JP2008108047A - Communication picture reproducing device and communication picture reproducing program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reproduce a picture which is being communicated of a terminal which has performed communication of a communication content together with an input picture when the communication content to be reproduced includes input value. <P>SOLUTION: A network interface 51 intercepts a packet on a network. A reconstruction part 53 reconstructs a communication content from the intercepted packet. A communication content storage part 42 stores a communicator address, an address of a communicated party, and date and time in association with the communication content. A communication content retrieval part 54 retrieves the communication content from the communication content storage part 42 in accordance with a retrieval condition. An input value determination part 541 determines whether or not the retrieved communication content includes the input value. An input picture acquisition part 542 acquires the communication content including the input picture on the basis of the communicator address, address of the communicated party, or the date and time. A display picture creation part 543 creates a display picture by embedding the input value into the input picture. A reproduction picture display part 55 displays the created display picture. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a communication screen reproduction device and a communication screen for reconstructing communication contents of communication between a terminal and a server and reproducing a screen during communication of a terminal that has performed communication with the reconstructed communication contents. Reproduction program.

  As interest in information leakage prevention solutions has increased in recent years, the contents of communications performed by managed terminals can be intercepted and recorded, and any one of the recorded communications contents can be read out and read. There is an increasing demand for a communication screen reproduction device that reproduces a screen during communication of a terminal that has performed communication with the communication content that has been issued.

  This communication screen reproduction device intercepts a packet on a network segment to be monitored. This packet is, for example, a collection of data obtained by dividing the communication content of communication between the terminal and the Web server. The communication screen reproduction device reconstructs and records the communication content from, for example, one or more packets that have been intercepted. The communication screen reproduction device has a function of searching for recorded communication contents in accordance with, for example, a search condition designated by the user and displaying the searched communication contents to the user.

In such a communication screen reproduction device, communication data passing through the target network is intercepted, classified according to the type of the intercepted communication data, and new search data is added and stored in the analysis result database. The technique to do is disclosed (for example, refer patent document 1). According to this technique, it is possible to easily and reliably confirm the progress of communication using the target network based on the analysis result data stored in the analysis result database.
International Publication No. 02/29579 Pamphlet

  In the communication screen reproduction device as described above, an arbitrary one is read from a plurality of recorded communication contents, and the read communication contents are reproduced (displayed).

  Here, for example, in communication using HTTP (HyperText Transfer Protocol), for example, a case where a user operating a terminal inputs an input value into an input field of an input screen displayed on the screen of the terminal in communication is assumed. In this case, first, for example, communication is performed from the server to the terminal with the communication content including the input screen (information). Then, communication is executed from the terminal to the server with the communication content including the input value for the input screen. At this time, the communication content including the input value does not include the input screen.

  The input screen is included in the communication content of HTTP communication before the communication content including the input value. That is, the communication executed with the communication content including the input screen is a communication (session) different from the communication executed with the communication content including the input value. Therefore, the communication including the communication content including the input value and the input screen. The content is recorded as another communication content.

  For this reason, when the communication content read out for reproduction includes an input value, even if an attempt is made to reproduce the screen during communication of the terminal based on the communication content including the input value, the input in which the input value is input The screen cannot be used. In this case, the communication content is reproduced using only the read communication content (input value).

  That is, even if the read communication content includes the input value input in the input field of the input screen displayed on the screen of the terminal in communication, for example, the input screen cannot be displayed. Is displayed in a completely different form from the screen of the terminal in communication.

  For this reason, for example, a viewer who browses the reproduced communication content cannot know what input value the input value included in the reproduced communication content is input to. Thus, even if the viewer confirms the reproduced communication content, the viewer may not be able to achieve information leakage investigation or other purposes.

  An object of the present invention is to reproduce a communication screen of a terminal that has performed communication with the communication content together with the input screen when the communication content to be reproduced includes an input value input on the input screen. It is an object to provide a communication screen reproduction device and a communication screen reproduction program that are possible.

