Patent Application
20240386126
The present invention relates to an information processing method for controlling access to a network resource, and a storage medium.
For work in a company or the like, it is typical for each person to be provided with a personal computer (hereinafter, referred to as a PC). In regards to security when using a PC, a known technique restricts operations involving a resource by a user with no access privilege to the computer resource while using an existing OS (operating system) and processes (PTL 1).
With increasing diversity in the work content performed in a company and the like, when PCs are used for work in a company and the like, for security reasons, it is becoming common to selectively use a plurality of PCs according to the work content. For example, when the same PC is used for a task involving in-company information of high confidentiality, a task using the Internet, or tasks performed when teleworking, there are concerns such as the risk of in-company information being leaked outside the company and the risk of being the target of a cyber attack. Thus, different PCs which have separate operation environments, such as storage areas and networks accessible or usable based on the work content, are used to carry out tasks. In practice, different operation environments separated per task are implemented using methods such as physically using a plurality of PCs and using VDI (virtual desktop infrastructure) or virtual PCs on one PC.
PTL 1: Japanese Patent Laid-Open No. 2011-175649
However, preparing physical or virtual PCs separated per work content increases the resources (PCs and the OS and other software) that need to be managed, the complexity involved in using a plurality of PCs, and various costs and the like. A plausible solution includes physically separating access terminals using known virtual technology to selectively use the physically existing network resources per user and work content. However, this requires many virtual machines to be prepared for sufficient separation. Also, for example, in the case of separating a file server, there is a method including preparing a plurality of user accounts according to the work and separating them for use at the login stage. However, this makes user management complicated. In either case, user-friendliness may be impaired, and the overall cost may be increased.
The present invention is made in light of the issues described above and an object of the present invention is to realize access control that is expanded according to the use status of a worker for network resources that can be used by the worker.
In order to solve the aforementioned issues, one aspect of the present disclosure provides an information processing method for controlling access to a computer resource on a network resource from a communication apparatus used by a user, comprising: selecting a policy suitable for a state of the communication apparatus from a plurality of policies with access privilege allowed for each one of a plurality of types of work defined as a policy for each work; and in the network resource, obtaining information of a policy selected for the communication apparatus; capturing an operation request from a process or an operating system for the computer resource on the network resource before the computer resource is accessed, in a case where an access request for a computer resource on the network resource is received from the communication apparatus; determining whether or not there is access privilege for a computer resource specified by the operation request captured in the capturing on a basis of information of the policy obtained in the obtaining; executing processing to send the operation request as is to an operating system if a result of the determining is that there is an access privilege and send the result back to a request source; and denying access to the computer resource specified by the operation request if a result of the determining is that there is no access privilege.
Another aspect of the present disclosure provides a non-transitory computer-readable storage medium storing one or more programs for causing one or more computers to execute an information processing method for controlling access to a computer resource on a network resource from a communication apparatus used by a user, the information processing method comprising: selecting a policy suitable for a state of the communication apparatus from a plurality of policies with access privilege allowed for each one of a plurality of types of work defined as a policy for each work; and in the network resource, obtaining information of a policy selected for the communication apparatus; capturing an operation request from a process or an operating system for the computer resource on the network resource before the computer resource is accessed, in a case where an access request for a computer resource on the network resource is received from the communication apparatus; determining whether or not there is access privilege for a computer resource specified by the operation request captured on a basis of information of the policy obtained in the obtaining step; executing processing to send the operation request as is to an operating system if a result of the determining is that there is an access privilege and send the result back to a request source; and denying access to the computer resource specified by the operation request if a result of the determining is that there is no access privilege.
The present invention enables realization of access control that is expanded according to the use status of a worker for network resources that can be used by the worker, while using an existing OS or process of a terminal or a device on a network.
Other features and advantages of the present invention will be apparent from the following description taken in conjunction with the accompanying drawings. Note that the same reference numerals denote the same or like components throughout the accompanying drawings.
The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the invention and, together with the description, serve to explain principles of the invention.
Hereinafter, embodiments will be described in detail with reference to the attached drawings. Note, the following embodiments are not intended to limit the scope of the claimed invention, and limitation is not made to an invention that requires a combination of all features described in the embodiments. Two or more of the multiple features described in the embodiments may be combined as appropriate. Furthermore, the same reference numerals are given to the same or similar configurations, and redundant description thereof is omitted.
