Improper access prevention program, method, and apparatus

• US 20030188197A1
• Filed: 12/11/2002
• Published: 10/02/2003
• Est. Priority Date: 03/28/2002
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Miyajima, Ichiro, Miyata, Kaori
• Application Number:
  US10/316,100
• Publication Number:
  US 20030188197A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An improper access prevention program is provided that executes processing for preventing improper access through a network, whereby the task load on the administrator can be alleviated and a plurality of sites protected by a plurality of protection means can be effectively and efficiently protected, and such improper access prevention program is designed to cause administration means connected to a plurality of protection means and a plurality of detection means through a network to receive improper access information detected by any of the detection means, to decide, in accordance with this received information, on protection means where counter-measures against this improper access are to be implemented and decide on the particulars of the protective counter-measures in respect of the protection means, and to give instructions for the implementation of said protective counter-measures that have been decided upon to the protection means.

Claims

1. An improper access prevention program for causing a computer connected, through a network, with a plurality of protection means that respectively execute counter-measures for protecting a plurality of prescribed sites from improper access through said network and with a plurality of detection means that respectively detect said improper access, to execute processing for preventing said improper access, said preventing processing comprising:

a first step of receiving information relating to improper access detected by any of said detection means from the detection means that detected the improper access;

a second step of, in accordance with said received information relating to improper access, deciding on said protection means where counter-measures in respect of the improper access are to be implemented and deciding said counter-measures in respect of each said decided protection means; and

a third step of sending instruction information for implementation of each said decided counter-measures to each said decided protection means.

2. The improper access prevention program according to claim 1, wherein said information relating to the improper access includes the type of said improper access, and said decision regarding the protection means where said counter-measures are to be implemented in said second step is performed in accordance with said type of the improper access.

3. The improper access prevention program according to claim 1, further comprising:

a step of storing predetermined rules in a counter-measures rules section, wherein

the decision regarding said counter-measures and said protection means where said counter-measures are to be implemented in the second step is performed in accordance with said stored rules.

4. The improper access prevention program according to claims 1, further comprising:

a fourth step of sending instruction information, in regard to each said protection means that received said instruction information in said third step, to stop said counter-measures in respect of which instructions for execution were given by said instruction information.

5. The improper access prevention program according to claim 4, wherein said fourth step is executed with a predetermined timing after said second step.

6. The improper access prevention program according to claim 4, wherein said fourth step is executed if the type of said improper access that is detected is a predetermined type that is the subject of stoppage of counter-measures.

7. The improper access prevention program according to claim 4, wherein said fourth step is executed if said detected transmission source of said improper access is a predetermined communication correspondent with whom communication is deemed necessary.

8. The improper access prevention program according to claims 1, further comprising:

a step of receiving information relating to the condition of implementation of said counter-measures at said protection means from said protection means and displaying the received information relating to the condition of implementation.

9. An improper access prevention program for causing a protection computer that protects a prescribed site from improper access through a network, to execute processing for implementing counter-measures in respect of said improper access in accordance with instructions from an administration computer that administers said protection computer, said implementing processing comprising:

a receiving step of receiving from said administration computer instruction information designating the counter-measures to be implemented in respect of said improper access decided on by said administration computer, through said network;

a decision step of deciding whether or not counter-measures in respect of the improper access decided by said administration computer in accordance with said instruction information are to be implemented, in accordance with rules stored beforehand in a local rules section, in association with said protection computer; and

an implementation step wherein, if, in said decision step, it is decided that counter-measures in respect of said improper access are to be implemented, the counter-measures are implemented and wherein if it is decided that counter-measures in respect of said improper access are not to be implemented the counter-measures are not implemented.

10. The improper access prevention program according to claim 9, wherein the decision in said decision step that said counter-measures is to be implemented against said improper access includes the decision that some of the counter-measures decided by said administration computer should be implemented;

and

if it is decided that some of said counter-measures should be implemented in said decision step, some of said counter-measures are implemented in said implementation step.

11. A method of preventing improper access in administration means connected, through a network, with a plurality of protection means that execute counter-measures for protecting prescribed sites from improper access through the network, and with a plurality of detection means that detect said improper access, comprising:

a first step of receiving information relating to improper access detected by any of said detection means from the detection means that detected the improper access;

a second step of, in accordance with said received information relating to improper access, deciding on said protection means where counter-measures in respect of the improper access are to be implemented, and deciding said counter-measures in respect of each said decided protection means; and

a third step of sending instruction information for implementation of each said decided counter-measures to each said decided protection means.

