JP2007179522A - Method, system, device and program for verification of link information - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system and method for preventing a user from being guided to unintended electronic information by a link from link information. <P>SOLUTION: An information disclosure device 12 discloses electronic information on a network. A link information verification device 11 receives electronic information including connection information from the disclosure device 12, and detects connecting destination information recognized by a user as a connecting destination of the connection information included in the electronic information from the electronic information. The verification device 11 verifies whether the relation of the connection information included in the electronic information and the connecting destination information detected from the electronic information is valid or not. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a technique for detecting link information that guides a user to unintended electronic information on a network using a link.

  Recently, damage caused by phishing scams is frequent. In a phishing scam, an e-mail in which a company name such as a reliable financial institution is disguised is transmitted to an unspecified number of users. A user who clicks on a hyperlink included in the e-mail is directed to an unauthorized Web site. The site then asks the user to enter personal information, credit card numbers, etc. and tries to fraud.

  Various countermeasures have been proposed for such phishing scams (see Non-Patent Documents 1 to 3). Conventional phishing countermeasures can be classified into the following three methods.

  A first countermeasure is a method of monitoring a URL (Uniform Resource Locator) to be accessed using a black list in a Web browser. The second countermeasure is a method of monitoring an access URL using a white list in a Web browser. The third method is a method of refusing to receive illegal mail by spam mail filtering.

  Non-Patent Document 1 shows an example of the first countermeasure. According to this, the URL group of the illegal site is managed as a black list, the URL accessed by the user is always checked, and a warning is issued to the user when the illegal site is accessed.

  Non-Patent Document 2 shows an example in which the first countermeasure and the second countermeasure are merged. According to this, a malicious script that attempts to disguise the address bar of the Web browser is checked using the black list, and further, the validity of the Web site visited by the user is checked using the white list.

  The first and second countermeasures are methods for performing phishing countermeasures using a Web browser, and detect them when visiting a phishing site. Therefore, these methods cannot detect phishing scams before visiting a phishing site.

On the other hand, a third countermeasure is a method of detecting a phishing scam before visiting a phishing site and issuing a warning to the user. Since phishing scams often start with spam emails that pretend to be financial institutions, the third measure is to detect spam emails as described in Non-Patent Document 3 and guide users to phishing sites. Prevent it before being done. However, spam email techniques have become more sophisticated year by year, making it difficult to distinguish between spam emails and other emails.
Netcraft, “Anti-Phishing Toolbar”, [online], May 2004, [searched November 7, 2005], Internet, <URL: http: // toolbar. netcraft. com /> Secure Brain, “Phishwall”, [online], [retrieved November 7, 2005], Internet, <URL: http: // www. securebrain. co. jp / products / client. html> Symtec, Inc., “Norton Antivirus 2006”, [online], [searched November 7, 2005], Internet, <URL: http: // www. symantec. co. jp />

  According to spam mail filtering, phishing scams can be detected before visiting a phishing site, but only e-mails can be filtered.

  However, not only electronic mail but all electronic information including hyperlinks may be used for phishing scams. Examples of electronic information other than electronic mail include information exchanged on a real-time conversation system such as chat, electronic document files, and information published on a website. In fact, there is an example in which a phishing scam using a hyperlink affixed to a web site or chat software called a blog has occurred.

  Spam mail filtering measures cannot prevent such phishing scams through electronic information other than electronic mail.

  An object of the present invention is to provide a system and method for preventing a user from being guided to unintended electronic information by a link from the link information.

  In order to achieve the above object, the link information verification method of the present invention is a link information verification method for verifying the validity of electronic information including connection information indicating a link to other electronic information. A step of detecting connection destination information recognized by the user as a connection destination of the connection information included in the electronic information from the electronic information including the information; connection information included in the electronic information; and a connection destination detected from the electronic information And verifying whether the relationship with the information is valid.

  According to the present invention, the connection destination information that the user recognizes as the connection destination is extracted from the electronic information including the connection information, and it is verified whether or not the relationship between the connection destination information and the connection information is valid. It is possible to prevent the user from being guided to unintended electronic information by the link.

In addition, proof information that proves the correspondence between the predetermined connection destination and the legitimate connection information of the connection destination is determined in advance,
By comparing the text included in the electronic information or the image visualized in the display of the electronic information with the information indicating the connection destination included in the certification information, the connection information included in the electronic information Detect connection destination information recognized by the user as the connection destination,
By comparing the connection information included in the electronic information with the valid connection information proved by the certification information of the connection destination indicated by the detected connection destination information, the connection information included in the electronic information It is also possible to verify whether the relationship with the connection destination information is valid.

  According to this, not only text but also electronic information that allows a user to visually recognize a specific connection destination by an image can be verified.

In addition, the connection information included in the electronic information includes a host name, and proof information for proving the correspondence between a predetermined connection destination and the valid connection information of the connection destination is determined in advance, and the proof information is valid connection information. Contains an IP address,
Whether the relationship between the connection information included in the electronic information and the connection destination information is valid by converting the host name of the connection information included in the electronic information into an IP address and comparing it with the valid connection information in the certification information. It may be verified whether or not.

  According to this, verification is performed by converting the host name of the connection information into an IP address and comparing it with the valid connection information of the certification information. Therefore, it is possible to verify the contents of the system file used for conversion between the host name and the IP address, and to detect alteration of the system file, which is a kind of phishing scheme.