The configuration of an access control system 10 according to the present embodiment will now be described with reference to
An example of the functional configuration of the PC 102 will now be described with reference to
A communication unit 1201 includes a communication circuit and the like, for example, and accesses the server 100 and the Internet via wireless communication such as via wireless LAN to exchange the necessary data. A control unit 1202 includes a CPU 1210 and RAM 1211. The control unit 1202 controls the operations of each unit in the PC 102 by loading a computer program stored in a storage unit 1207 onto the RAM 1211 and the CPU 1210 executing the computer program. Also, the control unit 1202 controls access via input via an operation unit 1203 or the like to the internal resources of the PC 102 and the network resources external to the PC.
The operation unit 1203 may include an input apparatus such as a keyboard, mouse, touch panel, and the like of the PC 102 and accepts an operation of a GUI for various types of operations displayed on a display unit 1206. An external IF 1204 is an interface between a predetermined device such as a printer and the PC 102. An imaging device 1205 is a camera device including an image sensor, for example, that captures images in response to instruction from the control unit 1202. The display unit 1206 includes an LCD, OLED or similar display device, for example, and displays a GUI for operation, data successfully accessed by the user, and the like.
The storage unit 1207 includes a non-volatile memory (non-volatile storage medium) such as a semiconductor memory or the like and stores computer programs executed by the control unit 1202, setting values, and the like. Data such as files created for company work and the like are also stored here. The computer program stored in the storage unit 1207 includes an operating system for implementing the various functions of the PC 102, various applications, and programs for executing various types of processing such as the access control program described below.
Next, an example of the functional configuration of the server 100 will be described with reference to
A communication unit 1301 includes a communication circuit for communicating with the PC 102 via the network. Information processed by a control unit 1302 is transmitted to the PC 102, and information processed by the control unit 1302 is received from the PC 102.
The control unit 1302 includes a CPU 1310 and RAM 1311. The CPU 1310 is a central processing unit. The control unit 1302 implements each function of the server 100 by loading a computer program stored in a storage unit 1304 onto the RAM 1311 and executing the computer program using the CPU 1310. The RAM 1311 includes a volatile storage medium such as DRAM, for example, and temporarily stores parameters, processing results, and the like for the control unit 1302 to execute computer programs.
The storage unit 1304 includes a non-volatile storage medium such as a hard disk, semiconductor memory, of the like and stores setting values and computer programs required to the operations of the server 100. Also, the storage unit 1304 stores, in a database 1330, the data of various files relating to work that are uploaded form the PC 102. The computer program stored in the storage unit 1304 includes an operating system for implementing the various functions of the server 100, various applications, and programs for executing various types of processing such as the access control program described below. An operation unit 1303 is an operation mechanism that enables operation of the server 100 either directly or remotely. The operation unit 1303 includes a mouse and the keyboard as well as a component for receiving operation instruction from an external apparatus via communication. For example, the administrator of the server 100 uses the operation unit 1303 to perform various operations including setting the required settings and inputting the required information.
Before describing separation of a network resource according to the present embodiment, two techniques for implementing the present embodiment, namely an API capture technique and a separation policy application technique, will be described.
First, the API capture technique will be described. In the present embodiment, the API capture technique is applied to a terminal (for example, a PC) used by a user and a file server or network device (network resource) on a network, for example. To facilitate a more general description of the API capture technique, in the following example, the API capture technique is applied to a typical electronic device (for example, a PC). Note that it should be clear to one skilled in the art that the API capture technique described below can be applied in a substantially similar manner between each OS of a file server and a network device and an application.
Typically, for an application to access the resources managed by the OS, the API (application program interface) provided by the OS is used. The method for using the API is set by the OS, and an executable code portion that uses the API can be determined. In the present invention, a monitoring routine for monitoring all APIs required to access the resource is provided, and, before an application uses the API, the executable code portion is changed or the entrance of API processing entrance is substituted with the monitoring routine such that the monitoring routine is used when the API is used. The monitoring routine processes the API required by the application, or returns a result to the application as an illegal command without executing the API processing. The access privilege extended by the resource management program of the present invention is managed by this program independently of management of the OS, and a monitoring routine is provided for each type of access privilege. With this method, access from an application that illicitly uses resources is restricted from that application.
