JP2002118590A - System and method for controlling internet access - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system and method for controlling internet access which are capable of taking inhibiting measures against access with high accuracy in practical use. SOLUTION: The internet access control system 1 for controlling access to prescribed addresses on the Internet is provided with a permitted address table 15 for storing addresses which are permitted to be accessed, a prohibited address table 16 for storing addresses which are not permitted to be accessed, a use state table 14 for storing use states of undefined addresses which are not stored in storage means in the both tables 15 and 16, and an address type defining unit 13 for obtaining the use state of the undefined addresses to store them in the table 14 and storing the undefined addresses in the table 16 according to a reference previously prepared based on the use state stored in the table 14.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to access control to the Internet.

[0002]

2. Description of the Related Art Conventionally, access control to the Internet has been performed by the following two methods.

[0003] (1) An access permission list is created, and access is made only to previously permitted addresses.

[0004] (2) A list of addresses determined to be harmful to users or managers of a LAN (Local Area Network) is created, and the list is updated daily, and the addresses listed in this list are updated. Prohibit access to

[0005]

The method (1) has a problem that even if a new address to be accessed is obtained, the access cannot be made until the permission list is updated.
The method (2) has a problem that it is necessary to search for harmful addresses every day in order to create a list of prohibited addresses.

[0006] Therefore, an object of the present invention is to prevent access to addresses that are harmful to LAN users or managers.
An object of the present invention is to provide an Internet access control apparatus and method which can prevent access with a sufficient accuracy, but not practically enough.

[0007]

An Internet access control device according to the present invention (for example, the Internet access control device 1 in the present embodiment) is an Internet access control device for controlling access to a predetermined address on the Internet. And an authorized address storage means (for example, an authorized address table 15 in the present embodiment) for storing an address for which access is permitted, and a disallowed address storage means (for example, for storing an address to which access is not permitted). A non-permitted address table 16 according to the present embodiment, and a usage status storage unit (for example, a usage status storage unit that stores the usage status of an undefined address that is not stored in the storage units of both the permitted address storage unit and the unauthorized address storage unit) Usage in this embodiment 14) and the usage status of the undefined address is obtained and stored in the usage status storage means, and the undefined address is obtained according to a predetermined standard based on the usage status stored in the usage status storage means. Is stored in the unauthorized address storage means (for example, the address type definition device 13 in the present embodiment).

It is preferable that the address type definition means stores the undefined address in the unauthorized address storage means when the usage status stored in the usage status storage means is equal to or more than a predetermined value.

[0009] The address type defining means may include a predetermined number of upper undefined addresses among a plurality of undefined addresses ranked based on the usage status stored in the usage status storage means. The information may be stored in the permitted address storage means.

[0010] Preferably, in the above-mentioned use status storage means,
As information on the usage status, information on the usage time is stored.

[0011] The usage status storage means may store information on the size of the file as the information on the usage status.

It is desirable that the Internet access control device is connected to a gateway provided between the client and the Internet, and controls access to the Internet by providing the unauthorized address information to the gateway. .

[0013] The gateway may be provided with information for controlling access to the undefined address.

Further, an access log may be obtained from the gateway, and an undefined address may be obtained based on the obtained access log.

[0015] On the other hand, an Internet access control method according to the present invention is an Internet access control method for controlling access to a predetermined address on the Internet, comprising: a permission address storing step of storing a permission address permitted to access. A non-permitted address storing step of storing a non-permitted address to which access is not permitted, a use state storing step of storing a use state of an undefined address other than the permitted address and the non-permitted address, and a use of the undefined address The method includes a use information acquiring step of acquiring a situation, and a defining step of storing the undefined address as an unauthorized address in accordance with a predetermined criterion based on the stored use situation.

[0016] In the defining step, the undefined address may be stored as a non-permitted address when the use status is equal to or more than a predetermined value.

Further, in the defining step, a predetermined number of higher-ranked undefined addresses among the plurality of undefined addresses ranked according to the use status may be stored as the non-permitted addresses.

Further, it is desired that the use status storing step stores information on the use time as the information on the use status.

