DE202010016871U1 - Device for detecting unwanted access - Google Patents

Abstract

Apparatus (120) for detecting unwanted access to information, the apparatus comprising:
a monitor (125) for monitoring access to information;
provisioning means (126) for providing the information, wherein the provisioning means is arranged to process an inquiry of information by access from an access origin (100) and to provide the access originated information, the provisioning means being arranged in an area protected by the monitoring means is; and
a security device (130) for detecting unwanted accesses, wherein the security device is arranged to start detecting unwanted accesses at a particular point in time after processing the retrieval of information and after providing the information to the access origin (100) the provisioning device (126) lies,
wherein the security device (130) comprises:
a determining means for determining the access origin (100);
a detention facility ...

Description

The invention relates to a device for detecting unwanted access to network devices.

The data transfer via computer networks is an important means of communication between users of these computer networks or also for managing and doing business. The networking is wired or realized by radio links. By means of a computer network, individual or groups of computers are interconnected. Currently the largest computer network is the Internet dar. Communication via the Internet via a common protocol, individual users (English: User) are z. B. identifiable via the so-called Internet Protocol address or IP address of your computer or computer network or via a MAC address or an Ethernet ID.

For example, users can enter inquiries using a user interface on the computer.

The retrieval of data on the Internet is made by means of accesses or queries or queries on so-called web pages (English: Websites), which are stored on a so-called application server, in particular a so-called network server (English: Web server). An application server can provide static information, i. H. Information already present in files and / or dynamically generated, d. H. only with regard to a request made information represent. For example, information is generated dynamically via a search engine by downloading pages of the network or information from the network onto the computer of the search engine and indexing the pages being searched for further processing. References to these pages are sent at the origin of the request. A netpage that contains these references is only generated when the referrals are retrieved.

The presentation of static or dynamically created websites takes place by means of so-called "web browsers", which are regarded as "clients" to the web servers. The English terms are included in the German jargon and are therefore used below.

Often, the requests to retrieve data are automated to circumvent an action by the Internet user, so that, for example, he does not have to look at pages with advertising or to systematically query and, if necessary, further process data from a web server. Through these systematic queries, databases of a database can be queried and at least partially copied. Depending on what data is queried, there is the problem that data is placed in connection with other information and so ultimately sensitive information is unauthorized access points.

It is therefore an object of the invention to provide a way to effectively and inexpensively detect and block unwanted, especially automated access, in particular to a server.

This object is solved by devices according to the independent claims. Advantageous developments are the subject of the dependent claims.

The device according to the invention has a monitoring device, a provision device and a safety device for detecting accesses. The monitoring device monitors accesses to information provided by the providing device. In this case, the provision device is arranged in a protected area by the monitoring device. The providing device is set up to process a query of information by access from an access origin and to provide the access origin with the requested information. The security device begins detecting unwanted access at a particular time that is after processing the retrieval of information and after providing the information to the access origin by the providing device. The security device furthermore has a determination device for determining the access origin, a determination device for determining the number of accesses from the determined access origin within a predetermined period of time, a comparison device for comparing the determined number of accesses with a threshold value, and an output device for outputting a blocking message, if the detected number of accesses is greater than the threshold. Furthermore, the device has a blocking device for processing the blocking message and blocking further access access accesses in the event of a blocking message.

The blocking device may be coupled to the monitoring device to configure the monitoring device to block further access origin accesses. This is particularly advantageous since the locking device and the monitoring device can be configured independently of each other and the locking device enables dynamic blocking of accesses.

According to an advantageous development, the device further comprises an evaluation device for evaluating the utilization of the safety device. The security device is set up to select the specific point in time for starting the detection of undesired accesses depending on the evaluation of the utilization.

The blocking message can in particular be formed by a flag and / or an entry in a protocol file and / or a text message and / or a message to a unit or software component. It may moreover be a command or an instruction to another device or another software module by which further access from the access origin is forcibly or optionally suppressed. As a result, further accesses can be prevented depending on specified criteria. In particular, such a protection of the data that should be queried by means of access can be guaranteed.

This procedure has the further advantage that inquiries that occur with a certain frequency can be detected. Such access or requests indicate automated access.

According to an advantageous development, a determination device determines a second number of accesses within a second time period. This second period is different from the first period.

The difference between the first and second time periods may be in particular at a different start time of the time period, end time of the time period and / or length of the time period.

A comparator compares the second number of accesses with a second access number threshold. An output device issues a blocking message if the second detected number of accesses is greater than the second access number threshold.

First and / or second access number thresholds can be established in particular as a function of the time period. Additionally or alternatively, the access count threshold was determined depending on a quantity and / or type of queried data. For example, in terms of type, the data may be divided into different groups, with more queries allowed for one group than for another. With regard to the quantity, for example, a limit can be set with regard to the data records obtained.

This approach has the advantage that automatic requests with different frequencies can be detected. For example, if the first period is shorter than the second period, and the accesses within the second period are distributed such that the first access count threshold is not exceeded, yet a large number of accesses occur over the longer second period, it is also possible to recognize this access. Thus, accesses with different temporal granularities can be detected. In particular, accesses having a very high access frequency in a short period of time, which are often referred to as data accessors with high access frequency, or accesses that extend over a long period of time and thus reach a high number of access, often referred to as data suckers over a long period will be recognized. These accesses can then be blocked, for example.

According to a further refinement, the access origin is recognized or established on the basis of at least part of an address. The address may in particular be a network address, for example an IP address, and / or a MAC address. Part of a network address is often already used to identify the origin, since it also identifies a specific subnetwork, in the case of an IP address, for example, the Internet.

According to a development of the safety device, the number of accesses in a control period is furthermore determined by a determination device and this number is compared by a comparison device with a control threshold. If the further determined number lies above this control threshold, then at least a part of the determined address of the access origin is determined by a memory device stored and compared by a comparison device with at least one entry in a list. The at least one entry in the list is formed by at least part of an address.

For example, in the case of an IP address xxx.yy.zzz. *, The part xxx.yy.zzz is compared with corresponding IP address entries in the list.

By means of an output device, at least part of the determined address is output if the determined address is not included in the list. The output can be made in particular by means of a blocking message. Furthermore, an output can also be made in a log file as in a so-called log file. Alternatively or additionally, an output can be made as an electronic message, in particular e-mail, to a specific recipient. This procedure has the particular advantage that it can be detected quickly whether frequent accesses have already taken place from the access origin in the past. Thus, for example, actions such as the blocking of further accesses can be made quickly and purposefully.