  According to one aspect of the present invention, there is provided a communication screen reproduction device connected to a network capable of communicating packets in which communication contents of communication between a terminal and a server are divided. The communication screen reproduction device is intercepted by the packet on the network, reconstructed by the reconstruction unit for reconstructing the communication content from the packet intercepted by the intercepted unit, and reconstructed by the reconstructed unit Corresponding to the communication content, the communication source address indicating the terminal that performed the communication performed with the communication content, the communication destination address including the server that performed the communication performed with the communication content, and the communication content Storage means for storing the date and time when the packet that was divided was intercepted, communication content search means for searching communication contents that match the search condition from the storage means, according to the search condition specified by the user, Whether or not the communication content searched by the communication content search means includes an input value input to the input screen displayed on the terminal. When the communication content is determined to include an input value by the input value determination unit that determines according to the content and the input value determination unit, the communication content including the input screen is associated with the communication content including the input value. Input screen acquisition means for acquiring from the storage means based on the communication source address, communication destination address or date and time stored, and the input value included in the communication content determined to include the input value by the input value determination means Display screen creation means for creating a display screen by embedding in the input screen included in the communication content acquired by the input screen acquisition means, and the display screen created by the display screen creation means for the user Display means for displaying.

  According to the present invention, when the communication content to be reproduced includes an input value input to the input screen, the communication screen of the terminal that has performed communication with the communication content can be reproduced together with the input screen. it can.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a block diagram showing a hardware configuration of a client-server system including a communication screen reproduction device according to an embodiment of the present invention.

  The client-server system of FIG. 1 is mainly composed of a plurality of servers and a plurality of client terminals. The plurality of client terminals include a client terminal 20. The plurality of servers includes a server 60. On the client terminal 20, client software that uses the server 60 operates. The client software is a browser, for example. A plurality of client terminals including the client terminal 20 are connected to the server 60 via a network 30 such as the Internet. In FIG. 1, client terminals other than the client terminal 20 and servers other than the server 60 are omitted.

  A computer 10 is connected to the network 30. The computer 10 is connected to an external storage device 40 such as a hard disk drive. The external storage device 40 stores a program 41 executed by the computer 10. The computer 10 and the external storage device 40 constitute a communication screen reproduction device 50.

  FIG. 2 is a block diagram mainly showing a functional configuration of the communication screen reproduction device 50 shown in FIG. The communication screen reproduction device 50 includes a network interface 51, a packet data capture unit 52, a communication content reconstruction unit 53, a communication content search unit 54, and a reproduction screen display unit 55. In the present embodiment, these units 51 to 55 are realized by the computer 10 shown in FIG. 1 executing the program 41 stored in the external storage device 40. This program 41 can be stored in advance in a computer-readable storage medium and distributed. Further, this program 41 may be downloaded to the computer 10 via the network 30.

  The communication screen reproduction device 50 includes a communication content storage (accumulation) unit 42. In the present embodiment, the communication content accumulation unit 42 is stored in the external storage device 40.

  The communication screen reproduction device 50 is connected to a network capable of intercepting packets (packet data) obtained by dividing communication contents between a plurality of client terminals including the client terminal 20 and a plurality of servers including the server 60, for example. Yes.

  The network interface 51 intercepts a packet on a network (network segment) to be monitored for the communication screen reproduction device 50.

  When the communication between the client terminal and the server (for example, the Web server) is, for example, communication using HTTP (HyperText Transfer Protocol), an HTTP request is transmitted from the client terminal to the Web server, and A response to the HTTP request is returned. This series of processing (contents) is defined as one communication content (one session). Note that this HTTP request may include a Referer header (reference source address) indicating, for example, information (page) of a reference source referred to by a user during HTTP communication.

  Further, the number of packets constituting one communication content varies depending on the communication content capacity, for example. Each of the divided packet data includes, for example, a communication (transmission) source address indicating a terminal that communicates (transmits) the packet data, or a communication (transmission) destination address including a Web server that is a communication partner of the terminal, for example. Contains the port number.

  The packet capture unit 52 has a function of capturing a packet intercepted by the network interface 51. Further, the packet capture unit 52 assigns the date and time (date and time information indicating the date and time) when the packet was intercepted by the network interface 51 to the captured packet.