18. The method of preventing improper access according to claim 11, further comprising:

a fourth step of sending instruction information, in regard to each said protection means that received said instruction information in said third step, to stop said counter-measures in respect of which instructions for execution were given by said instruction information.

12. A method of preventing improper access in protection means that protects a prescribed site from improper access through a network comprising:

a receiving step of receiving from administration means that administers said protection means instruction information designating the counter-measures to be implemented in respect of said improper access decided on by said administration means, through said network;

a decision step of deciding whether or not counter-measures in respect of the improper access decided by said administration means in accordance with said instruction information are to be implemented, in accordance with rules stored beforehand in said protection means; and

an implementation step wherein, if it is decided in said decision step that counter-measures in respect of said improper access are to be implemented, the counter-measures are implemented and wherein if it is decided that counter-measures in respect of said improper access are not to be implemented these counter-measures are not implemented.

19. The method of preventing improper access according to claim 12, wherein the decision in said decision step that said counter-measures is to be implemented against said improper access includes the decision that some of the counter-measures decided by said administration means should be implemented;

and

if it is decided that some of said counter-measures should be implemented in said decision step, some of said counter-measures are implemented in said implementation step.

13. A recording medium on which is recorded an improper access prevention program for causing a computer connected, through a network, with a plurality of protection means that execute counter-measures for protecting prescribed sites from improper access through said network and with a plurality of detection means that detect said improper access, to execute processing for preventing said improper access, said preventing processing comprising:

a first step of receiving information relating to improper access detected by any of said detection means from the detection means that detected the improper access;

a second step of, in accordance with said received information relating to improper access, deciding on said protection means where counter-measures in respect of the improper access are to be implemented and deciding said counter-measures in respect of each said decided protection means; and

a third step of sending instruction information for implementation of each said decided counter-measures to each said decided protection means.

14. A recording medium on which is recorded an improper access prevention program for causing a protection computer that protects a prescribed site from improper access through a network, to execute processing for implementing counter-measures in respect of said improper access in accordance with instructions from administration means that administers the protection computer, said implementing processing comprising:

a receiving step of receiving from said administration means instruction information designating the counter-measures to be implemented in respect of said improper access decided on by said administration means, through said network;

a decision step of deciding whether or not counter-measures in respect of the improper access decided by said administration means in accordance with said instruction information are to be implemented, in accordance with rules stored beforehand in said protection computer; and

an implementation step in which, if it is decided in said decision step that counter-measures in respect of said improper access are to be implemented, the counter-measures are implemented and if it is decided that counter-measures in respect of said improper access are not to be implemented the counter-measures are not implemented.

15. An improper access prevention device connected, through a network, with a plurality of protection means that execute counter-measures for protecting prescribed sites from improper access through said network and with a plurality of detection means that detect said improper access, which:

receives information relating to improper access detected by any of said detection means from the detection means that detected the improper access;

in accordance with said received information relating to improper access, decides on said protection means where counter-measures in respect of the improper access are to be implemented and decides said counter-measures in respect of each said decided protection means; and

sends instruction information for implementation of each said decided counter-measures to each said decided protection means.

16. A protection device that protects a prescribed site from improper access through a network, which:

receives from administration means that administers said protection device instruction information designating the counter-measures to be implemented in respect of said improper access decided on by said administration means, through said network;

decides whether or not counter-measures in respect of the improper access decided by said administration means in accordance with said instruction information are to be implemented, in accordance with rules stored beforehand; and

if it is decided that counter-measures in respect of said improper access are to be implemented, implements the counter-measures and if it is decided that counter-measures in respect of said improper access are not to be implemented does not implement the counter-measures.

17. An improper access prevention system for preventing improper access through a network, comprising:

a plurality of protection means that protect prescribed sites from said improper access by implementing counter-measures in respect of said improper access;

a plurality of detection means that detect said improper access; and

administration means connected with said plurality of protection means and said plurality of detection means through said network, that receives information relating to improper access detected by any of said detection means from the detection means that detected the improper access and, decides on said protection means where counter-measures in respect of the improper access are to be implemented, decides on said counter-measures in respect of each said decided protection means in accordance with said received information relating to the improper access and sends instruction information for implementing each said decided counter-measures to each said decided protection means.