Further, the use status storage step may store information on the size of the file as the information on the use status.

Preferably, the method further comprises the step of providing the unauthorized address information to a gateway provided between the client and the Internet.

The method may further include providing information for controlling the gateway to permit access to the undefined address.

Further, the method may further include a step of acquiring an access log from the gateway and acquiring an undefined address based on the acquired access log.

On the other hand, a storage medium according to the present invention is a storage medium storing an Internet access control program for controlling access to a predetermined address on the Internet. A permission address storing step of storing a permitted address, a non-permitted address storing step of storing a non-permitted address to which access is not permitted, and a use state of an undefined address other than the permitted address and the non-permitted address. A use status storing step for storing; a use information obtaining step for obtaining a use status of the undefined address; and a definition for storing the undefined address as an unauthorized address according to a predetermined criterion based on the stored use status. Run the attachment step It is intended.

[0024]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS First, the present invention will be outlined.

In the present invention, Internet addresses, that is, URLs (Uniform Resource Locaters) are classified into the following three types (see FIG. 6). (1) Permitted address (2) Non-permitted address (3) Undefined address

The permitted address is always accessible even if it is a non-permitted address. Unauthorized addresses are not accessible. Undefined addresses are accessible.

As described above, by providing the type of undefined address, all addresses can be accessed in principle, that is, unless it is not permitted.
This allows free use of the Internet.

According to the present invention, the use of the Internet is permitted in principle, and the access is restricted later according to the actual use.

In the present invention, whether or not a certain Internet address is harmful is determined not from whether it is against public order and morals (for example, a pornographic site), but from the viewpoint of whether or not there is a problem with business. It is harmful if there is a significant hindrance to work, otherwise it is not harmful even for private use. This is because it is difficult to determine in advance whether or not each site on the Internet is useful for business purposes, and eliminating all uses of the Internet from the nature of the Internet is rather disadvantageous.

[0030] A task is significantly impaired when the line / server is occupied so much as to hinder other tasks, that is, when the occupancy of the line / server is extremely high. Therefore, the usage time for a certain URL (= the number of hits ×
Usage time) and / or from the URL (or
It is determined whether the packet data is harmful based on the amount of packet data (to L). For example, access to a music site where the amount of data to be downloaded is enormous corresponds.

As described above, it is desirable to determine whether the data is harmful based on the occupancy of the line / server from the viewpoint of actual labor and the privacy of the user. This is because there is no need to examine the contents of the URL.

Even when the occupancy of the line / server increases, there are times when access is required for business purposes. In such a case,
The URL is manually set in the permitted address table in advance or manually after being rejected. Since the permitted address table has priority over the disallowed address table,
The URL of the permitted address table is always accessible.

Next, the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the system according to the present invention. In the figure, 1 is the Internet
An access control device. 2 is the Internet, 3 is a gateway, 4 is a LAN, and 5 is a client.

The Internet access control device 1
Access log acquisition device 11, undefined address extraction device 1
2, address type definition device 13, usage status table 1
4, an authorized address table 15, an unauthorized address table 16, and a table editing device 17.

The access log acquisition device 11 acquires an access log from the gateway 3 at a predetermined interval and sends the access log to the undefined address extraction device 12. Undefined address extraction device 1
2 refers to both the permission address table 15 and the non-permission address table 16 and extracts an undefined address that is neither permission nor permission from the access log. The address type definition device 13 is an undefined address extraction device 12
And updates the usage table 14 in response to the usage status of the undefined address. Upon receiving an address type definition process start command from the outside, the address type definition device 13 determines whether the undefined address is not permitted or remains undefined. The address type definition process start command is a signal from a timer when performing the process periodically, and a signal from a keyboard or mouse when performing the process manually. The rejected address is sent to and stored in the rejected address table 16. The table editing device 17 has a function of editing the permitted address table 15 and the non-permitted address table 16.

FIG. 2 is a flowchart of the operation of the gateway 3 when a request to access the Internet is issued.

