JP2004118791A - Patrol system and patrol method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To specify electronic equipment by which a sophisticator has performed falsification. <P>SOLUTION: A current home page 21, current check information of signature information in the current home page 21 are stored in an electronic information storage part 24. An update log 32 including identification information for a computer 1 of a home page preparing person preparing/updating the home page 21 is stored in an update log storage part 25. This patrol system 4 stores a patrolled patrol log 23 in a patrol log storage part 38. The patrol system 4 patrols the presence of falsification in the current home page 21, and specifies an sophisticator's computer 7 based on the update log 32 stored in the update log storage part 25, and based on patrol log 23 stored in the update log storage part 25, when deciding the presence of the falsification. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an apparatus and a method for monitoring unauthorized alteration of electronic information existing on a network.
[0002]
[Prior art]
In recent years, with the spread of the Internet, online sales via a homepage and online publicity of local governments have become more and more active. The homepage is an important component of the important social infrastructure of the 21st century. In other words, the electronic service function for the residents of the government and local governments called the e-government, the electronic medical records and electronic transcripts that serve as the basis for services and joint work of hospitals and schools, and the advertising and distribution departments of all companies are revolutionized. The homepage connected to the Internet, such as the new e-commerce, is the basis.
However, homepage falsification occurs at a rate of one or more times a day on Japanese sites, and is becoming one of the major bottlenecks in the realization of the 21st century information society, which has been called e-japan. On the negative side, falsification of the homepage could be a means of cyber terrorism.
As described above, a homepage having important information for the information society is located in a server of a site that manages a group of homepages called a Web server. This homepage is not only viewable via the Internet, but also allows the creator to update via the same Internet. By taking advantage of this point, there is a danger of unauthorized tampering by a person impersonating the legitimate creator of the homepage. That is, since the person who intends to falsify has previously obtained the authentication code (password) of the creator of the homepage illegally by another means, impersonates the creator and overcomes the firewall server authentication check of the Web server to obtain the homepage. Perform an update.
Japanese Patent Application Laid-Open No. 2001-202288 “Electronic information patrol apparatus and electronic information tampering patrol method” constantly inspects a group of homepages in a Web server without changing existing software in the Web server and checks for tampering. System (see Patent Document 1).
FIG. 8 is a diagram showing the electronic information patrol device disclosed in JP-A-2001-202288 included in the server 200.
The patrol unit 320 of the server 200 creates a collation digest of the current digest obtained by processing the current check information extracted from the current homepage in which the current check information is embedded by the decoding unit 250 and the current homepage after separating the current check information from the current digest. The collation digest created by the processing in the unit 270 is periodically compared, and if they are not the same, the fact that the current homepage has been tampered is notified to the electronic information creator computer 100 that created the current homepage. In addition, the access blocking unit 300 prevents a third party client computer 400 from accessing the current home page.
According to the electronic information patrol device, if there is tampering, it is possible to detect the tampering and notify the legitimate creator of the homepage, close the homepage, or switch to another predetermined content.
[0003]
[Patent Document 1]
JP 2001-202288 A (pages 9-16, FIG. 2)
[0004]
[Problems to be solved by the invention]
However, with this method, the presence or absence of tampering can be inspected, but who has tampered with has not been pursued. Therefore, the effect of suppressing tampering in advance for those who attempt tampering is not sufficient.
[0005]
SUMMARY OF THE INVENTION It is an object of the present invention to capture and identify a falsified electronic device.
[0006]
[Means for Solving the Problems]
A patrol device of the present invention, an electronic information storage unit that stores electronic information and signature information for checking whether the electronic information is authentic,
An update log storage unit that stores an update log including identification information of the electronic device that has created and updated the electronic information stored in the electronic information storage unit,
A patrol unit that patrols whether the electronic information has been tampered with using the signature information,
A patrol log storage unit that stores a patrol log that the patrol unit patrols,
When determining that the electronic information has been tampered with, the patrol unit determines the falsification of the tampered person who has tampered with the electronic information from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. It has a capturing unit for specifying an electronic device.
[0007]
Further, the capturing unit specifies the electronic device of the falsifier from the patrol log of the patrol determined to have been tampered with and the patrol log of the latest patrol determined to be tampered.
[0008]
The patrol log storage unit stores the inspection time, which is the time of patrol, in the patrol log,
The update log storage unit stores an update time, which is a time at which the electronic information is stored in the electronic information storage unit, in an update log,
The update unit stores, from the update log storage unit, an update log having, as an update time, a time existing between the inspection time of the patrol determined to be falsified and the inspection time of the latest patrol determined to be falsified. The electronic device of the falsifier is specified based on the identification information of the electronic device included in the selected update log.
[0009]
The electronic information storage unit stores a plurality of electronic information and signature information,
The patrol unit patrols the electronic information,
The patrol log storage unit stores the inspection time for each of the electronic information,
The update log storage unit stores the update time and the identification information of the electronic device, and the capturing unit determines, for each piece of the electronic information, the inspection time of the patrol that has been determined to have been tampered with and the latest determined that there has been no tampering. An update log having a time existing between the inspection time of the patrol and the update time is selected from the update log storage unit, and the electronic device of the falsifier is identified from the identification information of the electronic device included in the selected update time. I do.
[0010]
The patrol device of the present invention further comprises:
A browsing log storage unit that stores a browsing log including identification information of the electronic device that browsed the electronic information stored in the electronic information storage unit,
The capturing unit identifies the electronic device of the falsifier by using the browsing log stored in the browsing storage unit.
[0011]
A patrol system of the present invention, an electronic information storage unit that stores electronic information and signature information for checking whether the electronic information is authentic,
A server having an update log storage unit that stores an update log including identification information of an electronic device that has created and updated the electronic information stored in the electronic information storage unit,
A patrol unit that patrols whether the electronic information has been tampered with using the signature information,
A patrol device having a patrol log storage unit that stores a patrol log that the patrol unit patrols,
When determining that the electronic information has been tampered with, the patrol unit determines the falsification of the tampered person who has tampered with the electronic information from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. It has a capturing unit for specifying an electronic device.
