JP2007272574A - Bulletin board system and unauthorized contribution prevention method thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a bulletin board system and an unauthorized contribution prevention method, capable of effectively preventing an unauthorized contribution by an automatic contribution program. <P>SOLUTION: Identification information for specifying a GET method is added into the GET method 211, the identification information is inspected in a POST method 212 (213), and it is decided whether a client is a regular client 202 executing the GET method 211 or not on the basis of identity of the identification information and a lapsed time until receiving the POST method 212. When the POST method is the POST method from the unauthorized client, it is rejected. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a bulletin board system using a communication protocol for connecting to a server, and more particularly to a system and method for preventing unauthorized writing by an automatic posting program or the like.

  With the spread of the Internet, a web-based information transmission method called a bulletin board has exploded, and it has become easier to transmit personal opinions externally. This trend itself is welcome, but it has become easier to send information than it was in the past, and it has become a hotbed for troubles such as irresponsible slander, slander and speculation due to speculation. Has become a problem.

  In addition to the problem of increasing the number of people who do not follow manners on the bulletin board in this way, the recent increase in writing is an automatic writing program (commonly known as “robot” or “bot”) (commonly known as “trolling”). ). Usually, the contents written by the automatic posting program are often undesirable from the viewpoint of public order and morals, such as solicitation to adult sites, and are usually completely unrelated to the theme of the bulletin board. If an automatic posting program is used, it can be written easily at 1000 times or 10,000 times, so the contents of the bulletin board are filled with the contents of the automatic writing program, and the function as the bulletin board can be stopped as an actual problem.

  If such a problem is left unattended, the WEB-based bulletin board system becomes unreliable as it becomes popular as a means for transmitting personal information. Therefore, how to limit the vandalism of the bulletin board by such an automatic posting program is an important issue, and various solutions have been proposed.

  For example, Japanese Patent Application Laid-Open No. 2004-334458 (Patent Document 1) discloses an electronic bulletin board monitoring system that examines the content of a post and disallows posting of the post when an inappropriate word or phrase is included therein. Has been.

  In the method control method disclosed in Japanese Patent Application Laid-Open No. 2004-348202 (Patent Document 2), whether or not the proxy server between the client and the server permits the use of the HTTP method is registered in advance for each URL. In addition, the use of the HTTP method is restricted for each access destination URL of the HTTP request.

  All of these conventional methods attempt to eliminate illegal writing and the like by preparing a database for specifying the restriction target in advance.

JP 2004-334458 A JP 2004-348202 A

  However, these methods have a problem that it takes time and effort because the inappropriate words and URL information to be regulated must be constantly updated. In addition, if an automatic deletion is performed simply because it contains inappropriate words, there is a possibility of erroneous deletion that deletes even a post that should not be rejected. On the other hand, in a system that notifies the administrator to prevent accidental deletion and deletes it after the administrator confirms the contents, the administrator will check all suspicious posts, and the administrator is proportional to the number of posts. Will increase the burden.

  Further, in the conventional method, since the command (GET) for downloading the posting form on the bulletin board and the command (POST) for uploading the writing information are independent, it is possible to write illegally. It was. For example, this is the case.

  FIG. 7 is a sequence diagram for explaining the conventional GET and POST methods. The server 701 transmits a GET method 711 in response to the request from the client 702. The GET method 711 includes two input fields: name and message corresponding to name and opinion.

  The client 702 displays a screen according to the information obtained by the GET method 711, and the user inputs and transmits it. As a result, the POST method 712 is transmitted from the client 702 to the server 701. This includes the information entered on the screen (here: name: Taro Yamada, opinion: claim for purchased product ...). What is important here is that in the server 701, the GET method 711 and the POST method 712 are independent and the two operations are not associated with each other.

  FIG. 8 is a sequence diagram showing a case where illegal writing is performed in the conventional GET method and POST method. Here, an example in which a plurality of clients 801, 802 and 803 communicate with one server 701 is shown.

  First, it is assumed that the client (A) 801 executes the GET method 811. If the client 801 normally returns the POST method, it is assumed that the client (B) 802 receives information on the GET method 811 from the client 801 and returns the POST method 812 on behalf of the client. In this case, the server 701 accepts the POST method 812 without any particular problem. This is possible because the GET method 811 and the POST method 812 are independent.

