 also compares the policy format of the object-object record with the object-object record identified as an authorized record, and extracts the name of the destination object group as destination information from the 9th column of the object-object record (corresponding to column 9 of the 6th row in the table shown in Figure 7).

[0046] Furthermore, the extraction unit 132 determines whether at least one of the source information or destination information is an IP address. Specifically, when the extraction unit 132 extracts source information and destination information from the permission record, it determines, based on the extracted source information and destination information, whether at least one of the source information or destination information is the name of an object group. For example, the extraction unit 132 determines whether the source (or destination) information is the name of an object group. For example, the storage unit 120 stores a list of object group names. The extraction unit 132 also obtains the list of object group names by referring to the storage unit 120. Subsequently, the extraction unit 132 compares the list of object group names with the source (or destination) information to determine whether the source (or destination) information is the name of an object group. For example, the extraction unit 132 determines whether the source (or destination) information exists in the list of object group names. If the extraction unit 132 determines that the source (or destination) information exists in the list of object group names, it determines that the source (or destination) information is an object group name. On the other hand, if the extraction unit 132 determines that the source (or destination) information does not exist in the list of object group names, it determines that the source (or destination) information is not an object group name. Furthermore, if the extraction unit 132 determines that the source (or destination) information is an object group name, it determines that the source (or destination) information is not an IP address. Furthermore, if the extraction unit 132 determines that the source (or destination) information is not an object group name, it determines whether or not the source (or destination) information is a subnet address. For example, the extraction unit 132 determines whether or not the source (or destination) information is a subnet address by determining whether or not the source (or destination) information exists in the subnet list information. For example, if the extraction unit 132 determines that the source (or destination) information is in the subnet list information, it determines that the source (or destination) information is a subnet address.Furthermore, if the extraction unit 132 determines that the source (or destination) information is a subnet address, it determines that the source (or destination) information is not an IP address. Also, if the extraction unit 132 determines that the source (or destination) information is not in the subnet list information, it determines that the source (or destination) information is not a subnet address. If the extraction unit 132 determines that the source (or destination) information is not a subnet address, it determines that the source (or destination) information is an IP address.

[0047] Furthermore, the extraction unit 132 may determine whether at least one of the source information or destination information is a subnet address. Specifically, when the extraction unit 132 extracts source information and destination information from the permission record, it may determine whether at least one of the source information or destination information is a subnet address based on the extracted source information and destination information. For example, the extraction unit 132 determines whether the source (or destination) information is a subnet address by determining whether the source (or destination) information is in the subnet list information. For example, if the extraction unit 132 determines that the source (or destination) information is in the subnet list information, it determines that the source (or destination) information is a subnet address. Also, if the extraction unit 132 determines that the source (or destination) information is not in the subnet list information, it determines that the source (or destination) information is not a subnet address.

[0048] Furthermore, the extraction unit 132 may determine whether at least one of the source information or destination information is the name of an object group. Specifically, when the extraction unit 132 extracts source information and destination information from the permission record, it may determine, based on the extracted source information and destination information, whether at least one of the source information or destination information is the name of an object group. For example, the extraction unit 132 determines whether the source (or destination) information is the name of an object group. For example, the extraction unit 132 determines whether the source (or destination) information exists in the list of object group names. If the extraction unit 132 determines that the source (or destination) information exists in the list of object group names, it determines that the source (or destination) information is the name of an object group. On the other hand, if the extraction unit 132 determines that the source (or destination) information does not exist in the list of object group names, it determines that the source (or destination) information is not the name of an object group.

[0049] (Specific Section 133) The identification unit 133 performs analysis of the configuration file following the processing by the extraction unit 132. Specifically, based on the information extracted by the extraction unit 132, the identification unit 133 identifies subnet address information indicating the subnet address corresponding to the source information, and subnet address information indicating the subnet address corresponding to the destination information.