[0012]
Further, the patrol system is characterized in that access from the patrol device to the server is permitted, and access from the server to the patrol device is not permitted.
[0013]
The patrol method of the present invention stores electronic information and signature information for checking whether the electronic information is authentic in an electronic information storage unit,
An update log including the identification information of the electronic device that created and updated the electronic information stored in the electronic information storage unit is stored in the update log storage unit,
Using the signature information stored in the electronic information storage unit, patrol whether the electronic information stored in the electronic information storage unit has been tampered with,
The patrol log that has been patroled is stored in the patrol log storage unit,
When the patrol determines that the electronic information stored in the electronic information storage unit has been tampered with, the electronic information is obtained from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. The electronic device of the falsified person (= illegal update without author signature) is specified.
[0014]
The patrol program of the present invention is a process of storing electronic information and signature information for checking whether the electronic information is authentic in an electronic information storage unit;
A process of storing, in the update log storage unit, an update log including identification information of the electronic device that created the electronic information stored in the electronic information storage unit;
A process of patroling whether the electronic information stored in the electronic information storage unit has been tampered with, using the signature information stored in the electronic information storage unit;
A process of storing the patrolled patrol log in the patrol log storage unit;
When the patrol determines that the electronic information stored in the electronic information storage unit has been tampered with, the electronic information is obtained from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. And causing the computer to execute a process of identifying the electronic device of the falsified person.
[0015]
A computer-readable recording medium on which the patrol program of the present invention is recorded, a process of storing electronic information and signature information for checking whether the electronic information is genuine in an electronic information storage unit,
A process of storing, in the update log storage unit, an update log including identification information of the electronic device that created the electronic information stored in the electronic information storage unit;
A process of patroling whether the electronic information stored in the electronic information storage unit has been tampered with, using the signature information stored in the electronic information storage unit;
A process of storing the patrolled patrol log in the patrol log storage unit;
When the patrol determines that the electronic information stored in the electronic information storage unit has been tampered with, the electronic information is obtained from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. And causing the computer to execute a process of identifying the electronic device of the falsified person.
[0016]
A patrol device of the present invention, an electronic information storage unit that stores electronic information and signature information for checking whether the electronic information is authentic,
A patrol unit that patrols the presence or absence of falsification of the electronic information,
The patrol part,
A collation information creating unit that creates collation information from the electronic information stored in the electronic information storage unit,
At the first patrol, the signature information stored in the electronic information storage unit is decrypted using the public key of the creator of the electronic information, and the decrypted signature information is compared with the verification information. At the time of patrols other than the above, the decrypted signature information used at the time of the previous patrol is compared with the above-mentioned verification information, and if the comparison results in a mismatch, the information is further stored in the electronic information storage unit. A comparison unit that decrypts the signature information using the public key of the creator of the electronic information and compares the decrypted signature information with the current verification information;
[0017]
The patrol method of the present invention stores electronic information and signature information for checking whether the electronic information is genuine,
Patrols the presence or absence of falsification of the electronic information,
The patrol above is
Create collation information from the stored electronic information,
At the first patrol, the stored signature information is decrypted using the public key of the creator of the electronic information, the decrypted signature information is compared with the verification information, and at the time of patrol other than the first patrol, The decrypted signature information used during the previous patrol is compared with the current verification information. If the comparison results in a mismatch, the stored signature information is further converted to the public key of the creator of the electronic information. A patrol method that decrypts the signature information and compares the decrypted signature information with the current verification information.
[0018]
FIG. 1 is a diagram showing an example of a hardware configuration of a patrol device according to the present invention.
In the figure, a CPU 122 is an arithmetic processing unit that performs calculations, and a flexible disk 115, a fixed disk 116, a ROM 119, and a RAM 118 are storage media that store electronic information and a control program that performs patrol. The keyboard 113 and the mouse 114 are input units for performing initial settings such as, for example, how long a patrol is performed. The CRT 111 displays, for example, when the electronic information is tampered with as a result of the patrol, who is the falsified person, and the printer 117 outputs, for example, the patrol result. When patrol of electronic information is performed, the timer 123 is for measuring, for example, a patrol start time. The communication board 121 is for connecting computers to each other via a network.
[0019]
The individual components described above are connected by a bus 112. With the above configuration, the patrol apparatus according to the present invention takes in the inspection applicable information in the information of the homepage uploaded from the homepage creator computer 1 to the Web server 2 in FIG. In addition, a control program for performing patrol of electronic information falsification is stored in the fixed disk 116, and the patrol for falsification is realized by operating the control program using the CPU 122.
[0020]
BEST MODE FOR CARRYING OUT THE INVENTION
In the following description and drawings, (XX) indicates unencrypted electronic information, and [XX] indicates encrypted electronic information. That is, (XX) indicates electronic information having no falsification resistance, and [XX] means electronic information having falsification resistance.
[0021]
Embodiment 1 FIG.
Hereinafter, Embodiment 1 will be described.
FIG. 2 is a configuration diagram of a home page falsified person capturing system.
First, each component of the present system will be described.
The homepage creator computer 1 is a computer that creates / updates a homepage. The homepage creator computer 1 may be a portable information terminal, a mobile phone, or the like. That is, the homepage creator computer 1 is an example of an electronic device that creates electronic information such as a homepage. These electronic devices have identification information for identifying each, such as, for example, an IP (INTERNET PROTOCOL) address and a telephone number.
The Web server 2 is an example of a server that stores and manages homepages transmitted from a plurality of homepage creator computers 1 and information for checking whether or not the homepages are authentic. The Web server 2 can be connected via the Internet 6 to a homepage creator computer 1, a browsing computer 3 for browsing the homepage, and a falsification computer 7 for falsifying the homepage.