According to a further development, the control period is chosen to be longer than the first and second periods. This allows the identification of automatic access even for relatively low frequencies, but extend over a long period of time and so realize a high number of accesses.

This approach has the advantage that, for example, a long control period of the order of one day or days compared to short first and second periods in the range of seconds or hours is chosen. In the case of frequent accesses in the control period, then a comparison can be made with addresses that were accessed frequently in previous periods. Thus, in the event that the address or part thereof is included in the list, previous decisions regarding the access origin associated with the determined address can be resorted to. This allows a quick decision and avoids unnecessary duplication.

According to a development, further accesses are blocked by means of the blocking device if an output of the at least one part of the determined address takes place. This has the advantage that access from access origins that are not yet included in the list can be prevented.

According to a development, at least part of a determined address is included in the list when the predetermined control threshold is exceeded in the control period. This allows effective monitoring of access origins with high access frequency.

According to one development, the at least one part of the address is compared by means of a comparison device with an exception list. A blocking of further accesses from the access origin belonging to the address takes place by means of a blocking message, if the at least part of the address is not contained in the exception list. This approach has the particular advantage that accesses of specific origin, in particular internal access or monitoring tools can be allowed. In particular, the comparison with the exception list can also be preceded by at least one check or several checks of the access numbers.

According to another development, the access with regard to an identifier is examined by an analysis device and a blocking message is issued by an output device if the access has at least one specified identifier. In particular, the identifier can be a string or a format that characterizes the access. For example, the identifier may be formed by a string included in the request. In particular, this may be the string "http / 1.0".

This approach has the advantage that automated requests, which are made in a particular programming language, can also be recognized by certain forms or formatting or strings, and can be perceived as automatic requests.

Preferably, at least one criterion which leads to the output of a blocking message is stored by a memory device. This criterion can be formed by the number of accesses and / or format and / or time period and / or control period and / or an action description "lock" or "issue".

This has the advantage that this stored data can be accessed if necessary.

In particular, the blocking of accesses by the locking device for a fixed timeout. This can in particular be determined as a function of at least one criterion which leads to the blocking or to the output of the blocking message. This has the advantage that, for example, be adapted to the frequency-adjusted time-outs.

According to a further development, a message device creates a message that contains at least one of the stored criteria that lead to blocking or output of the blocking message. This message can be displayed in particular by means of a display device or sent by means of a transmitting device as an e-mail to a predetermined address.

The message preferably contains the address of the access origin and / or the criteria of blocking or of the output and / or a time of blocking or of the output and / or an unlocking time and / or a timeout. This allows the message to be used to further edit access from this address.

In particular, by a reset means, a manual reset of the lock or an automatic reset of the lock after the expiry of the time-out or at a Entsperrzeitpunkt done.

The access can in particular be done by means of a web browser, wherein the Internet forms the access network. This allows access to data on the Internet.

According to a further advantageous embodiment, which can be combined with all previous embodiments, the detection devices and / or the blocking device operate on at least two different network levels or layers. So z. B. determining the number of accesses in the network access layer and another determination of the number of accesses in the Internet, transport or application layer are performed. Alternatively, they can be performed in parallel in two different layers. To win z. B. during the first period information about accesses from an access origin in two different layers, so that z. For example, the IP address can be determined via the application layer and the MAC address of the access origin via the Internet layer. This makes it possible to obtain additional information about the access origin and thus a more secure recognition of the access.

According to a further advantageous embodiment, accesses are assigned to a pattern which characterizes the type of access. If a same pattern exists for a same data origin, a lock message is issued.

According to a further embodiment, an apparatus for detecting unwanted access to information comprises a monitoring device for monitoring access to information, a provision device for providing the information, a protocol device for logging the access of the access origin and a security device for detecting unwanted access. In this case, the provision device is set up to process a query of information by access from an access origin and to provide the access origin with the requested information, wherein the provision device is arranged in an area protected by the monitoring device. Furthermore, the protocol device is set up to write an entry for each access together with a time stamp indicating the arrival time of the access at the providing device to a log memory. The security device is set up to read the entries in the log memory in order to detect the unwanted accesses.

In this embodiment, the security device comprises a determination device for determining the access origin, a determination device for determining the number of accesses from the determined access origin within a predetermined period of time, a comparison device for comparing the determined number of accesses with a threshold value, and an output device for outputting a blocking message, if the determined number of accesses is greater than the threshold value. Furthermore, the device has a blocking device for processing the blocking message and blocking further access access accesses in the event of a blocking message.

The invention is explained below with reference to selected examples, which are partially illustrated in the figures.

Show it:

1 a schematic access from an access origin to a search engine;

2 a schematic overview of the further procedure, if special criteria are available;

3 an embodiment of the procedure when blocking or output criteria are present;

4 a schematic embodiment of a network server device; and

5a . 5b and 5c each a schematic embodiment of a device according to an embodiment of the invention.

In 1 is an access from an access origin 100 via an access network 110 on a device 120 , for example, a network server device. At the access origin 100 it is preferably a networked computer, which is characterized by its Internet Protocol address or IP address ADR. Alternatively or additionally, characterization is provided via further identification characters, such as a MAC address or a network ID, such as an Ethernet ID. The access origin is not limited to a location or a local area, but may also include virtual addresses or address ranges, from which corresponding queries to a network server device 120 sent.

Access is preferably by means of a so-called web browser via the Internet as an access network 110 , Alternatively or additionally, accesses via other programs and / or other access networks are provided. The embodiment is directed z. B. on the type of information to be queried by means of access and / or networking.

A browser generally allows the viewing of information. This information is due to access from the network server device 120 made available. A web browser displays information available on the Internet. The information can be static or dynamic. Alternatively, other programs or so-called "clients" may be used, depending on which application layer with the network server device 120 is communicated, sends corresponding requests to the network server device.

In order to prevent or at least be informed about certain types of access, as in 2 represented, at least one criterion 200 depending on which the step continues 230 and / or locks 220 and / or issue 210 he follows. Following the lock may be an issue 240 respectively.

In particular, there are several loopbacks or "loops" that can lead to the output of a blocking message and / or a subsequent blocking.

