JP2006005503A - Shared security platform, illegitimate intrusion preventing system, gateway apparatus, and illegitimate intrusion preventing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a shared security platform capable of enhancing the security against a password hacker attack and reducing a security management operating cost. <P>SOLUTION: Upon the receipt of a packet from remote connection terminals 50, 51, an SSL-VPN gateway apparatus 3 identifies an enterprise from data of the packet, allows a concerned enterprise Web server to output a password entry menu to the remote connection terminals 50, 51, transfers passwords from the remote connection terminals 50, 51 to an authentication system 4, and obtains an authentication propriety response from the system 4. When the authentication propriety response indicates authentication OK, the SSL-VPN gateway apparatus 3 transfers the packet to a pre-specified address, executes communication, and executes interruption of the session when the number of consecutive times of authentication NG exceeds a preset threshold value. An illegitimate intrusion prevention system 2 watches port scanning. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a common security platform, an unauthorized intrusion prevention system, a gateway device and an unauthorized intrusion prevention method, and more particularly to a remote access security system that provides a security platform for a remote access system.

  Conventionally, in this type of remote access security system, a security platform is constructed and operated for each company, and security for the intranet is ensured for each company.

  For example, as a security platform, there are DMZ (DeMilitized Zone) and IPS (Intrusion Prevention System), which are constructed for each company. Further, as a method for ensuring security by these methods, a method is proposed in which false information is returned when unauthorized access or unauthorized intrusion is detected, and then the connection is disconnected (see, for example, Patent Documents 1 to 3). .

JP 2000-26183 A JP 2002-073433 A Japanese Patent Laid-Open No. 2002-199024

  With regard to the conventional security assurance mentioned above, it is necessary to have a dedicated security engineer in order to incorporate and manage new devices and systems, applications, etc. that are developed one after another, and to implement them. There is a problem that the operation management cost is high.

  Further, as described above, in the conventional security ensuring, there is a problem that DMZ is constructed for each company, and IPS cannot process the traffic of a plurality of companies.

  Furthermore, when accessed by SSL-VPN (Secure Sockets Layer-Virtual Private Network), the session layer and application layer information are encrypted with SSL, so conventional IPS includes ID (identification information) and password There is a problem that an authentication packet cannot be recognized and a password hacker attack cannot be recognized.

  Accordingly, an object of the present invention is to solve the above-described problems, improve security against password hacker attacks, and reduce security management operation costs, a common security platform, an unauthorized intrusion prevention system, a gateway device, and its It is to provide a method for preventing unauthorized intrusion.

A common security platform according to the present invention is a common security platform including a gateway device for connecting a plurality of remote connection terminals to corresponding in-house business systems,
The gateway device has means for recognizing an illegal password acquisition attack from the outside, and means for blocking the connection with the recognized source of the unauthorized password acquisition attack,
An unauthorized intrusion prevention system including means for recognizing unauthorized access from outside and means for blocking connection with the recognized unauthorized access source;
The gateway device and the unauthorized intrusion prevention system are shared by a plurality of in-house business systems.

The unauthorized intrusion prevention system according to the present invention is an unauthorized intrusion prevention system that is shared by a plurality of in-house business systems to which corresponding remote connection terminals are connected,
Means for recognizing unauthorized access from the outside and means for blocking the connection with the recognized unauthorized access source.

A gateway device according to the present invention is a gateway device that connects a plurality of remote connection terminals to a corresponding system among a plurality of in-house business systems and is shared by the plurality of in-house business systems,
Means for recognizing an illegal password acquisition attack from the outside, and means for blocking a connection with the source of the recognized illegal password acquisition attack.

An unauthorized intrusion prevention method according to the present invention is an unauthorized intrusion prevention method used in a common security platform including a gateway device that connects a plurality of remote connection terminals to a corresponding system among a plurality of in-house business systems,
When the gateway device recognizes a password fraud acquisition attack from the outside, the gateway device is disconnected from the recognized password fraud acquisition attack source,
A plurality of in-house business systems share the gateway device and an unauthorized intrusion prevention system that blocks a connection between the recognized unauthorized access source and the unauthorized access source.

  That is, the common security platform of the present invention recognizes a password hacker attack (password illegal acquisition attack) and shuts down an SSL-VPN (Secure Sockets Layer-Virtual Private Network) gateway device, and an unauthorized access that recognizes unauthorized access and shuts down. The intrusion prevention system can be shared by multiple companies.

  Further, the common security platform of the present invention is characterized by providing a security platform service that allows a plurality of companies to share a security network during remote access using SSL-VPN.

  As a result, the common security platform of the present invention can improve security against password hacker attacks and reduce security management operation costs.