The patrol device 4 is a device that monitors unauthorized alteration of a homepage stored in the Web server 2, and periodically patrols the homepage for tampering. The patrol device 4 includes, for example, hardware such as a CPU 122 which is an arithmetic processing unit shown in FIG. 1 and a RAM 118 for temporarily storing a calculation result and software such as a patrol program.
Although only one homepage creator computer is shown as one, a plurality (many) exist in a normal operation mode. These are registered in the Web server 2 in advance, and each has a unique authentication code (password).
Although only one browsing computer is illustrated as three, an unspecified number of computers connected to the Internet correspond to the normal operation mode.
Although the tampering computer is shown as 7, it is originally one of the browsing computer 3. However, a specific computer having the intention of tampering is shown as a tampered computer 7.
The home page is configured so that it can be viewed not only by the viewer computer 3 via the Internet 6 but also updated by the home page creator computer 1 via the same Internet 6. Taking advantage of this point, there is a risk that the homepage is falsified by the falsifier computer 7. That is, the tampering computer 7 intended to be tampered illegally obtains the authentication code (password) of the homepage creator computer 1 by another means in advance, and uses the obtained authentication code to impersonate the homepage creator computer 1. The homepage created by the homepage creator computer 1 is updated by overcoming the authentication check of the Web server 2. Thus, there is a possibility that the homepage is falsified.
[0022]
The internal configuration and operation of the homepage creator computer 1 will be described. The homepage creator computer 1 includes a homepage creation unit 11 for creating an original homepage (OH) and a signature unit 12 for creating an original digest (OD) obtained by hash-compressing the original homepage (OH).
The homepage creator computer 1 also includes an encryption unit 14 that creates original check information [OC] obtained by encrypting the original digest (OD) with the secret key of the homepage creator. Here, the original check information [OC] refers to information from which a home page, which is electronic information, is checked for falsification, and is information relating to the contents when the original home page was created. Also, the homepage creator computer 1 sends the original homepage (OH) to which the original check information [OC] is attached to the attachment section 15 for attaching the original check information [OC] to the original homepage (OH) to the Web server 2. A homepage creator communication unit 16 is provided. The homepage creator communication unit 16 uploads the original homepage (OH) to which the original check information [OC] is attached to the Web server 2 according to FTP (FILE TRANSFER PROTOCOL: file transfer protocol).
The original check [OC] information is always attached to the original homepage (OH) in a certain format standard. The original check information [OC] is signature information and indicates the authenticity of the homepage.
[0023]
Next, the internal configuration and operation of the Web server 2 will be described.
The Web server 2 includes an update reception unit 31 that receives an update of the homepage, an update log storage unit 25 that stores the IP address of the homepage creator computer 1 that has uploaded the content of the homepage and an update time as an update log 32, and a browsing of the homepage. A browsing accepting unit 30 that accepts, a browsing log storage unit 27 that stores, as a browsing log 33, an IP address of the browsing computer 3 that has requested browsing, and an electronic information storage unit that stores a plurality of current homepages 21 (homepage groups). 24, a public key certificate storage unit 700 for storing the public key certificate 600. The homepage is updated based on the homepage information uploaded from the homepage creator computer 1 based on the FTP protocol. The browsing of the home page is executed when there is a browsing request from the browsing computer 3 based on HTTP (HYPERTEXT TRANSPORT PROTOCOL).
[0024]
The update receiving unit 31 receives the original homepage (OH) to which the original check information [OC] is attached from the homepage creator computer 1 based on the FTP protocol.
The electronic information storage unit 24 stores the original homepage (OH) transmitted from the homepage creator computer 1 and attached with the original check information [OC] as it is. The homepage uploaded and stored in this manner is called a current home page (CH). Check information included in the current homepage is referred to as current check information [CC].
[0025]
The information on the public key of the homepage creator computer 1 is uploaded to the Web server 2 as initial setting information when the homepage creator computer 1 newly registers in the system of the present embodiment and updates the public key. . This initial setting information is encrypted with the secret key of the certificate authority, and the authenticity is maintained. This is called a public key certificate 600. The Web server 2 stores the public key certificate 600 in the public key certificate storage unit 700.
[0026]
The current homepage (CH) and the current check information [CC] are information that is provided to an unspecified large number of users on the Web server 2 and may be falsified. The original homepage (OH) created and transmitted by the creator on the homepage creator computer 1 and the original check information [OC] are used separately.
[0027]
The update log storage unit 25 uses the IP address of the homepage creator computer 1 that created the original homepage (OH) and the update time at which the original homepage (OH) was stored in the electronic information storage unit 24 as an update log 32. Record.
FIG. 3 shows an example of the update log 32 recorded by the update log storage unit 25. The update log storage unit 25 records the IP address 13 and the update time 17 of the homepage creator computer 1 that has performed the update.
Depending on the FTP program, the Web server 2 may acquire the host name of the homepage creator computer 1 as information of the update log 32 instead of the IP address of the homepage creator computer 1 requesting the update. In this case, the update log storage unit 25 may record the host name. In that case, the IP address can be acquired from the host name of the homepage creator computer 1 by using a DNS (DOMAIN NAME SYSTEM) table or a DNS server as necessary.
The IP address 13 is an example of identification information that identifies the homepage creator computer 1, and the update log storage unit 25 may store other identification information that can identify the homepage creator computer 1.
[0028]
In this way, the Web server 2 can update all the homepage creator computers that upload data based on the FTP protocol to update the contents of all the current homepages stored in the electronic information storage unit 24. 1 is stored in the update log storage unit 25.
[0029]
According to the above operation, the IP address 13 stored in the update log storage unit 25 usually indicates the IP address of a terminal (homepage creator computer 1) in which a legitimate homepage creator updates the contents of the homepage. However, a different IP address may be mixed in the IP address 13 stored in the update log storage unit 25. In this case, two states are possible. One is that a falsifier impersonating a legitimate homepage creator uses any method such as illegally obtaining an ID (IDENTIFICATION) number in the IP address 13 stored in the update log storage unit 25. This is a case where the IP addresses of the terminals are mixed. The other is a case where a legitimate homepage creator updates a homepage from a terminal different from usual, and in this case, an IP address of a terminal different from usual is mixed.
