JP3973982B2 - Access restriction information management device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an access restriction information management apparatus.
[0002]
[Prior art]
As is well known, in recent years, in order to prevent unauthorized access from another device to its own device, it is necessary to restrict access by a router or a firewall program (the type of packet received by its own device or its own device). To limit the types of packets transmitted from the Internet to the Internet).
[0003]
[Problems to be solved by the invention]
In order to restrict access, of course, it is necessary to make settings for routers and firewall programs. And the setting corresponds to the contents of the access restriction performed by the device on the other side that can be the target of communication (the type of packet that the other side does not send is not received, and the packet that the other side does not receive is not sent. It is desirable that However, it is practically impossible to inquire the user / administrator of each device to be communicated about what settings are being made on that device. In the operation condition setting that has been performed, an access restriction that is looser than an access restriction that can be actually performed is performed.
[0004]
The present invention has been made in view of such circumstances, and an object of the present invention is to provide an access restriction information management apparatus that can provide a user with an environment in which operating conditions for routers and firewall programs can be accurately set. There is.
[0007]
[Means for Solving the Problems]
In order to solve the above problems, the access restriction information management apparatus according to the present invention provides a packet that a user performs for each of a plurality of users accessing the Internet using a device having a packet filtering function. Based on the access restriction information database for storing the access restriction information indicating the contents of filtering and the information transmitted by an arbitrary user among a plurality of users, the access restriction information regarding the user in the access restriction information database When content update means for updating content and a predetermined type of request transmitted by an arbitrary user among a plurality of users are received, the user is selected from the access restriction information stored in the access restriction information database. Extract all information indicating access restriction details for And the extracted all the information and a request response means for sending back to the device that transmitted the request.
[0008]
When the access restriction information management apparatus of the present invention having such a configuration is connected to the Internet and the content of packet filtering performed by a certain user is changed by the user, the content updating means is changed by the user. If the process for making the function function is performed, each user can know the contents of the access restriction that other users are performing by making the response request means function. . Therefore, by using this access restriction information management apparatus, it is possible to provide the user with an environment in which operation conditions can be accurately set for routers and firewall programs.
[0009]
When realizing the access restriction information management apparatus of the present invention, as the access restriction information database, for each of a plurality of users, the IP address of the device used by the user in a form associated with the access restriction information related to the user Is also used as a content update means that performs processing for changing the IP address related to the user in the access restriction information database based on information transmitted by an arbitrary user among a plurality of users. The request response means uses information that returns all the extracted information with the IP address stored in the access restriction information database associated with the access restriction information included in each information. It can be kept.
[0010]
By configuring the access restriction information management apparatus of the present invention as described above, it is possible to realize an access restriction information management apparatus that can cope with a change in the IP address of a device used by another user who is a communication target. Become.
[0017]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0018]
First, an outline of an access restriction information management apparatus according to an embodiment of the present invention will be described with reference to FIGS.
[0019]
As shown in FIG. 1, the access restriction information management apparatus 20 according to the present embodiment is an apparatus that is used while being connected to a number of Internet access systems 10 via the Internet 100.
[0020]
This access restriction information management device 20 provides an environment in which the user of the Internet access system 10 that is a device that can perform access restriction (packet filtering) can easily perform setting work for access restriction contents for the Internet access system 10. It is a device for performing a service (hereinafter referred to as an access restriction information management service).
[0021]
Then, the access restriction information management device 20 stores a member information database 21, an access restriction information database 22, various routers (Internet routers), an operation condition setting program 23 for a firewall program, source data of various Web pages, and the like. It is a kind of held Web server. Further, as shown in FIG. 2A, the access restriction information management apparatus 20 includes a system including a router having a packet filtering function and a computer that accesses the Internet using the router, and FIG. As shown in (2), a computer having a packet filtering function (a computer on which a so-called firewall program is executed) is a device handled as the Internet access system 10.