In addition, the valid connection information of the certification information includes both the host name and the IP address corresponding to the host name,
If the host name of the connection information included in the electronic information can be converted into an IP address, the IP address included in the valid connection information of the certification information is preferentially verified, and the host name of the connection information included in the electronic information is determined. If the IP address cannot be converted, verification may be performed using the host name included in the valid connection information of the certification information.

Further, the part of the legitimate connection information in the certification information is recorded as a hash value,
When comparing the connection information included in the electronic information with the valid connection information in the certification information, a hash value of the connection information included in the electronic information may be obtained and the hash values may be compared.

  According to this, it becomes impossible to browse the content of the certification information by the user or a third party, and security can be improved.

In the link information verification method of the present invention, the validity of the relationship between the connection information and the connection destination information is verified in advance from the connection information disclosure apparatus indicated by the connection destination information to the link information verification apparatus used by the user. Notified by the link information verification device using the certification information stored in the link information verification device,
When it is determined by the link information verification device that the connection information and the connection destination information are not valid, the connection destination information is sent to the information disclosure device, and the latest certificate held by the information disclosure device It is good also as re-verifying in an information disclosure apparatus using information.

  According to this, the link information verification device notifies the link information that has failed verification to the information disclosure device of the connection destination, and re-verifies it using the latest certification information, so high accuracy verification by the latest certification information Can be detected at the connection destination at an early stage, and impersonation with illegal link information is possible.

  Further, in the link information verification method of the present invention, it is determined by the verification in the link information verification apparatus that the relationship between the connection information and the connection destination information is not valid, and the connection information and the connection destination are determined by re-verification in the information disclosure apparatus. When it is determined that the relationship with the information is valid, the latest certification information may be sent from the information disclosure apparatus to the link information verification apparatus.

  According to this, when link information that has failed verification in the link information verification device succeeds in re-verification of the information disclosure device, the latest certification information is notified from the information disclosure device to the link information verification device. The certification information stored in the device can be updated to the latest version at an early stage to enable highly accurate verification.

In addition, the connection information included in the electronic information includes the host name,
The certification information includes information on the correspondence between the host name and the IP address corresponding to the host name,
When the link information verification device converts the host name of the connection information into an IP address and compares it with the certification information, and determines that the relationship between the connection information and the connection destination information is not valid, it converts the host name and its host name. The associated IP address and send it to the information disclosure device,
The information disclosure apparatus may verify the correspondence relationship between the host name and the IP address received from the link information verification device by comparing the correspondence relationship information included in the certification information.

  According to this, when the link information verification device determines that the relationship between the connection information and the connection destination information is not valid in the verification performed by converting the host name of the connection information into the IP address, the information disclosure device further Verify the correspondence between the host name and the IP address. Therefore, it is possible to verify the system file with high accuracy using the latest certification information.

  A link information verification system according to the present invention is a link information verification system that verifies the validity of electronic information including connection information indicating a link to other electronic information, and is an information disclosure apparatus that publishes electronic information on a network. And receiving the electronic information including the connection information from the information disclosure device, detecting the connection destination information visually recognized by the user as the connection destination of the connection information included in the electronic information from the electronic information. A link information verification device that verifies whether the relationship between the connection information included in the connection information and the connection destination information detected from the electronic information is valid.

  The link information verification device of the present invention is a link information verification device for verifying the validity of electronic information including connection information indicating a link to other electronic information, and from the electronic information including the connection information, the electronic information A connection destination detection unit that detects connection destination information recognized by the user as a connection destination of the connection information included in the connection information, connection information included in the electronic information, and a connection destination detected from the electronic information by the connection destination detection unit A link information processing unit that verifies whether the relationship with the information is valid.

  The link information verification program of the present invention is a link information verification program for causing a computer to verify the validity of electronic information including connection information indicating a link to other electronic information, from the electronic information including connection information. The relationship between the procedure for detecting the connection destination information recognized by the user as the connection destination of the connection information included in the electronic information, and the connection information included in the electronic information and the connection destination information detected from the electronic information is valid. This is a program for causing a computer to execute a procedure for verifying whether or not.

  According to the present invention, the connection destination information that the user recognizes as the connection destination is extracted from the electronic information including the connection information, and it is verified whether or not the relationship between the connection destination information and the connection information is valid. It is possible to prevent the user from being guided to unintended electronic information by the link.

  Embodiments for carrying out the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram showing the configuration of the link information verification system according to this embodiment. Referring to FIG. 1, the link information verification system includes a link information verification device 11 and an information disclosure device 12. The link information verification device 11 and the information disclosure device 12 are connected via a network (not shown) such as the Internet. The link information verification device 11 includes a link information processing unit 21 and a connection destination detection unit 22.

  The link information verification device 11 is a device used by a user, and is, for example, a personal computer for performing transmission / reception of e-mails, browsing of websites, and the like.

  The link information processing unit 21 of the link information verification device 11 performs processing related to electronic information including connection information to a specific Web site such as a hyperlink displayed by a URL, such as transmission / reception of e-mail, chat, and browsing of a document file. Execute. For example, the link information processing unit 21 operates in cooperation with the Web browser by a user clicking on a hyperlink on electronic information. Here, the electronic information refers to electronic information such as a Web site described in HTML (HyperText Markup Language), an e-mail or a document file transmitted to the user. The electronic information including connection information for connecting to other electronic information such as a hyperlink is referred to as link information.

  Functions such as browsing websites, sending and receiving e-mails, chatting, and browsing document files are realized by, for example, a processor (not shown) executing software. Examples of such software include a web browser, software called MUA (Mail User Agent), software for sending and receiving e-mail, software for chatting, and software for viewing document files.