[0030]
The browsing accepting unit 30 accepts a browsing request when there is a browsing request from the browsing computer 3 based on the HTTP protocol. In this way, the browsing computer 3 that has received the browsing request can browse the current homepage 21 stored in the electronic information storage unit 24.
The browsing log storage unit 27 stores the IP address of the browsing computer 3 and the browsing time as the browsing log 33. As a storage method, a method similar to the above-described method in which the update log storage unit 25 stores the update log 32 can be used.
Note that the IP address of the viewer computer 3 is an example of identification information for identifying the viewer computer 3, and the browse log storage unit 27 may store other identification information that can identify the viewer computer 3.
[0031]
Next, the patrol device 4 will be described.
The patrol device 4 is a patrol unit 22 for sequentially checking whether a falsified homepage exists in the current homepage (CH) stored in the electronic information storage unit 24. The patrol unit 22 checks the inspection time when the patrol unit 22 patrols the inspection result. A patrol log storage unit 38 that stores the inspection result flag and the inspection result flag as a patrol log 23, a communication unit 35 that communicates with the Web server 2 via the intranet 5, and a public key storage unit 34 that stores a public key 36. The communication unit 35 includes, for example, the communication board 121 illustrated in FIG.
The patrol apparatus 4 constantly patrols a plurality of current homepages (CHs) stored in the electronic information storage unit 24 of the Web server 2 at regular intervals, sequentially inspects and patrols whether the homepages have been tampered with.
In this system, in order to secure the security of the patrol device 4 itself, the communication path between the Web server 2 and the patrol device 4 via the intranet 5 is only one-way communication from the patrol device 4 to the Web server 2. Is set to enable. Accordingly, transmission of information, reading of a file, and the like from the patrol device 4 to the Web server 2 are enabled, but communication in the reverse direction is disabled. That is, the patrol device 4 can access the Web server 2 and obtain data, etc., but on the other hand, the Web server 2 independently accesses the patrol device 4 to transmit or obtain data. Etc. cannot be performed. Thereby, the danger that the patrol device 4 is invaded from the outside can be eliminated.
[0032]
Next, the internal configuration and operation of the patrol unit 22 in the patrol device 4 will be described.
As shown in FIG. 4, the patrol unit 22 includes a patrol start unit 43, a current check information separation unit 44, a decryption unit 45, a collation information creation unit 47, a comparison unit 48, a notification unit 49, an access blocking unit 50, and a capture unit 46. It has.
[0033]
The patrol start unit 43 starts a patrol program for checking whether the current homepage (CH) stored in the electronic information storage unit 24 has been tampered with. The patrol start unit 43 automatically starts the patrol program when a predetermined time has elapsed by the timer 120 shown in FIG. Alternatively, a method of automatically starting the next patrol as soon as one patrol is completed may be adopted.
[0034]
The current check information separation unit 44 separates the current check information [CC], which is the signature information attached to the current homepage (CH), from the current homepage (CH).
Since the separated current check information [CC] is encrypted, the decryption unit 45 decrypts the current check information [CC] using the public key 36 stored in the public key storage unit 34. The current check information after decryption is called a current digest (CD). The current digest (CD) has a role as collation information.
Here, it is desirable that the time for decoding calculation of the current check information [CC] in the decoding unit 45 be short. Therefore, from the viewpoint of shortening the decryption calculation time, it is desirable to use an asymmetric one in which the decryption time is shorter than the time for encrypting the original digest (OD).
[0035]
The patrol device 4 acquires the public key certificates 600 of all the creators registered in the public key certificate storage unit 700 of the Web server 2 at the time of initial environment setting, and decrypts them using the public key of the certificate authority. To obtain the genuine public keys 36 of all the creators. Then, these are stored in the public key storage unit 34. This operation is the same as the operation of changing the initial setting even when the home page creator computer 1 updates the public key itself once every several years.
[0036]
Next, the collation information creation unit 47 that creates a collation digest that is one of the collation information performs hash compression on the data of the current homepage (CH) itself stored in the electronic information storage unit 24, and converts the collation digest (RD). create. The collation digest (RD) is used to collate with the current digest (CD) decrypted from the current check information [CC].
The hash compression performed by the collation information creation unit 47 has the same algorithm as the hash compression performed when the homepage creator computer 1 creates the original digest (OD). This algorithm is assumed to be standardized in advance, for example. Note that the original digest (OD) refers to a digest created by the homepage creator computer 1.
[0037]
Next, the comparing unit 48 compares whether the current digest (CD) decrypted by the decrypting unit 45 and the collating digest (RD) created by the collating information creating unit 47 are the same. When both are the same, the comparing unit 48 determines that the patrol target current homepage (CH) among the plurality of current homepages (CH) stored in the electronic information storage unit 24 has not been tampered with. On the other hand, if the two are not the same, the comparing unit 48 determines that the patrol target current homepage (CH) among the plurality of current homepages (CH) stored in the electronic information storage unit 24 has been tampered with.
[0038]
The patrol log storage unit 38 records the inspection result flag 28 and the inspection time 29 as the patrol log 23 based on the comparison result of the comparison unit 48.
FIG. 5 shows an example of the patrol log 23 recorded in the patrol log storage unit 38. The patrol log storage unit 38 records the patrol log 23 for each current homepage (CH) of each number. Specifically, the patrol time is recorded as the inspection time 29. When the comparing unit 48 determines that the current homepage (CH) is not tampered, “OK” is recorded in the inspection result flag 28. On the other hand, when the comparing unit 48 determines that the current homepage (CH) is falsified, “NG” is recorded in the inspection result flag 28.
[0039]
As a specific time to be stored as the inspection time 29, a method of storing the time at which the patrol is performed for each current homepage (CH) of each number can be considered.
