JP2004318820A - Database repair system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a database repair system that can enhance the reliability of tampering detection and quickly automatically repair the data tampering. <P>SOLUTION: Original data stored in a first database are downloaded from a server through a communication line when newly storing and updating data. The compare data stored in the first database are downloaded from the server through the communication line at a constant cycle or predetermined timing. The contents of the compare data are compared with the contents of the original data to detect presence of the tampering of the data stored in the first database. When the tampering is detected, the original data are uploaded into the server via the communication line to automatically repair the data in the first database. The database repair system is equipped with an exclusive repair terminal independent of the server, so that the exclusive repair terminal can be operated regardless of the status of the server, even if the server is attacked and stalled. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a database repair system that detects falsification of a database connected to a communication line such as the Internet and automatically repairs the database.

  With the spread of the Internet, especially the explosive spread of the always-on environment using broadband, the population of the Internet has increased dramatically, and the establishment of a homepage (hereinafter referred to as HP) has become common for both businesses and individuals.

  However, there has been a situation where a cracker attacks a security hole of an operating system, an Internet browser, or the like, and falsifies HP data stored in a web server. In this case, erroneous information will be disclosed contrary to the intention of the HP establisher, and the damage will be spread to both the HP establisher and the user. Therefore, the publication of the HP must be temporarily stopped. You are driven into a situation that you cannot get.

  For example, in a website such as Internet shopping, if the price is falsified, the sales period is falsified, the inquiry information is falsified, etc., both the owner and the user of the HP suffer disadvantages. As shown in FIG. 3, when the HP has been tampered with (S1), conventionally, the publication of the HP is stopped (S2), the developer is instructed to check for tampering (S3), and the result of the check is waited for. (S4) HP data restoration (S5) was instructed, and after the restoration was completed, the HP was released again (S6).

  However, first, it takes time to notice that the HP has been tampered with, it takes a considerable amount of time to investigate and repair the tampering, and in many cases it takes a long time before the HP is re-released. In the case of a disclosure purpose such as an HP, it is practically impossible to completely prevent the data from being tampered with. Therefore, on the premise that there is a risk of being tampered with, it is an important issue how quickly it can be repaired in the event of tampering.

  In order to solve the above problems, for example, Patent Documents 1 to 4 and the like have been conventionally proposed.

  First, Patent Literature 1 discloses a homepage tampering detection device that detects tampering of a homepage set in a WWW server connected to the Internet, in which content of a homepage stored in the WWW server is copied and stored. Storage means, falsification determining means for comparing the content stored in the content storage means with the content stored in the WWW server at a predetermined cycle, and determining whether or not the content stored in the WWW server has been falsified. And a homepage tampering detection device characterized by having the following.

  In the following order, Patent Document 2 discloses a public web server computer storing an encrypted web file, an original web server computer connected to the public web server computer via a firewall or the like, and a public web server receiving an access request from a user. Means for checking the tampering of the encrypted web file and decrypting the encrypted web file when it is determined that the tampering has not been tampered with, and transmitting the data to the user; A means for encrypting a corresponding web file stored in a public web server and updating / restoring a falsified web file in a public web server has been disclosed.

  Patent Document 3 compares a homepage content registered in a storage unit installed in a server on the Internet, a backup unit for creating a backup file of the homepage content, and a comparison between the homepage content and the content of the backup file. A content comparison unit that determines that there has been tampering when the two are different, and a recovery unit that rewrites the homepage content to the content of the backup file when the content comparison unit determines that the content of the homepage is different from the content of the backup file. And a means for preventing falsification of a home page.

  Patent Literature 4 discloses a digital computer connected to a communication network for browsing a home page, a unit for reading information to be verified from digital information of the home page being viewed, verification information and verification information unique to a regular home page. And a means for comparing the web page being viewed if the comparison result is determined to be inconsistent, and determining whether the web page being viewed is falsified when the comparison result is determined to be inconsistent. And a means for detecting tampering with a home page, including:

JP 2001-331374 A JP 2002-175010 A JP 2002-207623 A JP 2002-313284 A

  In Patent Literatures 1, 3, and 4, tampering detection means is provided on a server in which HP data is stored. In addition, Patent Documents 1 to 4 are all operated while being connected to the Internet.

