JP2004302764A - Web-page falsification monitoring method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a Web-page falsification monitoring method which can clearly assure anonymity of a Web page. <P>SOLUTION: A falsification checking center 2 stores the Web page of a company 1 as master information after converting the Web page to a hash value when the anonymity of the Web page is maintained. When a Web questionnaire page is accessed from a user terminal 20, a questionnaire collecting server 10 transfers processing to a falsification checking PRG on a falsification checking server 30. The questionnaire collecting server 10 generates a hash value of each module as information to be checked and transmits the value to the falsification checking server 30. The falsification checking PRG compares the transmitted hash vale as the information to be checked with the hash value stored as the master information in the prior processing. If the above values are the same, the falsification checking PRG determines that there is no falsification and conducts a questionnaire survey, and determines that there is a falsification if the values are not the same, and stops the processing. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a method for monitoring tampering of a page (web page) constructed on a network using web technology.
[0002]
[Prior art]
Methods for monitoring web page tampering have been known in the art. For example, Patent Literature 1 discloses a technique of monitoring electronic information content provided on a web page and detecting tampering. In this document, the target web page is a web page for information transmission of a company or government office.
[0003]
On the other hand, it is common practice to set up a questionnaire page on the web and collect user opinions widely in order to use it as material for product development and organizational reform. Questionnaires are often conducted anonymously, especially in a survey conducted by management within a company, where anonymity is important so that frank opinions can be expressed.
[0004]
[Patent Document 1] Japanese Patent Application Laid-Open No. 2002-318726
[Problems to be solved by the invention]
However, Patent Literature 1 merely discloses that a third party other than the content provider periodically checks the content for tampering, and does not consider the anonymity of the web page as described above. When a questionnaire page is provided on the web, even if the implementer is anonymous, the user cannot confirm whether or not the anonymity is actually secured. When the questionnaire collection server obtains the IP address of the user terminal, the user may be identified. In particular, when the questionnaire collection server and the user terminal are connected to a company network, the IP of the respondent to the questionnaire may be identified. If the address is obtained, the user terminal can be easily specified. If the anonymity is not clearly assured in this way, the atrophy effect will work, making it difficult to write content that criticizes the management side even if it is a constructive opinion, as a result it is difficult to aggregate constructive opinions Become.
[0006]
Also, if tampering is not monitored, the organizer may arbitrarily alter the questionnaire questionnaire if the result of the questionnaire is inconvenient for the organizer, and We cannot guarantee. Furthermore, there is a possibility that the contents of the question may be altered by a malicious third party without the organizer's knowledge, and if the alteration is not monitored, the user will respond to the altered questionnaire. If the anonymity is falsified, personal information may be collected unfairly.
[0007]
The present invention has been made in view of the above-described problems of the related art, and provides a method of monitoring tampering of a web page that can clearly guarantee the anonymity of a web page in which anonymity of a user is important, such as a questionnaire page. Aim.
[0008]
[Means for Solving the Problems]
In order to achieve the above object, a method for monitoring tampering of a web page according to the present invention is a method of monitoring tampering of a web page published by a web server with a tampering monitoring server connected to a web server via a network. The anonymity of the web page published by the server is confirmed, the unique information on the page is stored as master information in the falsification monitoring server, and when the user terminal accesses the web page, the web server The access is automatically transferred to the tampering monitoring server, and the unique information at the time of accessing the web page is transferred to the tampering monitoring server as checked information. The tampering monitoring server compares the master information and the checked information, If they match, it is determined that there is no tampering, and Scan and automatic transfer to allow access to the web server, if they do not match and inhibits the access is determined that there is tampering.
[0009]
According to the above method, every time a user terminal accesses a web page, the tampering monitoring server determines whether the web page has been tampered with. If the web page has been tampered with, access to the web page is prohibited. Therefore, the anonymity of the web page can be clearly assured. For example, when monitoring the falsification of the questionnaire page, the user can write frank opinions without shrinking.
[0010]
As the unique information, a hash value of a file related to the web page can be used. When the master information and the checked information do not match, a warning may be displayed on the user terminal without transferring the access from the user terminal to the web server.
