JP5723306B2 - Filtering device and filtering method - Google Patents

Description

  The present invention relates to a technique for filtering (access restriction to harmful information, etc.) for a connection request from a terminal to the Internet.

  While the Internet, which is spreading around the world, is convenient, it also has harmful aspects. Harmful examples include, for example, web pages that promote crime and suicide, adult sites for children, and malicious dating sites. In order to protect users (Internet users) from such harmful information, not only human means such as monitoring of children by parents at home but also filtering techniques by Internet-related businesses are important.

  Conventional filtering techniques include, for example, a technique of blocking in domain units by DNS (Domain Name Server), a technique of filtering in packet units using an IP (Internet Protocol) address or URL (Uniform Resource Locator), There are a technique of filtering by a proxy server and a technique of hybrid filtering using both a URL and an IP address (see Non-Patent Document 1).

"Child pornography blocking method (http-based)", [online], Japan Internet Providers Association, [February 10, 2012 search], Internet <URL: http://www.jaipa.or.jp/other /anshin-net/bloking.pdf>

  However, in any conventional method, since all users (terminals) are targeted, in order to implement high-accuracy filtering, a large cost is required in terms of equipment for introduction. On the other hand, for Internet-related business operators, such filtering is free of charge and does not directly affect profits, so it is a fact that it does not want to cost much.

  In addition to such filtering, there is a paid filtering service provided by Internet-related businesses. In a paid filtering service, predetermined filtering is performed on a contracted user (terminal) using, for example, a URL. Hereinafter, the paid filtering service is referred to as “paid filtering service”, and the free filtering from before is referred to as “free filtering”.

  When the paid filtering service and the free filtering are performed separately, the equipment costs are large, but if the equipment is shared, the total cost can be greatly reduced.

  Accordingly, the present invention has been made in view of such circumstances, and it is an object to reduce the total cost of filtering by performing a paid filtering service and free filtering using a common facility. .

In order to solve the above-described problems, the present invention provides a filtering device that prohibits access from a terminal to some Web pages on the Internet, and a set of URLs corresponding to a plurality of predetermined Web pages to be prohibited from access. in a browse restriction URL list, out of the terminal, filtering service contract terminal SA list is a set of SA corresponding to the contract terminal of filtering a surcharge, a set of URL corresponding to the access prohibited the Web page in the filtering service A storage unit that stores a filtering service target URL list, and a browsing restriction DA list that is a set of DAs corresponding to the predetermined plurality of access-prohibited Web pages, and a processing unit. parts are connection request from the terminal to the Internet If there is, it operates before the URL browsing restriction determination unit, and determines whether or not the DA corresponding to the destination URL in the connection request is in the browsing restriction DA list. restriction determination unit to pass processing, and if not, the DA viewing restriction determination unit to pass the processing to the filtering service contract judgment unit, when the destination URL in those the connection request is determined to be in the browse restriction URL list, When the URL browsing restriction determination unit that discards the connection request and the URL browsing restriction determination unit determines that the destination URL is not in the browsing restriction URL list, the SA in the connection request is the filtering service contract terminal SA. when it is determined that not in the list, and the filtering service contract judgment unit for permitting the connection request, the connection request When the filtering service contract determination unit determines that the SA in the filtering service contract terminal SA list is in the filtering service contract terminal SA list, the connection request is discarded when it is determined that the destination URL in the connection request is in the filtering service target URL list And a filtering necessity determination unit.

According to this, the filtering device (common equipment) executes both filtering by the browsing-restricted URL list (free filtering) and filtering by the filtering service target URL list (paid filtering service), so that the total filtering is performed. Cost can be reduced.
In addition, the processing time can be shortened by using filtering (part of free filtering) based on the browsing-restricted DA list having a smaller data amount than the browsing-restricted URL list.

  Further, according to the present invention, in the filtering service target URL list, a set of URLs corresponding to the access-prohibited Web pages is grouped into predetermined categories, and the storage unit stores the SA of the contract terminal. And the SA / group correspondence list, which is correspondence information between the group and the group, and the filtering necessity determination unit determines whether the SA in the connection request is in the filtering service target URL list. The group corresponding to the contract terminal is determined with reference to the SA / group correspondence list.