[0022]
The operating condition setting program 23 held by the access restriction information management apparatus 20 is a program provided to a user who has performed a membership registration procedure for using the access restriction information management service (hereinafter referred to as a member). . Details (functions) of the operating condition setting program 23 will be described later. As shown in FIG. 2, each Internet access system 10 is usually suitable for a router or a firewall program used in its own system. The operating condition setting program 23 is used in the installed state. Note that “normal” indicates that the access restriction information management service can be used even if the operating condition setting program 23 is not installed in the Internet access system 10 and is used by members. This is because an operating condition setting program 23 suitable for the router and firewall program being used may not be prepared.
[0023]
The member information database 21 is a database for storing, for each member, a member ID and password assigned to the member, and personal information (name, address, etc.) regarding the member.
[0024]
As shown in FIG. 3A, the access restriction information database 22 is a database that can store a member status, a terminal ID, and access permission list information for each of a plurality of member IDs.
[0025]
The member status stored in the access restriction information database 22 indicates whether or not the Internet access system 10 of the corresponding member (the member having the member ID associated with the member status) is connected to the Internet. It is information which shows. The terminal ID is the IP address of the Internet access system 10 used by the corresponding member to access the Internet.
[0026]
The access permission list information is information set by the corresponding member. As schematically shown in FIG. 3B, this access permission list information is composed of several pieces of application target designation information and access permission condition designation information associated with each application target designation information. Yes. Here, the access permission condition designation information is information in which a condition for permitting access to the own system is designated by a service name, a port number, and a protocol name. Further, the application target designation information is information for designating a person to whom the condition designated by the corresponding access permission condition designation information is to be applied, and the access restriction information management server 20 provides the application target designation information. Member ID of the target member, information designating that all persons (members and non-members) are targeted (hereinafter referred to as “all users”, see FIG. 3B), access permission list The apparatus can set information (hereinafter referred to as “registered member”) that specifies that all members for which member IDs are set in the information are targeted.
[0027]
Based on the above, the operation of the access restriction information management apparatus 20 will be specifically described below. In the following description, for convenience of explanation, the computer included in the Internet access system 10 having the configuration shown in FIG. 3A and the Internet access system 10 having the configuration shown in FIG. I will do it.
[0028]
As already described, the access restriction information management service is a service provided to members (members that have undergone membership registration procedures). For this reason, a user who wishes to use the access restriction information management service performs a member registration procedure by starting a Web browser of a computer used by the user and accessing the access restriction information management apparatus 20. Since the contents of this membership registration procedure are the same as those generally performed for membership registration, the detailed explanation thereof is omitted, but once the membership registration procedure has been carried out, Is notified of the user ID and password to be used at the time of login. In addition, the member information database 21 stores the combination thereof together with the personal information set by the applicant for use during the member registration procedure.
[0029]
Of those who have completed the membership registration procedure, the operating condition setting program 23 suitable for the router and firewall program used by the person is prepared, and those who are willing to use it At this stage, the operating condition setting program 23 suitable for the router and firewall program used by the user is downloaded from the access restriction information management apparatus 20 and installed in the computer used by the user.
[0030]
Then, the person who has completed the member registration procedure (hereinafter referred to as a member) performs the following work in order to store the access permission list information related to himself / herself in the access restriction information database 22. In addition, the member who has changed the setting related to the access restriction of the Internet access system 10 being used also performs the following work.
[0031]
First, the member transmits a setting page request, which is an HTTP request received and processed by the access restriction information management apparatus 20, to its own computer (Web browser). That is, the member performs an operation of inputting a predetermined URL into the Web browser or an operation of operating a predetermined link provided on the Web page published by the access restriction information management apparatus 20.
[0032]
Upon receiving this setting page request, the access restriction information management apparatus 20 returns the source data of the login page. As a result, since the login page as shown in FIG. 4 is displayed on the member computer, the member inputs his member ID and password in the input fields 31 and 32, respectively, and then the send button. Press 33.