The gateway 3 receives L from the client 5
An Internet access request transmitted via the AN 4 is received (step S1). Gateway 3
Based on this access request, the requested URL is determined (step S2). It is determined whether the first requested URL is a permitted address (step S3). This determination is performed by the gateway 3 referring to the permitted address table 15 of the Internet access control device 1. If it is determined that the address is a permitted address, the access is permitted (step S6). The client
With this access permission, it becomes possible to access the requested URL.

On the other hand, if it is determined in step S3 that the gateway 3 is not a permitted address, it is further determined whether the gateway 3 is a non-permitted address (step S4).
This determination is performed by the gateway 3 referring to the unauthorized address table 16 of the Internet access control device 1. If it is determined that the address is not permitted, the access is rejected (step S7). The client is prohibited from accessing the requested URL by this access rejection.

On the other hand, if it is determined in step S4 that the gateway 3 is not a non-permitted address, the access is set as a use status monitoring target (step S4).
5). Then, access to the requested URL is permitted (step S6).

Next, step S in the flowchart of FIG.
The monitoring related to the access set as the monitoring target of the usage status will be described with reference to FIG. FIG. 3 is a flowchart of monitoring the access status by the gateway 3.

When the client 5 attempts to access a predetermined URL on the Internet via the LAN 4 (step S10), the gateway 3
It is determined whether or not is a monitoring target (step S11). If it is determined that the URL is not a monitoring target, monitoring is not performed (step S15). On the other hand, when it is determined that the URL is to be monitored, first, the usage time related to the URL is measured (step S12). Then, while connected to the URL, the size of the file transmitted to the URL and the size of the file received from the URL, that is, the amount of packet data, is measured (step S13). The usage time and the file size thus measured are accumulated and stored in a predetermined storage area for each URL (step S14).

Next, referring to FIG. 4, a description will be given of the process of creating the use status table and the address type definition process of the address type definition device 13.

First, the undefined address extracting device 12 of the Internet access control device 1 acquires an access log of an undefined address from the access log acquired by the access log acquiring device 11 (Step S20).
Then, the address type definition device 13 accumulates the total use time and the size of the file for each undefined address from the access log of the undefined address acquired by the undefined address extraction device 12 and stores them in the use status table 14. (Step S21).

Next, the undefined addresses are ranked by the total use time based on the use time data stored in the use state table 14 (step S22). Similarly, based on the data on the cumulative file stored in the usage table 14, the undefined addresses are ranked according to the size of the cumulative file (step S23). Then, the overall ranking is also performed based on both the total use time and the size of the cumulative file (step S24). Further, the address type definition device 13 sets an undefined address in the order specified in advance as a non-permitted address based on the information on the overall ranking performed in step S24 (step S25). Specifically, this undefined address is stored in the unauthorized address table 16.

Through such processing, access to some of the predetermined higher-level addresses for which the line / server occupancy is determined to be high is prohibited.

Here, a specific configuration of the permitted address table 15, the non-permitted address table 16, and the use status table 14 will be described.

FIG. 5A shows the permission address table 15.
3 shows an example of the contents of the unauthorized address table 16. Permitted address table 15 and disallowed address table 1
6 stores, for each URL, information on the URL and information on the address type indicating whether the access is permitted or prohibited. On the other hand, FIG. 5B shows an example of the contents of the usage status table 14.
The usage status table 14 includes information on URL,
Information on the total use time, information on the cumulative file size, and information on the use order are stored for each URL. In this example, a URL 13 with a total use time of 5 hours and a cumulative file size of 5 MB, and a URL 14 with a total use time of 2 hours and a cumulative file size of 10 MB
However, in both cases, the use order is first. Which algorithm is used to determine the use order can be set in advance. Therefore, even when the total use time and the accumulated file size are different as in this example, the same may be evaluated as the same.

Next, a description will be given, with reference to FIG. 7, of a use situation table creation process and an address type definition process of the address type definition device 13 according to another embodiment.

First, the undefined address extracting device 12 of the Internet access control device 1 acquires an access log of an undefined address from the access log acquired by the access log acquiring device 11 (Step S30).
Then, the address type definition device 13 accumulates the total use time and the size of the file for each undefined address from the access log of the undefined address acquired by the undefined address extraction device 12 and stores them in the use status table 14. (Step S31).

