JP5284012B2 - Client / server system and client / server system audit method - Google Patents

Description

  The present invention relates to a client / server system to which security measures are taken and a client / server system auditing method.

  When implementing security measures in a client / server system consisting of a server device connected to the network and a client device connected to the network under the control of this server device, the security measures must be implemented. In many cases, the security module installed in the client device monitors the client device, and the server device audits the log sent from the client device with the audit module. It was.

  In the above, when the monitoring agent acquires an alert from the monitoring target device, the operation confirmation is notified at a cycle shorter than the periodic cycle over a certain period (see Patent Document 1).

  However, if there are dozens or hundreds of client devices and the log file size is large, the log to be audited becomes enormous, so if you try to quickly detect an action that leads to information leakage, Although the audit cycle must be shortened, the load on the server device increases.

In addition, when a mobile PC uses a wireless LAN and is taken out and the client device cannot access the server device for a certain period of time, the log from the client device to the server device cannot be transmitted. There is a problem that cannot be done, and the vulnerability of the system has been regarded as a problem.
JP 2006-221484 A

  An object of the present invention is to reduce the contents of audit processing of a server device in a security measure of a client / server system, reduce the processing load of the server device, and quickly find a client device that violates a security policy and prevent information leakage. The object is to provide a client / server system and an audit method for the client / server system.

In order to achieve the above object, a client / server system of the present invention is a client / server system in which a plurality of clients and a server are connected via a network, and the client creates a log of the client. Monitoring means, and primary audit means for monitoring a highly urgent log that leads to information leakage including at least unauthorized mail transmission and file copying to an external memory, based on the log created by the monitoring means in the first period; The server includes at least a WEB operation, a logon / logoff operation, and a game software execution based on the log acquired by the monitoring unit in a second period longer than the first period. a secondary inspection means for monitoring a low urgency log, audit results between the primary verification unit said secondary verification unit Zui, the pre-registered clients beyond the security violation frequency comprises a black list creation means for blacklisting, and the secondary verification unit is client or found preferentially registered in the black list It is characterized by conducting an audit.

An audit method for a client / server system according to the present invention is an audit method for a client / server system in which a plurality of clients and a server are connected via a network, and includes the step of creating a log of the client ; A primary audit step for monitoring a highly urgent log that leads to information leakage including at least unauthorized mail transmission and file copy to an external memory based on the log in the first period, and a period longer than the first period A secondary audit step for monitoring a log of low urgency including at least a WEB operation, a logon / logoff operation, and a game software execution based on the log in the second period, the primary audit step and the secondary audit step clients that based on the audit results, beyond the security violation frequency that has been pre-registered in Comprising a blacklisting step of blacklisting, and said secondary audit step is characterized in carrying out the priority audit clients registered in the black list.

  According to the above-described invention, the contents of audit processing of the server device are reduced in the security measures of the client / server system, the processing load of the server device is reduced, and the client device that violates the security policy is quickly found to prevent information leakage. It is possible to provide a client / server system and a client / server system audit method.

  In the security measures of the client / server system of the present invention, the contents of audit processing of the server device are reduced, the processing load of the server device is reduced, and the client device that quickly finds a client device that violates the security policy and prevents information leakage It is possible to provide an audit method for a server system and a client / server system.

Hereinafter, embodiments of a backup system of the present invention will be described with reference to the drawings.
FIG. 1 shows a schematic configuration of the entire backup system according to the present embodiment.
<Embodiment>
FIG. 1 shows a configuration diagram of a client / server system in this embodiment.
The client apparatuses 2a to 2c have (1) a monitoring module 21 and (2) a primary audit module 23 as main constituent modules, and a log 22 created by the monitoring module 21 and a file created by the audit module 23 (hereinafter, referred to as the following) Audit report 24).

  (1) The monitoring module 21 operates as a resident program such as a Windows (registered trademark) service program, and mainly performs file operations, accessed Web application operations, device operations, print jobs, logon / logoff, and mail transmission. The contents are monitored and a log 22 is created.

  (2) The primary audit module 23 operates as a resident program and audits the client device 2a, similar to the (1) monitoring module 21. The audit function 232 of the primary audit module 23 operates in a shorter cycle than the secondary audit module 12 of the server device every hour or the like, and leads to information leakage such as mail transmission logs and log files copied to USB memory. An audit is performed on a highly urgent log and an audit report 24 is created.

