JP2003085079A - Content filtering device in computer network, delivery method of filter pattern file, storage medium and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a device and a method that execute content filtering continuously based on the latest information without requiring troublesome operations of a user. SOLUTION: A filter pattern server comprises a filter pattern generating part for extracting a filter pattern for specifying contents from the contents selected from contents transacted in a network of computers, a storing part for storing the filter pattern, and a delivering part for delivering the filter pattern when a given condition is met. A content filtering device comprises a delivery requesting part for transmitting a delivery request for the filter pattern when the give condition is met, a receiving part for receiving the filter pattern, a storing part for storing the filter pattern, and a content filter part for selectively passing contents according to the filter pattern.

Description

Detailed Description of the Invention TECHNICAL FIELD OF THE INVENTION

The present invention relates to contents exchanged in a computer network such as the Internet,
That is, the present invention relates to a content filtering device that examines and evaluates the content of arbitrary information and selectively carries out predetermined processing.

[Prior art]

In a computer network including the Internet, contents (computer files including electronic mail or streaming data)
Is stored and sent in response to a request from a client computer, and a client computer that receives the sent content and reproduces it in a form usable by a user. A gateway server (including a firewall server or proxy server) is provided at the relay point between the server and the client computer.
There may be a relay device called.

On the Internet, since it is relatively easy for anyone to freely install a server, it is difficult to examine the content of the content stored in the server, and undesired content may be widely disclosed to the general public.

[0004] In addition, in the case of electronic mail, spam mail such as advertisement and undesired electronic mail from a third party may be sent without the consent of the recipient, which is a very annoying problem for the recipient. There is. In particular, spam mails in an e-mail system using a mobile phone often require communication charges when received, and have become a serious social problem.

On the other hand, conventionally, the following method called content filtering has been adopted. First, the first method is a method of collating the address of the delivery source and permitting access. In this case, the gateway server is installed at the relay point of the network, and the access-prohibited address is registered in the table provided in the storage device of the gateway server, so that the address of the content distribution source server and the address registered in the table are registered. There is a method of collating and determining the access permission. In this case, registration of the address in the table is often manually input for each gateway server. Further, instead of the gateway server, each client computer may be implemented by executing a computer program having a similar function.

As a second method, there is a method of examining the contents by using a keyword table. Instead of registering the above-mentioned address, a predetermined keyword is registered, full-text scanning of the content is performed, and the content is detected and filtered by pattern matching with the keyword.

[Problems to be Solved by the Invention]

Both the first method and the second method are
The registered contents of the address table and the keyword table, which are the criteria for filtering the contents, need to be set for each gateway server or client computer, and the setting work is very troublesome and the operation method is very difficult for an amateur. . In addition, it is troublesome to always keep the latest information.

It is an object of the present invention to solve the above problems and provide an apparatus and method for always carrying out content filtering based on the latest information without the user performing troublesome work.

[Means for Solving the Problems]

[0009] A filter pattern generation unit for extracting a filter pattern for specifying the content from the selected contents exchanged in the computer network, a storage unit for storing the filter pattern, and a predetermined condition. A filter pattern server comprising a delivery unit that delivers the filter pattern.

A distribution request unit for transmitting a distribution request of a filter pattern under a predetermined condition, a receiving unit for receiving the filter pattern, a storage unit for storing the filter pattern, and a content selectively based on the filter pattern. And a content filtering device that allows the content to pass through.

The above content filtering device, which includes a gateway function.

[0012] A content filtering device as described above, which includes a firewall function.

[0013] The content filtering device described above, which includes a proxy server function.

The content filtering apparatus described above, wherein the SMTP (SIMPLE MAIL TRANS) is used.
A content filtering device including a FER PROTOCOL server.

A step of calculating a pattern for specifying each individual content to be examined, a step of creating a filter pattern file containing the calculated pattern, a step of storing the filter pattern file in a filter pattern server, A method of delivering a filter pattern file, comprising the step of a computer at another point connected by a network obtaining the latest filter pattern file from the filter pattern server.

The method further comprises the steps of: registering the address of the distribution destination computer in advance in the database; and automatically distributing the filter pattern file to the distribution destination computer registered in the database at a predetermined timing. A method of delivering the filter pattern file, wherein:

In the computer, a step of calculating a pattern for identifying each individual content to be examined, a step of creating a filter pattern file containing the calculated pattern, and a step of storing the filter pattern file in a filter pattern server A storage medium storing a computer program for executing the step and a step of causing a computer at another point connected via a network to obtain the latest filter pattern file from the filter pattern server.