  More specifically, the common security platform according to the present invention includes a packet identification unit for identifying traffic for each enterprise based on a destination IP (Internet Protocol) address and a domain name, and an enterprise for a packet identified by the packet identification unit. IPS having monitoring and detecting means for monitoring a pre-search action such as port scan every time, and shutting down a packet from the TCP (Transmission Control Protocol) session when detecting the pre-search action, and a communication means for performing TCP packet communication (Intrusion Prevention System: unauthorized intrusion prevention system).

  Also, the common security platform of the present invention notifies authentication data to the authentication communication system at the time of session generation in communication between the client terminal and the in-house business system server, and performs packet transfer processing or proxy processing after the authentication. Incorrect password detection detection that monitors communication with the communication means, authentication communication means for transferring data to the authentication system, and the authentication system, and shuts down packets from the session when the number of consecutive authentication NGs exceeds the specified number And an SSL-VPN gateway apparatus that processes session management for each company.

  As a result, the common security platform of the present invention can process data for a plurality of companies on a single common platform, improving security against password hacker attacks and reducing security management operation costs. .

  In other words, the common security platform of the present invention can monitor unauthorized acquisition of passwords that could not be detected by a conventional unauthorized intrusion prevention system, and can improve the security level.

  Also, with the common security platform of the present invention, it is possible to share a common platform that provides security among multiple companies, and not only infrastructure but also security management operators can share, which can reduce costs. Become. In this case, particularly as a security service, initial investment is unnecessary, and the cost reduction effect is remarkable.

  By adopting the configuration and operation as described below, the present invention can improve the security against password hacker attacks, and can reduce the security management operation cost.

  Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a common security platform according to an embodiment of the present invention. In FIG. 1, a common security platform 1 includes an unauthorized intrusion prevention system (IPS) 2, an SSL (Secure Sockets Layer) -VPN (Virtual Private Network) gateway device 3, an authentication system 4, and routers 11 and 12. And the hub 13.

  The common security platform 1 is connected via the router 11 to the Internet 100 to which the remote connection terminals 50 and 51 are connected, and the IP-VPN (Internet Protocol) to which the company A in-house business system 6 and the company B in-house business system 7 are connected. -Virtual Private Network) 200 is connected via the router 12.

  The unauthorized intrusion prevention system 2 is a device having a function for detecting a malicious attacker from the outside, and the SSL-VPN gateway device 3 includes remote connection terminals 50 and 51 (remote access users) and a company A company. This is a device for connecting the business system 6 and the server of the company B internal business system 7.

  The authentication system 4 is a device for authenticating a remote access user and defining an access authority, and communicates with the SSL-VPN gateway device 3 by a RADIUS (Remote Authentication Dial-In User Service) protocol.

  The routers 11 and 12 are devices for connecting to the Internet 100 and connecting to the company A in-house business system 6 and the company B in-house business system 7 by the IP-VPN 200.

  The remote connection terminals 50 and 51 are terminals for connecting to the company A in-house business system 6 and the company B in-house business system 7 by remote access. After accessing the SSL-VPN gateway apparatus 3 and receiving authentication, each user Communication with an in-house business system that is permitted is possible.

  FIG. 2 is a block diagram showing the configuration of the unauthorized intrusion prevention system 2 of FIG. In FIG. 2, the unauthorized intrusion prevention system 2 includes monitoring detection means 21, packet identification means 22, and communication means 23.

  The packet identification unit 22 identifies traffic for each company from a destination IP (Internet Protocol) address or a domain name. The monitoring detection unit 21 monitors a pre-search act such as a port scan for each company from the packet identified by the packet identification unit 22, and shuts down a packet from the TCP (Transmission Control Protocol) session when the pre-search activity is detected. The communication unit 23 performs TCP packet communication.

  FIG. 3 is a block diagram showing a configuration of the SSL-VPN gateway apparatus 3 of FIG. In FIG. 3, the SSL-VPN gateway device 3 includes a communication unit 31, an authentication communication unit 32, and an unauthorized password acquisition detection unit 33. Although not shown, the SSL-VPN gateway device 3 has firewall means, and the authentication communication means 32 has protocol conversion means for the authentication system 4.

  4 is a flowchart showing the operation of the SSL-VPN gateway apparatus 3 shown in FIG. 3, and FIG. 5 is a flowchart showing the operation of the unauthorized intrusion prevention system 2 shown in FIG. The operation of the common security platform 1 according to an embodiment of the present invention will be described with reference to FIGS. The processing shown in FIGS. 4 and 5 is not shown, but in the SSL-VPN gateway device 3 and unauthorized intrusion prevention system 2, the CPU (central processing unit) loads a program from a recording medium to a RAM (random access memory). It is realized by moving to and executing. In this case, the CPU, RAM, and recording medium constitute a computer system.