  If this is abused, it becomes possible for the client (C) 803 to make an illegal post (distraction). That is, as the client 802 POSTs on behalf of the client, the client C (504) can perform the POST methods 813, 814..., And the server 701 normally accepts the posting even if the same content is written a plurality of times. . In particular, in the case of a program in which the client 803 automatically posts, it will be greatly inconvenienced.

  An object of the present invention is to provide a bulletin board system and an illegal posting prevention method capable of effectively preventing unauthorized posting by an automatic posting program or the like.

  In the electronic bulletin board system using the communication protocol for connecting to the server, the unauthorized post prevention method according to the present invention adds identification information for specifying the acquisition request to the acquisition target information in response to the acquisition request from the client. When the information write request corresponding to the acquisition request is received, the identification information added to the information write request is compared with the identification information for specifying the acquisition request, and the identification information In accordance with the comparison result, it is determined whether or not to reject the information write request.

  According to an embodiment of the present invention, the identification information for specifying the acquisition request is time information when the acquisition target information is transmitted. In particular, when the time when the information write request corresponding to the acquisition request is received has passed a predetermined time or more from the time indicated in the time information added to the information write request, the information write It is characterized by rejecting the request. Alternatively, the identification information for specifying the acquisition request may be identification information for specifying the client. If the identification information added to the information write request does not match the identification information for specifying the acquisition request, the information write request is rejected.

  According to another aspect of the present invention, there is provided a terminal or a client that executes a GET method by adding means for adding identification information for specifying the GET method in the GET method and means for checking the identification information in the POST method. A POST method from another terminal or client program unrelated to the program is rejected.

  According to the present invention, it is determined whether or not to reject the information write request based on the comparison result between the identification information added to the information write request and the identification information for specifying the acquisition request. Accordingly, it is possible to effectively prevent posting by an unauthorized client. In particular, in a bulletin board system using the HTTP protocol, a large amount of illegal writing by an automatic posting program or the like can be effectively prevented by linking a GET method and a POST method with identification information.

1. Configuration FIG. 1 is a block diagram showing a functional configuration of a bulletin board providing server according to an embodiment of the present invention. The bulletin board providing server 101 has a processing system for transmitting information to the Internet and a transmission system for performing the transmission, and a receiving system for processing the reception and reception information.

  The transmission system includes a form generation unit 111 that generates an input form for a user, an identification information generation unit 113 that is a feature of the present invention, and a transmission protocol processing unit 112 that actually transmits data to the Internet. The reception system includes a reception protocol processing unit 114 that receives data from the Internet, a form processing unit 115 that receives input data from a user, an identification information inspection unit 116 that is a feature of the present invention, and a form processing unit 117. .

  Note that a control unit that controls the overall operation of the bulletin board providing server 101 is not shown. This control unit is typically a program control processor such as a CPU. The functional blocks 111 to 117 shown in the figure may be configured in hardware, but similar functions can be realized by executing corresponding programs on the program control processor.

  According to the present embodiment, the transmission system identification information generation unit 113 and the reception system identification information inspection unit 116 are linked. As will be described in detail later, when transmitting the input form to the user, when the identification information generated by the identification information generation unit 113 is added and a form in which data is written is received from the user, the identification information inspection unit 116 receives the received form. It is checked whether or not the identification information added to is generated by the identification information generation unit 113, or whether or not a predetermined time condition is satisfied even if the identification information is the same. Based on the check result, the form receiving unit 115 determines whether to accept or reject the received form.

2. Operation FIG. 2 is a sequence diagram for explaining the overall operation of the bulletin board system according to the present embodiment. The server 201 that provides the bulletin board system corresponds to the bulletin board providing server 101 shown in FIG. The client 202 acquires input form information from the server 201 by the GET method 211. An input form usually has a plurality of fields composed of three elements of type, name, and value. In this example, a form having three fields whose names are username, ID, and message are shown.

  The ID is identification information generated by the identification information generation unit 113 of the server 201, and is transmitted to the client 202 by the field <type = hidden name = ID value = "identification information"> of the GET method 211. In this example, since the hidden characteristic is given to the ID, the field is hidden on the client and cannot be seen by human eyes.