Specifically, the resource management program interposed between the application and the operating system, before accessing a computer resource of an operation request from an application specified for accessing the computer resource, monitors and captures the operation request for a specified computer resource from among operation requests issued by the application. Also, whether or not to allow access to the computer resource specified by the captured operation request is determined on the basis of a separation policy, which is a collection of the computer access privileges described below, to control access.
The resource management program 203 is located between a user environment 202 constituted by a typical application which includes an application 2021 for sending a resource access request and an OS function operation 2022 such as a screen capture and a general-purpose OS 201. The resource management program 203 is configured to monitor requests for resources provided by the general-purpose OS 201 and the user environment 202.
Note that the general-purpose OS 201 includes a resource 2011 managed by the OS and an API group 2012 provided by the OS to the application 2021.
The API monitoring CTRL 2031 in the resource management program 203 according to the present invention is a module for monitoring all APIs required for performing access control. Also, the APL monitoring CTRL 2032 is a module for storing resources held by the application 2021. The access control CTRL 2033 is a module for determining whether or not to allow access to the resource 2011 and includes an access privilege management table 2035. Also, the OS monitoring CTRL 2034 is a module for monitoring the operations to access the resource via the function of the general-purpose OS 201.
As illustrated in
The resource specifying information 20351 is information for specifying a specific resource 2011 from among the resources 2011 managed by the general-purpose OS 201. In the case of a file, information such as a file name or a file ID is registered. In the case of an application, a program name is registered, for example. In the case of communication data, a host name, a port number, an IP address, or a Bluetooth identifier or Wi-Fi AP (access point) address is registered. In the case of memory, an object name indicating the object, an address, or the like is registered. Also, in the case of an external apparatus, a device name indicating the device driver or a unique identifier called device ID is registered, for example.
The condition 20352 indicates a condition for validating access privilege or a combination thereof. For example, a user name/ID, a group name/ID, time, or the like is registered.
The access privilege information 20353 to 2035n indicates, from among access privileges extended but not defined in an existing environment, a privilege added to the specified resource. For example, a privilege to move to another medium, a privilege to copy to another medium, a print privilege, a privilege to load to a shared memory (clipboard or the like in the case of Windows), screen capture privilege, usable application restrictions (prohibited to use outside of specified application, prohibited to attach to email), or the like are registered. Also, for resources involving reading and writing, each of these privileges can be registered. For example, writing to a specific USB memory may be not allowed but read may be allowed. In a case where writing is also allowed, writing using encryption can be specified, and the encryption key at this time is defined by the separation policy (separation policy will be described below in detail). Only a separation policy with the same encryption key can read the information. Thus, the information that can be essentially referenced can be separated on a separation policy basis. Such specifications can be made for resources having writing privilege such as files, USB devices, clipboard, and the like. Communication resources have reading (receiving) and writing (transmitting) information as well as connecting and accepting information.
Note that typically, access to a resource may be performed via a plurality of APIs. The resource specifying information in this case is converted to an ID (handle or the like) managed by the OS. In this case, inside the resource management program 203, the resource specifying information and the ID are equated with one another.
The processing of the resource management program 203 according to such a configuration will now be described following the information transfer process indicated by (1) to (9) (corresponding to the numbers 1 to 9 in the diagram) in
As a result, the application 2021 runs as if the request succeeded, but actually, the requested resource cannot be accessed.
In a case where the application 2021 issues a resource release request API and the API is successful, this is sent to the APL monitoring CTRL 2032. The APL monitoring CTRL 2032 deletes the association between the application 2021 and the previously held resource.
In the first basic mode (1), in a case where an access request for a target resource exists via an API issued by the application 2021 (step 401), the resource management program 203 checks whether the application 2021 has the access privilege for the resource (step 402). In a case where the check result shows there is access privilege (step 403), the API issued by the application 2021 is sent as is to the general-purpose OS 201. The general-purpose OS 201 executes API processing belonging to the OS (step 404).
In a case where the API processing is successful, the resource management program 203 registers information indicating that the application 2021 is holding the resource (step 405). Then, the API result from the general-purpose OS 201 is sent back as is to the application 2021 (step 406). In this manner, access to the resource is completed (step 407).