  When the link information processing unit 21 performs processing related to link information, the link information processing unit 21 verifies the validity of the connection information included in the link information. When the information disclosure source (connection destination name) that the user recognizes as the connection destination from the contents of the link information matches the connection information included in the link information, it can be said that the connection information included in the link information is valid. This is because the connection information does not lead to an unintended electronic information source.

  In the verification, the link information processing unit 21 instructs the connection destination detection unit 22 to send link information to detect the connection destination name, and the connection destination name detected by the connection destination detection unit 22 and the link information. It is determined whether or not the detection information that is paired with the connection information included in is valid. When a plurality of connection destination names are detected, for example, the user may select one of them.

  To determine whether the detection information is valid, a proof consisting of a pair of the name of a publisher who publishes electronic information such as a website on the network and legitimate connection information for connecting to the publisher Information is used. Normally, the detection information and the certification information match if the link information is valid, but the detection information and the certification information do not match if the link information is illegal for the purpose of phishing.

When the link information processing unit 21 detects suspicious link information as a result of the verification, the link information processing unit 21 notifies the information disclosure device 12 of detection information of the link information. Since the link information verification device 11 of the user does not always hold the latest version of the certification information, it is not preferable to determine that the link information is invalid due to the verification failure. For this reason, in the present embodiment, the information is released to the information disclosing device 12 that has the latest version of certification information and is re-verified.
In response to an instruction from the link information processing unit 21, the connection destination detection unit 22 detects the connection destination from the link information and notifies the link information processing unit 21. The link information is not limited to text-based information but may be information described in HTML or an image.

  The information disclosing device 12 is a device for disclosing electronic information such as a company that may be disguised by a phishing scam. Such a company publishes, for example, a website on the network by the information disclosure device 12, and becomes a legitimate source of electronic information. The legitimate sender information disclosure apparatus 12 holds the latest certification information of the company's Web site and distributes it to the link information verification apparatus 11. Further, when receiving the suspicious detection information from the link information verification device 11, the information disclosure device 12 re-verifies the detection information using the latest information, and notifies the link information verification device 11 of the re-verification result.

  FIG. 2 is a block diagram showing the configuration of the link information verification apparatus. Referring to FIG. 2, the link information verification device 11 includes a link information processing unit 21 and a connection destination detection unit 22.

  The link information processing unit 21 includes a link information display unit 23, a link information reception unit 24, a link information storage unit 25, a link information verification unit 26, a certification information storage unit 27, and a certification information update unit 28.

  The link information receiving unit 24 receives link information including connection information such as a hyperlink. There are link information including valid connection information and link information including illegal connection information.

  The link information display unit 23 displays the link information received by the link information receiving unit 24 to the user.

  The link information storage unit 25 temporarily stores the link information received by the link information receiving unit 24.

  The link information verification unit 26 verifies the validity of the detection information including the connection information included in the link information stored in the link information storage unit 25 and the connection destination name detected by the connection destination detection unit 22. That is, it is verified whether or not the relationship between the connection information and the connection destination name is valid. At that time, the link information verification unit 26 compares the detection information with the certification information stored in the certification information storage unit 27. The certification information includes information on the name of the publication source of the electronic information and legitimate connection information for connecting to the publication source. Therefore, the link information verification unit 26 verifies whether or not the connection information included in the certification information including the publishing source name that matches the connection destination name included in the detection information matches the connection information included in the detection information. To do.

  The verification at that time may be performed after converting the host name portion of the connection information included in the link information into an IP address. In general, conversion from a host name to an IP address is performed by referring to an OS (Operating System) system file (hosts file) in which the correspondence relationship is recorded. If the contents of the hosts file are correct, the host name is converted to the correct IP address. However, if the hosts file is illegally rewritten, the host name is converted to an incorrect IP address. Therefore, as described above, the host name portion of the connection information included in the link information is converted into an IP address, and the converted connection information is compared with the connection information included in the certification information, thereby Can detect attacks that rewrite files. In this case, if the correspondence is recorded in the hosts file, the converted connection information is preferentially used for verification, and if the correspondence is not recorded, the unconverted connection information is used for verification. It is good.

  The certification information storage unit 27 stores certification information used for verification of the detection information by the link information verification unit 26. Although the connection destination name (public name) and the connection information are recorded in the certification information, one or both of them may be recorded as a hash value. As a result, the user or a third party cannot view the contents of the certification information, and security can be improved. In this case, when the link information verification unit 26 described above verifies the detection information including the connection information included in the link information and the connection destination name detected by the connection destination detection unit 22, the connection information and the connection destination name are verified. One or both hash values are obtained and the hash values are compared. For example, recording connection information as a hash value makes it difficult to acquire or tamper with certification information.

  As described above, when the verification is performed after converting the host name part of the connection information included in the link information into the IP address, the connection information obtained by converting the host name part into the IP address can be recorded in the certification information. That's fine. If the correspondence is recorded in the hosts file, the converted connection information is preferentially used for verification, and if the correspondence is not recorded, the unconverted connection information is used for verification. In that case, both the connection information in which the host name is not converted and the connection information in which the host name portion is converted into the IP address may be recorded in the certification information. From this certification information, the correspondence between the host name and the IP address is known.

  The certification information update unit 28 updates the certification information to the latest version based on the notification from the information disclosure apparatus 12. At that time, the certification information update unit 28 performs the update on condition that the authentication of the publishing source by the digital signature is successful.

  The connection destination detection unit 22 includes a character information acquisition unit 29, a connection destination name detection unit 30, and a connection destination information storage unit 31.