  The identification information generated by the identification information generation unit 113 is preferably information that can identify a GET method or a client. For example, the time when the server executes the GET method and the specific information (IP address, browser name, etc.) of the client that executed the GET method can be used.

  The client 202 displays a screen from information acquired by the GET method 211. Since the ID has a hidden characteristic, the ID is not displayed on the screen. In this example, username and message are information input by the user. When the user performs a transmission operation after inputting on the screen, a POST method 212 is issued from the client 202 to the server 201.

  In the POST method 212, information input by the user is transmitted to the server 201 as it is in text format. Normally, the information entered on the screen is embedded as value, and the field <type = hidden name = ID value = “identification information”> of the hidden characteristic that did not request the screen input is returned as it is. Therefore, the identification information included in the GET method 211 and the identification information included in the POST method 212 are the same unless changed intentionally by the client 202.

  The identification information inspection unit 116 of the server 201 compares the identification information transmitted by the GET method 211 with the identification information received by the POST method 212 (ID inspection processing 213), and determines whether to accept the posting or reject the posting. Do. Posts determined to be fraudulent will be rejected.

3. Embodiments In order to describe the present invention specifically, a bulletin board system that listens to opinions from customers is assumed, and only two input fields, name and opinion, are provided to simplify the explanation. Also, the time when the GET method is executed is used as the identification information generated by the identification information generation unit 113.

  FIG. 3 is a diagram showing an example of an input form displayed on the client terminal. The input form 301 is a portion displayed by a WEB browser on the client terminal. In the input form 301, a name field 302, an opinion writing field 303, and a send button 304 for sending after entry are displayed. By clicking the send button 304, a POST method is issued.

  FIG. 4 is a sequence diagram for explaining the overall operation of the bulletin board system according to the first embodiment of the present invention. The server 201 that provides the bulletin board system corresponds to the bulletin board providing server 101 shown in FIG. In response to the request from the client 202, the server 201 transmits information constituting the screen shown in FIG. “Identification information” in the field <type = hidden name = ID value = “identification information”> of the GET method 211 is date information. In this example, date information “2006-01-31-13: 34” of January 31, 2006, 13:34 is added.

  The client 202 generates an input screen from the GET method 211, and issues a POST method 212 when the user presses a send button on the screen.

  When the POST method 212 is received, the identification information inspection unit 116 of the server 201 compares the date information included in the POST method 212 with the current time of the server 201 (213, 214). In this embodiment, posting is rejected when the elapsed time from the GET method 211 to the POST method 212 is equal to or greater than a predetermined limit value (for example, one day or more). Normally, when the tampering is performed by the automatic posting program, it takes a little time because the automatic posting program is created from the GET method. Therefore, it is possible to eliminate most automatic posting programs by rejecting writing that has passed for a certain period of time.

  For example, if the POST method 212 is a legitimate client 202, the POST method 212 will arrive within a predetermined elapsed time from the date information "2006-01-31-13: 34" contained therein, Posting is permitted by the date inspection (213) of the identification information inspection unit 116.

  On the other hand, if the POST method 214 is an unauthorized client 202, the POST method 214 has the same date information “2006-01-31-13: 34” included in the POST method 214 as that when the GET method 211 is issued. Even so, the posting will be rejected by the date check (215) of the identification information checking unit 116, since it will arrive after a predetermined elapsed time.

  The bulletin board providing server 201 of the system according to this embodiment operates as follows.

  FIG. 5A is a flowchart of the GET method in the bulletin board providing server, and FIG. 5B is a flowchart of the POST method. First, in FIG. 5A, when a request is received from a client, the server form generation unit 111 generates a basic form (step S401), and the identification information generated by the identification information generation unit 113 (current time in this example). Is added (step S402). In this way, the transmission protocol processing unit 112 transmits the input form with the current time as identification information to the requesting client (step S403).

  Subsequently, as shown in FIG. 5B, when the form is received from the client (step S501), the identification information inspection unit 116 receives the time information and the form as the identification information added to the received form. The time is compared (step S502). If the elapsed time is within one day, the received form is accepted as a normal post (step S503), but if one day has passed, the post is rejected (step S504).