  According to this, grouping is performed in the filtering service target URL list, and the processing time can be shortened by performing filtering only on a necessary group for the terminal in the paid filtering service.

  According to the present invention, the total cost of filtering can be reduced by performing the filtering service and free filtering using a common facility.

It is a figure which shows the structure etc. of the filtering apparatus in embodiment of this invention. It is a flowchart which shows the flow of the process by the filtering apparatus in embodiment of this invention.

  Hereinafter, modes for carrying out the present invention (hereinafter referred to as “embodiments”) will be described with reference to the drawings.

<First Embodiment>
As shown in FIG. 1, the filtering device 100 according to the first embodiment has a filtering function that prohibits access to some Web pages when a connection request to the Internet 300 is received from a user terminal 200 (terminal). A computer device.

  The filtering device 100 includes a storage unit 1, a processing unit 2, an input unit 3, and a display unit 4. The filtering device 100 also has an input / output interface and a communication interface (not shown).

  The storage unit 1 is a means for storing information, and includes a memory such as a random access memory (RAM) and a read only memory (ROM), a hard disk drive (HDD), and the like. The storage unit 1 stores a browsing restriction DA (Destination address) list 11, a browsing restriction URL list 12, a filtering service contract terminal SA (Source Address) list 13, a filtering service target URL list 14, and an SA / group correspondence list 15. ing. The storage unit 1 also stores an operation program for the processing unit 2 (not shown).

The browsing-restricted DA list 11 is a list for free filtering, and is a set of DAs corresponding to a plurality of predetermined access-prohibited Web pages.
The browsing-restricted URL list 12 is a list for free filtering, and is a set of URLs corresponding to a predetermined plurality of access-prohibited Web pages.
The filtering service contract terminal SA list 13 is a set of SAs corresponding to contract terminals of the pay filtering service among the user terminals 200.

  The filtering service target URL list 14 is a set of URLs corresponding to access-prohibited Web pages in the paid filtering service. In the filtering service target URL list 14, a set of URLs is grouped into predetermined categories. The number of groups is about 100, for example. In that case, the average number of URLs per group is, for example, about 10,000.

  The SA / group correspondence list 15 is correspondence information between SAs of contract terminals in the user terminal 200 and groups in the filtering service target URL list 14. With such a mechanism, the user can freely select these groups (categories) as filtering targets in the paid filtering service.

  The processing unit 2 is means for performing arithmetic processing based on information stored in the storage unit 1, and is configured by, for example, a CPU (Central Processing Unit). The processing unit 2 includes a DA browsing restriction determination unit 21, a URL browsing restriction determination unit 22, a filtering service contract determination unit 23, and a filtering necessity determination unit 24.

  When there is a connection request from the user terminal 200 to the Internet 300, the DA browsing restriction determination unit 21 operates before the URL browsing restriction determination unit 22, and the DA corresponding to the destination URL in the connection request is the browsing restriction DA. If it is determined whether or not it is in the list 11, the process is passed to the URL browsing restriction determination unit 22 when it is determined, and the process is transferred to the filtering service contract determination unit 23 when it is determined that it is not. The DA browsing restriction determination unit 21 is not an essential component in the filtering device 100 and may be omitted.

  When the DA browsing restriction determination unit 21 determines that the DA corresponding to the destination URL in the connection request is not in the browsing restriction DA list 11, the URL browsing restriction determination unit 22 sets the destination URL in the connection request in the browsing restriction URL list 12. It is determined whether or not there is, and when it is determined that there is, the connection request is discarded. When discarding the connection request, the URL browsing restriction determination unit 22 may notify the user terminal 200 of connection prohibition, for example.

  When the URL browsing restriction determination unit 22 determines that the destination URL is not in the browsing restriction URL list 12, the filtering service contract determination unit 23 determines whether the SA in the connection request is in the filtering service contract terminal SA list 13. When it is determined that there is no connection, the connection request is permitted.

  When the filtering service contract determination unit 23 determines that the SA in the connection request is in the filtering service contract terminal SA list 13, the filtering necessity determination unit 24 determines whether the destination URL in the connection request is in the filtering service target URL list 14. When it is determined that the connection request has been made, the connection request is discarded. The filtering necessity determination unit 24 refers to the SA / group correspondence list 15 to determine whether the SA in the connection request is in the filtering service target URL list 14 for the group corresponding to the contract terminal. .