  The connection destination name detection unit 30 detects a connection destination name such as a company name that the user recognizes as a connection destination from the link information received from the link information verification unit 11. As described above, the link information may be text-based or not.

  In the case of text-based link information, the connection name detection unit 30 extracts a connection name such as a company name from the text of the link information. At that time, the connection destination name detection unit 30 refers to the list stored in the connection destination information storage unit 31 and extracts the connection destination name included in the list from the link information.

  In addition, one company or the like may have a plurality of names including abbreviations. Thus, if the link information includes a notation that matches any of these names, the company name or the like may be extracted as the connection destination name.

  On the other hand, if the link information is not text-based, the connection destination name detection unit 30 sends the link information to the character information acquisition unit 29 to acquire the character information, and extracts the connection destination name from the obtained character information.

  When a plurality of connection destination names are detected, the connection destination name detection unit 30 may notify the link information verification unit 26 of the link information processing unit 21 of these as connection destination name candidates. In this case, the link information verification unit 26 may present a plurality of connection destination names to the user and prompt selection. Thereby, the intention of the user is reflected, and a company or the like that the user recognizes as a connection destination can be reliably detected. Even when only one connection destination name is detected, it may be presented to the user for confirmation.

  The character information acquisition unit 29 extracts character information from link information that is not text-based, such as an image file or an HTML description, according to an instruction from the connection destination name detection unit 30. For example, if there is an image part that visually recognizes a specific connection destination in the link information, the connection destination name is extracted as character information. An example of a part that recognizes a specific connection destination is a company logo. When extracting the character information, the character information acquisition unit 29 refers to the list of display information stored in the connection destination information storage unit 31, and if the display information included in the list is in the link information, Character information associated with display information is extracted. As a result, not only text but also link information that allows a user to visually recognize a specific connection destination by using an image can be verified.

  For example, software OCR (Optical Character Reader) can be used to detect a notation part that visually recognizes a specific connection destination. In this type of phishing scam, there is a tendency to use the company logo mark and font as they are, and detection by software OCR is effective.

  In addition, in phishing scams, not only a description that completely matches the company name and logo, but also a misleading notation that approximates the company name to the extent that the user misidentifies may be used. Therefore, the connection destination name detection unit 30 may extract the connection destination name if the link information includes a notation that approximates the connection destination name included in the list. Alternatively, in addition to the original company name, a notation that approximates it may be included in the list.

  In addition, spam mails used in phishing scams try to escape keyword matching for spam mail filtering by enclosing words unrelated to the contents of the document with the same character color as the background color. In this case, the visual recognition by the user does not match the character notation included in the contents described in the link information. Even in such a case, the character information visually recognized by the user may be extracted using the software OCR.

  The connection destination information storage unit 31 stores a list of connection destination names to be detected and a list of display information that allows the user to recognize specific character information. In the list of connection destinations to be detected, an organization that is highly likely to be camouflaged by a phishing scam such as a reliable financial institution or a public institution may be registered in advance. For example, it is good also as registering by the application from a company etc. Accordingly, the connection destination name detection unit 30 can detect the name of an information disclosure source that is highly likely to be camouflaged by a phishing scam and is likely to be recognized as a connection destination by a user with incorrect link information. become.

  The display information is information that allows the user to visually recognize specific character information when displayed in the link information, and is stored in association with the character information. An example of display information is an image file such as a company logo.

  FIG. 3 is a block diagram illustrating a configuration of the information disclosure apparatus. Referring to FIG. 3, the information disclosure apparatus 12 includes a link information storage unit 41, a link information re-verification unit 42, a latest version certification information storage unit 43, and a certification information transmission unit 44.

  The link information storage unit 41 stores electronic information such as a Web site that is disclosed to the user. The electronic information includes link information including connection information.

  The link information re-verification unit 42 uses the latest information stored in the latest version proof information storage unit 43 for the detection information notified as suspicious because the detection information does not match the proof information in the verification by the link information verification device 11. Re-verify with the version of the certification information. The verification method is basically the same as that of the link information verification apparatus 11.

  The latest version certification information storage unit 43 stores the latest version of the certification information of the link information published by the information disclosure apparatus 12.

  The certification information transmission unit 44 distributes the latest version of certification information stored in the latest version certification information storage unit 43 to the link information verification device 11 of each user. For example, the certification information transmission unit 44 transmits the latest certification information to the link information verification apparatus 11 that has notified the suspicious detection information. Alternatively, the certification information transmission unit 44 transmits the latest certification information to the link information verification device 11 when the detection information notified from the link information verification device 11 succeeds in the re-verification of the information disclosure device 12. It is good.

  FIG. 4 is a flowchart showing the operation of the link information verification system when the link information disclosed by the information disclosure apparatus is browsed by the link information verification apparatus. Examples of link information include a website and electronic mail.

  Referring to FIG. 4, the link information verification device 11 receives link information from the information disclosure device 12 according to the user's operation (step 101).

  The link information verification device 11 that has received the link information displays the link information to the user (step 102), and further stores the link information in the link information storage unit 25 (step 103). The user browses the link information displayed on the link information display unit 23. In some cases, the user requests browsing of link information of a connection destination by clicking a hyperlink that is connection information included in the link information.

  FIG. 5 is a flowchart illustrating an example of the operation of the link information verification system when browsing of link information of a connection destination is requested. Referring to FIG. 5, when a user requests browsing of link information of a connection destination by clicking on a hyperlink, the link information verification apparatus 11 uses the link information temporarily stored in the link information storage unit 25 as a text base. It is determined whether or not (step 202).