[0011]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of a web page tampering monitoring method according to the present invention will be described. FIG. 1 is a block diagram schematically illustrating a system for realizing the falsification monitoring method according to the embodiment. First, the configuration of the system will be described with reference to FIG. In the embodiment, a web questionnaire page constructed on a questionnaire collection server (web server) is targeted for falsification monitoring as a web page in which anonymity is emphasized. This web questionnaire is used for collecting information in a company, and monitoring of tampering of the web questionnaire page is performed by a tampering check center operated by a third party company different from this company.
[0012]
The questionnaire collection server 10 is installed in the company 1. The server 10 includes, as WWW server functions 11, initial screen data (TOP.html) 11a, question screen creation PRG (program, P1.cgi) 11b, answer result acquisition PRG (P2.cgi) 11c, hash creation PRG (H .Cgi) 11d and a WWW server operating environment file (httpd.conf) 11e. Further, the question screen creation PRG 11b is connected to a question content DB (database) 12 storing questionnaire question contents, and the answer result acquisition PRG 11c is connected to an answer result DB 13 storing answer from the user to the questionnaire. . Further, the WWW server function 11 is connected to a hashing means 14 for hashing a program or a module, and the hashed value (hash value) is stored in the checked hash value DB 15.
[0013]
The company 1 is provided with a company network 3, and a user terminal 20 that answers a questionnaire to the network and the questionnaire collection server 10 are connected to the network. The intra-company network 3 is connected to the Internet 4. The user terminal 20 is provided with a browser 21 for browsing a web page.
[0014]
On the other hand, the tampering check center 2 is provided with a tampering check server 30. The tampering check server 30 includes a tampering check PRG (C.cgi) 31 and a master hash value DB 32 accessed by this program, and can communicate with the questionnaire collection server 10 and the user terminal 20 via the Internet 4. It has been. The checked hash value DB 15 provided in the questionnaire collection server 10 is a database that stores, as checked information, a hash value that is unique information at the time of accessing the web questionnaire page. The master hash value DB 32 is a database that confirms anonymity of a web questionnaire page in advance and stores a hash value that is unique information regarding the page as master information.
[0015]
The outline of the process for monitoring the falsification of the web questionnaire page in the above system configuration will be described below in an itemized form, and will be described with reference to FIGS. Details of each will be described later. Of the following procedures 1 to 10, 1 to 3 are pre-processes to be executed in advance before conducting a questionnaire, and 4 and below are normal processes to be executed when a user accesses a web questionnaire page.
[0016]
1. The company 1 that conducts the questionnaire requests the tampering check center 2 to perform anonymous authentication off-line.
2. The tampering check center 2 checks whether anonymity is maintained for the modules (cgi file, html file, md5 library) of the web page of the company 1, and authenticates if the anonymity is maintained. Provide guidance if anonymity is not maintained.
[0017]
The censorship process for authentication is shown in FIG. In the censorship process, the hierarchy of each module is checked in step S1. For example, if the initial screen data (TOP.html) is checked and it is determined that “cgi called acclog.pl is called in line 11 of TOP.html”, then acclog. Check pl. Here, if it is determined that “another module is not called from acclog.pl”, it can be determined that “the hierarchy is two layers”.
[0018]
In step S2, the source of each module is peer-reviewed for each layer investigated in step S1. FIG. 3A shows a part of the source of the initial screen data (TOP.html) described in html. If it is determined that “top.html has no function for storing the IP address”, acclog. Check pl. FIG. 3B shows acclog. Written in the cgi language called perl. Here is an example of a pl source. In this example, "the environment variable called REMOTE_ADDR is referred to in the sixth line of acclog.pl to obtain the IP address of the remote host", and "the eighth line of acclog.pl .Dat ". From this, acclog. It can be determined that pl does not maintain anonymity. If anonymity is not maintained, change the source and instruct them to maintain anonymity.