[0033]
When this operation is performed, the computer transmits a login request received by the access restriction information management apparatus 20 including the member ID and password set by the member on the Internet.
[0034]
The access restriction information management apparatus 20 that has received this login request attempts to confirm that the person accessing the own apparatus is a member based on the member ID and password included therein. That is, the access restriction information management server 20 determines whether or not the member information database 21 stores a combination of the member ID and password included in the received login request.
[0035]
When it is confirmed that the accessor is a member (when the combination of the member ID and password included in the received login request is stored in the member information database 21), the access restriction information management device 20 Then, it is determined whether or not information (member ID or the like) related to the member (hereinafter referred to as a processing target member) is registered in the access restriction information database 22. When the information regarding the processing target member is not registered, the access restriction information management apparatus 20 stores the member ID of the processing target member (member ID included in the received login request) in the access restriction information database 22. In addition, the online status and the IP address of the transmission source terminal of the login request are stored as the member status and terminal ID related to the processing target member, respectively. On the other hand, when information related to the processing target member is stored in the access restriction information database 22, the access restriction information management apparatus 20 displays the member status and terminal ID related to the processing target member in the access restriction information database 22 online. The IP address of the transmission source terminal of the login request is rewritten. The access restriction information management device 20 performs the process of changing the member status to offline when information indicating that the own Internet access system 10 is set to the offline state is transmitted from the member.
[0036]
Then, the access restriction information management apparatus 20 starts so-called session management for the processing target member and transmits the source data for the setting page to the computer that has transmitted the login request (hereinafter referred to as the processing target computer). .
[0037]
With this processing, the setting page displayed on the processing target computer is as shown in FIG. 5, and the processing target computer displaying the setting page operates as follows.
[0038]
When the radio button 41x (x is any one of a, b, and c) is clicked, the processing target computer has the display form of the clicked radio button 41x being “ON” (selected) ) (The display form of the radio button 41c in the figure), and the display form of the other radio buttons 41y (y ≠ x) is “OFF” (not selected). Change the display format to indicate. In addition, when the text box 42 or the text box 44 is selected, the processing target computer changes the character string displayed in the selected text box 42 or 44 according to the operation content on the keyboard. Perform the process.
[0039]
When any one of the check boxes 43 is clicked, the processing target computer checks that the check box 43 indicates that the check box 43 shows a check mark. When the mark is erased and the check box 43 has a check mark displayed therein, the check mark is displayed inside the check box 43.
[0040]
When the “Register” button 45 is pressed, the processing target computer transmits an information setting request including all information indicating the state of each control on the setting page to the Internet.
[0041]
The access restriction information management apparatus 20 that has received this information setting request grasps which of the radio buttons 41a to 41c the processing target member has turned on based on the information included therein. Then, when the processing target member has the radio button 41a turned on, the access restriction information management apparatus 20 stores “all users” as processing target application target designation information, and the processing target member sets the radio button 41b to ON. If registered, “registered member” is stored as processing target application target designation information. Further, when the processing target member has the radio button 41c turned ON, the access restriction information management apparatus 20 stores the information (that is, the member ID) input in the text box 42 as the processing target application target designation information.
[0042]
Further, the access restriction information management apparatus 20 determines whether or not the received information setting request indicates that no checked check box exists and no information is input in the text box 44. If it is, the received information setting request recognizes that the processing target application target designation information and the application target designation information coincide with deletion of access permission condition designation information. From the access permission list information regarding the processing target user stored in the access restriction information database 22, the application target specifying information that matches the processing target application target specifying information and the access permission condition specifying information associated therewith are deleted. To do.
[0043]
On the other hand, when the received information setting request does not instruct deletion of the access permission condition designation information (when the access permission condition is specified in some form), the access restriction information management apparatus 20 Based on the information included in the received information setting request, access permission condition designation information to be stored in the access restriction information database 22 in the subsequent processing is prepared.