[0050] More specifically, if the extraction unit 132 determines that at least one of the source information or destination information is an IP address, the identification unit 133 identifies subnet address information indicating the subnet address corresponding to at least one of the source information or destination information that is an IP address. Hereinafter, the IP address corresponding to the source information or destination information determined to be an IP address by the extraction unit 132 may be referred to as the target address. For example, the identification unit 133 calculates start IP address information indicating the start IP address with the smallest numerical value among the multiple IP addresses included in each subnet address, and end IP address information indicating the end IP address with the largest numerical value, and identifies target subnet address information indicating the target subnet address corresponding to the target IP address based on whether or not the target IP address exists among the IP addresses between the start IP address and the end IP address. For example, if the extraction unit 132 determines that at least one of the source information or destination information is an IP address, the identification unit 133 refers to the storage unit 120 and obtains subnet list information 123 with the start IP address and end IP address converted to continuous values ​​added. Furthermore, the identification unit 133 determines whether the target IP address exists within the IP addresses between the start IP address and the end IP address of each of the multiple subnet addresses included in the subnet list information 123, which has been converted to a continuous value and has the start IP address and end IP address added. If the identification unit 133 determines that the target IP address exists within the IP addresses between the start IP address and the end IP address of a predetermined subnet address, it identifies the predetermined subnet address information indicating the predetermined subnet address as the target subnet address information corresponding to the target IP address. In this way, if the extraction unit 132 determines that the source information is an IP address, the identification unit 133 identifies subnet address information indicating the subnet address corresponding to the IP address which is the source information (hereinafter, this may be referred to as "subnet address information corresponding to the source information").Furthermore, if the extraction unit 132 determines that the destination information is an IP address, the identification unit 133 identifies subnet address information (hereinafter sometimes referred to as "subnet address information corresponding to the destination information") that indicates the subnet address corresponding to the IP address which is the destination information.

[0051] Furthermore, if the extraction unit 132 determines that at least one of the source information or the destination information is a subnet address, the identification unit 133 identifies subnet address information indicating the subnet address corresponding to at least one of the source information or the destination information. In this way, if the extraction unit 132 determines that the source information is a subnet address, the identification unit 133 identifies subnet address information indicating the subnet address of the source information (hereinafter sometimes referred to as "subnet address information corresponding to the source information"). Furthermore, if the extraction unit 132 determines that the destination information is a subnet address, the identification unit 133 identifies subnet address information indicating the subnet address of the destination information (hereinafter sometimes referred to as "subnet address information corresponding to the destination information").

[0052] Furthermore, if the extraction unit 132 determines that at least one of the source information or destination information is the name of an object group, the identification unit 133 identifies the subnet addresses included in the object group corresponding to the object group name. For example, if the extraction unit 132 determines that at least one of the source information or destination information is the name of an object group, the identification unit 133 searches the configuration file for records that define object groups using the string indicating the name of the object group as a search query. The identification unit 133 obtains the records that define object groups as search results. If the identification unit 133 obtains the records that define object groups as search results, it identifies subnet address information from the records that define object groups, indicating the subnet addresses of each of the multiple subnetworks included in the object group. In this way, if the extraction unit 132 determines that the source information is the name of an object group, the identification unit 133 identifies subnet address information (hereinafter sometimes referred to as "subnet address information corresponding to the source information") that indicates the subnet addresses of each of the multiple subnetworks included in the object group corresponding to the object group name. Furthermore, if the extraction unit 132 determines that the destination information is the name of an object group, the identification unit 133 identifies subnet address information (hereinafter sometimes referred to as "subnet address information corresponding to the destination information") that indicates the subnet addresses of each of the multiple subnetworks included in the object group corresponding to the name of the object group.