[0040]
When the comparing unit 48 determines that the current digest and the matching digest created by the matching information creating unit 47 are not the same in the comparing unit 48, the homepage creator computer 1 that created the current homepage (CH) has been tampered with. Notify that.
In this manner, the author can be immediately notified that the current homepage (CH) has been tampered with on the Web server 2, and the author can be protected.
[0041]
When the comparing unit 48 determines that the current digest (CD) and the matching digest (RD) created by the matching information creating unit 47 are not the same in the comparing unit 48, the browsing computer 3 as the user stores the electronic information. The access to the falsified current homepage (CH) stored in the section 24 is prevented. However, it is also possible to replace the falsified current homepage (CH) with a predetermined alternative page without blocking.
The presence of the access blocking unit 50 can prevent the contents of the tampering from being disclosed to an unspecified number of third parties, for example, when there is tampering that slanders someone. Further, for example, it is possible to prevent the author from performing unintended electronic commerce due to tampering.
[0042]
Next, the operation of the capturing unit 46 will be described.
FIG. 6 shows a method in which the capturing unit 46 captures a falsified person of the first current homepage (CH) (1). The horizontal axis indicates time T. Further, T (n−2) to T (n + 1) illustrated in FIG. 6 represent the same time as T (n−2) to T (n + 1) illustrated in FIG.
As shown in FIG. 5, as a result of the comparison by the comparing unit 48, in the (n-2) -th, (n-1) -th, and n-th patrols performed by the patrol device 4, the first current homepage (CH) is all used. It is known that (1) has not been tampered with. However, in the (n + 1) -th patrol, it was determined that the first current homepage (CH) (1) was falsified. That is, this is a case where the inspection result flag 28 stored in the patrol log storage unit 38 becomes “NG” in the (n + 1) -th patrol. In this case, as shown in FIG. 6, the capturing unit 46 patrolls the homepage last time when the inspection time 29 (= T (n + 1)) of the (n + 1) th patrol when the inspection result flag 28 becomes “NG”. It is determined that there has been tampering by the falsifier before the inspection time 29 (= T (n)) at the time (n-th patrol). That is, the capturing unit 46 determines that the inspection time 29 is T (n) = 2002/07/23 11:50:44 from the patrol log 23 of the first current homepage (CH) (1) in the patrol log storage unit 38. T (n + 1) = 2002/07/23 It is determined that tampering has occurred until 12:00:18.
As described above, the capturing unit 46 records even two records, the inspection time 29 of the patrol determined to have been tampered and the inspection time 29 of the patrol immediately before, which is the latest patrol determined to have not been tampered. If so, the period of tampering can be specified. Therefore, the patrol log 23 older than the patrol one time before the current patrol can be ignored unless the patrol detects an abnormality.
[0043]
Next, the capturing unit 46 searches for the update time 17 stored in the update log storage unit 25 based on the above determination.
FIG. 3 illustrates T (n) and T (n + 1) determined to have been tampered. The first current homepage (CH) between T (n) = 2002/07/23 11:50:44 determined to have been tampered and T (n + 1) = 2002/07/23 12:00:18 (1) is updated only at the update time 17 “02/07/23 11:57:35” by the computer having the IP address 13 “192.215.48.17”.
Therefore, the capturing unit 46 specifies that the computer with the IP address 13 “192.215.48.17” is the falsified computer 7.
Since the patrol device 4 normally traverses the current homepage (CH) stored in the electronic information storage unit 24 for several tens of seconds to several minutes, it is recorded in the update log 32 in such a short period of time. The IP address 13 is usually predicted to be one, and it can be concluded that the computer having that address is the immediate tampering computer 7.
However, if two or more update logs 32 have been recorded in the update log storage unit 25 from time T (n) to T (n + 1) when it is determined that there has been tampering, they are registered in advance. A computer having an IP address that is not normally used other than the IP address of the genuine homepage creator computer 1 is determined to be the falsified computer 7.
[0044]
Hereinafter, the operation of the patrol apparatus 4 will be described with reference to the flowchart shown in FIG. Note that (n) shown in the figure is for distinguishing a plurality of current homepages (CH) stored in the Web server 2 and a plurality of homepage creator computers 1 that have created the current homepage. For example, the current home page of the first home page creator computer 1 is described as (CH) (1), and the current home page of the second home page creator computer 1 is described as (CH) (2). [CC] (n) shown in the figure represents current check information which is signature information of the n-th homepage creator computer 1, and (CD) (n) represents the n-th homepage creator computer. 1 (RD) (n) represents the collation digest of the n-th homepage creator computer 1.
[0045]
In patrol start step S300, it is checked whether a predetermined time has elapsed, and when the predetermined time has elapsed, patrol is started. It is also possible to set the predetermined time to zero and perform continuous patrol at all times.
First, the current homepage (CH) (n) + [CC] (n) to which the current check information [CC] (n) stored in the electronic information storage unit 24 is attached, the current check information [CC] (n) (Current check information separation step S301).
Then, the separated current check information [CC] (n) is decrypted using the public key 36 of the creator of the nth home page stored in the public key storage unit 34 to obtain the current digest (CD) (n). (Decoding step S302).
Further, a collation digest (RD) (n) is created from the current homepage (CH) (n) and stored in a RAM or the like (collation digest creation step S304).
Then, the current digest (CD) (n) decrypted in the decryption step S302 is compared with the collation digest (RD) (n) created in the collation digest creation step S304 (identical comparison step S305).
[0046]
If it is determined in the same comparison step S305 that they are the same, the patrol log 23 is recorded in the patrol log storage unit 38 (inspection result output step S309a). On the other hand, if it is determined that they are not the same, the nth homepage creator is notified that the current homepage (CH) (n) has been tampered with (notification step S306b). Further, the patrol log 23 is recorded in the patrol log storage unit 38 (inspection result output step S309b), and at the same time, the access of the browsing computer 3 to the falsified current homepage (CH) (n) is blocked (access blocking step S307). . Alternatively, the falsified homepage is replaced with a predetermined substitute page.