  If the link information is not text-based, the link information verification device 11 extracts character information from the link information (step 203). For example, the character information is extracted by detecting the display of a company logo or the like from the link information that is an image or a display similar thereto, and extracting the character information displayed by the display information.

  When the link information is text-based in the determination in step 202, or when character information is extracted in step 203, the link information verification device 11 connects from the text-based link information or the extracted character information. A name is detected (step 204).

  Here, a plurality of connection destination names may be detected. The link information verification apparatus 11 presents the detected connection destination name to the user (step 205). The user who sees the display selects a desired connection destination name from the presented connection destination names.

  When the connection destination name is selected by the user, the link information verification device 11 verifies the detection information including the connection destination name and the clicked connection information using the certification information (step 206). It is determined whether the verification has been successful and whether the verification has failed due to invalid link information (step 207). At this time, the verification information stored in the verification information storage unit 27 is used for verification. When a hash value is used for the certification information, a comparison is performed using the hash value.

  If the verification is successful, the link information verification device 11 displays the electronic information indicated by the clicked connection information (step 208) and ends the process. Specifically, the URL of the clicked hyperlink is notified from the link information processing unit 21 of the link information verification apparatus 11 to the Web browser. The web browser acquires and displays the electronic information of the website at the URL. As a result, the user can safely visit and browse the Web site.

  On the other hand, if the verification is not successful, the link information verification apparatus 11 transmits the detection information to the connection destination information disclosure apparatus 12 indicated by the connection destination name included in the detection information (step 209), and re-verification processing is performed. Migrate to Specifically, information on the URL that failed to be verified may be sent to the connection destination URL.

  FIG. 6 is a flowchart showing an example of the operation of the link information verification system when re-verification is performed. Referring to FIG. 6, the information disclosure apparatus 12 that has received the detection information verifies the detection information using the latest version of the certification information (step 301). Specifically, the URL information notified from the link information verification device 11 is verified by the latest version of the certification information stored in itself.

  If the verification fails, the information disclosure apparatus 12 transmits the verification result to the link information verification apparatus 11 (step 303), and the link information verification apparatus 11 notifies the verification result to the user (step 304). The failure of verification with the latest version of certification information means that the link information being verified is a phishing site, and the connection information included in the detection information may lead the user to an unauthorized connection destination. It shows that there is sex.

When verification is successful in step 302, or after the processing in step 304, the information disclosure apparatus 12 transmits the latest version of certification information to the link information verification apparatus 11 (step 305). This is because if the information disclosure apparatus 12 succeeds in verification, there is a difference between the certification information stored in the link information verification apparatus 11 and the latest version of certification information stored in the information disclosure apparatus 12. This is because the certification information of the link information verification device 11 is updated to the latest version.
If verification fails in the information disclosure apparatus 12, whether there is a difference between the certification information stored in the link information verification apparatus 11 and the latest version of certification information stored in the information disclosure apparatus 12. This is because the certification information of the link information verification device 11 is surely updated to the latest version because it is unknown.

  The link information verification device 11 that has received the latest version of certification information updates the certification information in the certification information storage unit 27 to the latest version after confirming the transmission source of the certification information by a digital signature (step 306).

  Finally, the link information verification device 11 displays the electronic information indicated by the connection information that has been verified (step 307), and ends the process. Specifically, the URL of the clicked hyperlink is notified from the link information processing unit 21 of the link information verification apparatus 11 to the Web browser. As a result, the user can safely visit and browse the Web site.

  As described above, according to this embodiment, a connection destination name that a user recognizes as a connection destination is extracted from link information that is electronic information including connection information such as a hyperlink, and the connection destination is extracted. It verifies whether the relationship between the name and the connection information is valid, and notifies the user if it is illegal. This prevents the user from being guided to unintended electronic information, and risks phishing scams Can be reduced.

  Also, according to the present embodiment, the link information verification device 11 notifies the link information verification device 11 to the connection destination information disclosure device 12 and re-verifies it using the latest certification information. Verification with high accuracy by information becomes possible, and it is possible to detect at an early stage at the connection destination that the information is camouflaged with illegal link information.

  Further, according to the present embodiment, when the link information that has failed verification in the link information verification device 11 succeeds in the re-verification of the information disclosure device 12, the latest certification information is transferred from the information disclosure device 12 to the link information verification device 11. Therefore, the certification information stored in the link information verification device 11 can be updated to the latest version at an early stage, and verification with high accuracy is possible.

  In the present embodiment, as described above, the host name portion of the connection information may be converted into an IP address and verified. The operation in that case will be described below. Even in that case, the operation of the link information verification system when the link information published by the information disclosure apparatus is browsed by the link information verification apparatus is the same as that shown in FIG.

  FIG. 7 is a flowchart illustrating another example of the operation of the link information verification system when browsing of link information of a connection destination is requested. Referring to FIG. 7, when a user requests browsing of link information of a connection destination by clicking a hyperlink (step 401), the link information verification apparatus 11 stores the link temporarily stored in the link information storage unit 25. It is determined whether the information is text-based (step 402). If the link information is not text-based, the link information verification device 11 extracts character information from the link information (step 403).

  When the link information is text-based in the determination in step 402, or when character information is extracted in step 403, the link information verification device 11 connects from the text-based link information or the extracted character information. A name is detected (step 404). Subsequently, the link information verification apparatus 11 presents the detected connection destination name to the user (step 405). The user who sees the display selects a desired connection destination name from the presented connection destination names. Steps 401 to 405 so far are the same as steps 201 to 205 shown in FIG.