Thereafter, in a case where a release request for a held resource is issued from the application 2021 (step 408), the resource management program 203 sends the release request to the general-purpose OS 201. The general-purpose OS 201 executes API processing belonging to the OS (step 409). In a case where the API processing is successful, the resource management program 203 removes information indicating that the application 2021 is holding the resource (step 410). Then, the API result from the general-purpose OS 201 is sent back as is to the application 2021 (step 411). In this manner, release of a held resource is complete (step 412).
In the second basic mode (2), in a case where an access request for a target resource exists via an API issued by the application 2021 (step 501), the resource management program 203 checks whether the application 2021 has the access privilege for the resource (step 502). In a case where the check result shows no access privilege (step 503), an illegal access error is sent back to the application 2021 (step 504). In this manner, processing for access to a resource ends (step 505).
In a case where an access request for a target resource exists via an API issued by the application 2021 not responding to an illegal access error (step 506), the resource management program 203 checks whether the application 2021 has the access privilege for the resource (step 507). In a case where the check result shows no access privilege and the application 2021 is not responding to the illegal access error (step 508), the access request is replaced with an access request for a dummy resource prepared in advance by the resource management program 203, and this is sent to the general-purpose OS 201 (step 509).
The general-purpose OS 201 executes API processing belonging to the OS (step 510). The resource management program 203 sends the API processing result from the general-purpose OS 201 as is back to the application 2021 (step 511). As a result, processing for access to a target resource ends, but due to dummy resource, essentially nothing happens (step 512).
Note that a case where an illegal access error is sent back to the application 2021 and where the access request is replaced with an access request for a dummy resource prepared in advance, in a case where there is no access privilege, has been described above. However, the access request may be replaced so that another resource allowed to be accessed is accessed. Whether the replacement is with a dummy or another resource is specified in the access privilege management table 2035.
The separation policy application technique will be described below. To facilitate a more general description of the separation policy application technique, in the following example, the separation policy application technique is applied to a typical electronic device (for example, a PC). As described below, the separation policy application technique is also applied to a file server (or another network device) on the network, for example.
In the following example of the separation policy application, the resource management program 203 manages access requests for resources on the basis of the separation policies. The separation policies are information, where, for a plurality of types of tasks, policies (hereinafter, referred to as separation policies) are collectively defined for each task for access privileges required for each task.
A separation policy includes an application executable or not executable for the corresponding task, areas (such as a specific local disk or network disk) which are readable and writable or not readable and writable, allowed communication destinations (such as email or the Internet), target user, PC, time period, use location, and similar information.
The plurality of defined separation policies are manually switched by the user or automatically switched when a PC is used, and, when the PC is running, one of these separation policies is always applied to the resource management program 203.
For the OS or software running on a PC, the resource management program 203 performs control to allow an access request for a resource only in the range defined by the applied separation policy. In other words, control is performed to satisfy the separation policy by the resource management program 203 capturing the processing executed by the OS or software at the API level, processing violating the separation policy being prohibited, and only allowing processing that satisfies the separation policy to be executed. Alternatively, processing that violates the separation policy may be prohibited as well as being switched to a different processing that does satisfy the separation policy.
In “API capture” by the resource management program 203, the required capture is performed not only at the application level but also at a system level called the driver and service to implement separation equivalent to that of PCs being physically separated.
For example, to not allow access to the Internet, various known techniques such as denying access partway along the communication path can be implemented. However, with a physical separation, the PCs are able to be not even connected to such a network. On the other hand, in the present embodiment, using the resource management program 203, whether to allow access to a communication resource (for example, a network card or the like) for implementing communication with the network is determined at the API level inside the PC, and thus, when the access is denied, communications do not flow through the connected network. This is as effective as physical separation in relation to recent concerns such as the communication device itself being targeted with a cyber attack and the like.
Next, examples of items for setting allow or prohibit using a separation policy according to the present embodiment will be described.
First, the following are examples of separation policy control information. These may correspond to the resource specifying information in
The following are examples of separation policy application target information. These may correspond to the controllable conditions or the access privileges in
Also, clear processing of the information of when switching to another separation policy is executed as follows.
The control information, application target information, and clear information described above are made a set to define one separation policy. Note that a plurality of separation policies can be defined by defining each name, and the plurality of separation policies are switched between via the separation policy switching mechanism and applied to the resource management program 203.