Such an inhibit message is information that blocks it when the information is made available to the authority responsible for the revocation. It may therefore be in particular a so-called "flag", which is set in the context of a program and z. B. just leads to a blocking in a processing. Alternatively or additionally, it may be a command that is sent to a unit or software components and / or a text message that z. B. to one or more computers or computer networks or even more wired or wirelessly networked terminals is sent, and / or an entry in a log or log file or configuration file. The nature of the blocking message can thus depend in particular on the configuration of the network and the information requirements of other points in the network as well as the required speed of a response to an access.

For a loopback that relates to the number of accesses, the number of accesses is determined and for each access, an entry is made in a log file or "log entry". If the number of entries exceeds a blocking parameter specified for the loopback, accesses from this access origin are blocked for a blocking period dependent on the loopback. If a blockage occurs, a corresponding message is sent to the user or the access origin.

This is shown for a concrete example in the following tables for a first and a second test loop: Test loop 1: Hits in 20 s Log entries per access lock parameter blocking time 120 1 120 48 hours Test loop 2: Hits in 10 hours Log entries per access lock parameter blocking time 3000 1 3000 48 hours

In 3 For example, another exemplary flow for checking and handling requests is shown schematically.

As will be shown in greater detail below, queries from an access origin are subject to a particular audit. While this check may take place prior to the actual processing of the request, according to one embodiment of the present invention, the request is answered and, independently, also forwarded to a particular device for testing. This device, for example a security device, checks each incoming request independently of its processing.

In case of a request will be in a first test step 300 first determines the number of accesses Z1 in a first period ZR1. If this number lies above a first access threshold ZTH1, a comparison step closes once the address or origin of the access has been determined 380 in which it is checked whether the address or a part thereof is on an exception list WL. The first threshold ZTH1 is determined in particular as a function of the first time period ZR1. To the purpose of the test step 300 to explain briefly, the overall context is explained, which is explained in detail below. In this case, the accesses in the application layer are determined at the level of the HTTP protocol in the example shown.

At the address. this is in particular an IP (Internet Protocol) address or part of this address. If, for example, the IP address has the form xxx.yy.zzz *, then it is sufficient to consider only the first two or three blocks for identifying the origin, over which the individual computer, but the domain, is not known.

The exception list WL contains at least a part of at least one address, which is granted extended access rights, so that any exceeding of thresholds of access origins to which these addresses are assigned is not punished. If the determined address is an address or part of the address which is in this exception list, then the accesses can continue. If appropriate, a message is output that is entered on the one hand for documentation purposes in so-called "log files" in which events are logged, and on the other hand can serve as user information.

The test step 300 has the advantage that queries can be detected with a certain frequency, so that automatic requests can be filtered out.

Automatic requests often have a high access frequency in, for example, a short period of time.

Will in the test step 300 has been determined that the determined number of accesses Z1 does not exceed the first threshold ZTH1, then another test step is performed 340 continued, if not with the comparison step 380 ,

In parallel, in the further test step 310 compared whether a further determined number of accesses in a further period ZR2 exceeds a further threshold ZTH2. The further period ZR2 is selected in particular longer than the first time period ZR1, and the further threshold ZTH2 is also adapted to this longer time period. The second period starts in particular with the first period.

Alternatively, this further test step 310 following the test step 300 respectively. Thus, for example, if an excess already according to test step 300 takes place, to be waived further checks.

Furthermore, alternatively or additionally, test step 300 and further test step 310 done in different layers. In the event that it is the access network 110 can be the World Wide Web on the Internet, the testing steps 300 and 310 in the different layers of the TCP / IP reference model, e.g. In the network access layer, the Internet layer, the transport layer or the application layer. This has the advantage of being able to recognize systematic queries even more effectively.

If the further number of accesses Z2 exceeds the further threshold ZTH2, the comparison step follows 380 if not, with the test step 340 ,

The advantage of this further test in the test step 310 lies in the fact that so automatic inquiries can be recognized, which take place with different frequencies.

In addition, in at least one further checking step, access numbers can be checked in further time periods with respect to further thresholds.

Furthermore, in parallel in the test step 330 the format of the request or a part thereof and compared with at least one predetermined format or part thereof.

According to a specific embodiment of the invention, automatic inquiries about their form and / or about the protocol by which they are executed and / or the protocol version can be checked. It can be determined whether a so-called script request with the hypertext transfer protocol version 1.0 and thus has the string http / 1.0.

A script is a program written in a so-called scripting language. This is a programming language that is simplified in that it eliminates elements such as declaring constraints on variables that are beneficial only for larger software projects. HTTP refers to a hypertext transfer protocol for transferring data over a network. It finds particular application to load data such as web pages from the World Wide Web into a web browser. The version number 1.0 indicates an older version, which is usually no longer used by the popular browsers and therefore provides an indication of script-based automatic requests.

In the case of a Http / 1.0 request, the check therefore refers to whether the identifier "Http / 1.0" is contained in the request text.

In this context, it should be mentioned that a large number of information and databases can be queried via the hypertext transmission protocol or have been made accessible via the World Wide Web. Thus, the query on the hypertext transfer protocol is currently the most widespread. Alternatively, such requests can also z. B. via Java servlets or Java applications, eg. B. be performed via HTTP tunneling. Even in such a case, the access origin can be determined and, if necessary, logged.

Alternatively, test step 330 be preceded by the other test steps. This allows requests that receive these strings to be sorted out from the outset quickly and effectively.

If there is a match with a given format or part of it, then the comparison step 380 continued. If there is no match, the test step closes 340 at.

In 3 is therefore a parallel processing of the test steps 300 . 310 . 330 shown.

Alternatively, a temporal staggering of the examination steps 300 . 310 . 330 be made. Examples of a time staggering have already been mentioned. However, other time sequences are also provided.

In addition, access numbers can be determined in one or more further time periods and can also be used as a criterion by means of further threshold comparisons.

In the test step 340 it is checked whether a further number of accesses Z3 within a control period ZR3 is above a control threshold ZTH3. If this is not the case, then in step 345 continued. If the control threshold ZTH3 is exceeded, then the comparison step 350 continued.

The control period begins in the 3 Example shown after the in test steps 300 and 310 mentioned periods. As an alternative to time staggering, this control period can also begin at the same time as the other periods.