  When the connection destination name is selected by the user, the link information verification apparatus 11 tries to convert the host name portion of the clicked connection information into an IP address (step 406). When the host name portion of the connection information can be converted into the IP address, the link information verification device 11 verifies the detection information including the connection destination name and the connection information represented by the IP address using the certification information ( Step 407). Subsequently, the link information verification device 11 determines whether the connection information is valid and the verification is successful, or whether the connection information is incorrect and the verification fails (step 408). At that time, the certification information stored in the certification information storage unit 27 is used. When a hash value is used for this certification information, a comparison is performed using the hash value.

  If the verification is successful, the link information verification device 11 displays the electronic information indicated by the clicked connection information (step 409) and ends the process. Specifically, the URL of the clicked hyperlink is notified from the link information processing unit 21 of the link information verification apparatus 11 to the Web browser. The web browser acquires and displays the electronic information of the website with the URL. As a result, the user can safely visit and browse the Web site.

  On the other hand, if the verification in step 408 is not successful, the link information verification device 11 transmits the detection information to the connection destination information disclosure device 12 indicated by the connection destination name included in the detection information (step 410). Transition to verification process. Specifically, the information on the URL (both host name notation and IP address notation) that has failed to be verified may be sent to the information disclosure apparatus 12 of the connection destination.

  In step 406, if the host name portion of the connection information cannot be converted into an IP address, the link information verification device 11 converts the detection information including the connection destination name and the connection information represented by the host name into the certification information. To verify (step 411). Subsequently, the link information verification device 11 determines whether the connection information is valid and the verification is successful, or whether the connection information is incorrect and the verification fails (step 412).

  If the verification is successful, the link information verification device 11 displays the electronic information indicated by the clicked connection information (step 413) and ends the process. If the verification is not successful, the link information verification device 11 transmits the detection information to the connection destination information disclosure device 12 indicated by the connection destination name included in the detection information (step 414), and proceeds to re-verification processing. To do. At that time, information of the URL (host name notation only) that failed to be verified is sent.

  FIG. 8 is a flowchart showing another example of the operation of the link information verification system when re-verification is performed. Referring to FIG. 8, the information disclosing apparatus 12 that has received the detection information checks whether the received connection information is only the host name notation or includes both the host name notation and the IP address notation (step 501). This is a process of determining whether the detection information is transmitted in step 414 or the detection information transmitted in step 410.

  If the connection information is only the host name notation, the information disclosure apparatus 12 re-verifies the connection information with the latest version of the certification information stored by itself (step 502), and determines whether the verification is successful (step 502). Step 503).

  If the verification is successful, the information disclosure apparatus 12 transmits the latest version of certification information to the link information verification apparatus 11 (step 504). The link information verification device 11 displays the electronic information indicated by the connection information that has been successfully verified (step 505). Specifically, the URL of the clicked hyperlink is notified from the link information processing unit 21 of the link information verification apparatus 11 to the Web browser. Thereby, the user can safely visit and browse the Web site.

  If the verification fails, the information disclosure apparatus 12 transmits the verification result to the link information verification apparatus 11 (step 506). The link information verification apparatus 11 receives the verification result at the link information processing unit 21 and notifies the user (step 507). The failure of verification with the latest version of certification information means that the link information being verified is a phishing site, and the connection information included in the detection information may lead the user to an unauthorized connection destination. It shows that there is sex.

  After the processing of step 505 or step 507, the information disclosure apparatus 12 transmits the latest version of certification information to the link information verification apparatus 11 (step 508). The link information verification apparatus 11 receives the latest version of the certification information from the certification information update unit 28 and updates the certification information in the certification information storage unit 27 (step 509).

  This is because if the information disclosure apparatus 12 succeeds in verification, there is a difference between the certification information stored in the link information verification apparatus 11 and the latest version of certification information stored in the information disclosure apparatus 12. This is because the certification information of the link information verification device 11 is updated to the latest version. If verification fails in the information disclosure apparatus 12, whether there is a difference between the certification information stored in the link information verification apparatus 11 and the latest version of certification information stored in the information disclosure apparatus 12. This is because the certification information of the link information verification device 11 is surely updated to the latest version because it is unknown.

  In step 501, when the received connection information includes both the host name notation and the IP address notation, the information disclosure apparatus 12 manages the correspondence between the host name and the IP address included in the received connection information. Verification is performed by comparing with the correspondence relationship between the host name and the IP address (step 510), and it is determined whether the verification is successful (step 511). It is assumed that the information correspondence apparatus 12 manages the correct correspondence between the host name and the IP address. Therefore, if the correspondence relationship between the host name and the IP address included in the received connection information does not match the correspondence relationship managed by the information disclosure device 12, the correspondence relationship managed by the link information verification device 11 Can be judged to be wrong. That is, it indicates that the hosts file of the link information verification apparatus 11 has been tampered with.

  If the verification in step 511 is successful, the hosts file is correct (not tampered), so the process proceeds to step 502, and the validity of the connection information is continuously verified. If the verification in step 511 fails, the hosts file is wrong (has been tampered with), and the information disclosure apparatus 12 transmits the verification result to the link information verification apparatus 11 (step 512). The link information verification apparatus 11 receives the verification result at the link information processing unit 21, notifies the verification result that the contents of the hosts file are incorrect (that there is a possibility of falsification) (step 513), and step 508. Migrate to

  As described above, according to this example, verification is performed by converting the host name of the connection information into an IP address and comparing it with the valid connection information of the certification information. Therefore, it is possible to verify the contents of the hosts file used for the conversion between the host name and the IP address, and to detect the alteration of the hosts file, which is a type of phishing scheme.