[0019]
The IP address of the remote host is stored not only by the user program (cgi) but also by the function of the www server itself. Therefore, anonymity cannot be maintained unless this function is invalidated. For example, in the case of a www server called Apache, http. If the log file name in the operating environment file “conf” is changed to a file name “/ dev / null”, the IP address protection function can be disabled. However, in order to avoid multiple votes in spoofing, the IP address is hashed and recorded.
[0020]
3. The tampering check center 2 converts the authenticated modules (cgi, html, md5 library) into a hash value with md5 and stores it in the master hash value DB 32 as master information. At this time, the company 1 applies to the falsification check center 2 the data obtained by hashing the content of the question and the expiration date of the content of the question. The tampering check center 2 stores these data in the master hash value DB 32 as master information in the same manner as the above modules. The contents of the question itself are not notified to the tampering check center 2.
[0021]
4. As shown in FIG. 4, when there is access to the web questionnaire page from the user terminal 20 (t1), the questionnaire collection server 10 transmits data (TOP.html) of the initial screen to the user terminal 20 (t2). When accessing via the Internet, data is transmitted and received according to the SSL encryption procedure. An initial screen is displayed on the user terminal 20 by the browser 21 (t3). FIG. 5 shows an image of the initial screen.
[0022]
5. The questionnaire collection server 10 skips the processing to the tampering check PRG on the tampering check server 30 (t4).
6. The tampering check PRG31 requests the questionnaire collection server 10 to acquire a hash value (t5).
7. The questionnaire collection server 10 creates a hash value of each module as information to be checked, and transmits it to the tampering check server 30 (t6).
[0023]
8. The tampering check PRG compares the hash value as the information to be checked transmitted at t6 with the hash value stored in the master hash value DB 32 as the master information in the preprocessing to check whether there is tampering. (T7).
9. If the hash values are the same, it is determined that there is no tampering, and the process is returned to the questionnaire collection server 10. If the hash values are different, it is determined that there has been tampering, and the processing is interrupted.
[0024]
10. If there is no tampering, the questionnaire collection server 10 creates a question screen and transmits it to the user terminal 20 (t8), and the question screen of the questionnaire is displayed on the user terminal 20 (t9). The question of the questionnaire is read from the question content DB 12 and dynamically created. Although not shown, the tampering check server 30 checks the content of the question when the questionnaire collection server 10 creates the question screen, and the hash value of the checked information is within the validity period and the hash value of the checked information is the hash value of the master information. If it is different from the value, the questionnaire organizer determines that tampering has occurred and interrupts the process.
[0025]
11. When the answer of the questionnaire is input at the user terminal 20 and the result is returned to the questionnaire collection server 10 (t10), the questionnaire collection server 10 acquires the answer result and executes statistical processing and the like. At this time, information obtained by hashing the IP address of the user terminal 20 with md5 is attached to the response information. As a result, the questionnaire collection server 10 cannot identify the IP address of each answer, but if the hash value of the IP address attached to a plurality of answers is the same, the same user terminal It can be determined that a plurality of answers have been sent by the spoofing of 20. Therefore, when performing statistical processing or the like, accurate processing can be performed by excluding answers having the same hash value.
[0026]
Next, main processes in the above-described processes will be described in more detail.
First, the process of the hash value creation PRG (FIG. 4, t6) executed by the questionnaire collection server 10 will be described based on FIG. When the hash value creation PRG is executed, the questionnaire collection server 10 checks whether or not the requester of the hash value is the falsification check server 30 in step S10. It is the tampering check center 2 that authenticates the anonymity of the questionnaire collection server 10, and there is no need to respond to access from other sites. Therefore, in step S10, if the IP address of the request source is not “* .senta.co.jp” indicating the address of the tampering check server 30, the process is terminated as it is. If the addresses match, it is determined that the request is from the tampering check server 30, and the process from step S11 is continued.
[0027]
In step S11, the source screen TOP. Create a hash value for html. Similarly, in step S12, the source P1. cgi, and in step S13, the source P2. cgi, in step S14, the source H. of the hash value creation PRG. cgi hash value. In step S15, the WWW server operating environment file httpd. In step S16, the hash value of the hash value of the conf is created. These hash values are data generated as information to be checked when accessing the web questionnaire page, and are automatically transferred to the falsification monitoring server 10 in step S17.