  In addition, although “1 day” is used as the time passage reference, it is not particularly limited to “1 day”. It is appropriate to determine the optimum value for efficiently eliminating the automatic posting program by looking at the result of actually implementing the present invention.

  The unauthorized posting prevention method according to the present invention is not applied only to the server, but may be applied to an alternate server between the bulletin board server and the client.

  FIG. 6 is a sequence diagram for explaining the overall operation of the bulletin board system according to the second embodiment of the present invention. The system according to this embodiment includes a bulletin board server 601, a proxy server 602, and a client 202, and the illegal posting prevention function according to the present invention is provided in the proxy server 602.

  The proxy server 602 adds identification information to and checks the input form exchanged between the bulletin board server 601 and the client 202, and transfers only the received form that has passed the inspection to the bulletin board server 601 for inspection. A reception form that does not pass is not transferred to the bulletin board server 601. In order to realize this function, the proxy server 602 identifies the next functional unit in FIG. 1, that is, the transmission protocol processing unit 112 and the reception protocol processing unit 114 for performing communication between the bulletin board server 601 and the client 202. The information generation unit 113, the identification information inspection unit 116, the form processing unit 117, and a control unit that performs operation control as a proxy server are included.

  In FIG. 6, first, the proxy server 602 transfers a request from the client 202 to the bulletin board server 601, and the bulletin board server 601 responds to the request by the GET method 611 with original information that does not include identification information (here, Information corresponding to the display shown in FIG. 3) is transmitted. When the proxy server 602 receives the original information by the GET method 611, the identification information generation unit 113 generates a GET method 612 in which a field of identification information (here, date information) is added to the GET method 611, and sends it to the client 202. Send. The control unit of the proxy server 602 waits for the POST method 613 for the GET method 612 to be received from the client 201.

  Upon receiving the POST method 613, the identification information checking unit 116 of the proxy server 602 compares the date information included in the POST method 613 with the current time (614, 617), and discards it as a posting rejection if it exceeds a certain time. To do. If it is within a predetermined time, the control unit returns a POST method obtained by removing the identification information field from the received POST method 613 to the bulletin board server 601.

  For example, if the POST method 613 is a valid client 202, the POST method 613 is identified because the date information “2006-01-31-13: 34” included in the POST method 613 will arrive within a predetermined elapsed time. Posting is permitted by the date check (614) of the information check unit 116, and the POST method 615 obtained by removing the identification information field from the received POST method 613 is returned to the bulletin board server 601.

  On the other hand, if the POST method 613 is an unauthorized client 202, the POST method 613 indicates that the date information “2006-01-31-13: 34” included in the POST method 613 is the same as that when the GET method 612 is issued. Even so, the posting will be rejected by the date check (617) of the identification information checking unit 116 because it will arrive after a predetermined elapsed time.

  In this way, the proxy server 602 performs fraud monitoring, so that illegal posting can be prevented without modifying the program of the bulletin board server 601 at all.

  In the operation mode shown in FIG. 6, the proxy server 602 provides a fraudulent posting monitoring service, and the operator of the proxy server 602 charges the operator of the bulletin board server 601 or the client user as the price of the service. It becomes possible to run a business. It is also possible to provide a monitoring service on behalf of the bulletin board server operator or the client user without charging the proxy server operating cost by inserting an advertisement or the like in the proxy server 602.

  As described above, unauthorized posting by an automatic posting program can be prevented by adding identification information to the GET method and inspecting the identification information by the POST method. In the first and second embodiments, the time of the GET method is used as the identification information. However, there is valid identification information other than the time, such as the IP address of the client and the browser name. It is not a thing. In addition, it is also effective for preventing unauthorized posting so that the person who creates the automatic posting program cannot easily imagine what kind of identification information is contained even if he / she looks at the GET method.

  The present invention is generally applicable to an electronic bulletin board system in which a user receives predetermined information from a server, adds desired information to the information, and transmits the information to the server.

It is a block diagram which shows the functional structure of the bulletin board provision server by one Embodiment of this invention. It is a sequence diagram for demonstrating the whole operation | movement of the bulletin board system by this embodiment. It is a figure which shows an example of the input form displayed on a client terminal. It is a sequence diagram for demonstrating the whole operation | movement of the bulletin board system by 1st Example of this invention. (A) is a flowchart of the GET method in the bulletin board providing server, and (b) is a flowchart of the POST method. It is a sequence diagram for demonstrating the whole operation | movement of the bulletin board system by 2nd Example of this invention. It is a sequence diagram for demonstrating the conventional GET and POST method. It is a sequence diagram which shows the case where illegal writing is performed in the conventional GET method and POST method.