[0053] (Generation unit 134) The generation unit 134 generates first communication pattern information relating to permitted communication patterns between the source and the destination based on the source information and the destination information. Specifically, the generation unit 134 generates first communication pattern information that includes subnet address information corresponding to the source information or subnet address information corresponding to the destination information. For example, the generation unit 134 generates first communication pattern information that includes subnet address information corresponding to the source information or subnet address information corresponding to the destination information identified by the identification unit 133. The generation unit 134 also generates first communication pattern information relating to permitted communication patterns on a subnet address basis between the source subnet and the destination subnet. For example, as first communication pattern information, the generation unit 134 counts the number of permitted records for each subnet address that permit communication from the source subnet indicated by the subnet address information corresponding to the source information identified by the identification unit 133 to the destination subnet indicated by the subnet address information corresponding to the destination information. For example, the generation unit 134 counts the number of pairs of information, which are sets of subnet address information corresponding to the source information identified by the identification unit 133 and subnet address information corresponding to the destination information, as first communication pattern information. For example, the generation unit 134 counts the number of permission records, which are records that permit communication from each of several different source subnetworks to each of several different destination subnetworks, as first communication pattern information.

[0054] Furthermore, the generation unit 134 generates second communication pattern information based on the first communication pattern information, which includes source category information indicating the category corresponding to the source subnetwork and destination category information indicating the category corresponding to the destination subnetwork. Specifically, the generation unit 134 generates second communication pattern information relating to category-based communication patterns permitted between the source category corresponding to the source category information and the destination category corresponding to the destination category information. For example, the generation unit 134 obtains source category information indicating the category corresponding to the source subnetwork by referring to subnetwork list information. The generation unit 134 also obtains destination category information indicating the category corresponding to the destination subnetwork by referring to subnetwork list information. Furthermore, the generation unit 134 generates second communication pattern information relating to category-based communication patterns permitted between the source category corresponding to the source category information and the destination category corresponding to the destination category information. For example, as second communication pattern information, the generation unit 134 counts the number of permitted records for each category in which communication is permitted from the source category corresponding to the source category information to the source category corresponding to the source category information. For example, the generation unit 134 counts the number of permission records that are authorized to communicate from each of several different source categories to each of several different destination categories, as second communication pattern information.

[0055] (Display section 140) The display unit 140 outputs the second communication pattern information in a tabular format showing the relationship between the source category and the destination category. For example, the generation unit 134 generates a matrix table 125 showing category-specific communication patterns permitted between the source category and the destination category, as shown in Figure 8. Figure 8 is a diagram showing an example of a matrix table 125 showing category-specific communication patterns permitted between the source category and the destination category according to the embodiment. In Figure 8, the generation unit 134 generates a matrix table 125 in which each cell displays the number of permitted records in which communication is permitted from each of the source categories identified by categories #1 to #4 to each of the destination categories identified by categories #1 to #4. The display unit 140 displays the matrix table 125 generated by the generation unit 134.

[0056] Furthermore, the generation unit 134 generates an unknown category list information. Figure 9 shows an example of the unknown category list information 126 according to the embodiment. For example, if the extraction unit 132 extracts an IP address or subnet address whose category is unknown, the generation unit 134 writes the IP address or subnet address whose category is unknown in the "IP address" column of the unknown category list information 126. In addition, the "category" column of the unknown category list information 126 writes information indicating that the category is unknown (for example, the string "unknown").

[0057] Furthermore, if the generation unit 134 generates the unknown category list information 126, it generates the unknown category list information 127 after adding the new category. Figure 10 shows an example of the unknown category list information after adding the new category. For example, for each IP address or subnet address whose category is unknown as listed in the unknown category list information 126, the generation unit 134 adds a new category that does not exist in the subnet list information 121.

[0058] [3. Variant Example] Furthermore, the extraction unit 132 may further extract from the authorized record at least one of either destination port number information indicating the destination port number, or protocol information indicating the protocol type. For example, if the extraction unit 132 identifies the extracted IP-IP record as an authorized record, it extracts protocol information indicating the protocol type from the 5th column of the IP-IP record (corresponding to column 5 in Figure 3) based on the extracted IP-IP record and the information regarding the policy format of the acquired IP-IP record. The generation unit 134 may further generate first communication pattern information based at least one of the destination port number information or the protocol information.