[0044]
Then, the access restriction information management apparatus 20 determines whether or not the application target designation information that matches the process target application target designation information is included in the access permission list information regarding the process target member. Replaces the access permission condition designation information with the access permission condition designation information prepared this time. On the other hand, when the application target designation information that matches the process target application target designation information is not included in the access permission list information related to the process target member, the access restriction information management device 20 prepares the process target application target designation information and The access permission condition designation information is added to the access permission list information regarding the processing target member in the access restriction information database 22.
[0045]
Thereafter, the access restriction information management device 20 applies the application target designation information indicating the processing target member (that is, the processing target member's information) from the access permission list information in the access restriction information database 22 regarding the members other than the processing target member. All access permission list information including member ID) is specified. Then, for each of the specified access permission list information, access permission condition designation information related to a processing target user included in the access permission list information, and access related to registered members and all users included in the access permission list information. By combining with the permission condition specification information, the access restriction information that is the information indicating the type of access permitted by the member who set the access permission list information to the processing target member is created, and the created access restriction information Is stored in association with the member ID, member status, and terminal ID of the member for which the access permission list information is set.
[0046]
Then, when the above processing is completed for all the specified access permission list information, the access restriction information management device 20 associates the information (member ID, member status, and terminal ID) obtained by the processing so far. 6 and a Web page (hereinafter, contents) as shown in FIG. 6 based on the access permission condition designation information set by the processing target member stored in the access restriction information database 22. Source data for displaying on the Web browser is created and returned to the processing target computer. In FIG. 6, information shown in association with the member ID in the column of “access permitted by the target” is information corresponding to the access restriction information created by the above processing. .
[0047]
The processing target computer that has received the source data (the processing target computer that has transmitted the information registration request as a result of pressing the “registration” button 45) displays the setting based on the display based on the source data. It is done in a window different from the window. More specifically, the processing target computer changes the display content of the window based on the received source data without opening a new window if the window for the content confirmation page has already been opened. If the window for the content confirmation page has not been opened, a new window is opened and the content confirmation page is displayed in the window.
[0048]
In addition, when the “confirm” button 46 on the setting page is pressed, the access restriction information management apparatus 20 of the processing target computer displaying the setting page causes the content confirmation page to be included in the above processing. A confirmation request is generated on the Internet, which creates only the source data for use and performs only the process of returning it (the process excluding the process of updating the contents of the access restriction information database 22 from the process described above). . Then, the processing target computer displays a window based on the source data transmitted as a response to the transmitted confirmation request, a window different from the window displaying the setting page (the window displaying the content confirmation page or a new window opened) Window).
[0049]
When the “end” button 47 on the setting page is pressed, the processing target computer transmits a logout request to the access restriction information management apparatus 20. The access restriction information management apparatus 20 that has received this logout request ends session management for the processing target user and returns source data for the so-called “Thanks page” to the processing target computer.
[0050]
As is clear from the above description, the access restriction information management apparatus 20 according to the present embodiment provides each member with the IP address of the Internet access system 10 used by other members and other members with respect to itself. This is a device capable of notifying information indicating the contents of access restrictions being performed.
[0051]
The information that each member can obtain from the access restriction information management apparatus 20 includes all information necessary for setting the router and the firewall program. Therefore, the access restriction information management apparatus 20 is used. For example, it is possible to provide each member with an environment in which the router and firewall program used by the member can be accurately set.
[0052]
However, based on the information obtained from the access restriction information management device 20, the work that must actually be performed when changing the settings of the router and the firewall program is performed for those who are not able to perform such work. This is a difficult task, and for those who are familiar, it is a cumbersome task.
[0053]
A program that can be prepared for this purpose (so as not to perform such work) is the operating condition setting program 23.