  However, if the tampering detection means is provided on the server, there is a problem that if the server itself stops functioning due to an attack, the tampering detection means cannot be used. Further, even if a firewall is provided as in Patent Literature 2, there is a very high risk that the backup data to be compared itself is falsified in a state where it is constantly connected to the Internet. There is a problem that the reliability of the tampering detection due to the above is reduced.

  There is also a need for a system that can quickly and automatically repair a database stored in a server connected to a communication line, not limited to homepage data, when the database is tampered with.

  SUMMARY OF THE INVENTION It is an object of the present invention to provide a database repair system which can solve the problems based on the conventional technique, can improve the reliability of tampering detection, and can quickly and automatically repair data tampering. .

In order to achieve the above object, the present invention provides a repair-only terminal connected via a communication line to a server having a first database in which data is stored,
A communication control unit that controls communication with the server,
A second database that stores the data stored in the first database downloaded from the server via the communication line as original data when the communication control unit newly stores and updates the data; And a third database that stores the data stored in the first database as compare data, downloaded from the server via the communication line at a fixed cycle or at a predetermined timing;
A tampering check unit that compares the content of the original data with the content of the compare data, and detects whether the data stored in the first database has been tampered with;
A database restoration unit that uploads the original data to the server via the communication line and restores data in the first database when the alteration check unit detects that the data has been altered. A database restoration system characterized by comprising:

Here, the repair-only terminal includes a fourth database,
When the falsification check unit detects that the data has been falsified, it is preferable that difference information between the original data and the compare data is generated and stored in the fourth database.

  Further, it is preferable that the restoration-dedicated terminal includes an administrator notification unit that notifies a previously registered administrator when the falsification check unit detects that the terminal has been tampered with.

Further, further comprising a communication line controller between the communication line and the restoration dedicated terminal,
The restoration dedicated terminal is controlled by the communication control unit, includes a USB interface for transmitting a control signal to the communication line controller,
The communication line controller is turned on / off to transmit a switch for controlling physical connection / disconnection between the communication line and the restoration dedicated terminal, and transmitted from the restoration dedicated terminal via a USB interface. Preferably, a line control instruction unit for controlling ON / OFF of the switch according to a control signal is provided.

  Further, the communication line controller may further manually forcibly turn on the switch and set the switch to the always-on mode, or the line control instruction unit may set the switch to a disconnection control mode for controlling on / off of the switch. It is preferable to provide a manual connection control unit for controlling whether to set.

  Preferably, the repair-only terminal uses one of Linux, Windows, and Unix as an operating system.

  It is preferable that the repair-only terminal is operated without executing an existing application program.

  Preferably, the data stored in the first database is data of a homepage.

  In addition, it is preferable that the falsification checking unit compares data of all lower-level homepages specified by the top page of the homepage, excluding the specified exclusion items.

  Since the database repair system of the present invention includes a dedicated repair terminal independent of the server, even if the server is attacked and its function stops, the dedicated repair terminal can operate regardless of the state of the server. is there. Further, by providing the function of notifying the administrator, it is possible to recognize the tampering at an early stage, and after the automatic repair, it is possible to investigate the tampering using the difference information. In addition, by installing a line controller, using an operating system with a low penetration rate, or operating without using existing application programs, the risk of attacks on repair-only terminals via communication lines is greatly increased. And the reliability of falsification detection can be improved.

  Hereinafter, the database repair system of the present invention will be described in detail based on a preferred embodiment shown in the accompanying drawings.

  FIG. 1 is a schematic diagram of an embodiment showing a configuration of a system to which a database repair system of the present invention is applied. A system 10 shown in FIG. 1 has a function of detecting falsification of data on a homepage (hereinafter also referred to as HP) and automatically recovering the data. The system 10 includes a web server 14, a client 16, (Hereinafter, referred to as an HP restoration system) 18.

  Here, the web server 14, the client 16, and the HP restoration system 18 are mutually connected via a communication line 20 such as a LAN (local area network) or the Internet.

  The web server 14 is a computer for publishing the HP corresponding to the viewing HP data stored in the database 12, and is basically always on the communication line 20 except when newly storing and updating the HP data. It is connected.

  The client 16 is a computer that can access the web server 14 via the communication line 20. Although not shown, the number of clients 16 is not limited to one, and includes a computer for developing HP data, a computer of a general user who accesses and uses the web server 14, and the like.

  The developed HP data is uploaded from the client 16 to the web server 14 via the communication line 20. In the web server 14, after the HP data uploaded from the client 16 is stored in the database 12, the HP corresponding to the HP data is made public via the communication line 20. When updating the HP data, the publication of the HP is temporarily stopped, and similarly the HP data in the database 12 is updated.