In a case where a separation policy is applied to the resource management program 203, the separation policy provided to the resource management program 203 is analyzed by the access control CTRL 2033 illustrated in
Examples of separation policies to be used at a company or the like include a confidential work separation policy, an in-company office work separation policy, a remote work at home separation policy, a business trip work separation policy, an unregistered location separation policy, a predetermined separation policy, and the like.
Specifically, with the confidential work separation policy, the PCs to which the separation policy is applied are restricted, the people who use them are restricted to certain management or development personnel, and the usable location and the like is also strictly restricted. Also, the resource management program 203 to which the confidential work separation policy is applied allows access to substantially all of the resources for access requests from the application 2021. For example, regarding usable programs, access is allowed to basically all of the programs, such as a schedule management application, a development application, a document creation application, and the like. Also, regarding the readable area, the writable area, and the like, an external HDD, the internal HDD, and other storage areas are basically all allowed to be used. Accordingly, the company's confidential information and the like can be accessed by only certain people, and the various types of tasks using the information can be freely performed. However, access to networks such as an intracompany network is allowed but access to networks such as the Internet is not allowed due to the nature of possibly dealing with confidential information.
With the in-company office work separation policy, compared to the confidential work separation policy, the range of people registered for office work at the company that can use a terminal is expanded, the location information which allows the use of the terminal is expanded. In this manner, by increasing the number of people or locations allowed for use, the security level is reduced. Thus, the resource management program 203 reduces the number of resources that can be accessed in the case of this separation policy being applied compared to the confidential work separation policy. For example, regarding usable programs, development applications are made not usable, and basically, access is allowed only to programs required for office work, such as schedule management applications, document creation applications, and the like. Also, regarding the readable area, the writable area, and the like, access to an external HDD is not allowed, and only access to the internal HDD is allowed. Also, access to networks such as an intracompany network and the Internet is allowed to allow for searching using the Internet. Alternatively, depending on the work, access may be allowed to the intracompany network, but communication via the Internet may be not allowed.
Also, with the remote work at home separation policy, the terminal to which the separation policy is applied is a mobile PC registered with the company, and the usable location is the home of a company employee registered with the company. In a case where the remote work separation policy is applied, the terminal references its GPS information and the registered address of the home of the employee and applies the separation policy to the resource management program 203. When remotely working from home, because the security level is lower than the security at the company, the usable programs are further restricted. For example, development applications, office work applications, and the like are unable to be used, and basically only programs required for working at home such as document creation applications are allowed to be accessed. Also, regarding the readable area, the writable area, and the like, access to an external HDD is not allowed, only reading from the internal HDD is allowed, and only storage prepared in the company are readable and writable. Also, for the Internet and intracompany storage to be used via an intracompany network, the network allows access only for a VPN (virtual private network) to connect to the intracompany network.
Also, with the business trip work separation policy, the terminal to which the separation policy is applied is a mobile PC registered with the company, and the usable location is the trip destination registered with the company. In a case where the business trip work separation policy is applied, the GPS information and the registered address of the trip destination are referenced and applied to the resource management program 203. Also, the usable programs are restricted to a greater extent than with working from home with only browsers and email being made usable. Also, the readable area is restricted to only the content of the carried USB memory, for example. Access to a network is also not allowed.
Also, in a case where a terminal registered with the company is trying to be used by an employee or another person at an unknown location such as an unregistered location, as the security state is unknown, the resource management program 203 prohibits access to all resources.
The predetermined separation policy is a separation policy preset to be used in a case where no applicable policy exists. With the predetermined separation policy, typical office work programs, document creation applications, email, and the like can be used. With the predetermined separation policy, it is assumed that the terminal is used at the company, and the work typically performed at the company is allowed. Also, as with the in-company office work separation policy, access to networks such as an intracompany network and the
Internet is allowed to allow for searching using the Internet.
Next, a method for managing separation policies will be described.
Next, a method for switching separation policies such as those described above depending on the work will be described.
First, candidates of the separation policies to be applied at the start of use of a PC are those having application target information registered in a separation policy which matches with the PC use situation. Also, an order of priority can be defined for the separation policies on the basis of, of the application target information, the application terminal information, application user information, application position information, application time information, and similar types of information, and the applicable separation policy with the highest order of priority is made the candidate.