[0054]
The function of the operating condition setting program 23 differs depending on the corresponding router and firewall program. For this reason, although detailed explanation thereof is omitted, the operation condition setting program 23 for any router / firewall program is basically operated by setting a user ID, a password, a schedule, and the like. The computer periodically acquires information corresponding to the information displayed on the content confirmation page from the access restriction information management device 20 according to the set schedule, and sets the router / firewall program based on the acquired information. It is a program that can be used to change the process.
[0055]
In addition, the operating condition setting program 23 determines whether or not to take into account the user status (when the user status goes offline, leave the type of access permitted for the user or allow the permission. Obtained from the access restriction information management device 20 before setting the router / firewall program (when the content of the access restriction information database 22 is updated by another member). It is also a program that can set whether or not to display information.
[0056]
Therefore, if the operating condition setting program 23 is installed in the computer, each member can more easily (actually have to perform the access restriction information management service provided by the access restriction information management apparatus 20). (In a lesser form).
[0057]
<Deformation>
The access restriction information management apparatus 20 according to the embodiment can perform various modifications. For example, when only the Internet access system 10 having a fixed IP address is targeted, the access restriction information management apparatus 20 can be configured so as not to have a function of managing the IP address. Further, the access restriction information management device 20 may be configured so that each member does not have a function of notifying online / offline.
[0058]
In addition, it is assumed that the operating condition setting program 23 is incorporated as firmware for a device for using the Internet such as a router, a modem, a network connection board, etc., instead of installing the operating condition setting program 23 in the computer. You can leave it.
[0059]
The access restriction information management device 20 is a device in which settings relating to access permission list information are performed using a Web page, but settings relating to access permission list information are installed in a computer (Internet access system 10). It may be performed using a dedicated program. The specific configuration of the setting page and the content confirmation page displayed on the computer by the access restriction information management apparatus 20 and the specific contents of the processing executed by the access restriction information management apparatus 20 to display them are as follows. Of course, it may be different from the above.
[0060]
【The invention's effect】
According to the access restriction information management apparatus of the present invention, it is possible to provide a user with an environment in which operating conditions can be accurately set for an Internet router or a firewall program.
[Brief description of the drawings]
FIG. 1 is an explanatory diagram of a usage pattern and configuration of an access restriction information management apparatus according to an embodiment of the present invention.
FIG. 2 is an explanatory diagram of a system handled as an Internet access system by the access restriction information management apparatus according to the embodiment.
FIG. 3 is an explanatory diagram of an access restriction information database provided in the access restriction information management apparatus according to the embodiment.
FIG. 4 is an explanatory diagram of a login page displayed on the computer by the access restriction information management apparatus according to the embodiment.
FIG. 5 is an explanatory diagram of a setting page displayed on the computer by the access restriction information management apparatus according to the embodiment.
FIG. 6 is an explanatory diagram of a content confirmation page displayed on the computer by the access restriction information management apparatus according to the embodiment.
[Explanation of symbols]
10 Internet access system
20 Access restriction information management device
21 Member information database
22 Access restriction information database
23 Operating condition setting program

Claims (2)

An access restriction information management device used connected to the Internet,
An access restriction information database for storing access restriction information indicating the contents of packet filtering performed by each of a plurality of users accessing the Internet using a device having a function of performing packet filtering When,
Content updating means for updating the content of access restriction information related to the user in the access restriction information database based on information transmitted by any user among the plurality of users;
When a predetermined type of request transmitted by an arbitrary user among the plurality of users is received, the content of access restriction for the user is indicated from the access restriction information stored in the access restriction information database. An access restriction information management apparatus comprising: request response means for extracting all information and returning all the extracted information to the device that transmitted the request. The access restriction information database is a database that stores, for each of the plurality of users, an IP address of a device used by the user in a form associated with the access restriction information related to the user,
The content updating means also performs processing for changing an IP address related to the user in the access restriction information database based on information transmitted by any user among the plurality of users.
The request response means returns information obtained by adding an IP address stored in the access restriction information database in association with the access restriction information including each information to all the extracted information. The access restriction information management apparatus according to claim 1, wherein:

Images