  The HP repair system 18 detects that the HP data stored in the database 12 has been tampered with and automatically repairs it. The HP controller 18 has a line controller 22 and a dedicated terminal for a homepage repair system (hereinafter referred to as “repair”). Dedicated terminal 24). The line controller 22 controls physical connection / disconnection between the restoration dedicated terminal 24 and the communication line 20. The restoration dedicated terminal 24 is a computer that detects falsification of HP data and automatically repairs the data.

  Since the HP repair system 18 is configured by a dedicated computer independent of the web server 14, even when the web server 14 is attacked and stops functioning, the HP repair system 18 changes to the state of the web server 14. It is operable regardless.

  Hereinafter, the HP repair system 18 will be described in detail.

  FIG. 2 is a schematic diagram of an embodiment showing a configuration of the database repair system of the present invention. As shown in the figure, first, the restoration dedicated terminal 24 includes a line control interface unit 26, an application program unit 28, a database 30 of original data, a database 31 of compare data, and a database 32 of difference information. ing.

  The HP data stored in the database 12 of the web server 14 is downloaded to the database 30 via the communication line 20 at the time of new storage and update of the HP data under the control of the communication control unit 40, which will be described later. Is stored as Similarly, under the control of the communication control unit 40, the HP data stored in the database 12 is downloaded to the database 31 at a predetermined cycle or at a predetermined timing, and is stored as compare data.

  Subsequently, the application program unit 28 is software that checks whether the HP data has been tampered with and, if it has been tampered with, detects that the data has been tampered with. A restoration unit (hereinafter, referred to as an HP restoration unit) 36, an administrator notification unit 38, and a communication control unit 40 are provided. Each unit of the application program unit 28 is configured by a program that operates on a computer constituting the restoration dedicated terminal 24.

  After the compare data is stored in the database 31, the falsification checking unit 34 compares the original data stored in the database 30 with the compare data stored in the database 31 to check for falsification. The falsification check is determined based on whether or not the contents of the original data and the contents of the compare data completely match. By confirming the exact match of the data contents, it is possible to accurately detect even tampering with details that are difficult to understand at first glance.

  When the falsification check unit 34 detects that there is falsification, difference information between the original data and the compare data is generated and stored in the database 32. Although this difference information is not an essential component, it can be effectively used at the time of falsification investigation after automatic restoration of HP data.

  The tampering check unit operates by designating the top page of the HP so that the data of all lower HPs can be compared. As a result, when the HP data is updated, newly added data is also automatically subjected to comparison, so that maintenance work can be omitted. However, it is preferable that it is possible to specify that data that dynamically changes, such as input information of a questionnaire, be excluded from comparison.

  The HP restoration unit 36 uploads the original data stored in the database 30 to the web server 14 via the communication line 20 when the tampering check unit 34 detects that the HP data is automatically restored.

  When the falsification check unit 34 detects that the data has been tampered with, the notification unit 38 notifies the administrator who has been registered in advance using, for example, an electronic mail or a mobile mail. . The administrator notification unit 38 is not an essential component, but by providing it, the administrator can know in a timely manner that the information has been tampered with.

  The communication control unit 40 controls communication with the web server 14 via the line control interface unit 26 described below.

  Subsequently, the line control interface unit 26 is hardware for physically connecting the restoration dedicated terminal 24 and the line controller 22, and includes a USB (Universal Serial Bus) interface 42, a line controller interface 44, , A communication interface 46.

  The USB interface 42 is for connecting the dedicated repair terminal 24 and the line controller 22 via a USB cable. Since the USB interface 42 is conventionally known, a detailed description thereof will be omitted.

  The line controller interface 44 transmits a signal for controlling whether to physically connect or disconnect the restoration dedicated terminal 24 and the communication line 20 via the USB interface 42 according to the control of the communication control unit 40. 22.

  The communication interface 46 is for connecting the restoration dedicated terminal 24 and the communication line 20 via a network cable such as Ethernet (registered trademark). Since the communication interface 46 is also known, its detailed description is omitted.