  Further, according to this example, when the link information verification device 11 converts the host name of the connection information into an IP address and compares it with the certification information, when the link information verification device 11 determines that the relationship between the connection information and the connection destination information is not valid, Furthermore, the information disclosure apparatus 12 verifies the correspondence between the host name and the IP address. For this reason, the host file can be verified with high accuracy using the latest certification information.

It is a block diagram which shows the structure of the link information verification system by this embodiment. It is a block diagram which shows the structure of a link information verification apparatus. It is a block diagram which shows the structure of an information disclosure apparatus. It is a flowchart which shows operation | movement of the link information verification system when browsing the link information which an information disclosure apparatus discloses by a link information verification apparatus. It is a flowchart which shows an example of operation | movement of a link information verification system when browsing of the link information of a connection destination is requested | required. It is a flowchart which shows an example of operation | movement of the link information verification system when performing re-verification. It is a flowchart which shows the other example of operation | movement of a link information verification system when browsing of link information of a connection destination is requested | required. It is a flowchart which shows the other example of operation | movement of the link information verification system when performing re-verification.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 Link information verification apparatus 12 Information disclosure apparatus 21 Link information processing part 22 Connection destination detection part 23 Link information display part 24 Link information reception part 25 Link information storage part 26 Link information verification part 27 Certification information storage part 28 Certification information update part 29 Character information acquisition unit 30 Connection destination name detection unit 31 Connection destination information storage unit 41 Link information storage unit 42 Link information re-verification unit 43 Latest version certification information storage unit 44 Certification information transmission units 101 to 103, 201 to 209, 301 to 307 , 401-414, 501-513 steps

Claims (21)