The advantage of the test step 340 This is because, on the one hand, requests with further different temporal frequencies are recorded and thus can be identified as automatic requests. On the other hand, in the comparison step 350 determined whether a denomination of origin ADR, in particular an IP address, has already queried high-frequency. For this, the requesting IP address ranges are clustered daily to the first two or three blocks, ie the addresses are stored in the form xxx.yy.zzz and the frequency of the requests is compared with the value of the two previous days. For this purpose, the control period ZR3 is set to one day and the Internet address or just a part of this Internet address is stored if the associated control threshold ZTH3 is exceeded by the number of accesses Z3. The stored Internet addresses or parts thereof are stored in a list. Is now the comparison step 350 successful, ie at least part of the Internet address is included in the list, this means that high frequency has already been requested from this access origin in past periods.

Queries from a local network often take place via a so-called proxy server, which receives the page requests as an intermediary and then at its own address to the network server device 120 forwards. Thus, all requests from this local network have the same address, even if they come from different computers or terminals in the local network.

In order to distinguish unwanted requests from permitted requests, in a further, preferred embodiment of the invention, in addition to the address, the type of request or access can also be stored. Under type of query is preferably z. B. understood a specific structure or a specific pattern of the query. According to this specific structure or pattern specific or similar information is systematically requested. With constant repetitions of such requests z. For example, systematically querying information from entire databases.

As an example, queries of surnames based on known street names and house numbers in a city are mentioned. The purpose of these queries is to record all residents in one part of the city. The various queries have z. For example, the specific pattern is that the house numbers and street names are systematically varied.

Also, requests that aim to obtain a complete record, such as, for example, all data, persons, or business addresses in a city or multiple cities, may be associated with a pattern. For example, the pattern could be composed of several sub-patterns, such as search for parameter 1 nursery in parameter 2 city. By varying the two parameters, such as parameter 1 with respect to different sectors and parameter 2 with respect to different cities, a complete data set can be obtained. Another way to get a complete record of a city would be to leave parameter 2 fixed and vary parameter 1 alphabetically or in some other order. If such a pattern exists and if this information is requested from the same address, a blocking message is output and further accesses may be blocked.

If there is no obvious pattern with the same address, no issue of a blocking message occurs. If, on the other hand, accesses by one or more access origins are detected, the number of accesses being above a specific value within a period of time and at least a certain proportion of the accesses having a specific pattern, it is preferable to output an accessorque barring message whose accesses have the specific pattern.

If the at least part of the Internet address was not previously part of the list L, inclusion in this list takes place in a recording step 360 ,

In addition, a recording message in an output step 370 be issued. This recording message can be made in particular by an entry in a log or log file. Based on the Logfiles can be an automatic or manual assignment of the Internet address and a manual or automatic assessment, which may be followed by a blocking.

An inclusion in the list L can also be made manually, if there are other reasons suspicion of abuse. The list L can be cleaned up at certain times, i. H. the at least contained portions of Internet addresses are erased when the access originating from the Internet address is no longer accessed at a high frequency for a certain time.

In a comparison step 380 it is checked whether the determined IP address or the part of this address is contained in an exception list WL. In this exception list WL are denominations of origin, so in particular IP addresses or parts thereof, which are allowed frequent access. This allows requests from internal access origins to be allowed. For example, these addresses identify internal proxy servers.

Accordingly, the exception list is in particular in a format in which a serial number of a single address, eg. B. the address is assigned to 1.2.3.4 or the so-called "localhost" or a serial number of a plurality of addresses, for example, the sequence 1.2.3 or 1.2.3 <-> 5 is interpreted as the address group 1.2.3.0 to 1.2.3.255 , A "localhost" is a name for an IP address that is resolved via a so-called dynamic name server or DNS server, i. H. can be converted into a number. Alternatively or additionally, the sequence 1.2.0.0/16 can be interpreted as the address group 1.2.0.0-1.2.255.255. For a secure identification, the serial number may not be duplicated.

If the address is included in the exception list like WL, then in a further step 390 an output to a log file. This provides an overview of high-frequency access, even from internal addresses. Following this, in one step 395 continued.

If the address is not included in the exception list, this is done in an output step 396 the output of a lock message. In response, it is preferable in a further step 397 made a lock, as explained below. This blocking will be in a further step 398 canceled after expiry of a lock time or at a certain unlock time. The cancellation can alternatively or additionally be done manually.

The lock time or lock duration or an unlock time may already be specified in the lock message. This blocking message preferably also contains the IP address of the blocked access origin as well as the reason for the blocking, that is, for example, blocking on the basis of the checking step 300 . 310 or 330 , In addition, the determined number of accesses can be specified. In addition, the blocking message can additionally contain an extract from a log file with an identification of the application in the context of which a blocking took place. In particular, the so-called URL, a uniform resource locator (English: Uniform Resource Locator) can be used as identification. This specifies a resource and the network protocol used, such as the HTTP protocol, and the location of the resource on a computer network. The steps 396 . 397 . 398 are output in assigned output steps in each case in a log file.

In the in 3 In the example shown, certain time sequences were described. As already partially explained, the steps can also take place differently in time. In particular, a check as to whether an address is contained in an exception list can also be preceded by all other steps. The chosen temporal sequence may in particular also depend on the respective computational effort of the individual steps, so that, for example, less compute-intensive steps are first performed in order to possibly bring about a decision with regard to blocking.

Furthermore, further output steps can be carried out or output steps can be omitted. This depends on the documentation requirements and information requirements for the users of the method.

As already mentioned, the individual steps can in particular be the steps 300 . 310 and 340 also in at least two different layers.

Via a so-called proxy server, which acts as an intermediary between networks, it is possible for a large number of users to request the network server device 120 initiate. Because the proxy server the user requests under his own IP address to the network server device 120 This may give the impression that a single access origin will initiate a multitude of accesses, although the multitude of accesses will be uncoordinated from a plurality of computers. In order to obtain as much information as possible regarding such accesses, it is preferable to collect information in at least two different layers.

Depending on where and in which layer and / or which layers the access is logged, eg. In a so-called "bridge", d. H. an access (English: gateway) from a local network to another network at the level of the layer 2 or "link layer", or a network node (English: Router), d. H. Such a connection at the level of the layer 3, or "Internet layer", the MAC address of the access origin can alternatively or additionally be logged.

In particular, one or more layers can therefore be selected specifically for logging. In case of attack, d. H. if accesses have been identified as systematic or automated or otherwise undesirable, one or more further layers can be selectively added thereto. These layers may be overlying, for example an application layer, or underlying layers, for example a mesh access layer. Depending on the configuration of the communication protocol so appropriate identification options can be exploited.