  The repair-dedicated terminal 24 preferably uses an operating system having a relatively low penetration rate, such as LINUX. In this case, each unit of the application program unit 28 is configured by software operating on this operating system. As a result, it is possible to significantly reduce the risk that the security terminal of the operating system is attacked and the function of the dedicated repair terminal 24 stops. The operating system used in the repair dedicated terminal 24 is not limited to Linux. For example, a conventionally known operating system such as Windows (Windows (registered trademark) (manufactured by Microsoft)) or Unix (UNIX (registered trademark)) may be used. It is also possible to use it.

  In addition, it is preferable that the restoration dedicated terminal 24 be operated without executing an existing application program such as an Internet browser. As a result, the risk that the security terminal of the existing application program is attacked and the repair dedicated terminal 24 stops functioning or the data in the databases 30 and 31 is falsified can be greatly reduced. Can greatly improve the reliability of tampering detection.

  Next, as shown in FIG. 2, the line controller 22 includes a line control instructing unit 48, a manual connection control unit 50, and a switch 52.

  The line control instructing unit 48 controls on / off of the switch 52 according to a control signal transmitted via the USB interface 42. Although not shown, the line controller 22 also has a USB interface, and the USB interface of the line controller 22 and the USB interface 42 of the restoration dedicated terminal 24 are connected to each other via a USB cable, and signal transmission and reception are performed. Done.

  The manual connection control unit 50 manually sets the switch 52 to the ON state and sets the switch 52 to the continuous connection mode, or sets the switch 52 to the disconnection control mode in which the ON / OFF of the switch 52 is controlled by the control of the line control instruction unit 48. Control. Although the manual connection control unit 50 is not an essential component, the provision of the manual connection control unit 50 makes it possible to set the connection mode to the always-on connection mode, and to set the connection state substantially to the same state as when the line controller 22 is not provided. Becomes possible. The manual connection control unit 50 is not particularly limited as long as it is a unit that can manually set the constant connection mode and the disconnection control mode, and examples thereof include a toggle switch and a button switch.

  The switch 52 controls the physical connection / disconnection between the communication interface 46 and the communication line 20. In the disconnection control mode, the on / off of the switch 52 is controlled by the control of the line control instruction unit 48. When the switch 52 is on, a network cable for connecting the communication interface 46 and the communication line 20 is physically connected, such as an Ethernet (registered trademark) cable, and when the switch 52 is off, the network cable is physically connected. Be cut off.

  In this manner, the connection between the repair-dedicated terminal 24 and the communication line 22 is not cut off electrically but physically cut off, so that the repair-dedicated terminal 24 is attacked via the communication line 22. Can be more completely prevented.

  The network cable for connecting the restoration dedicated terminal 24 and the communication line 20 is physically connected when the manual connection control unit 50 sets the constant connection mode and when the HP data is newly stored and updated. Sometimes, when downloading the HP data stored in the database 12 to the database 30, and when restoring the HP data, when uploading the HP data stored in the database 30 to the database 12, and when notifying the administrator Only.

  As described above, in the HP restoration system 10, the line controller 22 is provided between the restoration dedicated terminal 24 and the communication line 20, and the restoration dedicated terminal 24 and the communication line 20 are connected only when it is necessary to connect to the communication line 20. And is controlled to connect. Thus, the risk of the HP restoration system 10 being attacked via the communication line 20 can be significantly reduced, and the reliability of the falsification detection by the restoration dedicated terminal 24 can be further improved.

Hereinafter, the operation of the HP restoration system 18 will be described.
In the following description, it is assumed that the manual connection control unit 50 has set the disconnection control mode.

  First, at the time of new storage and update of HP data, the communication control unit 40 transmits the HP data stored in the database 12 via the communication line 20, the network cable (including the switch 52 in the middle), and the communication interface 46. The data is downloaded to the repair dedicated terminal 24 and stored in the database 30 as original data.

  When communication is performed between the restoration dedicated terminal 24 and the communication line 20, a control signal is transmitted from the communication control unit 40 to the line control instruction unit 48 via the line controller interface 44 and the USB interface 42. . The switch 52 is turned on by this control signal, and the dedicated repair terminal 24 and the communication line 20 are physically connected via the network cable. After the end of the communication, the switch 52 is turned off, and the physical connection is disconnected.

  Thereafter, the HP data stored in the database 12 is downloaded to the restoration dedicated terminal 24 at a fixed cycle or at a predetermined timing, and is stored in the database 31 as compare data.

  After the compare data is stored in the database 31, under the control of the tampering check unit 34, the original data and the compare data are compared, and the presence or absence of the tampering is detected.