[0059] [4. Effects] As described above, the information processing device 100 according to the embodiment has an extraction unit 132 and a generation unit 134. The extraction unit 132 identifies permission records from the configuration file that correspond to policies containing permission information that permits the firewall to transmit packets, based on a configuration file that describes firewall policies that control packet transmission based on pre-configured policies and a policy format that shows policy description patterns, and extracts source information and destination information from the permission records. The generation unit 134 generates first communication pattern information relating to communication patterns permitted between the source and destination based on the source information and destination information.

[0060] This allows the information processing device 100 to automatically extract information about the source and destination of communications permitted through the firewall from the vast number of records (e.g., 100,000 lines) contained in the configuration file. Therefore, the information processing device 100 can easily analyze the firewall policy settings. Furthermore, because the information processing device 100 can easily analyze the firewall policy settings, it can contribute to achieving Sustainable Development Goal (SDG) 9, "Build resilient infrastructure, promote inclusive and sustainable industrialization and foster innovation."

[0061] The information processing device 100 also includes a specification unit 133. The specification unit 133 calculates starting IP address information indicating the starting IP address with the smallest numerical value among multiple IP addresses included in each subnet address, and ending IP address information indicating the ending IP address with the largest numerical value. Based on whether or not the target IP address exists among the IP addresses between the starting IP address and the ending IP address, it identifies target subnet address information indicating the target subnet address corresponding to the target IP address. The extraction unit 132 determines whether at least one of the source information or the destination information is an IP address. If the extraction unit 132 determines that at least one of the source information or the destination information is an IP address, the specification unit 133 identifies subnet address information indicating the subnet address corresponding to at least one of the source information or the destination information that is an IP address. The generation unit 134 generates first communication pattern information including subnet address information corresponding to the source information or subnet address information corresponding to the destination information.

[0062] This allows the information processing device 100 to identify the subnetwork corresponding to an IP address when at least one of the source information or destination information is an IP address.

[0063] Furthermore, the generation unit 134 generates first communication pattern information relating to the permitted subnet address-based communication patterns between the source subnetwork and the destination subnetwork.

[0064] This enables the information processing device 100 to analyze communication patterns on a subnet address basis.

[0065] Furthermore, the extraction unit 132 further extracts from the permission record at least one of either destination port number information indicating the destination port number, or protocol information indicating the protocol type. The generation unit 134 further generates first communication pattern information based on at least one of the destination port number information or the protocol information.

[0066] This enables the information processing device 100 to analyze the communication pattern based on the destination port number or protocol type.

[0067] Furthermore, the generation unit 134 generates second communication pattern information based on the first communication pattern information, which includes source category information indicating a category corresponding to the source subnetwork and destination category information indicating a category corresponding to the destination subnetwork.

[0068] This allows the information processing device 100 to analyze communication patterns, for example, on a category basis.

[0069] Furthermore, the generation unit 134 generates second communication pattern information relating to category-based communication patterns permitted between the source category corresponding to the source category information and the destination category corresponding to the destination category information.

[0070] This enables the information processing device 100 to analyze communication patterns on a category-by-category basis.

[0071] The information processing device 100 also includes a display unit 140. The display unit 140 outputs the second communication pattern information in a tabular format that shows the relationship between the source category and the destination category.

[0072] This allows the information processing device 100 to easily enable administrators to check whether communication is being conducted in accordance with the security policy of a given organization's network.

[0073] [5. Hardware Configuration] Furthermore, the information processing device 100 according to the above-described embodiment is realized by a computer 1000 having a configuration such as that shown in Figure 11. The information processing device 100 will be described below as an example. Figure 11 is a diagram showing an example of the hardware configuration. The computer 1000 is connected to an output device 1010 and an input device 1020, and has a configuration in which an arithmetic unit 1030, a primary storage device 1040, a secondary storage device 1050, an output interface 1060, an input interface 1070, and a network interface 1080 are connected by a bus 1090.

[0074] The arithmetic unit 1030 operates based on programs stored in the primary storage device 1040 and the secondary storage device 1050, as well as programs read from the input device 1020, and executes various processes. The arithmetic unit 1030 can be implemented using, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field Programmable Gate Array).