In the method steps described above, the periods ZR1 and ZR2 and the threshold values ZTH1 and ZTH2 can be determined statically or dynamically. Thus, as already described above, for the periods ZR1 and ZR2 and possibly other periods z. For example, you can set fixed values that may differ from each other.

Alternatively, the time periods ZR1 and ZR2 and possibly further time periods can preferably be flexibly determined as a function of the access origin and / or the time of day and / or the local time at the access origin. So it is z. For example, it is possible to define different time periods ZR1 and ZR2 depending on the access origin and possibly further time periods.

In the same way, it is possible to variably define the threshold values ZTH1 and ZTH2 and possibly further threshold values as a function of the access origin. So z. For example, for a gateway, a router or a proxy server of a large Internet service provider, over which a large number of Internet users have access to the Internet, much higher thresholds ZTH1 and ZTH2 be set than for a single computer or for a gateway, a router or proxy server of a small local network. Because of a gateway, a router or proxy server of a large Internet service provider such. For example, 1 & 1, AOL, T-Home, etc. are expected to have a much higher number of authorized accesses to the network server device 120 per unit time, than by a small local network. Thus, after determining the access origin and a corresponding assignment of the access origin to an Internet service provider and / or an organization and / or a local network, specific threshold values ZTH1 and ZTH2 and possibly further specific threshold values are preferably defined for this purpose. These specific thresholds may be stored in a lookup table. These specific threshold values can also be stored in a database together with the network addresses and / or host name, country code of the access origin, location details of the access origin, information of the Internet service provider via which the access was made, and / or information of the organization or enterprise in which the Access origin is stored. Alternatively, these specific thresholds may also be based on access values determined for the particular access origins over a period of time. So z. For example, for the proxy server with the IP address of 62.153.195.210, for which the Rosenheim site, the Internet Service Provider Deutsche Telekom AG and the organization XY is determined, an average number of n accesses per hour on weekdays over a certain period of time be determined. For example, the threshold ZTH1 may be defined as ZTH1 = x * n and the threshold ZTH2 be defined as ZTH2 = y * n, where x and y are real numbers.

If the access origin with the IP address 62.153.195.210 has an average of 10 accesses per hour on working days, for example, a first threshold ZTH1 of 50 accesses is set for a first time period ZR1 of 1 minute. For a second period ZR2 of 1 hour, a second threshold of 200 accesses is set. Achieving this access origin with the IP address 62.153.195.210 z. B. now more than 70 accesses per minute, this suggests an untypical user behavior. By exceeding the threshold value ZTH1, a blocking message can be output which inhibits the access to the network server device 120 from the access origin with the IP address 62.153.195.210.

The time periods and threshold values may alternatively or additionally also be determined as a function of the local time of the access origin and / or the working day. For this, it is possible to fall back on previously defined values or user profiles for the periods and threshold values stored in lookup tables or databases. Alternatively, during operation of the network server device 120 Access profiles are created depending on the access origin and / or the local time of the access origin and / or the week or calendar day. The periods and thresholds are then set dynamically according to the access origin and / or the local time of the access origin and / or the week or calendar day. This can be specifically taken into account the different user behavior. Experience has shown that late at night (local time of the access origin) and at weekends significantly lower numbers of visitors than in the afternoon and evening on weekdays. High traffic levels within periods ZR1 and ZR2 are unlikely at these local times. Therefore, the thresholds at these local times can have significantly lower values than the thresholds in the afternoon and evening on weekdays. High traffic levels within the ZR1 and ZR2 periods are more likely to indicate automated queries.

In order to detect unauthorized accesses from a botnet or botnet, further time periods and further thresholds are preferably determined, which determine the maximum number of accesses within a period for a group of access origins and / or all access origins. These additional time periods and further threshold values can be determined statically or dynamically as described above.

In 4 is a device 120 , such as a network server device. Preferably, the network server device comprises 120 a provisioning device 126 , such as an application server or web server, one or more firewalls 125 and 128 and one or more databases or data stores 127 , Alternatively, the network server device 120 even from an application server or web server 126 consist. In addition, the network server device includes 120 a safety device 130 either in one of the firewalls 125 and 128 or in the application server or web server 126 is set up. Application server or web server 126 , Firewalls 125 and 128 and the databases are preferably interconnected via one or more wired or wireless data lines.

A firewall is used to monitor access to information. In particular, it is used to decide for the passing through them data traffic on the basis of predetermined rules or rules whether certain data is allowed to pass. This can be done by means of a firewall protection against unauthorized access. Defining the specifications or rules is also called configuration.

In one embodiment, the safety device is 130 both in one of the firewall 125 and 128 as well as in application server or web server 126 set up. According to a further embodiment, the safety device 130 provided as a separate software component.

For access belonging incoming data first pass the first firewall 125 before going to the application server 126 at which the query is handled. By means of an application server, dynamically or statically generated information can be displayed. At the application server 126 in particular, it is a web server on which websites are stored. A web server can also display static or dynamically generated information in the form of static or dynamic web pages.

For example, to generate content from dynamic web pages, the content to be displayed is stored in a data store or database 127 queried and integrated into the dynamically generated website. This is done on a data store or a database 127 which is in communication connection with the application server. Alternatively, the data store 127 Part of the application server 126 ,

If particularly sensitive data is accessed, the query or data belonging to the query pass through another firewall 128 before accessing more data stores.

The data stores or databases are also preferably used to store the values or user profiles described above for the periods and threshold values as well as the access profiles.

The safety device 130 is now in first firewall 125 , Application Server 126 and second firewall 128 integrated.

Alternatively, the safety device may be present only in one of these units or a subset of these units.

The blocking of the access via a locking device 140 the network server device 120 if there is a blocking message. This locking device can be part of the safety device 130 be realized or separated from it. A separate implementation can be done in a firewall. In one embodiment, the barrier device is 140 Part of the firewall 125 , Alternatively, the locking device 140 disconnected from the firewall 125 is implemented, so coupled with this, to block access to the firewall 125 to enable.

For blocking, an output device issues a blocking message to the blocking device 140 is transmitted. In accordance with the information in the blocking message, blocking of the accesses originating from the determined access origin is then performed by the blocking device in accordance with the method steps described above 140 carried out.