The address type definition device 13 specifies any one undefined address from the undefined addresses stored in the use status table 14 (step S32).
Further, the address type definition device 13 determines whether the total use time of the specified undefined address exceeds a predetermined value (step S33). here,
If it is determined that the total use time of the undefined address has exceeded a predetermined value, the undefined address is set as a non-permitted address (step S3).
5). Specifically, the address type definition device 13 stores the undefined address in the unauthorized address table 16.

If it is determined in step S33 that the total use time of the undefined address does not exceed the predetermined value, the size of the cumulative file for the undefined address is further changed to a predetermined value. It is determined whether or not it has exceeded (step S34). Here, when it is determined that the size of the cumulative file exceeds the predetermined value for the undefined address, the undefined address is set as the non-permitted address (step S).
35). Specifically, the address type definition device 13 stores the undefined address in the unauthorized address table 16.

If it is determined in step S34 that the size of the accumulated file does not exceed the predetermined value for the undefined address, the process for the address is terminated and the next arbitrary one Specify the definition address and perform the same processing.

According to the invention described in the embodiment of the present invention, access prohibition can be realized with sufficient accuracy in practice by selecting only addresses having an access history and prohibiting access. The frequency of updating the list may be several weeks to several months, and the man-hour required for daily operation can be minimized.

The above-described Internet access control device can also be realized by installing a predetermined program on a general-purpose computer. Various programs installed on the hard disk of the computer can be stored in a storage medium, and can be transmitted via a communication medium. Here, the storage medium includes, for example, a floppy (registered trademark).
Includes disks, hard disks, magnetic disks, magneto-optical disks, CD-ROMs, DVDs, ROM cartridges, RAM memory cartridges with battery backup, flash memory cartridges, nonvolatile RAM cartridges, and the like. The communication medium includes a wired communication medium such as a telephone line, a wireless communication medium such as a microwave line, and the like.
Internet is also included.

[0055]

According to the present invention, it is possible to provide an Internet access control apparatus and method capable of taking an access prohibition measure with sufficient accuracy for practical use.

[Brief description of the drawings]

FIG. 1 is a system block diagram according to the present invention.

FIG. 2 is a flowchart showing the operation of the gateway 3 when an Internet access request is issued.

FIG. 3 is a flowchart for monitoring an access status by a gateway.

FIG. 4 is a flowchart of a use status table creation process and an address type definition process of the address type definition device.

FIG. 5 is a diagram showing contents of an permitted address table 15, a non-permitted address table 16, and a use state table 14.

FIG. 6 is an explanatory diagram of an operation principle.

FIG. 7 is a flowchart of a usage status table creation process and an address type definition process of an address type definition device according to another embodiment.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 Internet access control device 2 Internet 3 Gateway 4 LAN 5 Client 11 Access log acquisition device 12 Undefined address extraction device 13 Address type definition device 14 Usage status table 15 Permitted address table 16 Non-permitted address table 17 Table editing device

Continued on front page F-term (reference) 5B085 AC01 BC00 5B089 GA11 GA31 GB02 HA10 KA17 KB06 KB13 KC28 KC37 KC54 5K030 HA08 HC01 HD09 JT06 KA01 KA04 LB02 LB03 LC13 LD20 MC08

Claims (20)