  First, in order for a user who is an employee of company A to remotely access the company A in-house business system 6 from the remote connection terminal 50, a company A Web server (not shown) of the SSL-VPN gateway apparatus 3 is used. Start communication by specifying an IP address (reverse proxy function), or add the address of an in-house business server (not shown) to be connected to the session data from the remote connection terminal 50 and perform communication (transfer by session layer) Function).

  When the SSL-VPN gateway apparatus 3 receives the packet from the remote connection terminal 50 by the communication means 31 (step S1 in FIG. 4), the company identifies the company from the data of the packet (step S2 in FIG. 4), and the corresponding corporate web The server prompts authentication by outputting a password input screen to the remote connection terminal 50 (step S3 in FIG. 4).

  Upon receiving the password input screen, the remote connection terminal 50 presents the password input screen to the user, and returns the password input by the user to the SSL-VPN gateway apparatus 3.

  The SSL-VPN gateway apparatus 3 transfers the password received from the remote connection terminal 50 to the authentication system 4 and obtains an authentication permission response (steps S4 and S5 in FIG. 4).

  If the authentication permission response is OK (step S6 in FIG. 4), the SSL-VPN gateway apparatus 3 sends a packet to the IP address defined in the SSL-VPN gateway apparatus 3 for each application if the reverse proxy function is used. The communication is continued until the application session is released.

  In addition, when the SSL-VPN gateway apparatus 3 uses the transfer function of the session layer, the address of the in-house business server to be connected is added to the session data from the remote connection terminal 50 and the session is sent to the designated IP address. Set and implement communication (step S7 in FIG. 4).

  On the other hand, when the user who is an employee of company A is in session connection, the user who is an employee of company B remotely accesses the company B in-house business system 7 in the remote connection terminal 51 when the user who is an employee of company A is in session connection. After identifying the company by IP address and port number, the same processing as described above is performed, and the common security platform 1 including the unauthorized intrusion prevention system 2 and the SSL-VPN gateway apparatus 3 is shared by the remote connection terminals 50 and 51. The connection to the company A internal business system 6 and the company B internal business system 7 is possible.

  The unauthorized intrusion prevention system 2 is installed in the security service provider's common security platform 1, and as shown in FIG. 2 and FIG. 5, keeps an eye on the port scan that is always carried out by a malicious user who attempts unauthorized intrusion from the outside. (Step S11 in FIG. 5) When a port scan is detected (Step S12 in FIG. 5), a pseudo port is replied to the port scan as if it were an original server (Step S13 in FIG. 5).

  As a result, when the intrusion prevention system 2 is attacked on the answered pseudo port (step S14 in FIG. 5), the TCP session for the pseudo port is blocked (step S15 in FIG. 5). These functions are managed and processed for each company by session ID (identification information) or the like.

  On the other hand, the SSL-VPN gateway device 3 looks at the communication with the authentication system 4 using the authentication data in the combined session data and application data in the communication means 31, and a threshold value in which the number of consecutive authentication NGs is set in advance. If it exceeds (the specified number of times) (step S8 in FIG. 4), the session is blocked (step S9 in FIG. 4), and unauthorized acquisition of a password that could not be detected by the conventional unauthorized intrusion prevention system is monitored. Will be able to.

  In this way, in this embodiment, since it becomes possible to monitor unauthorized acquisition of passwords that could not be detected by the conventional unauthorized intrusion prevention system, the security level can be improved.

  Further, in this embodiment, the common security platform 1 can be shared by a plurality of companies, and not only the infrastructure but also the security management operator can be shared, so that the security management operation cost can be reduced. it can. In particular, when the common security platform 1 is provided as a security service, initial investment is not required, and the effect of reducing the security management operation cost is remarkable.

It is a block diagram which shows the structure of the common security platform by one Example of this invention. It is a block diagram which shows the structure of the unauthorized intrusion prevention system of FIG. It is a block diagram which shows the structure of the SSL-VPN gateway apparatus of FIG. It is a flowchart which shows operation | movement of the SSL-VPN gateway apparatus shown in FIG. It is a flowchart which shows operation | movement of the unauthorized intrusion prevention system shown in FIG.