[0075] The primary storage device 1040 is a memory device, such as RAM (Random Access Memory), that temporarily stores data used by the arithmetic unit 1030 for various calculations. The secondary storage device 1050 is a storage device where data used by the arithmetic unit 1030 for various calculations and various databases are registered, and can be implemented using ROM (Read Only Memory), HDD (Hard Disk Drive), SSD (Solid State Drive), flash memory, etc. The secondary storage device 1050 may be internal storage or external storage. The secondary storage device 1050 may also be a removable storage medium such as USB (Universal Serial Bus) memory or SD (Secure Digital) memory card. The secondary storage device 1050 may also be cloud storage (online storage), NAS (Network Attached Storage), file server, etc.

[0076] The output I / F 1060 is an interface for transmitting information to be output to output devices 1010, such as displays, projectors, and printers, and is implemented using connectors of standards such as USB (Universal Serial Bus), DVI (Digital Visual Interface), and HDMI (High Definition Multimedia Interface). The input I / F 1070 is an interface for receiving information from various input devices 1020, such as mice, keyboards, keypads, buttons, and scanners, and is implemented using, for example, USB.

[0077] Furthermore, the output interface 1060 and input interface 1070 may be wirelessly connected to the output device 1010 and input device 1020, respectively. In other words, the output device 1010 and input device 1020 may be wireless devices.

[0078] Furthermore, the output device 1010 and the input device 1020 may be integrated as a touch panel. In this case, the output I / F 1060 and the input I / F 1070 may also be integrated as an input / output I / F.

[0079] The input device 1020 may also be a device that reads information from, for example, an optical recording medium such as a CD (Compact Disc), DVD (Digital Versatile Disc), or PD (Phase Change Rewritable Disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory.

[0080] The network interface 1080 receives data from other devices via network N and sends it to the computing unit 1030, and also transmits data generated by the computing unit 1030 to other devices via network N.

[0081] The arithmetic unit 1030 controls the output device 1010 and the input device 1020 via the output interface 1060 and the input interface 1070. For example, the arithmetic unit 1030 loads a program from the input device 1020 or the secondary storage device 1050 onto the primary storage device 1040 and executes the loaded program.

[0082] For example, when computer 1000 functions as an information processing device 100, the arithmetic unit 1030 of computer 1000 realizes the functions of the control unit 130 by executing a program loaded onto the primary storage device 1040. Alternatively, the arithmetic unit 1030 of computer 1000 may load a program obtained from another device via the network interface 1080 onto the primary storage device 1040 and execute the loaded program. Furthermore, the arithmetic unit 1030 of computer 1000 may cooperate with other devices via the network interface 1080 and call and use program functions, data, etc., from other programs on other devices.

[0083] [6. Other] Although embodiments of the present invention have been described above, the present invention is not limited by the content of these embodiments. Furthermore, the aforementioned components include those that can be easily conceived by those skilled in the art, those that are substantially the same, and those that fall within the so-called equivalent range. Moreover, the aforementioned components can be combined as appropriate. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the gist of the embodiments described above.

[0084] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified. For example, the various information shown in each figure is not limited to the information shown.

[0085] Furthermore, the components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions.

[0086] For example, the information processing device 100 described above may be implemented using multiple server computers, and depending on the function, it may be implemented by calling external platforms, etc., via APIs (Application Programming Interfaces) or network computing, allowing for flexible configuration changes.