A link information verification method for verifying the validity of electronic information including connection information indicating a link to other electronic information,
Detecting connection destination information recognized by a user as a connection destination of the connection information included in the electronic information from the electronic information including the connection information;
A link information verification method comprising: verifying whether a relationship between the connection information included in the electronic information and the connection destination information detected from the electronic information is valid. Proof information that proves the correspondence between the predetermined connection destination and the legitimate connection information of the connection destination is determined in advance,
By comparing the text included in the electronic information or the image visualized in the display of the electronic information with the information indicating the connection destination included in the certification information, the connection information included in the electronic information Detect connection destination information recognized by the user as the connection destination,
By comparing the connection information included in the electronic information with the valid connection information proved by the certification information of the connection destination indicated by the detected connection destination information, the connection information included in the electronic information The link information verification method according to claim 1, wherein whether the relationship with the connection destination information is valid is verified. The connection information included in the electronic information includes a host name, and proof information for proving a correspondence relationship between a predetermined connection destination and valid connection information of the connection destination is determined in advance, and the proof information is the valid connection information. The IP address is included in the information,
By converting the host name of the connection information included in the electronic information into an IP address and comparing it with the legitimate connection information of the certification information, the connection information and the connection destination information included in the electronic information The link information verification method according to claim 1, wherein whether or not the relationship between and is valid is verified. The valid connection information of the certification information includes both the host name and an IP address corresponding to the host name;
If the host name of the connection information included in the electronic information can be converted into an IP address, the IP address included in the legitimate connection information of the certification information is preferentially verified and included in the electronic information The link information verification method according to claim 3, wherein if the host name of the connection information cannot be converted into an IP address, verification is performed using the host name included in the valid connection information of the certification information. At least a part of the legitimate connection information in the certification information is recorded as a hash value,
When comparing the connection information included in the electronic information and the valid connection information in the certification information, a hash value of the connection information included in the electronic information is obtained and the hash values are compared with each other. 5. The link information verification method according to any one of 4 above. Verification of the validity of the relationship between the connection information and the connection destination information is notified in advance from the connection destination information disclosure apparatus indicated by the connection destination information to the link information verification apparatus used by the user, and the link information verification apparatus Performed by the link information verification device using the stored certification information,
When it is determined in the verification by the link information verification device that the relationship between the connection information and the connection destination information is not valid, the connection information is sent to the information disclosure device and held by the information disclosure device The link information verification method according to any one of claims 1 to 5, wherein re-verification is performed by the information disclosure apparatus using the latest certification information.   It is determined that the relationship between the connection information and the connection destination information is not valid by verification in the link information verification device, and the relationship between the connection information and the connection destination information is valid by re-verification in the information disclosure device. The link information verification method according to claim 6, wherein when it is determined that there is, the latest certification information is transmitted from the information disclosure apparatus to the link information verification apparatus. The connection information included in the electronic information includes a host name,
The certification information includes information on a correspondence relationship between a host name and an IP address corresponding to the host name,
The link information verification device converts the host name of the connection information into an IP address and compares it with the certification information. As a result, when determining that the relationship between the connection information and the connection destination information is not valid, A name associated with the IP address converted from the host name and sent to the information disclosing device,
The information disclosure device verifies the correspondence relationship between the host name and the IP address received from the link information verification device by comparing the correspondence information included in the certification information. 7. The link information verification method according to 7. A link information verification system for verifying the validity of electronic information including connection information indicating a link to other electronic information,
An information disclosing device for disclosing electronic information on a network;
Electronic information including connection information is received from the information disclosure device, and connection destination information recognized by a user as a connection destination of the connection information included in the electronic information is detected from the electronic information and included in the electronic information. Link information verification system comprising: a link information verification device that verifies whether a relationship between the connection information to be detected and the connection destination information detected from the electronic information is valid.   The link information verification device stores in advance proof information that proves the correspondence between a predetermined connection destination and legitimate connection information of the connection destination, and the text information included in the electronic information or the electronic information A connection destination information recognized by a user as a connection destination of the connection information included in the electronic information is detected by comparing an image visualized in the display with information indicating the connection destination included in the certification information. The connection information included in the electronic information by comparing the connection information included in the electronic information with the valid connection information proved by the certification information of the connection destination indicated by the detected connection destination information The link information verification system according to claim 6, wherein whether or not the relationship between the connection destination information and the connection destination information is valid is verified. The connection information included in the electronic information includes a host name,
The link information verification device stores in advance certification information that proves the correspondence between a predetermined connection destination and valid connection information of the connection destination, and the valid connection information includes an IP address,
The link information verification device converts the host name of the connection information included in the electronic information into an IP address, and compares the host name with the valid connection information of the certification information, thereby including the electronic information. The link information verification system according to claim 9 or 10, wherein the link information verification system verifies whether a relationship between connection information and the connection destination information is valid. The valid connection information of the certification information includes both the host name and an IP address corresponding to the host name;
If the link information verification device can convert the host name of the connection information included in the electronic information into an IP address, the link information verification device preferentially uses the IP address included in the legitimate connection information of the certification information. The verification is performed using the host name included in the legitimate connection information of the certification information if the host name of the connection information included in the electronic information cannot be converted into an IP address. Link information verification system. The link information verification device is configured to notify the verification of the validity of the relationship between the connection information and the connection destination information in advance from the connection destination information disclosure device indicated by the connection destination information, and store the stored certification information. When it is determined that the relationship between the connection information and the connection destination information is not valid, the connection destination information is sent to the information disclosure device,
The information disclosure apparatus re-verifies the validity of the relationship between itself and the connection information received from the link information verification apparatus, using the latest certification information held by the information disclosure apparatus. The link information verification system according to any one of the above.   It is determined that the relationship between the connection information and the connection destination information is not valid by verification in the link information verification device, and the relationship between the connection information and the connection destination information is valid by re-verification in the information disclosure device. The link information verification system according to claim 13, wherein when it is determined that there is, the latest certification information is transmitted from the information disclosure apparatus to the link information verification apparatus. The connection information included in the electronic information includes a host name,
The certification information includes information on a correspondence relationship between a host name and an IP address corresponding to the host name,
The link information verification device converts the host name of the connection information into an IP address and compares it with the certification information. As a result, when determining that the relationship between the connection information and the connection destination information is not valid, A name associated with the IP address converted from the host name and sent to the information disclosing device,
The information disclosure device verifies the correspondence relationship between the host name and the IP address received from the link information verification device by comparing the correspondence information included in the certification information. 14. The link information verification system according to 14. A link information verification device for verifying validity of electronic information including connection information indicating a link to other electronic information,
A connection destination detection unit for detecting connection destination information recognized by a user as a connection destination of the connection information included in the electronic information from the electronic information including the connection information;
A link information processing unit that verifies whether the connection information included in the electronic information and the connection destination information detected by the connection destination detection unit from the electronic information are valid. Information verification device. Proof information that proves the correspondence between the predetermined connection destination and the legitimate connection information of the connection destination is stored in advance,
The connection destination detection unit is configured to compare the electronic information by comparing the text included in the electronic information or an image visualized in the display of the electronic information with information indicating the connection destination included in the certification information. Detecting connection destination information recognized by a user as a connection destination of the connection information included in
The link information processing unit includes the connection information included in the electronic information and the valid connection information proved by the certification information of the connection destination indicated by the connection destination information detected by the connection destination detection unit. The link information verification device according to claim 16, wherein the link information verification apparatus verifies whether or not a relationship between the connection information included in the electronic information and the connection destination information is valid. The connection information included in the electronic information includes a host name,
The link information verification device stores in advance certification information that proves the correspondence between a predetermined connection destination and valid connection information of the connection destination, and the valid connection information includes an IP address,
The link information processing unit converts the host name of the connection information included in the electronic information into an IP address, and compares the converted host information with the legitimate connection information of the certification information. The link information verification apparatus according to claim 16 or 17, which verifies whether a relationship between connection information and the connection destination information is valid. The valid connection information of the certification information includes both the host name and an IP address corresponding to the host name;
If the link information processing unit can convert the host name of the connection information included in the electronic information into an IP address, the link information processing unit preferentially uses the IP address included in the legitimate connection information of the certification information. 19. If the host name of the connection information included in the electronic information cannot be converted into an IP address, verification is performed using the host name included in the legitimate connection information of the certification information. Link information verification device.   Verification of the validity of the relationship between the connection information and the connection destination information is performed using the certification information stored in advance and stored from the connection destination information disclosure device indicated by the connection destination information, and the connection information The link information verification device according to any one of claims 16 to 19, wherein when it is determined that a relationship between the connection destination information and the connection destination information is not valid, the connection destination information is transmitted to the information disclosure device. A link information verification program for causing a computer to verify the validity of electronic information including connection information indicating a link to other electronic information,
A procedure for detecting connection destination information recognized by a user as a connection destination of the connection information included in the electronic information from the electronic information including the connection information;
A link information verification program for causing a computer to execute a procedure for verifying whether the relationship between the connection information included in the electronic information and the connection destination information detected from the electronic information is valid.

Images