Depending on how the locking device 140 or the firewall 125 is configured and to which layers it has access, it blocks the accesses in the network access layer, the Internet layer, the transport layer and / or in the application layer according to the information in the blocking message. Alternatively, the access is from the determined access origin to the application server or web server 126 and / or the static or dynamic web pages of the application server or web server 126 and / or from the application server or web server 126 provided information in predetermined layers of the barrier device 140 prevented. Thus, as described above, by blocking messages in the firewall 125 or the locking device 140 the access from the determined access origin to from the application server or web server 126 provided information or on the application server or web server 126 be stopped directly in the network access layer or in the Internet layer.

The blocking can therefore be carried out in particular by means of a firewall which is configured for this purpose or by means of a blocking device. The accesses can, as already stated, be checked on different layers, depending on the type of protocol used. This can be used to determine the access origin in different ways. This determination can be made on the basis of information from one layer or from the information of several layers, which for example are combined with one another. For example, a safety device 130 in conjunction with at least one firewall 125 . 128 or a locking device 140 Identify simultaneously on multiple layers and, if appropriate, continue to detect effective unwanted access by using the pattern of the query patterns of the accesses or queries in one or more layers.

5a shows an arrangement of the components of the device 120 according to a further embodiment. The device 120 , For example, a network server device includes a monitoring device 510 , a provisioning device 520 with associated database or data storage 525 , a safety device 530 and a locking device 540 , The individual components of the device 120 are network components or network-compatible components. The individual components are connected to one another by one or more wired or wireless data lines or network connections.

The monitoring device 510 protects an area 515 (shown in dashed lines) of the device 120 before access. Within a network, like the network 110 in 1 , forms the monitoring device 510 thus a protected area 515 to which certain devices belong. These include, but are not limited to, the provisioning facility 520 and the database 525 as well as the safety device 530 and the locking device 540 , All devices or components within the protected area can only be monitored by the monitoring device 510 be addressed or accessed. By checking the monitoring device 510 Thus, a certain protection of the "behind it" components is possible.

In addition, other components may be added to the device 120 belong, which are however not shown for reasons of clarity. For example, further provision facilities and / or databases or data storage by the monitoring device 510 be protected. As in 4 may also be further monitoring device and / or firewalls (not shown) to the device 120 belong to better protect certain components.

As already mentioned above 4 a monitoring device is also used to monitor accesses to components of the protected area and data and / or information thereon. In particular, it decides whether or not to allow certain data to pass through the traffic passing through it on the basis of predetermined specifications or rules. This can be done by means of a monitoring device protection against unauthorized access. Defining the specifications or rules is also called configuration. The monitoring device 510 can be a firewall. Alternatively, the monitoring device 510 a network component, such as a router, gateway, or bridge, running a network traffic monitoring program. The program allows certain data to be blocked, ie not forwarded.

The provisioning device 520 holds data and / or information obtained by accessing from an access origin 100 be queried or retrieved. An exemplary form of providing device is an addressable server that is capable of allowing access and processing a query of data and / or information. In this case, the provisioning device can be at least one database or a data store 525 operate, or may hold the data and / or information itself. As described above, it may be dynamically or statically generated information. After successfully processing a query, the provisioning facility provides the retrieved data and / or information to the access origin. The requested data and / or information z. B. sent to the access origin.

According to one embodiment, the provisioning device is implemented by an application server or a network server (English: web server). Depending on the type of data and / or information to be provided, a corresponding implementation is provided, for example by installing an appropriate server software. In the case of a network server, queried data and / or information in the form of web pages can access the access origin 100 to be provided.

In order to protect the data and / or information from unwanted access, those at the provisioning facility 520 Inbound queries are checked as already in relation to 3 was explained. This check is made by a safety device 530 carried out.

The point in time at which the check starts is independent of the time at which the provisioning device handles access 520 , It can be selected by the safety device according to certain criteria. One possible criterion is the utilization of the safety device or the component on which it is implemented.

In the case that the security device and the provisioning device are implemented on the same component, it is advantageous to decouple processing of the request for information and the checking of undesired access. While inquiries or queries are processed and information is provided during periods of high traffic, the security device waits to ensure smooth information retrieval. At the end of such "peak periods", d. H. if the number of hits falls below a certain threshold, the check starts.

The provisioning device 520 can also consist of a large number of server units to which the access of access origins 100 evenly distributed. Although the safety device 530 is implemented on these server units, the point in time at which the check starts can also take place depending on the utilization of a single server unit. If a particular server unit has handled all incoming queries and thus gets into an "idle" state, it can start checking for unwanted accesses there.

The safety device 530 may have other components (not shown). These include, among other things, a determination device, a determination device, a comparison device and an output device. The determination device serves to determine the access origin, while the determination device determines a number of accesses from the determined access origin within a predetermined time period. The comparator then compares the detected number of accesses with a threshold to detect an undesirable number of accesses. If the determined number of accesses is greater than the threshold value, a blocking message is output by an output device. The safety device 530 this can be connected to the locking device 540 to output the lock message directly to the lock device. Alternatively or additionally, the safety device 530 the lock message also in a data store, such as database 525 , lay down. In this case, the locking device would 540 retrieve the lock messages stored there and process accordingly.

The safety device 530 is either as an independent software component on the provisioning device 520 is established or provided as a separate device, that is separate from the provisioning device 520 and the monitoring device 510 , In the case of the separate device receives the safety device 530 likewise the queries or accesses to the provisioning device 520 are directed. In this case, the security device can either receive the complete query of the access origin or only necessary for the determination of unwanted access data, such as address of the access origin, timestamp of the query, category or group of queried information, etc. Alternatively, the provisioning device 520 forward such data to the security device as soon as access takes place.

This offers the advantage of having a request by the providing facility 520 can be edited while the safety device 530 regardless of the requests according to the above regarding 3 check the procedure described. Due to the independence of the operation of the two facilities will be requests from the provision facility 520 edited, without a user noticing that the requests are also through the security device 530 be checked. The throughput of the provisioning device 520 is therefore not disturbed and a user also experiences no longer processing times of inquiries.

Furthermore, the device contains 120 the locking device 540 , The locking device 540 is separate from the monitoring device 510 but is coupled to this to block access to the monitoring device 510 to enable.

In a coupling with the monitoring device 510 can the locking device 540 the monitoring device 510 to configure that certain accesses by the monitoring device 510 be locked. For example, the locking device 540 the monitoring device based on the IP addresses available to it from lock messages 510 configure. In such a case, IP addresses of incoming requests are filtered out and blocked. The locking device 540 can also influence the blocking period. In this case, the monitoring device 510 reconfigured after expiration of a lock time for a particular address or type of access.