[0028]
The checked hash value DB 15 and the master hash value DB 32 hold data in a structure as shown in FIG. That is, these DBs include three fields of URL, file name, and hash value, and have one record for each file.
[0029]
Next, processing of the tampering check PRG executed by the tampering check server 30 will be described with reference to FIG. When the tampering check PRG is executed, the tampering check server 30 checks whether the request source is the questionnaire collection server 10 in step S20. The tampering check center 2 monitors the questionnaire collection server 10 of the company 1 and does not need to respond to accesses from other sites. Therefore, in step S10, if the IP address of the request source is not “* .kigyo.co.jp” indicating the address of the questionnaire collection server 10, the authentication NG message screen shown in FIG. Is displayed, and the process ends. If the addresses match, it is determined that the request is from the questionnaire collection server 10, and the process from step S22 is continued.
[0030]
In step S22, the tampering check server 30 requests the questionnaire collection server 10 to create a hash value (FIG. 4, t5). In step S23, the hash value sent from the questionnaire collection server 10 is obtained, and in step S24, the difference between the hash values is checked. If the hash value of the information to be checked is different from the hash value of the master information, an authentication NG message screen is displayed on the user terminal 20 in step S21, and the process ends. If the hash values are the same, the authentication OK message screen shown in FIG. 10 is displayed on the user terminal 20 in step S25, and the question screen creation PRG is executed by the questionnaire collection server 10 (t8 in FIG. 4).
[0031]
FIG. 11 shows the process of the question screen creation PRG executed by the questionnaire collection server 10. Here, in step S30, the previous page displayed on the user terminal 20 is checked. That is, it is desirable that the questionnaire be executed immediately after the alteration check processing is executed and it is determined that there is no alteration. This is because if time elapses after the check, tampering may be performed during that time. Therefore, it is checked whether or not the tampering check PRG (C.cgi) has been executed immediately before. The previous page is WWW. senta. co. jp / C. If it is not cgi, it is determined that time has passed since the tampering check was executed, and the processing is interrupted. The previous page is WWW. senta. co. jp / C. If it is cgi, the process from step S31 is executed.
[0032]
In step S31, the content of the question is read from the question content DB12. The question content DB 12 has a structure as shown in FIG. That is, it has two fields of a question number and a question content, and has one record for each question. Subsequently, in step S32, a question page is dynamically created based on the read question (t8 in FIG. 4). In step S33, the created question page is displayed on the user terminal 20, and in step S34, the answer result acquisition PRG is executed.
[0033]
The processing content of the answer result acquisition PRG is as shown in FIG. 13. In step S40, the answer to the questionnaire transmitted from the user terminal 20 is acquired, and the acquired content is written in the answer result DB 13 in step S41. The answer result DB has a structure as shown in FIG. That is, it has three fields of a question number, a sequence number, and an answer content common to the question content DB, and generates one record for each answer question.
[0034]
(Appendix 1)
A method for monitoring tampering of a web page published by a web server by a tampering monitoring server connected to the web server via a network,
Confirming the anonymity of the web page published by the web server, storing unique information related to the page as master information in the falsification monitoring server,
When the user terminal accesses the web page, the web server automatically transfers the access from the user terminal to the falsification monitoring server, and outputs the unique information at the time of accessing the web page to the checked information. Transferred to the falsification monitoring server as
The falsification monitoring server compares the master information and the checked information, and when they match, determines that there is no falsification and automatically transfers access from the user terminal to the web server to permit access. If the two do not match, it is determined that there is tampering and the access is prohibited, and a method of monitoring tampering of a web page is provided.
[0035]
(Appendix 2)
2. The method according to claim 1, wherein a hash value of a file related to the web page is used as the unique information.
[0036]
(Appendix 3)
The web page according to claim 1 or 2, wherein when the master information and the checked information do not match, a warning is displayed on the user terminal without transferring the access from the user terminal to the web server. Falsification monitoring method.