Further, the falsification computer 7 is captured (recognized) from the patrol log 23 recorded in the patrol log storage unit 38 (capture step S310).
[0047]
Next, it is determined whether or not patrol for all the current homepages stored in the electronic information storage unit 24 has been performed (patrolling end step S308). A patrol of the current home page not patroled is performed (S301). On the other hand, when the patrol has been performed on all the current home pages, the process returns to the patrol start step S300.
[0048]
When there is no tampering, that is, when CH = OH and CC = OC, the comparison and collation result of the comparison unit is RD = OD = CD.
When only CH is falsified, that is, when CH ≠ OH, CC = OC, the comparison and collation result of the comparison unit is RD ≠ OD = CD.
When both CH and CC are tampered with, that is, when CH ≠ OH, CC ≠ OC, the comparison and collation result of the comparison unit is RD ≠ OD ≠ CD.
If both CH and CC are falsified, RD = CD may be obtained. However, since the falsification actor does not have the author's secret key, both CH and CC must be matched so that RD = CD. It is impossible to remodel while doing it. This becomes tamper resistant. That is, the original check information serving as the base of the collation has the falsification resistance.
In this method, besides the patrol device 4 performing patrol and checking for tampering, the viewer computer 3 can individually check the viewer. In other words, the browser of the viewer may check the collation in the same procedure as the patrol unit 22.
Further, by arranging the patrol device 4 in the Web server 2, the Web server 2 itself may perform the patrol.
[0049]
It is anticipated that the falsified person will visit the falsified home page to check the falsification result with a high probability after performing the falsification.
Therefore, the capturing unit 46 sets the inspection log stored in the inspection log storage unit 27 for a certain period of time after the inspection time T (n + 1) when the inspection result flag 28 stored in the patrol log storage unit 38 is “NG”. 33
It can be used as an important reference material for tracking falsified persons, and the falsified person can be captured more accurately.
[0050]
In the present embodiment, the patrol of the homepage of the patrol apparatus 4 is used to effectively use the access record of the falsified computer 7 that has falsified the current homepage stored in the electronic information storage unit 24 in the Web server 2, and falsify the information. Computer 7 can be narrowed down to one or a very small number, and subsequent tracking work can be facilitated.
In addition, the patrol device 4 of the present embodiment allows the patrol device 4 to capture a falsified person at almost instantaneous timing.
In addition, by announcing that the patrol device 4 is provided with a function of tracking a falsified person, there is an effect that a person who intends to falsify feels danger of being caught and suppresses the falsification in advance.
[0051]
Embodiment 2 FIG.
Next, a patrol system according to the present embodiment will be described.
In the patrol system according to the above-described embodiment, in order to check the authenticity of the electronic information, the signature information stored in the electronic information storage unit 24 is decrypted with the public key of the creator of the electronic information every time the patrol is performed. Information for collation (current digest) is to be obtained. Since the decoding calculation work has a very heavy calculation load, it is desirable to substantially omit most of the calculation by the following means (1 to 7).
1. In the first patrol (or the true first patrol) recovered after falsification detection, the comparing unit 48 stores the electronic information stored in the electronic information storage unit 24 at that time and the electronic information stored in the electronic information storage unit 24 at that time. The collation is performed using the signature information and the method described in the first embodiment. This is called strict collation.
As a result of the comparison performed by the comparing unit 48, if the current digest that is the decrypted signature information matches the verification information (verification digest) generated by the verification information generation unit 47 described above, it is obtained as verification information at that time. Also, the decrypted signature information (current digest) is not discarded but left for the next patrol. On the other hand, as a result of the collation, if the decrypted signature information (current digest) and the collation information (collation digest) do not match, it is determined that the data has been tampered with, and the process proceeds to a predetermined process after tampering detection. .
2. In the second patrol, the comparing unit 48 omits the above operation of decrypting the signature information, and performs the collation check using the decrypted signature information (current digest) used in the previous patrol. This is called simple collation.
3. If the result of the second verification, that is, the simple verification is OK, the comparing unit 48 leaves the decrypted signature information (current digest) without discarding it.
4. The comparison unit 48 performs a simple verification using the decrypted signature information (current digest) remaining in the third verification in the same manner as the second verification.
5. The comparison unit 48 continues to use the first decrypted signature information (current digest) as long as the result of the simple verification is OK. Meanwhile, the decoding calculation for obtaining the current digest continues to be omitted.
6. If the homepage creator computer 1 does not update the electronic information (current homepage 21) stored in the electronic information storage unit 24 and is not falsified by a third party, this state is continued.
7. If the homepage creator computer 1 updates the electronic information (current homepage 21) shortly before the n-th simple verification, or if the electronic information (current homepage 21) is falsified, the comparison result by the comparing unit 48 Becomes NG.
At this point, it is impossible to distinguish whether the homepage creator computer 1 has properly updated the electronic information (current homepage 21) or has been tampered with. The reason is that, because of simple verification, the decrypted signature information (current digest) is actually an old digest and may not reflect the updated contents of the homepage creator computer 1.
Therefore, the comparing unit 48 immediately performs the strict collation described above. That is, the use of the previously decrypted signature information (current digest) is stopped, and the decryption calculation is performed from the signature information stored in the electronic information storage unit 24 obtained by the n-th patrol to obtain the latest decrypted signature. Obtain information (current digest) accurately. Using this, collation, that is, strict collation is performed. As a result, if the homepage creator computer 1 updates, the collation result is OK, and if it is falsified, the collation result is NG.