  When the tampering check unit 34 detects that the data has been tampered with, difference information between the original data and the compare data is generated and stored in the database 32. Also, the original data is uploaded from the restoration dedicated terminal 24 to the web server 14 by the HP restoration unit 36, and the HP data in the database 12 is automatically restored. In addition, the administrator notification unit 38 notifies a previously registered administrator that the HP data has been tampered with.

  In this way, when the HP restoration system 18 detects that the HP data has been tampered with, the HP data in the database 12 is automatically restored immediately and the administrator is notified. Therefore, even if the HP data has been tampered with, it can be restored instantly without stopping the publication of the HP. Also, the administrator can know in a timely manner that the data has been tampered with, and after repairing the HP data, can use the difference information to check for tampering with sufficient time.

  In the above embodiment, the HP restoration system has been described as an example. However, the present invention is not limited to the restoration of a homepage, but can be applied to the restoration of any database. Further, the concept of the database according to the present invention includes a file. In addition, the line controller is not limited to being used in a database restoration system, but establishes a physical connection between the electronic device and the communication line only when necessary, and when not necessary, establishes a connection between the electronic device and the communication line. It can be used in various systems that need to disconnect the physical connection with.

The present invention is basically as described above.
As described above, the database restoration system of the present invention has been described in detail. However, the present invention is not limited to the above embodiment, and various modifications and changes may be made without departing from the gist of the present invention. is there.

It is a schematic diagram of one embodiment showing the composition of the system which applies the database restoration system of the present invention. FIG. 1 is a schematic diagram of an embodiment showing an internal configuration of a database restoration system of the present invention. It is an example flowchart showing the process of restoring a conventional homepage.

Explanation of reference numerals

DESCRIPTION OF SYMBOLS 10 System 12, 30, 31, 32 Database 14 Web server 16 Client 18 Homepage restoration system 20 Communication line 22 Line controller 24 Dedicated terminal for homepage restoration system 26 Line control interface unit 28 Application program unit 34 Tamper check unit 36 Homepage restoration unit 38 administrator notification unit 40 communication control unit 42 USB interface 44 line controller interface 46 communication interface 48 line control instruction unit 50 manual connection control unit 52 switch

Claims (9)

A repair-only terminal connected via a communication line to a server having a first database in which data is stored,
A communication control unit that controls communication with the server,
A second database that stores the data stored in the first database downloaded from the server via the communication line as original data when the communication control unit newly stores and updates the data; And a third database that stores the data stored in the first database as compare data, downloaded from the server via the communication line at a fixed cycle or at a predetermined timing;
A tampering check unit that compares the content of the original data with the content of the compare data, and detects whether the data stored in the first database has been tampered with;
A database restoration unit that uploads the original data to the server via the communication line and restores data in the first database when the alteration check unit detects that the data has been altered. A database repair system comprising: The repair-only terminal includes a fourth database,
2. The database restoration system according to claim 1, wherein when the alteration check unit detects that alteration has been performed, difference information between the original data and the compare data is generated and stored in the fourth database. 3. .   3. The restoration dedicated terminal according to claim 1, wherein the falsification check unit includes an administrator notification unit configured to notify a previously registered administrator when tampering is detected. 4. Database repair system. Further, a communication line controller is provided between the communication line and the restoration dedicated terminal,
The restoration dedicated terminal is controlled by the communication control unit, includes a USB interface for transmitting a control signal to the communication line controller,
The communication line controller is turned on / off to transmit a switch for controlling physical connection / disconnection between the communication line and the restoration dedicated terminal, and transmitted from the restoration dedicated terminal via a USB interface. The database repair system according to any one of claims 1 to 3, further comprising a line control instruction unit that controls on / off of the switch according to a control signal.   The communication line controller further manually forcibly turns on the switch and sets the switch to an always-on mode, or sets the line control instruction unit to a disconnection control mode for controlling on / off of the switch. The database restoration system according to claim 4, further comprising a manual connection control unit that controls the operation.   The database repair system according to any one of claims 1 to 5, wherein the repair-only terminal uses any one of Linux, Windows, and Unix as an operating system.   The database restoration system according to claim 1, wherein the restoration dedicated terminal is operated without executing an existing application program.   The database restoration system according to any one of claims 1 to 7, wherein the data stored in the first database is homepage data.   9. The database restoration system according to claim 8, wherein the falsification check unit compares data of all lower-level homepages specified by the top page of the homepage, excluding specified exclusion items. 9.

Images