This has the advantage that both systems can be configured independently. While the monitoring device 510 For example, by a network administrator only rarely, such. B. once a month, is configured, so the locking device 540 automatically enable dynamic blocking of access by editing lock messages.

In a further embodiment of the monitoring device 510 This may be on the locking device 540 to access certain information. The locking device 540 Then the monitoring device will provide corresponding lists or configuration files on the basis of which the monitoring device 510 the locks can perform.

Alternatively, the locking device takes 540 the blocking itself before. In this embodiment, the monitoring device 510 set up so that incoming traffic through the monitoring device 510 and then through the locking device 540 is processed.

5b shows an alternative embodiment in which the handling of accesses, such as retrieving information, is also performed independently of the detection of unwanted accesses. As 5a also shows 5b An institution 510 to monitor and block traffic. This monitoring device can be, for example, a firewall.

Connected to the monitoring device is a provision device 520 , in turn, with a data store or a database 525 is coupled.

The devices behind the monitoring device 520 and 525 are also located in a protected area 515 , This protected area is protected by the monitoring device 510 generated.

The provisioning device 520 can be implemented by either a single component or a variety of components. For example, the provisioning device 520 consist of at least one server unit. All server units together form a so-called "server farm" which outwardly provides a single provisioning facility 520 forms. The load distribution of the individual server units is then made according to the free capacities of individual server units.

Each of these server units contains a component 521 that ensures the provision of data and / or information. For example, it may be an application server and / or web server. Furthermore, the provision device comprises 520 a program logic 522 that collects data related to access, requests or queries and the provision of data. A task of the program logic 522 is the logging of accesses or incoming requests. In this case, certain information is associated with the accesses in a corresponding memory 523 stored. This store 523 can contain a log file or log file. The program logic 522 is set up to store information regarding access. This information includes, among other things, an address of the access origin as well as the time at which the access was made to the provider 520 has arrived. The program logic 522 thus provides each entry in the log file with a timestamp identifying the input.

As explained in the notes 3 As can be seen, even more information regarding the accesses by the program logic in the memory 523 saved.

In the embodiment according to 5b now accesses the safety device 530 on the memory 523 and the stored log or log file. The safety device 530 evaluates the data stored in the log file. This evaluation is the same as above 3 described review for unwanted access.

The safety device 530 may have other components (not shown). These include, among other things, a determination device, a determination device, a comparison device and an output device. The determination device serves to determine the access origin, while the determination device determines a number of accesses from the determined access origin within a predetermined time period. The determination device and determination device are set up so that they carry out their investigations on the basis of entries from the stored log or log file. The safety device 530 is therefore able to store the entries 523 to read and provide the determining means and determining means.

As above 5a The comparator then compares the detected number of accesses with a threshold to detect an undesirable number of accesses. If the determined number of accesses is greater than the threshold value, a blocking message is output by the output device. The safety device 530 this can be connected to the locking device 540 to output the lock message directly to the lock device. Alternatively or additionally, the safety device 530 the lock message also in a data store, such as database 525 , lay down. In this case, the locking device would 540 retrieve the lock messages stored there and process accordingly.

The storage of the log data in a log file thus takes place independently of the process of the actual data evaluation. Since the arrival of a request or query at the provisioning device whose arrival is logged, data is provided, which can be evaluated independently of the processing of the request or query. The evaluation of the log data can therefore start at a later date. Thus, a parallel processing of incoming requests or queries and the evaluation of accesses are possible.

The safety device 530 Edits the entries in the log file in the order of their arrival, that is, in ascending order of the timestamp. Alternatively, the safety device 530 perform the evaluation in a different order. For example, the security device could 530 first sort a certain number of entries by the address of the access origin.

Furthermore, the security device is set up for storing intermediate information which is generated during the evaluation or recognition of undesired accesses. This can be z. Example, the frequency of a particular address that occurs within a certain period. Another example of such evaluation data is indexes that can be created over the data stored in the log file.

Alternatively, the program logic 522 instead of the safety device 530 perform initial evaluations and resorting of the entries in the log file. For example, the program logic could 522 store a counter to each address of an access origin for predetermined periods of time. It can, for. For example, a counter may be set up for equal addresses, which is reset to zero each hour, while a second counter is set to zero every 24 hours. The safety device 530 then accesses this data directly and can therefore evaluate faster whether there are any unwanted accesses.

As described above, the providing device 520 consist of several server units. In this case, each server unit includes program logic 522 , Because the individual server units of the provisioning device 520 are used differently, can always the program logic 522 the least-busy server unit will write and / or initially edit the log or log file. When it comes to the provisioning components 521 In the case of a large number of incoming accesses, each individual access to the server unit that is least busy is usually diverted to accessing the server unit. This allows the fastest possible processing of all queries or queries.

The locking device 540 is the same as above 5a described, trained. It uses lock messages to block unwanted access or the monitoring device 510 configure accordingly so that unwanted access is blocked.

5c illustrates a further embodiment of the embodiment 5b how 5b this also includes a monitoring device 510 , a provisioning device 520 with a database 525 as well as a safety device 530 and a locking device 540 ,

The provisioning device 520 also has a data delivery component 521 , such as An application server or web server. Furthermore, it contains a program logic 522 that performs the same tasks as described above 5b has been described. Any in-depth access to the deployment facility 520 is through the program logic 522 logged and in a corresponding data store 550 stored.

In particular, when the provisioning device 520 consists of a variety of server units, the design is advantageous. Each access that is redirected to the individual server units by the provisioning device is determined by the appropriate program logic 522 the respective server unit logged and in the common data memory 550 stored. Thus arises in the data memory 550 a log of all inbound traffic while the logging workload is distributed to each server unit. As above under 5b described, z. B. the address of the access origin and the time of receipt of access are stored.

This embodiment of the invention further comprises an evaluation device 560 attached to the data store 550 is coupled. The evaluation device 560 is set up so that at certain times in the data store 550 evaluated stored data. For example, every hour on the hour, it can evaluate the entries with a timestamp that is within the last 60 minutes. Additionally or alternatively, one or more evaluations over a different period, such. 24 hours or a week.

Another evaluation option by the evaluation device 560 is performed, is the recognition of patterns. These may be temporal patterns under which requests from particular access origins are made. Alternatively or additionally, content patterns of the accesses can also be revealed. As above regarding 3 described, z. B. certain identifiers or other characteristics of accesses are determined and evaluated.