A computer for causing a computer to further execute a step of receiving a filter pattern file from the filter pattern server, and a step of selectively processing the content by matching the received filter pattern file with any content. The storage medium described above, which stores a program.

A content filtering device for selectively passing contents exchanged in a computer network, comprising a filter pattern file in which at least one pattern calculated from a given content by a predetermined procedure is recorded, and the filter. A filter pattern server connected to the Internet for storing a pattern file is provided, the filter pattern file is received from the filter pattern server, and the content is selectively processed by collating the received filter pattern file with any content. In the content filtering device, a semiconductor memory that stores the filter pattern file, a buffer memory that temporarily stores a part of the content, and a filter pattern are provided. Content filtering device, characterized in that to comprise a semiconductor integrated circuit including matching circuits, including matching the contents of the buffer memory.

In the computer, a step of calculating a pattern for identifying each individual content to be examined, a step of creating a filter pattern file containing the calculated pattern, and a step of storing the filter pattern file in a filter pattern server And a step of causing a computer at another point connected by a network to obtain the latest filter pattern file from the filter pattern server.

DETAILED DESCRIPTION OF THE INVENTION

Embodiment 1 of the invention. An unauthorized access prevention gateway device according to the first embodiment of the present invention will be described with reference to FIG. 2 is a flowchart (filter pattern server side) in the present embodiment, and FIG. 3 is a content filtering device side. The first network 101 is, for example, the Internet. The second network 102 is a corporate LAN (LOCAL AREA).
NETWORK) and mobile phone networks.

A storage device 202 is connected to the filter pattern server 201 connected to the first network. When an operator discovers a spam mail, it extracts the characteristics (keyword) and creates pattern data. Features include, for example, network addresses (email addresses, URLs, etc.) held by malicious business operators, sender addresses included in member solicitation emails, telephone numbers of sender businesses listed in the email body, and operation service names. Or a combination of them. CRC (CYCLIC
A REDUNDANCY CHECK) code, a checksum, or the like can also be used. What can be created by a predetermined procedure may be automatically created by a computer program instead of the operator. (Steps S1001 to S1002)

Similarly, pattern data extracted from a large number of spam mails are stacked to form a filter pattern file 203, which is stored in the storage device 202. (Step S1003)

The computer program 204 executed by the filter pattern server 201 detects, for example, the update of the filter pattern file 203 and registers the address of at least one content filtering device 301 registered in the registration list 205 in advance. The filter pattern 203 is acquired from the list 205 and distributed to each content filtering device 301. (Steps S1004 to 1007, S1101)

The operator of the filter pattern server 201 may charge the distribution destination according to the registration list 205. Further, the fee may be charged according to the number of times of distribution.

The content filtering device 301 is
In this embodiment, a network gateway device is installed at a relay point between the first computer network 101 and the second network 102. The computer program 304 running on this apparatus updates the filter pattern file 303 in its own storage device 302 with the filter pattern file 203 received by the above procedure. (Steps S2001 to S20
02)

The content filtering device 301 is
The network traffic exchanged between the first network and the second network is checked for its suitability by matching it with the filter pattern file 303. For example, the filter pattern file 303
A network address owned by an undesired vendor is registered in advance, and the malicious email is sent to an email sent from a server in the first network 101 to any of the computers 401 in the second network. An e-mail containing an address held by a certain company is detected and eliminated before it arrives at the destination computer 401. (Steps S2003 to S2006)

The content filtering device 301 is
When a filter pattern update notification is received from the filter pattern server or when a filter pattern file update is detected by a user operation, the latest filter pattern file is acquired from the filter pattern server again and saved in the storage device. Update the pattern file. (Step S2010)

Alternatively, when any of the computers 401 existing in the second network inadvertently tries to access the home page of an undesired trader, the gateway device 301 filters when relaying the access request from the computer 401. Pattern file 303
By collating the contents of the access request with the contents of the access request, it is possible to prevent inadvertent unauthorized access.

Embodiment 2 of the invention. FIG. 4 shows the second aspect of the present invention.
The apparatus for preventing spam mail (undesired e-mail) according to the embodiment of the present invention. Most are the same as those in FIG. 1, except that the content filtering device 301 is installed as an SMTP server.