  If there is an operation that violates the security policy, a warning 25 is given to the server apparatus administrator. By auditing a highly urgent log in a short cycle, it is possible to quickly detect an action that leads to information leakage.

  On the other hand, the main component module of the server apparatus 1 is the secondary audit module 12. Similarly to the primary audit module 23, the secondary audit module 12 operates as a resident program.

  The blacklist creation function 121 of the secondary audit module 12 refers to a past audit report from the database 14 of the server device 1, calculates the frequency of violation of the security policy of each client device 2a to 2c, and creates the blacklist 122 Function.

  The audit function 124 operates in a longer cycle than the primary audit module 23 such as every day, and uses the blacklist 122 for the log 22 sent from the client apparatuses 2a to 2c that is not audited, and uses it in the security policy. Auditing is performed from the client devices 2a to 2c that are frequently violated. As the audit result, an audit report 13 merged with the audit report 24 sent from the client apparatuses 2 a to 2 c is created and registered in the database 14 of the server apparatus 1. Similarly to the audit function 232 of the client apparatuses 2a to 2c, if there is an operation that violates the security policy, a warning 15 is given to the server apparatus administrator.

  2 shows an operation flowchart of the primary audit module 23 of the client devices 2a to 2c, and FIG. 3 shows an operation flowchart of the secondary audit module 12 of the server device 1, which will be described in detail.

"Processing of client devices 2a to 2c"
(1) Acquisition of monitoring log 22 (S21)
A log 22 that is highly urgent with respect to security such as a file operation created by the monitoring module 21 and a URL of the accessed Web is acquired.
(2) Acquisition of audit keyword 231 (S22)
The audit keyword 231 set in advance is acquired. As the audit keyword 231, it is possible to set different keywords for the client devices 2 a to 2 c and the server device 1. For example, as described below, the client devices 2a to 2c set a department-specific audit keyword 231 and the server apparatus 1 sets a common keyword 123 for the department.

● Audit keyword 231 for primary audit
Company ○○○ Company Audit Keyword ├ Sales Department ・ ・ ・ Customer Information, Technical Information (Because sales may have technical information)
├ Engineering Department ・ ・ ・ Technical Information└ General Affairs Department ・ ・ ・ Employee Information ● Audit Keywords 123 for Second Audit
XX Company, Ltd. Audit keyword ├ Sales department ... Secret, top secret Technology department ... Secret, top secret General affairs department ... Secret, top secret (3) Audit execution (S23)
Executes at a set cycle such as every hour. In the primary audit of the client devices 2a to 2c, the audit cycle is set in a shorter cycle than the secondary audit of the server device 1. Whether the audit keyword 231 acquired in (2) is included in the log 22 acquired in (1) is detected by performing pattern matching.
In the primary audit, a highly urgent log such as mail transmission monitoring and file copying to a USB memory is audited at short intervals such as every hour.
Of the logs 22 created by the monitoring module 21 such as file operation, Web operation, application operation, device operation, print job, logon / logoff, and mail transmission, a file containing confidential information was copied to the USB memory. A log of file operations that understands and a log of email transmissions that show that confidential information has been sent by e-mail can lead to information leakage immediately.

  However, logs such as web operations, logon / logoff, and application operations such as games that are not related to work do not always lead to information leakage. Therefore, a second audit of the server apparatus 1 performs an audit. .

  Further, by performing the primary audit in the client devices 2a to 2c, it is possible to solve the vulnerability when the client devices 2a to 2c are taken out and cannot be connected to the server device 1 for a certain period of time.

(4) Audit report creation (S25)
The audit result is left as an audit report 24. If an operation that violates the security policy is found, the corresponding part is extracted and described in the audit report 24 together with the date and time, the user name, and the machine name.

(5) Alert transmission (S27)
When an operation that violates the security policy is found in the audit, a warning 25 is notified to the server apparatus administrator by using means such as e-mail.
"Processing of server device 1"
(6) Creation of black list (S32)
The black list 122 refers to past audit reports from the audit report database 14, calculates the frequency of violation of the security policy for each of the client devices 2a to 2c, and selects the client devices 2a to 2c that exceed a certain frequency (threshold). , Listed in order of violation frequency.

(7) Audit execution (S35)
Executes at a set cycle such as every day. The secondary audit of the server device 1 sets an audit cycle with a longer cycle than the client devices 2a to 2c.
When there is the black list 122, audits of the logs of the client apparatuses 2a to 2c are executed in the order described in the black list 122. Similarly to the primary audits of the client apparatuses 2a to 2c, the secondary audit of the server apparatus 1 performs pattern matching to determine whether the set keyword 123 is included in the log 11.