The input unit 3 is means for input by the administrator of the filtering device 100, and is configured by, for example, a keyboard or a mouse.
The display unit 4 is a means for displaying information in response to an instruction signal from the processing unit 2, and is configured by, for example, an LCD (Liquid Crystal Display).

Next, processing of the filtering device 100 will be described with reference to FIG. 2 (see FIG. 1 as appropriate).
In step S1, the processing unit 2 determines whether or not there is a connection request from the user terminal 200 to the Internet 300. If Yes, the process proceeds to step S2, and if No, the process returns to step S1.

  In step S2, the DA browsing restriction determination unit 21 determines whether or not the DA in the connection request is in the browsing restriction DA list 11. If Yes, the process proceeds to step S3. If No, the process proceeds to step S5.

In step S3, the URL browsing restriction determination unit 22 determines whether or not the URL in the connection request is in the browsing restriction URL list 12. If Yes, the process proceeds to step S4. If No, the process proceeds to step S5.
In step S4, the URL browsing restriction determination unit 22 discards the connection request, notifies the user terminal 200 of connection prohibition, and ends the process.

In step S5, the filtering service contract determination unit 23 determines whether the SA in the connection request is in the filtering service contract terminal SA list 13. If Yes, the process proceeds to step S6. If No, the process proceeds to step S9. move on.
In step S9, the processing unit 2 permits the connection request (connection to the Internet 300) and ends the process.

  In steps S <b> 6 to S <b> 8, the filtering necessity determination unit 24 refers to the SA / group correspondence list 15 for checking whether the destination URL in the connection request is in the filtering service target URL list 14 as a paid filtering service. However, this is done for each applicable group.

  That is, in step S7, the filtering necessity determination unit 24 proceeds to step S4 when the destination URL is in the (relevant) URL group (Yes), and when the destination URL is not in the (relevant) URL group ( No), the remaining URL groups are collated (return to step S7). In step S7, as the necessity determination unit 24 for filtering, a thread for performing collation for each group may be prepared, and processing may be performed in parallel as a multi-thread. Then, the processing time can be shortened.

  If the destination URL is not in any of the corresponding URL groups, the filtering necessity determination unit 24 proceeds from step S8 to step S9.

  Thus, according to this embodiment, the total cost of filtering can be reduced by performing the paid filtering service and the free filtering using the common facility (filtering device 100).

  Further, in the free filtering process, the processing time can be shortened by using filtering by the browsing restriction DA list 11 having a data amount smaller than that of the browsing restriction URL list 12.

  Further, the filtering service target URL list 14 is grouped, and in the paid filtering service, the processing time can be shortened by filtering only the necessary groups for the user terminal 200 corresponding to the connection request. it can.

  Here, a specific effect is considered. As an example, assume the following conditions: 1/10 out of a plurality of user terminals 200 have a contract for a paid filtering service (contract rate 10%). In the filtering service target URL list 14, 100 URL groups are prepared, and each group has 10,000 URLs. The service contractor selects 50 URL groups on average. One million URLs are registered in the browsing restriction URL list 12.

Under this condition, the required resources (resources) in the filtering device 100 are as follows when compared with the case of only free filtering.
The storage capacity for storing the list is {(10,000 × 100) +1 million} / 1 million = 2 times.
The CPU processing load is 1+ (1/10) × (50/100) = 1.05 times.
The processing time is 1 + 1/100 = 1.01 times (in the case of multithreading).

  Therefore, even if the paid filtering service and the free filtering are performed using the common equipment (filtering device 100), the CPU processing load and the processing time can be suppressed to be extremely small, and it can be said that the effect is high.

Although description of this embodiment is finished above, the aspect of the present invention is not limited to these.
For example, the filtering device 100 may use a hash value or a white list (a list of URLs that permit unconditional connection) for filtering.
In addition, specific configurations and processing contents can be appropriately changed without departing from the gist of the present invention.