[0052]
As described above, each time the electronic information is inspected cyclically, instead of decrypting and collating the electronic information at that time and the signature information, the collation created by hash-compressing the electronic information (current homepage 21) at that time is performed. The digest is collated with the decrypted signature information (current digest) used for decryption collation at the time of the previous cyclic inspection. If the collation results in a mismatch, the signature information (current digest) stored in the electronic information storage unit 24 at that time is immediately decrypted and collated again. If the result of the re-collation is OK, the electronic information (current homepage 21) is determined to be authentic. That is, it is determined that the electronic information (current homepage 21) has been properly updated between the previous time and this time. On the other hand, the patrol method for determining that the electronic information (the current homepage 21) has been falsified if the result of the re-matching is NG has been described.
[0053]
Generally, the cycle at which patrols are repeated is on the order of several minutes at most, whereas the cycle of updating by the homepage creator computer 1 is on the order of days, and is much longer than the cycle at which patrols are repeated. In fact, the actual state of the collation work is overwhelmingly passed with simple collation OK. As a result, the decryption calculation for obtaining the signature information (current digest) decrypted at an overwhelming ratio can be omitted.
[0054]
Construction of a firewall is also effective in preventing tampering of the homepage. However, in general, a falsified person often obtains the ID number of a legitimate creator separately and intrudes by impersonating the legitimate creator, in which case the falsifier easily gets over the firewall. . On the other hand, according to the patrol device 4 of the present embodiment, falsification detection and tracking are performed by using the homepage itself as a clue. Therefore, as described above, if the falsifier separately obtains the ID of the legitimate creator, etc. Can also capture a falsified person. Therefore, if both the patrol device 4 of the present embodiment and the firewall are introduced, there is an effect that the patrol device 4 of the present embodiment complements the firewall.
Further, according to the patrol device 4 of the present embodiment, it contributes to preventing cyber terrorism caused by falsification of the homepage.
Each time the electronic information is cyclically inspected, instead of decrypting and collating the electronic information and the signature information at that time, the electronic information at that time and the decrypted signature information used for decryption and collation at the previous cyclic inspection time (I.e., digest). If the collation results in a mismatch, the signature information at that point is immediately decrypted and collated again. If the result of the re-verification is OK, the electronic information is determined to be authentic. (It is determined that the electronic information has been properly updated between the previous time and the current time.) If the result of the re-matching is NG, it is determined that the electronic information has been falsified.
[0055]
A method of logging all the IP addresses of the connection terminals is a commonly conceived method. In that case, the logs for the past month are stored, so that the storage amount becomes enormous. However, in the patrol method in the present embodiment, it is sufficient to save the patrol log 23 at most one round before. Accordingly, as a result of the patrol, the patrol logs 23 in the normal period may be discarded sequentially up to two or more previous logs.
Also, since the detection of tampering is usually delayed, the update log 32 by the tampered computer 7 is also lost in a huge amount of data, making it difficult to track the tampered person. However, by patrol by the patrol device 4 in the present embodiment, it is sufficient to track the falsified person only within a very short time width close to the pinpoint. In general, the frequency of updating the homepage is much lower than the frequency of browsing the homepage. Therefore, the frequency of updating the homepage during the patrol cycle is very small, and it is possible to identify one abnormal IP address that is not usually used. Easy.
If the falsified computer 7 has falsified the IP address (for example, a springboard), further pursuit is required. In such a case, the apparently falsified computer 7 is an entry point for tracking. That is, it is possible to go back using the tampered computer 7 as a clue and reach the IP address of the true tampered computer behind it.
[0056]
The homepage creator computer 1, the browsing computer 3, the falsifier computer 7, the Web server 2, and the patrol device 4 described in the above embodiments are not limited to computers in order to realize each function. It can be realized with various electronic devices.
[0057]
The storage units described in the above embodiments need not be installed in the Web server 2 or the patrol device 4, but may be installed in another external device.
[0058]
In the above embodiment, a homepage (HP) has been described as an example of electronic information that is digitized information. However, electronic information refers to all digital information present on a network, and the present invention is directed to an apparatus and method for capturing electronic equipment that alters these digital information.
[0059]
In the above embodiment, the operations of the components are related to each other, and the operations of the components can be replaced as a series of operations while considering the relationship between the operations described above. Then, by substituting in this way, an embodiment of the method invention can be obtained.
Further, by replacing the operation of each of the above components with the processing of each of the components, an embodiment of a program can be realized.
In addition, by storing the program on a computer-readable recording medium on which the program is recorded, an embodiment of the computer-readable recording medium on which the program is recorded can be provided.
[0060]
The embodiment of the program and the embodiment of the computer-readable recording medium recorded in the program can all be constituted by a computer-operable program.
Further, the software and programs of the embodiments may be realized by firmware stored in a ROM (READ ONLY MEMORY). Alternatively, each function of the above-described program may be realized by a combination of software, firmware, and hardware.
[0061]
【The invention's effect】
According to the present invention, an electronic device of a falsifier can be specified.
[Brief description of the drawings]
FIG. 1 is a basic configuration diagram of a computer of a patrol device.
FIG. 2 is a configuration diagram of a homepage falsification capturing system;
FIG. 3 is a diagram showing an example of an update log 32 recorded in an update log storage unit 25.
FIG. 4 is an internal configuration diagram of the patrol unit 22.
FIG. 5 is a diagram showing an example of a patrol log 23 recorded in a patrol log storage unit 38.
FIG. 6 is a diagram illustrating a method in which the capturing unit 46 captures a falsified person of the first home page.
FIG. 7 is a flowchart showing the operation of the patrol device 4;
FIG. 8 shows a conventional diagram.
[Explanation of symbols]
1 Homepage creator computer, 2 Web server, 3 viewer computer, 4 patrol device, 7 falsification computer, 13 IP address, 17 update time, 21 current homepage, 22 patrol section, 24 electronic information storage section, 25 update log storage Unit, 27 browse log storage unit, 28 inspection result flag, 29 inspection time, 30 browse reception unit, 31 update reception unit, 34 public key storage unit, 35 communication unit, 38 patrol log storage unit, 43 patrol start unit, 46 capture , 600 public key certificate, 700 public key certificate storage unit.