Take an example where, for the information type order of priority, it is defined that the application terminal information is high in the order and the application user information is low in the order. If a user B uses a terminal A, then out of the separation policy of the terminal A and the separation policy for the user B, the separation policy for the terminal A would be made the candidate.
Also, an application order of priority can be defined for separation policies belonging to the same information type or the same order of priority can be defined. In a case where there are still a plurality of candidates after restriction using the information type order of priority, selection is made according to the priority order of the separation policies.
In a case where the result of restricting the separation policy candidates in this manner produces a plurality of separation policy candidates, the user can select any one from these. If the user does not select one, the first separation policy compatible inside the PC is applied.
In step S701, the CPU 1210 of the terminal PC obtains the information of its PC name, a user name, a use location, and the time.
In step S702, the CPU 1210 of the terminal PC obtains the separation policy file stored in its hard disk or the like.
In step S703, the CPU 1210 of the terminal PC selects the separation policy that matches with the application target information with the highest order of priority from among the application target information including PC name, user name, use location, time, and the like.
In step S704, the CPU 1210 of the terminal PC determines whether or not there are a plurality of policies corresponding to the application target information with the highest priority selected in step S703. In a case where there is a plurality, the flow proceeds to step S705. Otherwise, the flow proceeds to step S706.
In step S705, the CPU 1210 of the terminal PC selects the separation policy with the preset highest order of priority from among the plurality of separation policy candidates.
In step S706, the CPU 1210 of the terminal PC determines whether or not there is one separation policy. In a case where there is one separation policy, the flow proceeds to step S708. In a case where there are no separation policies, the flow proceeds to step S707.
In step S707, the CPU 1210 of the terminal PC selects the predetermined separation policy.
In step S708, the separation policy selected in one of the steps S705 to S707 is applied to the resource management program 203.
Note that as described above, in step S706, the separation policy with the preset highest order of priority from among the plurality of separation policy candidates is selected. However, the user may perform the selection.
In step S801, the CPU of the management server obtains the information of a PC name, a user name, a use location, and the time from the terminal PC.
In step S802, the CPU of the management server obtains the separation policy file stored in its hard disk or the like.
In step S803, the CPU of the management server selects the separation policy that matches with the application target information with the highest order of priority from among the application target information including PC name, user name, use location, time, and the like received from the terminal PC.
In step S804, the CPU of the management server determines whether or not there are a plurality of policies corresponding to the application target information with the highest priority selected in step S803. In a case where there is a plurality, the flow proceeds to step S805. Otherwise, the flow proceeds to step S806.
In step S805, the CPU of the management server selects the separation policy with the preset highest order of priority from among the plurality of separation policy candidates.
In step S806, the CPU of the management server determines whether or not there is one separation policy. In a case where there is one separation policy, the flow proceeds to step S808. In a case where there are no separation policies, the flow proceeds to step S807.
In step S807, the CPU of the management server selects the predetermined separation policy.
In step S808, the CPU of the management server transmits the separation policy selected in one of the steps S805 to S807 to the terminal PC.
Note that as described above, in step S805, the separation policy with the preset highest order of priority from among the plurality of separation policy candidates is selected. However, the plurality of separation policy candidates may be transmitted to the terminal PC as is, so the user may select the separation policy to be applied on the terminal PC.
In the examples described above, what separation policy is selected is determined when the terminal is started up. However, the processing described above may be executed to change the separation policy as appropriate at timing such as when the user information is changed such as when logging in or when switching users, when the registered position information is confirmed or changed, when the date and time obtained from the OS is changed, and the like. Also, each time, the operations of the OS when using the PC and all of the programs are controlled according to the separation policy selected and applied by the selection method described above.
Next, network resource separation according to the present embodiment will be described. In network resource separation, the API capture and separation policy are applied to a network resource (for example, a file server, a gateway machine, or a proxy server) to separate the access target. Note that the access control of the network resource may be performed using a known access control technique implement for each network resource instead using the API capture described above as long as the access control according to the separation policy according to the present embodiment can be performed.