Explanation of symbols

1 Common security platform
2 Unauthorized intrusion prevention system
3 SSL-VPN gateway device
4 Authentication system
6 Company A internal business system
7 Company B internal business system 11, 12 router 13 hub 21 monitoring detection means 22 packet identification means 23, 31 communication means 32 authentication communication means 33 illegal password acquisition detection means 50, 51 remote connection terminal 100 Internet 200 IP-VPN

Claims (15)

A common security platform including a gateway device that connects a plurality of remote connection terminals to a corresponding in-house business system,
The gateway device has means for recognizing an illegal password acquisition attack from the outside, and means for blocking the connection with the recognized source of the unauthorized password acquisition attack,
An unauthorized intrusion prevention system including means for recognizing unauthorized access from outside and means for blocking connection with the recognized unauthorized access source;
A common security platform, wherein the gateway device and the unauthorized intrusion prevention system are shared by a plurality of in-house business systems.   The common security platform according to claim 1, further comprising an authentication system that authenticates a terminal that accesses the in-house business system. Means for transferring authentication data from the remote connection terminal to the authentication system when the remote connection terminal accesses the in-house business system, and the remote connection terminal when the remote connection terminal is authenticated by the authentication system. Means for connecting between the connection terminal and the in-house business system in the gateway device,
The gateway device monitors communication with the authentication system and cuts off the communication that has become unauthenticated when the number of consecutive unauthenticated times from the authentication system exceeds a preset number of times. The common security platform according to claim 2.   4. The common security platform according to claim 1, wherein the gateway device is an SSL-VPN (Secure Sockets Layer-Virtual Private Network) gateway device. 5. The unauthorized intrusion prevention system includes packet identification means for identifying traffic for each in-house business system from at least a destination IP (Internet Protocol) address and a domain name,
The unauthorized intrusion prevention system monitors a pre-search act including at least a port scan for each in-house business system with respect to the packet identified by the packet identification unit, and communicates with the packet when the pre-search act is detected. The common security platform according to claim 1, wherein the common security platform is blocked. An unauthorized intrusion prevention system that is shared by a plurality of in-house business systems to which corresponding remote connection terminals are connected,
An unauthorized intrusion prevention system comprising: means for recognizing unauthorized access from outside; and means for blocking connection with a recognized unauthorized access source. A packet identifying means for identifying traffic for each in-house business system from at least a destination IP (Internet Protocol) address and a domain name;
The unauthorized intrusion prevention system monitors a pre-search act including at least a port scan for each in-house business system with respect to the packet identified by the packet identification unit, and communicates with the packet when the pre-search act is detected. The unauthorized intrusion prevention system according to claim 6, wherein the system is blocked. A gateway device that connects a plurality of remote connection terminals to a corresponding system among a plurality of in-house business systems and is shared by the plurality of in-house business systems,
A gateway apparatus comprising: means for recognizing an illegal password acquisition attack from outside; and means for blocking a connection with a source of the recognized unauthorized password acquisition attack. Means for transferring authentication data from the remote connection terminal to the authentication system when the remote connection terminal accesses the in-house business system, and the remote connection terminal when the remote connection terminal is authenticated by the authentication system. Means for connecting between the connection terminal and the in-house business system,
9. The communication with the authentication system is monitored, and the communication that has become unauthenticated is blocked when the number of consecutive authentication failures from the authentication system exceeds a predetermined number of preset times. Gateway device.   10. The gateway device according to claim 8, wherein the gateway device is an SSL-VPN (Secure Sockets Layer-Virtual Private Network) gateway device. An unauthorized intrusion prevention method used in a common security platform including a gateway device for connecting a plurality of remote connection terminals to a corresponding system among a plurality of internal business systems,
When the gateway device recognizes a password fraud acquisition attack from the outside, the gateway device is disconnected from the recognized password fraud acquisition attack source,
An unauthorized intrusion characterized in that a plurality of in-house business systems share the gateway device and an unauthorized intrusion prevention system that blocks connection between the recognized unauthorized access source when an unauthorized access from the outside is recognized Prevention method.   12. The unauthorized intrusion prevention method according to claim 11, wherein authentication of a terminal accessing the in-house business system is performed by an authentication system.   A process of transferring authentication data from the remote connection terminal to the authentication system when the remote connection terminal accesses the in-house business system from the remote connection terminal; The process of connecting between the remote connection terminal and the in-house business system when authenticated, and the communication with the authentication system is monitored, and the number of consecutive authentication failures from the authentication system is equal to or more than a predetermined number of times set in advance. The unauthorized intrusion prevention method according to claim 12, further comprising: a process of cutting off the communication that cannot be authenticated.   The unauthorized intrusion prevention method according to claim 11, wherein the gateway device is an SSL-VPN (Secure Sockets Layer-Virtual Private Network) gateway device. On the unauthorized intrusion prevention system side, processing for identifying traffic for each in-house business system from at least a destination IP (Internet Protocol) address and a domain name, and at least port scanning for the identified packet for each in-house business system The unauthorized intrusion prevention method according to claim 11, further comprising: a process of monitoring a pre-search act including a message and interrupting communication by the packet when the pre-search act is detected.

Images