[0087] Furthermore, the embodiments and modifications described above can be combined as appropriate, provided that the processing content is not inconsistent. [Explanation of symbols]

[0088] 100 Information Processing Devices 110 Communications Department 120 Storage section 130 Control Unit 131 Acquisition Department 132 Extraction part 133 Specific part 134 Generation part 140 Display section

Claims

1. An extraction unit identifies, from the configuration file, a configuration file that describes the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format that shows the description pattern of the policy, an permission record corresponding to the policy that contains permission information that allows the firewall to transmit packets, and extracts source information and destination information from the permission record. A generation unit generates first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient. A specific unit calculates starting IP address information, which indicates the starting IP address with the smallest numerical value among multiple IP addresses contained in each subnet address, and ending IP address information, which indicates the ending IP address with the largest numerical value among multiple IP addresses contained in each subnet address, and identifies target subnet address information, which indicates the target subnet address corresponding to the target IP address, based on whether or not the target IP address exists in the IP addresses between the starting IP address and the ending IP address. Equipped with, The extraction unit determines whether at least one of the source information or the destination information is an IP address. If the extraction unit determines that at least one of the source information or the destination information is an IP address, the identification unit identifies subnet address information indicating the subnet address corresponding to at least one of the source information or the destination information that is an IP address. The generation unit generates the first communication pattern information which includes subnet address information corresponding to the source information or subnet address information corresponding to the destination information. Information processing device.

2. A configuration file describing the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format indicating the description pattern of the policy, which identifies an authorization record from the configuration file that corresponds to the policy and contains authorization information that the firewall is permitted to transmit packets, and which extracts source information and destination information from the authorization record. A generation unit generates first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient. Equipped with, The generation unit generates the first communication pattern information relating to a subnet address-based communication pattern permitted between the source subnetwork and the destination subnetwork. Information processing device.

3. A configuration file that describes the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format that shows the description pattern of the policy, and an extraction unit that identifies an authorization record corresponding to the policy that contains authorization information allowing the firewall to transmit packets from the configuration file, and extracts source information and destination information from the authorization record, A generation unit generates first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient. Equipped with, The extraction unit further extracts from the permission record at least one of the following: destination port number information indicating the destination port number, or protocol information indicating the protocol type. The generation unit further generates the first communication pattern information based on at least one of the destination port number information or the protocol information. Information processing device.

4. A configuration file that describes the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format that shows the description pattern of the policy, and an extraction unit that identifies an authorization record corresponding to the policy that contains authorization information that the firewall is permitted to transmit packets from the configuration file, and extracts source information and destination information from the authorization record, A generation unit generates first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient. Equipped with, The generation unit generates second communication pattern information based on the first communication pattern information, which includes source category information indicating a category corresponding to the source subnetwork and destination category information indicating a category corresponding to the destination subnetwork. Information processing device.

5. The generation unit generates the second communication pattern information relating to category-based communication patterns permitted between the source category corresponding to the source category information and the destination category corresponding to the destination category information. The information processing apparatus according to claim 4.

6. The system further includes a display unit that outputs the second communication pattern information in a table format showing the relationship between the source category and the destination category. The information processing apparatus according to claim 5.

7. An extraction procedure that, based on a configuration file describing the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format indicating the description pattern of the policy, identifies an authorization record corresponding to the policy that contains authorization information allowing the firewall to transmit packets from the configuration file, and extracts source information and destination information from the authorization record. A generation procedure for generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, A procedure for identifying target subnet address information that indicates the target subnet address corresponding to the target IP address, based on whether or not the target IP address exists within the IP addresses between the start IP address and the end IP address, by calculating start IP address information indicating the start IP address with the smallest numerical value among multiple IP addresses contained in each subnet address, and end IP address information indicating the start IP address with the largest numerical value. Have the computer run it, The extraction procedure determines whether at least one of the source information or the destination information is an IP address, If the extraction procedure determines that at least one of the source information or the destination information is an IP address, the identification procedure identifies subnet address information indicating the subnet address corresponding to at least one of the source information or the destination information that is an IP address. The generation procedure generates the first communication pattern information which includes subnet address information corresponding to the source information or subnet address information corresponding to the destination information. Information processing program.

8. A configuration file describing the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format indicating the description pattern of the policy, wherein the configuration file identifies an authorization record corresponding to the policy that contains authorization information allowing the firewall to transmit packets, and the authorization record extracts source information and destination information. A generation procedure for generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, Have the computer run it, The generation procedure generates the first communication pattern information relating to a subnet address-based communication pattern permitted between the source subnetwork and the destination subnetwork. Information processing program.