Separation policies that enables separation of the network resource will now be described with reference to
As with the separation policies described above that separate the network resource, regarding the network resource, the separation policy provided to the resource management program 203 is analyzed by the access control CTRL 2033 illustrated in
As illustrated in
The network resource control information includes information of at least one of the IP address, host name, URL, directory path of the file server, network device name (printer, scanner, or the like) for the network resource targeted for access control (to allow or prohibit). In the example illustrated in
Also, with the network resource control information, these pieces of information may be designated in combination with an application program for access. For example, a program for allowing or prohibiting access to a network resource may be designated using at least one of a program name, program path, and a program file hash. In the example illustrated in
Note that the information constituting the application target and the information constituting the network resource control information can be used, as necessary, as individual separation policies omitted or masked depending on their role (PC, gateway, file server, or the like). In this case, when applying an individual separation policy to a PC or a file server, they may be linked by the separation policy name or a separation policy identifier ID.
As described using
With a configuration in which a network resource such as a file server is accessed by the PC, the resource management program described above that executes access control according to the separation policy may also run on one or more network resources such as a gateway, a proxy, a file server, and the like. In a case where the PC attempts to access a network resource, the resource management program existing on the network resource identifies the current separation policy of the PC which is the access source and executes access control according to, of the separation policies in the resource management program, the policy name and the policy details of the same name applied to the PC. In a case where the separation policy applied to the PC is changed, the PC may transmit the post-change separation policy name (information for identifying the separation policy) to the network resource (file server or proxy) to link the separation policy applied by the network resource to the separation policy applied by the PC. Note that in both the PC and the network resource, API capture can be executed by each resource management program applies a separation policy of the same separation policy name. In this manner, both the PC and the network resource are linked and separated by the applied separation policy, allowing for strong security to be ensured. On the PC side, the name of the separation policy name to be applied may be obtained but the API capture not executed. In other words, API capture with a separation policy (corresponding to the separation policy name obtained by the PC) applied only to the file server and the gateway of the network resource side may be executed. In this case, from the PC, these network resources are appropriately controlled relating to separation according to the separation policy, but there is no need to execute special control such as API capture on the PC side. Thus, the implementation on the PC side is simplified, and the operations of the PC are sped up. Also, in a case where one or more gateways exist on the path a file server is accessed from a plurality of PCs, API capture according to the separation policy may be executed only for the one or more gateways on one or more paths. In this case, since API capture is not executed at the PC and the file server, there is no need for special control at the PC and the file server. However, by the one or more gateway executing access control according to the separation policy (corresponding to the separation policy name obtained by the PC), network separation that is simple and has high security can be implemented.
Regarding the separation policies for separating the network resource, the information of the separation policies described above may be stored in a file format (separation policy file), for example. The separation policy file may be encrypted. The separation policy file may be stored in advance in the PC and the network resource.
Also, a management server for managing the contents of the separation policies may be provided, and the separation policies may be distributed from the management server. Furthermore, in the separation policies held by the PC, only the application target information may be included, and in the separation policies held by the network resource, only the network resource control information may be included. With such a configuration, there may be cases where the management of the network resource control is made easier, such as when the policy contents are changed in conjunction with a change to the network configuration. In a case where the separation policies are exchanged between apparatuses, an exchange of separation policies is performed after authentication is performed between both devices. The exchanged separation policies and other exchanged data may be encrypted.
In a case where a management server is used, the PC and the network resource may access the management server periodically or indeterminately, and the separation policies of each device may be changed by obtaining the latest separation policy file. Note that in a case where the separation policies used by the PC and the network resource are managed by a management server, the PC and the network resource may be configured to be able to access the management server to obtain a separation policy file regardless of the set contents of the separation policy.
In an example of a separation policy, separation policy information is dynamically provided to the PC and the network resource by the management server. In this case, the PC and the network resource store the separation policy information received from the management server in the memory or storage unit in the device for use. At a timing when no separation policy information exists, for example, after a restart, the “predetermined separation policy” described below may be used.
At a timing such as just after activating the PC or when switching the separation policy, the PC (and the network resource) may use a predetermined specific separation policy (also referred to as the default separation policy). The default separation policy is a default separation policy tentatively used in a case where no applicable separation policy exists, for example. The control unit in the network resource may apply the separation policy as a default value in the case of applying a separation policy where the access source does not have an applicable policy or it does not exist. The default separation policy may be defined by the contents of the policy at maximum restriction. The policy at maximum restriction may include, for example, allowing communication only with the management server, prohibiting access to all of the network resources, or the like.