The third party existing in the first network is
Mail server 5 using a third-party mail server 504
Attempts to send an email to a user who has a mailbox in 03. At this time, the mail server 504 uses the domain name server 502 to
3 is searched for, so the domain name server 502 is set to transfer the electronic mail addressed to the mail server 503 to the content filtering device 301. In this case, the electronic mail from the third party is once delivered to the content filtering device 301, so that the computer program 304 having the SMTP server function and the filtering function can match the filter pattern file 303 and judge that it is spam mail. E-mail is discarded, and if it is judged as legitimate e-mail, mail server 5
03. Only the filtered electronic mail is received by the client computer 501 that is the recipient of the electronic mail.

Third Embodiment of the Invention An electronic mail transfer device according to a third embodiment of the present invention will be described with reference to FIG. When the user of the client computer 501 connected to the first network has the mail servers 503 and 505 holding the mailboxes, the user discloses the mail address of the mail server 505 and the content filtering device 301 receives the mail server 505. Set to forward emails that you send. The content filtering device 301 filters the content using the filter pattern file and then transfers the content to the mail server 503. The user can receive the e-mail having passed the content filter by extracting the e-mail from the mailbox of the mail server 503 using the client computer 501. To do this, the mail server 505 that is the transfer source
The content filtering device 301 is characterized in that the content filtering device 301 is provided with an array in which the e-mail address registered in the e. The array may exist in a computer at another location accessible from the content filtering device 301 via the network.

The content filtering device 301 is
It may also serve as a proxy server. In this case, the protocols supported by the proxy server are SMTP, POP,
IMAP, HTTP, FTP, etc. can be considered.

The following is common to all the embodiments. In the filter pattern server, for example, a third party organization such as a “content filtering center” may collectively collect and register information from around the world and update the filter pattern file. When the user receives an undesired mail or the like, the user transfers the mail to the content filtering center to request the update of the filter pattern file. In this way, the filter pattern file is updated at any time and distributed to content filtering devices around the world.

As an example, the filter pattern server is
The pattern file is delivered at the following timing. (1) When the filter pattern is updated. (2) Delivered regularly by a timer. (3) When a new delivery destination is registered. (4) When a distribution request is received from the distribution destination. (5) When there is a distribution operation by the operator.

Further, a plurality of filter pattern files may be prepared for each filter genre, and only the necessary genres may be distributed in response to the request of the distribution destination. For example,
When the content filtering device at the delivery destination requests a filter pattern file of the genre “product sales”, the telephone number of the dealer who performs the product sales and the UR
Only the "product sales filter pattern file" in which L, mail address, business name, etc. are registered is delivered.
All filter pattern files are distributed to the distribution destinations that requested “all genres”. The content filtering device that has received this file may determine that one of the information items that matches one or more keywords at the same time is a spam mail.

In the content filtering device, it is preferable that the presence or absence of filtering or the type of filter to be used can be designated for each user (content user). For example, an array 601 as shown in FIG. 6 is prepared on a storage device so that which filter pattern is to be applied can be designated for each user. LDAP (L
IGHTWEIGHT DIRECTORY ACCESS
S PROTOCOL) server or the like may be used.

Further, it is preferable that the user can select the filter to be set by the input device while confirming the type of filter currently set on the display device.
FIG. 7 shows an example thereof. 621 indicates the user identification I
D is displayed, and 622 is a check box as to whether or not to perform filtering, and it is inverted every time the button is pressed. There are multiple 623, and if there is a filter being applied, it is displayed. Reference numeral 624 denotes a button for selecting a filter to be applied, and when pressed, the filter can be selected from a dropdown list.

On the contrary, if the system is such that the filter cannot be changed without going through a predetermined procedure such as submitting documents, and only the user who has gone through the predetermined procedure can change the filter, for example, in a household with a minor. Application to an internet gateway device is possible.

The content filtering device is installed in, for example, a gateway portion connecting a mobile phone network and the Internet, or a LAN of an educational institution or a company.
It is possible to eliminate the unwanted information by using the filter pattern file that immediately reflects the unwanted information collected from all over the world by installing it in the gateway part connecting the Internet with the internet.

When any one of the users receives an undesired electronic mail, the information can be shared with another person's content filtering device only by immediately registering the information in the filter pattern server.

Since the filter pattern file can be updated based on the information collected from a large number of users, it is possible to efficiently collect undesirable information as compared with the conventional method in which each individual sets the filtering condition separately. .