Explanation of symbols

101 bulletin board providing server 111 form generation unit 112 transmission protocol processing unit 113 identification information generation unit 114 reception protocol processing unit 115 form reception unit 116 identification information inspection unit 117 form processing unit

Claims (13)

In the illegal posting prevention method of the electronic bulletin board system using the communication protocol for connecting to the server,
In response to the acquisition request from the client, identification information for specifying the acquisition request is added to the acquisition target information and transmitted to the client,
When an information write request corresponding to the acquisition request is received, the identification information added to the information write request is compared with the identification information for specifying the acquisition request,
Determining whether to reject the information write request according to the comparison result of the identification information;
An illegal posting prevention method for an electronic bulletin board system.   2. The unauthorized posting rejection method according to claim 1, wherein the identification information for specifying the acquisition request is time information when the acquisition target information is transmitted.   When the time when the information write request corresponding to the acquisition request is received has passed a predetermined time or more from the time indicated in the time information added to the information write request, the information write request is 3. The method for rejecting unauthorized posting according to claim 2, wherein the rejection is rejected.   2. The unauthorized posting rejection method according to claim 1, wherein the identification information for specifying the acquisition request is identification information for specifying the client.   The information write request is rejected when the identification information added to the information write request does not match the identification information for specifying the acquisition request. The method of rejecting unauthorized postings according to item 1. In the illegal posting prevention method of the electronic bulletin board system using the HTTP protocol,
Add identification information that identifies the GET method to the GET method information,
Determining whether to reject the POST method by examining the identification information in the POST method;
An illegal posting prevention method for an electronic bulletin board system. In an electronic bulletin board system using a communication protocol for connecting to a server,
Identification information generating means for generating identification information for specifying an acquisition request from a client;
Transmission control means for adding the identification information to the acquisition target information of the acquisition request and transmitting it to the client;
When an information write request corresponding to the acquisition request is received, whether the information write request is rejected by comparing the identification information added to the information write request with the identification information for specifying the acquisition request An identification information inspection means for determining;
An electronic bulletin board system comprising: In a server in an electronic bulletin board system using the HTTP protocol,
Identification information generating means for generating identification information for specifying a GET method for the client;
Transmission control means for adding the identification information to the GET method information and transmitting the information to the client;
Identification information inspection means for determining whether to reject the POST method by inspecting the identification information in the POST method;
The server characterized by having. In an electronic bulletin board system using the HTTP protocol,
A bulletin board providing server and a proxy server of the bulletin board providing server;
The proxy server is
Identification information generating means for generating identification information for specifying a GET method for the client;
Transmission control means for adding the identification information to the GET method information and transmitting the information to the client;
Identification information inspection means for determining whether to reject the POST method by inspecting the identification information in the POST method;
An electronic bulletin board system comprising:   The electronic bulletin board system according to claim 9, wherein the server operator or the client is charged according to the processing content in the proxy server.   10. The electronic device according to claim 9, wherein a service such as an advertisement is provided by the proxy server without charging a server operator or a client user, and the operating cost of the proxy server is covered by revenue for the service. Bulletin board system. In a program for realizing an unauthorized posting prevention function of an electronic bulletin board system using a communication protocol for connecting to a server with a computer,
In response to an acquisition request from the client, adding identification information for specifying the acquisition request to the acquisition target information and transmitting to the client;
When receiving the information write request corresponding to the acquisition request, comparing the identification information added to the information write request with the identification information for specifying the acquisition request;
Determining whether to reject the information write request according to the comparison result of the identification information;
An unauthorized posting prevention program characterized by comprising: In a program for realizing an unauthorized posting prevention function of an electronic bulletin board system using the HTTP protocol by a computer,
Adding identification information for identifying the GET method in the GET method information;
Determining whether to reject the POST method by examining the identification information in the POST method;
An unauthorized posting prevention program characterized by comprising:

Images