[0037]
(Appendix 4)
The falsification check server checks whether or not the transfer source is the questionnaire collection server when the access from the user terminal is transferred, and performs the subsequent processing only when the transfer source is the web server. 3. The method for monitoring tampering of a web page according to any one of supplementary notes 1 to 3, wherein
[0038]
(Appendix 5)
The falsification check server requests the web server to transfer the unique information as the information to be checked, and the web server checks a request source of the request and receives the request from the falsification check server. 5. The method according to claim 4, wherein the unique information is transferred only when necessary.
[0039]
【The invention's effect】
As described above, according to the falsification monitoring method of the present invention, each time a user terminal accesses a web page that has been authenticated anonymously, it is determined whether the page has been falsified. Since access is permitted only when the web page has not been tampered with, the anonymity of the web page can be clearly guaranteed. Therefore, when the target is a web questionnaire page, the user can write frank opinions without shrinking because the property name is guaranteed.
[0040]
In addition, even when the organizer or a malicious third party alters the contents of a questionnaire question or the like, the fact that the information has been altered can be found, so that fairness can be guaranteed and personal information can be unfairly used. It can be prevented from being collected.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a system configuration for implementing a web page tampering monitoring method according to the present invention.
FIG. 2 is a flowchart illustrating a censorship process for verifying anonymity of a web questionnaire page.
FIG. 3 is a list showing a source of a file to be verified in the process of FIG. 2;
FIG. 4 is a flowchart schematically showing an entire process of a falsification monitoring method according to the embodiment;
FIG. 5 shows a screen image of a TOP page transmitted from the questionnaire collection server and displayed on the user terminal.
FIG. 6 is a flowchart showing a hash creation program executed by the questionnaire collection server.
FIG. 7 is a table showing a structure of a checked hash value DB of the questionnaire collection server and a master hash value DB of the tampering check server.
FIG. 8 is a flowchart showing a tampering check program executed by a tampering check server.
FIG. 9 shows an image of an authentication NG message screen transmitted from the tampering check server and displayed on the user terminal.
FIG. 10 shows an image of an authentication OK message screen transmitted from the tampering check server and displayed on the user terminal.
FIG. 11 is a flowchart showing a question screen creation program executed by the questionnaire collection server.
FIG. 12 is a table showing a structure of a question content DB of the questionnaire collection server.
FIG. 13 is a flowchart showing an answer result acquisition program executed by the questionnaire collection server.
FIG. 14 is a table showing a structure of an answer result DB of the questionnaire collection server.
[Explanation of symbols]
1 Company 2 Tamper Check Center 3 Company Network 4 Internet 10 Questionnaire Collection Server 11 WWW Server Function 11a Initial Screen Data 11b Question Screen Creation Program 11c Answer Result Acquisition Program 11d Hash Creation Program 11e WWW Server Operating Environment File 12 Question Content DB
13 answer result DB
14 hashing means 15 hash value DB to be checked
20 User Terminal 21 Browser 30 Tamper Check Server 31 Tamper Check Program 32 Master Hash Value DB

Claims (3)

A method for monitoring tampering of a web page published by a web server by a tampering monitoring server connected to the web server via a network,
Confirming the anonymity of the web page published by the web server, storing unique information related to the page as master information in the falsification monitoring server,
When the user terminal accesses the web page, the web server automatically transfers the access from the user terminal to the falsification monitoring server, and outputs the unique information at the time of accessing the web page to the checked information. Automatically transferred to the tampering monitoring server as
The falsification monitoring server compares the master information and the checked information, and when they match, determines that there is no falsification and automatically transfers access from the user terminal to the web server to permit access. If the two do not match, it is determined that there is tampering and the access is prohibited, and a method of monitoring tampering of a web page is provided. 2. The method according to claim 1, wherein a hash value of a file related to the web page is used as the unique information. 3. The web according to claim 1, wherein when the master information does not match the checked information, a warning is displayed on the user terminal without transferring the access from the user terminal to the web server. Page alteration monitoring method.

Images