DESCRIPTION OF SYMBOLS 1 Memory | storage part 2 Processing part 3 Input part 4 Display part 11 Browsing restriction DA list 12 Browsing restriction URL list 13 Filtering service contract terminal SA list 14 Filtering service object URL list 15 SA / group correspondence list 21 DA browsing restriction judgment part 22 URL browsing Restriction determination unit 23 Filtering service contract determination unit 24 Filtering necessity determination unit 100 Filtering device 200 User terminal 300 Internet

Claims (4)

A filtering device that prohibits access from a terminal to some web pages on the Internet,
A browsing-restricted URL list that is a set of URLs (Uniform Resource Locators) corresponding to a plurality of predetermined access-prohibited Web pages;
Among the terminals, a filtering service contract terminal SA list that is a set of SA (Source Address) corresponding to a contract terminal of a paid filtering service ,
A filtering service target URL list which is a set of URLs corresponding to Web pages to be prohibited from access in the filtering service; and
A storage unit that stores a browsing restriction DA list that is a set of DA (Destination address) corresponding to the predetermined plurality of access-prohibited Web pages, and a processing unit.
The processor is
When there is a connection request to the Internet from the terminal, it operates before the URL browsing restriction determination unit, determines whether or not the DA corresponding to the destination URL in the connection request is in the browsing restriction DA list,
If it is determined that there is, the process is passed to the URL browsing restriction determination unit,
If it is determined that there is no DA browsing restriction determination unit that passes the processing to the filtering service contract determination unit,
When the destination URL in those the connection request is determined to be in the browse restriction URL list, and discards the connection request the URL browse restriction determination unit,
When the URL browsing restriction determination unit determines that the destination URL is not in the browsing restriction URL list, the connection request is permitted when it is determined that the SA in the connection request is not in the filtering service contract terminal SA list. The filtering service contract determination unit;
When the filtering service contract determination unit determines that the SA in the connection request is in the filtering service contract terminal SA list, the connection URL is determined when the destination URL in the connection request is in the filtering service target URL list. And a filtering necessity determination unit that discards the request. In the filtering service target URL list, a set of URLs corresponding to the access-prohibited Web pages is grouped into predetermined categories.
The storage unit further stores an SA / group correspondence list, which is correspondence information between the SA of the contract terminal and the group,
The filtering necessity determination unit
Whether SA in the connection request is in the filtering service target URL list, by referring to the SA · group correspondence list to claim 1, wherein determining the said group corresponding to said contract terminal The filtering device described. A filtering method by a filtering device that prohibits access from a terminal to some web pages on the Internet,
The filtering device includes:
A browsing-restricted URL list that is a set of URLs (Uniform Resource Locators) corresponding to a plurality of predetermined access-prohibited Web pages;
Among the terminals, a filtering service contract terminal SA list that is a set of SA (Source Address) corresponding to a contract terminal of a paid filtering service,
A filtering service target URL list which is a set of URLs corresponding to Web pages to be prohibited from access in the filtering service; and
A storage unit that stores a browsing restriction DA list that is a set of DAs (Destination addresses) corresponding to the predetermined plurality of access-prohibited Web pages, and a processing unit.
The processor is
When there is a connection request to the Internet from the terminal, before the second step, it is determined whether or not the DA corresponding to the destination URL in the connection request is in the browsing restriction DA list,
If it is determined that there is, the process proceeds to the second step,
If not, the first step moves to the third step;
When the destination URL in the connection request is determined to be in the browse restriction URL list, and the second step of destroying the connection request,
The third step of permitting the connection request when it is determined that the SA in the connection request is not in the filtering service contract terminal SA list when it is determined that the destination URL is not in the browsing restriction URL list ;
When it is determined that the SA in the connection request is in the filtering service contract terminal SA list, the connection request is discarded when it is determined that the destination URL in the connection request is in the filtering service target URL list . Steps,
The filtering method characterized by performing . In the filtering service target URL list, a set of URLs corresponding to the access-prohibited Web pages is grouped into predetermined categories.
The storage unit further stores an SA / group correspondence list, which is correspondence information between the SA of the contract terminal and the group,
The processor is
In the fourth step, referring to the SA / group correspondence list, whether or not the SA in the connection request is in the filtering service target URL list is determined for the group corresponding to the contract terminal. The filtering method according to claim 3 , wherein

Images