When the file server 100 receives a file access (in other words, an access request) from the PC 102 (S1006), the file server 100 identifies (applies) the separation policy (for example, “for in-company confidential task A”) corresponding to the obtained identification information of the separation policy, and the resource management program of the file server 100 executes access control according to the separation policy (S1008). If it is access to a data region allowed in the separation policy, the file server 100 transmits the requested file data to the PC 102 (S1010).
The resource management program of the file server 100 checks the contents of the current separation policy with the terminal at the timing of when there is access from the PC 102 (when the control information is registered in combination with the program, the program of the access source also checks). Then, access is allowed or denied according to the separation policy in the API capture control processing. In this manner, detailed network resource control such as control of access to a directory in the file server can be performed. Note that in the case of a protocol with “establish connection” processing such as TCP/UDP and access with “open” processing such as file access, control can be executed on the processing and omitted for the subsequent processing.
In the example illustrated in
Also, in a case where one or more gateway machines are placed along the access path from the PC to the file server 100 as a network configuration, a separation policy is not required in a subsequent network resource, and the gateway machine may transmit the separation policy information to the file server 100, for example. This makes policy management easier. Note that in a case where only a URL that can access via a proxy server is controlled, an existing simple control technique (such as a proxy program, gateway program, or the like) may be used for access control.
In this manner, with a network resource in a network, the current separation policy to be applied to the PC corresponding to the access source is linked, and access control can be implemented that is restricted on a network resource that can access as defined by the separation policy. In this manner, as a result, a network resource that can be accessed from the same terminal and is usable can be separated on demand as necessary (like a separated network resource).
Next, processing for executing access control according to a separation policy in the file server 100, which is a network resource, will be described with reference to
In S1101, the CPU 1310 of the file server 100 obtains the separation policy file from the management server, for example. Note that the file server 100 is not required to obtain the separation policy file from the management server in advance. The contents of the separation policy may be obtained from the PC in advance, and when the PC accesses the file server 100, the file server 100 may obtain the contents of the separation policy from the management server.
In S1102, the CPU 1310 determines whether there has been an access request for a file from the PC 102. Here, the CPU 1310 may obtain this together with information relating to the application target (terminal information, user information, position information, and time information). When there has been an access for the file from the PC 102, the CPU 1310 proceeds the processing to S1103. Otherwise, the processing proceeds to S1102.
In S1103, the CPU 1310 obtains the identification information of the separation policy to be applied by the PC 102. In S1104, the CPU 1310, according to the obtained identification information of the separation policy, extracts the network resource control information of the separation policy file and set this as information (the resource designating information, condition, or access privileges illustrated in
In S1105, the CPU 1310 executes access control via the resource management program using API capture according to the network resource control information set as the information to be used for access control. Here, in S1104, in a case where the application target information of the separation policy file is set, access control is executed also according to the application target information.
In S1106, the CPU 1310 transmits the result (transmits the accessed file to the PC 102, for example) according to the result of the access control from the resource management program. When the CPU 1310 transmits the result, the present processing ends.
Note that in the example described above, access request for a file which is a computer resource on the file server 100 from the PC 102 is executed. However, the same applies to an example where a network device is accessed from the PC 102 (an example where an Internet access request to a proxy is executed, for example). In other words, the proxy is applied to the separation policy, and access control of a computer resource (for example, a port, an established connection, a tunnel, or the like) on a proxy is executed according to the separation policy.
As described above, in the embodiments described above, access control via API capture according to a separation policy may be linked to a PC used by a user on a network resource (for example, a file server or a network device) and executed. In this manner, an environment in which the PC and the network resource side are physically separated per task can be imitated. Also, since the PC and the network resource are linked and operating using the same separation policy, the network environment itself can imitate physically separated individual environments. In other words, access control that is expanded according to the use status of a worker for network resources that can be used by the worker, while using an existing OS or process of a terminal or a device on a network can be implemented.
The invention is not limited to the foregoing embodiments, and various variations/changes are possible within the spirit of the invention.
This application is a continuation of International Patent Application No. PCT/JP2022/002902 filed on Jan. 26, 2022, the entire disclosures of which is incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| Parent | PCT/JP2022/002902 | Jan 2022 | WO |
| Child | 18785153 | US |