(8) Creation of audit report (S36)
In creating the audit report 13 of the server device 1, the audit report 13 obtained by merging the audit report 24 and the audit result sent from the client devices 2 a to 2 c is created.
<Specific operation in this embodiment>
The specific operation of an example of auditing whether or not an auction site unrelated to the business is being browsed will be described below.
(A) An auction site (XX! Auction etc.) and a threshold (10 times) are set in the audit keyword 231 of the Web monitoring log.
(B) An audit is performed using the log 11 sent from the client devices 2a to 2c and the set audit keyword 123.
(C) In the WEB monitoring log of the client device 01, OO! It is assumed that the description of the auction is detected about 15 times, the client device 02 is detected 8 times, and the client device 03 is detected about 17 times.

(D) An audit result is created in the audit report 13, and a warning 15 is sent to the server apparatus administrator if there is a violation.
In the next audit,
(A) An audit report is acquired from the audit report database 14.
(B) Since it is found that the audit keyword 123 (XX! Auction) set by the client device 01: 2a is viewed about 15 times, the client device 01: 2a and the usage frequency 15 are displayed in the black list 122. Device 02: 2b and usage frequency 8 are set, and client device 03: 2c and usage frequency 17 are set.

  Since the threshold value of the audit keyword 123 is 10 times, the client device 01: 2a and the client device 03: 2c exceed the threshold value, and are recorded as dangerous client devices. The client device 02: 2b is registered as a dangerous client device when two more histories are seen.

(C) From the logs 22 sent from the client apparatuses 2a to 2c, auditing is first performed from the log 22 of the client apparatus 03: 2c on the black list 122, and then the client apparatus 01: 2a is audited The rest are audited in the order of acquisition.
(D) An audit result is created in the audit report 13, and a warning 15 is sent to the server apparatus administrator if there is a violation.
As described above, according to the security measures of the client / server system of the present embodiment, the contents of audit processing of the server device 1 are reduced, the processing load of the server device 1 is reduced, and the client that violates the security policy It is possible to provide a client / server system and a client / server system auditing method for quickly finding the devices 2a to 2c and preventing information leakage.

1 is a diagram showing an overall schematic configuration of a client / server system according to an embodiment. The operation | movement flowchart of the audit module of the client apparatus concerning this embodiment. The operation | movement flowchart of the audit module of the server apparatus concerning this embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Server apparatus, 2a, 2b, 2c ... Client apparatus, 3 ... Network, 11 ... Log, 12 ... Secondary audit module, 121 ... Black list creation function, 122 ... Black list, 123 ... Audit keyword, 124 ... Audit function (Long cycle), 13 ... audit report, 14 ... audit report database, 15 ... warning, 21 ... monitoring module, 22 ... log, 23 ... primary audit module, 231 ... audit keyword, 232 ... audit function (short cycle), 24 ... Audit report, 25 ... Warning,

Claims (2)

A client / server system in which a plurality of clients and a server are connected via a network ,
The client
Monitoring means for creating a log of the client;
Based on the log created by the monitoring means in the first period, primary audit means for monitoring a log with high urgency leading to information leakage including at least unauthorized mail transmission and file copy to an external memory;
Comprising
The server
Based on the log acquired by the monitoring means in a second period that is longer than the first period, a log with low urgency including at least a WEB operation, a logon / logoff operation, and game software execution is monitored. The next audit means,
On the basis of the inspection results of the primary verification unit said secondary verification unit, and blacklisting means for registering a client that exceeds the security violation frequency of pre blacklisted,
Comprising
Said secondary audit means to implement the client whether we preferentially auditing registered in the black list torque client / server system.
An audit method in a client / server system in which a plurality of clients and a server are connected via a network ,
Creating a log of the client ;
A primary audit step of monitoring a highly urgent log that leads to information leakage including at least unauthorized mail transmission and file copy to external memory based on the log in the first period;
A secondary audit step of monitoring a log with low urgency including at least a WEB operation, a logon / logoff operation, and a game software execution based on the log in a second period longer than the first period;
On the basis of the inspection result in the primary inspection step secondary auditing step, the blacklisting step of blacklisted the client beyond security breach often registered in advance,
Comprising
It said secondary Audit method torque client / server system to implement the priority audit clients registered in the black list in step.

Images