【The invention's effect】

Since the list of addresses of undesired vendors and information can be collectively managed by one or more filter pattern servers, the latest filtering information can be provided to many users. As a result, it is possible to save the user the trouble of collecting the latest information each time and confirming whether or not the access is not undesirable each time.

[Brief description of drawings]

FIG. 1 is a schematic diagram showing a configuration of a first embodiment according to the present invention.

FIG. 2 is a flowchart (filter pattern server side) in the first embodiment according to the present invention.

FIG. 3 is a flowchart (on the side of a content filtering device) according to the first embodiment of the present invention.

FIG. 4 is a schematic diagram showing a configuration of a second exemplary embodiment according to the present invention.

FIG. 5 is a schematic diagram showing a configuration of a third exemplary embodiment of the present invention.

FIG. 6 is a schematic diagram of an array that defines a filter for each user.

FIG. 7 is a display example on a display device for a user to confirm or set a filter.

[Explanation of symbols]

101 First Network 102 Second Network 201 Filter Pattern Server 202 Storage Device 203 Filter Pattern File 204 Computer Program 205 Content Filtering Device Address Registration List 301 Content Filtering Device 302 Storage Device 303 Filter Pattern File 304 Computer Program 401 Computer 501 Client Computer 502 Domain name server 503 Mail server 504 Third party mail server 505 Mail server 601 Filter definition array 621 Display column for user ID 622 Select whether to use filter Check box 623 Display applied filter Field 624 Button to select the filter to apply

Claims (12)

[Claims] 1. A filter pattern generation unit that extracts a filter pattern for specifying the content from selected contents exchanged in a computer network, a storage unit that stores the filter pattern, and a predetermined unit. A filter pattern server comprising: a delivery unit that delivers the filter pattern when a condition is met. 2. A distribution request unit that transmits a distribution request of a filter pattern under a predetermined condition, a reception unit that receives the filter pattern, a storage unit that stores the filter pattern, and a content based on the filter pattern. A content filtering device comprising: a content filter section that selectively passes the content. 3. The content filtering device according to claim 2, wherein the content filtering device includes a gateway function. 4. The content filtering device according to claim 2, wherein the content filtering device includes a firewall function. 5. The content filtering device according to claim 2, wherein the content filtering device includes a proxy server function. 6. The content filtering device according to claim 2, wherein the SMTP (SIMPLE MAIL) is used.
A TRANSFER PROTOCOL) server,
Content filtering device. 7. A step of calculating a pattern (keyword) for specifying each content to be examined, a step of creating a filter pattern file including the calculated pattern, and the filter pattern file to a filter pattern server. A method of delivering a filter pattern file, comprising the steps of storing and a step of causing a computer at another point connected by a network to obtain the latest filter pattern file from the filter pattern server. 8. A step of previously registering an address of a distribution destination computer in a database, and a step of automatically distributing the filter pattern file to a distribution destination computer registered in the database at a predetermined timing. The method of delivering a filter pattern file according to claim 7, characterized in that the method comprises: 9. A computer, a step of calculating a pattern for identifying each individual content to be examined, a step of creating a filter pattern file including the calculated pattern, and the filter pattern file to a filter pattern server. A storage medium storing a computer program for executing a step of storing and a step of causing a computer at another point connected by a network to obtain the latest filter pattern file from the filter pattern server. 10. The computer further comprises: a step of receiving a filter pattern file from the filter pattern server, and a step of selectively processing the content by matching the received filter pattern file with the arbitrary content. The storage medium according to claim 9, wherein the computer program is stored. 11. A content filtering device for selectively passing contents exchanged in a computer network, wherein at least one pattern calculated from a given content by a predetermined procedure is used.
One or more recorded filter pattern files and an Internet-connected filter pattern server for storing the filter pattern files, receiving the filter pattern files from the filter pattern server, and receiving the received filter pattern files and arbitrary contents In a content filtering device for selectively processing content by collating with each other, a semiconductor memory for storing the filter pattern file, a buffer memory for temporarily storing a part of the content, a filter pattern and a buffer memory A content filtering device comprising a semiconductor integrated circuit configured to include a matching circuit for matching the contents of the above. 12. A computer, a step of calculating a pattern for specifying each individual content to be examined, a step of creating a filter pattern file including the calculated pattern, and storing the filter pattern file in a filter pattern server. And a step of causing a computer at another point connected by a network to obtain the latest filter pattern file from the filter pattern server.