The evaluation device 560 also stores the results of these evaluations in the data store 550 , This allows the safety device 530 easy access to a central evaluation data memory. The safety device 530 can thus quickly and effectively determine if unwanted access to the delivery device 520 present or not. As explained above, in the presence of an unwanted access, a disabling message is issued by the disabling device 540 can be further processed.

The operation of the locking device 540 corresponds to the one above with respect to 5a and 5b described locking device 540 ,

In summary, devices are described for detecting automated accesses to information from an access origin based on their frequency and / or other characteristics, such as whether certain strings included in the request, and optionally blocking further accesses from that access origin ,

LIST OF REFERENCE NUMBERS

100

access origin

110

Access Network

120

Network server device

125

firewall

126

application server

127

data storage

128

firewall

129

data storage

130

safety device

140

locking device

200

criteria

210

output

220

Lock

230

Continue

240

output

300

Test step

310

Test step

330

Test step

340

Test step

345

Continue

350

comparison step

360

recording step

370

output step

380

comparison step

390

output

391

output

392

output

393

output

395

Continue

396

Issue lock message

397

Lock

398

Lift up blocking

Claims (17)

Contraption ( 120 ) for detecting unwanted access to information, the device comprising: a monitoring device ( 125 ) for monitoring access to information; a provisioning device ( 126 ) for providing the information, wherein the providing device is set up, a query of information by an access from an access origin ( 100 ) and to provide the requested information to the access origin, the provisioning means being located in an area protected by the monitoring device; and a safety device ( 130 ) for detecting unwanted accesses, wherein the security device is set up to start detecting unwanted accesses at a specific point in time after processing the request for information and after providing the information to the access origin ( 100 ) by the provisioning device ( 126 ), the safety device ( 130 ) comprises: a determination device for determining the access origin ( 100 ); determining means for determining the number of accesses from the determined access origin within a predetermined period of time; a comparing means for comparing the detected number of accesses with a threshold; and output means for outputting a disabling message if the detected number of accesses is greater than the threshold, the device comprising: a locking device ( 140 ) to edit the lock message and to block further access origin accesses ( 100 ) in the presence of a blocking message. Apparatus according to claim 1, wherein the locking device ( 140 ) with the monitoring device ( 125 ) and is set up, by means of the coupling, the monitoring device for blocking further access from the access origin ( 100 ). Apparatus according to claim 1 or 2, wherein the apparatus further comprises an evaluation device for assessing the utilization of the safety device, and wherein the safety device is adapted to select the specific time for starting the recognition of unwanted accesses depending on the evaluation of the utilization. Device according to one of claims 1 to 3, wherein the safety device ( 130 ) further comprises: a determination device for determining at least a second number of accesses from the access origin ( 100 ) within at least a second period, which is different from the first period; a comparing means for comparing the detected second number of accesses in the second period with at least a second access number threshold; an output device for outputting a blocking message when the second detected number of accesses is greater than the second accessing number threshold. Device according to one of claims 1 to 4, wherein the determining means is adapted to determine the access origin based on at least part of an address, in particular a network address and / or a MAC address. Device according to one of claims 1 to 5, wherein the safety device ( 130 ) further comprises: a determination device for determining at least one further number of accesses from the access origin ( 100 ) within at least one control period, which is different from the first period; a comparison device for comparing the determined further number of accesses in the control period with at least one predetermined control threshold; a memory means for storing at least a part of the determined address if the number of accesses is above a control threshold; comparing means for comparing this at least part of the address with a list of at least a part of at least one address; output means for outputting the at least a part of the determined address if the detected address is not included in the list. Apparatus according to claim 6, wherein the inhibiting means is arranged to inhibit further accesses when an output of the at least part of the determined address takes place. Apparatus according to claim 6 or 7, further comprising a list device, the list device being arranged to form the list by at least one entry from an address or a part of the address and to make an entry in the list when the accesses are from the address belonging to the address Access origin ( 100 ) exceed the control threshold during the control period. Device according to one of claims 6 to 8, wherein the control period is longer than the first period and / or the second period. Device according to one of the preceding claims, wherein the safety device ( 130 ) further comprising: analyzing means for analyzing access to an identifier, in particular a character string, output means for outputting a disabling message if the access has at least one specified identifier. Device according to one of the preceding claims, wherein the device further comprises: memory means for storing an action description, "lock" or "output" and / or at least one criterion, which leads to the output of a blocking message, wherein the at least one criterion, by the number of access and / or format and / or period and / or control period. Device according to one of the preceding claims, wherein the blocking device ( 140 ) is further configured to block accesses for a fixed time-out and to set the time-out in dependence on at least one criterion that leads to the blocking or the output of the blocking message. Apparatus according to any of claims 11 or 12, wherein the apparatus further comprises: a message device for creating a message with at least one of the stored criteria. The apparatus of claim 13, wherein the apparatus further comprises: a display device for displaying the created message, and / or a transmitting device for sending the created message, in particular an e-mail, to a predetermined address. Device according to one of Claims 13 or 14, in which the message contains the address of the access origin ( 100 ) and / or the criteria for blocking or issuing and / or the time of blocking or issuing and / or an unlocking time and / or a timeout. Apparatus according to any one of the preceding claims, wherein the apparatus further comprises: a reset means for manual reset of the lock and / or automatic reset of the lock after the expiry of the time-out and / or the unlock time. Contraption ( 120 ) for detecting unwanted access to information, the device comprising: a monitoring device ( 125 ) for monitoring access to information; a provisioning device ( 126 ) for providing the information, wherein the provisioning device is set up, a query of information by an access from an access origin ( 100 ) and to provide the requested information to the access origin, the provisioning means being located in an area protected by the monitoring device; a protocol device ( 522 ) for logging access of the access origin, wherein the logging means is arranged to store an entry for each access along with further information regarding the access in a first memory; and a safety device ( 130 ) for detecting unwanted accesses, wherein the security device is set up to read entries in the first memory and to detect unwanted accesses, wherein the security device ( 130 ) comprises: a determination device for determining the access origin ( 100 ) based on the read entries; determining means for determining the number of accesses from the determined access origin within a predetermined period based on the read entries; a comparing means for comparing the detected number of accesses with a threshold; and an output device for outputting a disabling message if the determined number of accesses is greater than the threshold, the device comprising: a disabling device ( 140 ) to edit the lock message and to block further access origin accesses ( 100 ) in the presence of a blocking message.

Images