9. A configuration file describing the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format indicating the description pattern of the policy, wherein the configuration file identifies an authorization record corresponding to the policy that contains authorization information allowing the firewall to transmit packets, and the authorization record extracts source information and destination information. A generation procedure for generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, Have the computer run it, The extraction procedure further extracts from the permission record at least one of the following: destination port number information indicating the destination port number, or protocol information indicating the protocol type. The generation procedure further generates the first communication pattern information based on at least one of the destination port number information or the protocol information. Information processing program.

10. A configuration file describing the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format indicating the description pattern of the policy, wherein the configuration file identifies an authorization record corresponding to the policy that contains authorization information allowing the firewall to transmit packets, and the authorization record extracts source information and destination information. A generation procedure for generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, Have the computer run it, The generation procedure generates second communication pattern information based on the first communication pattern information, which includes source category information indicating a category corresponding to the source subnetwork and destination category information indicating a category corresponding to the destination subnetwork. Information processing program.

11. An information processing method implemented by a program executed by an information processing device, An extraction step of identifying an authorization record corresponding to the policy, which contains authorization information that allows the firewall to transmit packets, from the configuration file, based on a configuration file that describes the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format that shows the description pattern of the policy, and extracting source information and destination information from the authorization record. A generation step of generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, The process involves calculating starting IP address information, which indicates the starting IP address with the smallest numerical value among multiple IP addresses contained in each subnet address, and ending IP address information, which indicates the ending IP address with the largest numerical value among multiple IP addresses contained in each subnet address, and then identifying target subnet address information, which indicates the target subnet address corresponding to the target IP address, based on whether or not the target IP address exists within the IP addresses between the starting IP address and the ending IP address. Includes, The extraction step determines whether at least one of the source information or the destination information is an IP address, If the extraction step determines that at least one of the source information or the destination information is an IP address, the identification step identifies subnet address information indicating the subnet address corresponding to at least one of the source information or the destination information that is an IP address. The generation step generates the first communication pattern information which includes subnet address information corresponding to the source information or subnet address information corresponding to the destination information. Information processing methods.

12. An information processing method implemented by a program executed by an information processing device, An extraction step of identifying an authorization record corresponding to the policy, which contains authorization information that allows the firewall to transmit packets, from the configuration file, based on a configuration file that describes the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format that shows the description pattern of the policy, and extracting source information and destination information from the authorization record. A generation step of generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, Includes, The generation step generates the first communication pattern information relating to a subnet address-based communication pattern permitted between the source subnetwork and the destination subnetwork. Information processing methods.

13. An information processing method implemented by a program executed by an information processing device, An extraction step of identifying an authorization record corresponding to the policy, which contains authorization information that allows the firewall to transmit packets, from the configuration file, based on a configuration file that describes the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format that shows the description pattern of the policy, and extracting source information and destination information from the authorization record. A generation step of generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, Includes, The extraction step further extracts from the permission record at least one of the following: destination port number information indicating the destination port number, or protocol information indicating the protocol type. The generation step further generates the first communication pattern information based on at least one of the destination port number information or the protocol information. Information processing methods.

14. An information processing method implemented by a program executed by an information processing device, An extraction step of identifying an authorization record corresponding to the policy, which contains authorization information that allows the firewall to transmit packets, from the configuration file, based on a configuration file that describes the policy of a firewall that controls packet transmission based on a pre-configured policy, and a policy format that shows the description pattern of the policy, and extracting source information and destination information from the authorization record. A generation step of generating first communication pattern information relating to a communication pattern permitted between the sender and the recipient, based on the information of the sender and the information of the recipient, Includes, The generation step generates second communication pattern information based on the first communication pattern information, which includes source category information indicating a category corresponding to the source subnetwork and destination category information indicating a category corresponding to the destination subnetwork. Information processing methods.

Images