[Claims] 1. An Internet access control device for controlling access to a predetermined address on the Internet, comprising: an allowed address storage means for storing an address to which access is permitted; An authorized address storage unit, a usage status storage unit that stores a usage status of an undefined address that is not stored in both the storage unit of the authorized address storage unit and the unauthorized address storage unit, and a usage status of the undefined address. An address type definition for acquiring and storing the undefined address in the unauthorized address storage unit in accordance with a predetermined standard based on the usage status stored in the usage status storage unit, Internet access control device with means. 2. The method according to claim 1, wherein the address type defining unit stores the undefined address in the unauthorized address storage unit when the usage status stored in the usage status storage unit is equal to or more than a predetermined value. The internet access control device according to claim 1. 3. The method according to claim 1, wherein the address type defining unit determines a predetermined number of upper undefined addresses among the plurality of undefined addresses ranked based on the usage status stored in the usage status storage unit. 2. The Internet access control device according to claim 1, wherein the Internet access control device is stored in an unauthorized address storage unit. 4. The Internet access control device according to claim 1, wherein said usage status storage means stores information on usage time as information on usage status. 5. The Internet access control device according to claim 1, wherein the use status storage unit stores information regarding a size of a file as the information regarding the use status. 6. The Internet access control device is connected to a gateway provided between a client and the Internet, and controls access to the Internet by providing the unauthorized address information to the gateway. The internet access control device according to claim 1, 2, 3, 4, or 5. 7. The Internet access control device according to claim 6, wherein information for controlling the gateway to permit access to the undefined address is provided. 8. The Internet access control device according to claim 6, wherein an access log is obtained from the gateway, and an undefined address is obtained based on the obtained access log. 9. An Internet access control device for controlling access to a predetermined address on the Internet, comprising: an authorized address storage means for storing an address to which access is permitted; An allowed address storage unit, an address type definition device for extracting an undefined address that is not stored in both the allowed address storage unit and the unauthorized address storage unit, and a use unit that stores a use status of the undefined address A status storage unit; and an address type definition unit that stores the undefined address in the unauthorized address storage unit according to a predetermined standard based on the usage status stored in the usage status storage unit. , Authorized addresses, unauthorized addresses or Classified as one of the undefined addresses,
The undefined address is accessible, the permitted address is always accessible even if it is a non-permitted address, and the non-permitted address is not accessible. Internet access control device. 10. The apparatus according to claim 1, wherein
Usage time for RL (= number of hits x usage time) and / or
Or, based on the amount of packet data from or to the URL, it is determined whether or not access to the URL interferes with the use of another user. When the access is interrupted, the URL is stored in the unauthorized address storage. 10. The Internet access control device according to claim 9, wherein the Internet access control device is stored in a means. 11. A UR in said unauthorized address storage means.
10. The Internet access control device according to claim 9, further comprising editing means for copying or moving a part or all of L to said permitted address storage means. 12. An Internet access control method for controlling access to a predetermined address on the Internet, comprising: an authorized address storing step of storing an authorized address to which access is permitted; Storing a non-permitted address for storing; a usage status storing step for storing a usage status of an undefined address other than the permitted address and the non-permitted address; a usage information obtaining step for obtaining a usage status of the undefined address; And storing the undefined address as an unauthorized address in accordance with a predetermined criterion based on the usage status. 13. The Internet access control method according to claim 12, wherein the defining step stores the undefined address as an unauthorized address when the use status is equal to or more than a predetermined value. 14. The method according to claim 1, wherein the defining step stores a predetermined number of higher-order undefined addresses among the plurality of undefined addresses ranked based on the usage status as the non-permitted addresses. The Internet access control method according to claim 12. 15. The Internet according to claim 12, wherein said usage status storage step stores information on usage time as information on usage status.
Access control method. 16. The Internet access control method according to claim 12, wherein the use status storing step stores information about a size of a file as information about the use status. 17. The method according to claim 12, further comprising the step of providing said unauthorized address information to a gateway provided between a client and the Internet.
17. The Internet access control method according to 14, 15, or 16. 18. The Internet access control method according to claim 17, further comprising the step of providing information for controlling access to the undefined address to the gateway. 19. The Internet access control method according to claim 17, further comprising a step of acquiring an access log from the gateway, and acquiring an undefined address based on the acquired access log. 20. A storage medium storing an Internet access control program for controlling access to a predetermined address on the Internet, wherein the Internet access control program stores, in a computer, an authorized address to which access is permitted. An unauthorized address storing step, an unauthorized address storing step of storing an unauthorized address to which access is not permitted, and a use state storing step of storing a use state of an undefined address other than the authorized address and the unauthorized address; A storage medium for executing a use information obtaining step of obtaining a use state of the undefined address, and a definition step of storing the undefined address as a non-permitted address according to a predetermined criterion based on the stored use state.