Claims (12)

An electronic information storage unit that stores electronic information and signature information for checking whether the electronic information is genuine;
An update log storage unit that stores an update log including identification information of the electronic device that created the electronic information stored in the electronic information storage unit;
A patrol unit that patrols whether the electronic information has been tampered with using the signature information,
A patrol log storage unit that stores a patrol log that the patrol unit patrols,
When determining that the electronic information has been tampered with, the patrol unit determines a falsification of the electronic information from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. A patrol device having a capturing unit for specifying an electronic device. The patrol apparatus according to claim 1, wherein the capturing unit specifies the electronic device of the falsifier from the patrol log of the patrol determined to have been tampered and the patrol log of the latest patrol determined to be tampered. The patrol log storage unit stores the inspection time, which is the time of patrol, in the patrol log,
The update log storage unit stores an update time, which is a time at which the electronic information is stored in the electronic information storage unit, in an update log,
The update unit stores, from the update log storage unit, an update log having, as an update time, a time existing between the inspection time of the patrol determined to be falsified and the inspection time of the latest patrol determined to be falsified. The patrol apparatus according to claim 2, wherein the patrol apparatus specifies a falsified electronic device from the electronic device identification information included in the selected update log. The electronic information storage unit stores a plurality of electronic information and signature information,
The patrol unit patrols the electronic information,
The patrol log storage unit stores the inspection time for each of the electronic information,
The update log storage unit stores the update time and the identification information of the electronic device, and the capturing unit determines, for each piece of the electronic information, the inspection time of the patrol determined to have been tampered with and the latest determined that no tampering has been performed. An update log having a time existing between the inspection time of the patrol and the update time is selected from the update log storage unit, and the electronic device of the falsifier is identified from the identification information of the electronic device included in the selected update time. The patrol device according to claim 3, wherein The patrol device further includes:
A browsing log storage unit that stores a browsing log including identification information of the electronic device that browsed the electronic information stored in the electronic information storage unit,
The patrol apparatus according to claim 1, wherein the capturing unit identifies the electronic device of the falsifier by using the browsing log stored in the browsing storage unit. An electronic information storage unit that stores electronic information and signature information for checking whether the electronic information is genuine;
A server having an update log storage unit that stores an update log including identification information of the electronic device that created the electronic information stored in the electronic information storage unit;
A patrol unit that patrols whether the electronic information has been tampered with using the signature information,
A patrol device having a patrol log storage unit that stores a patrol log that the patrol unit patrols,
When determining that the electronic information has been tampered with, the patrol unit determines a falsification of the electronic information from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. A patrol system having a capturing unit for specifying an electronic device. 7. The patrol system according to claim 6, wherein the patrol system permits access to the server from the patrol device and does not permit access to the patrol device from the server. Electronic information and signature information for checking whether the electronic information is genuine are stored in an electronic information storage unit,
An update log including identification information of the electronic device that created the electronic information stored in the electronic information storage unit is stored in the update log storage unit,
Using the signature information stored in the electronic information storage unit, patrol whether the electronic information stored in the electronic information storage unit has been tampered with,
The patrol log that has been patroled is stored in the patrol log storage unit,
When the patrol determines that the electronic information stored in the electronic information storage unit has been tampered with, the electronic information is obtained from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. A patrol method that specifies the electronic device of the falsified person. A process of storing electronic information and signature information for checking whether the electronic information is authentic in an electronic information storage unit;
A process of storing, in the update log storage unit, an update log including identification information of the electronic device that created the electronic information stored in the electronic information storage unit;
A process of patroling whether the electronic information stored in the electronic information storage unit has been tampered with, using the signature information stored in the electronic information storage unit;
A process of storing the patrolled patrol log in the patrol log storage unit;
When the patrol determines that the electronic information stored in the electronic information storage unit has been tampered with, the electronic information is obtained from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. A patrol program for causing a computer to execute a process of identifying a falsified electronic device of a falsified person. A process of storing electronic information and signature information for checking whether the electronic information is authentic in an electronic information storage unit;
A process of storing, in the update log storage unit, an update log including identification information of the electronic device that created the electronic information stored in the electronic information storage unit;
A process of patroling whether the electronic information stored in the electronic information storage unit has been tampered with, using the signature information stored in the electronic information storage unit;
A process of storing the patrolled patrol log in the patrol log storage unit;
When the patrol determines that the electronic information stored in the electronic information storage unit has been tampered with, the electronic information is obtained from the update log stored in the update log storage unit and the patrol log stored in the patrol log storage unit. A computer-readable recording medium in which a patrol program for causing a computer to execute a process of identifying a falsified electronic device of a falsified person is recorded. An electronic information storage unit that stores electronic information and signature information for checking whether the electronic information is genuine;
A patrol unit that patrols the presence or absence of falsification of the electronic information,
The patrol part,
A collation information creating unit that creates collation information from the electronic information stored in the electronic information storage unit,
At the first patrol, the signature information stored in the electronic information storage unit is decrypted using the public key of the creator of the electronic information, and the decrypted signature information is compared with the verification information. At the time of patrols other than the above, the decrypted signature information used during the previous patrol is compared with the current verification information according to the above-described procedure, and if the comparison results in a mismatch, the electronic signature is further stored in the electronic information storage unit. A patrol device having a comparing unit for decrypting the signed information using the public key of the creator of the electronic information, and comparing the decrypted signature information with the current verification information. Storing electronic information and signature information for checking whether the electronic information is genuine,
Patrols the presence or absence of falsification of the electronic information,
The patrol above is
Create collation information from the stored electronic information,
At the first patrol, the stored signature information is decrypted using the public key of the creator of the electronic information, the decrypted signature information is compared with the verification information, and at the time of patrol other than the first patrol, The decrypted signature information used during the previous patrol is compared with the current verification information according to the above procedure. If the comparison results in a mismatch, the stored signature information is further converted to the creator of the electronic information. A patrol method for decrypting using the public key, and comparing the decrypted signature information with the above verification information.

Images