  The communication content reconstruction unit 53 reconstructs one communication content from one or more packets constituting one communication content captured by the packet data capture unit 52. At this time, the communication content reconstruction unit 53 reconstructs the communication content based on, for example, the port number included in each packet. The communication content reconstruction unit 53 stores (accumulates) the reconstructed communication content in the communication content accumulation unit 42. This communication content includes a URL (Uniform Resource Locator) indicating the position on the network of information to be communicated according to the communication content.

  At this time, the communication content reconstruction unit 53 stores the communication source address, the communication destination address, and the date and time in the communication content storage unit 42 in association with the reconstructed communication content. The communication source address is stored based on the communication source address included in the packet constituting the communication content reconstructed by the communication content reconstruction unit 53. Similarly, the communication destination address is stored based on the communication destination address included in the packet constituting the communication content reconstructed by the communication content reconstruction unit 53. The date and time are stored in accordance with the date and time given by the packet data capture unit 52 to the packet constituting the communication content reconstructed by the communication content restructuring unit 53. Here, for example, when the communication content composed of a plurality of packets is reconstructed by the communication content reconstruction unit 53, the packet first intercepted by the network interface 51 among the plurality of packets constituting the communication content. The date and time assigned to is stored. The date and time given to the packet last intercepted by the network interface 51 among the plurality of packets constituting the communication content may be stored.

  The communication content search unit 54 searches the communication content storage unit 42 for communication content that matches the search condition, for example, according to the search condition specified by the user (viewer). The communication content search unit 54 has a function of outputting the searched communication content to the reproduction screen display unit 55.

  The communication content search unit 54 includes an input value determination unit 541, an input screen search unit 542, and a display screen creation unit 543.

  The input value determination unit 541 inputs, for example, the communication content specified (selected) by the user from the communication content searched by the communication content search unit 54 to the input screen displayed on the client terminal as a result of communication. It is determined whether or not the communication content (first communication content) includes the input value. The input value determination unit 541 performs a determination process according to the communication content specified by the user.

  The input screen acquisition unit 542 stores the communication content (second communication content) including the input screen in which the input value included in the communication content determined to include the input value by the input value determination unit 541 is stored as the communication content. Obtained from the unit 42. The input screen search unit 542 communicates communication contents according to the communication source address, communication destination address, or date / time stored in the communication content storage unit 42 in association with the communication content determined to include the input value by the input determination unit 541. To get.

  The input screen acquisition unit 542 includes an input screen search unit 544, an input screen selection unit 545, and an input screen determination unit 546. The input screen search unit 544 is associated with the communication content determined to include the input value by the input value determination unit 541 according to the communication source address, communication destination address, or date / time stored in the communication content storage unit 42. The communication content is searched from the communication content storage unit 42. The input screen selection unit 545 selects the communication source address, communication destination address, or date / time stored in the communication content storage unit 42 in association with each communication content of the communication content searched by the input screen search unit 544. Based on this, the communication content is selected. Whether the input screen determination unit 546 includes an input screen on which the input value included in the communication content determined by the input value determination unit 541 is included in the communication content selected by the input screen selection unit 545 Determine whether or not. The input screen determination unit 546 makes a determination based on the communication content including the input value and the communication content selected by the input screen selection unit 545.

  The display screen creation unit 543 creates a display screen for display to the user, for example, from the communication content determined to include the input value by the input value determination unit 541 and the communication content acquired by the input screen acquisition unit 542. To do. The display screen creation unit 543 creates a display screen by embedding input values in the input screen.

  The reproduction screen display unit 55 displays a list of communication contents searched by the communication content search unit 54, for example, for the user. The reproduction screen display unit 55 displays the display screen created by the display screen creation unit 543 to, for example, a user (viewer). As a result, the reproduction screen display unit 55 reproduces, together with the input screen, the communication screen of the terminal that has performed communication with the communication content determined to include the input value by the input value determination unit 541.

  FIG. 3 shows an example of the data structure of the communication content storage unit 42. As illustrated in FIG. 3, the communication content storage unit 42 stores a communication source address, a communication destination address, and a date and time in association with the communication content. The communication content indicates the communication content reconstructed by the communication content restructuring unit 53. The communication source address is an address indicating a client terminal serving as a communication source, for example, a network address. The communication destination address is an address including a Web server as a communication destination, for example, a URL. The date / time indicates the date / time when a packet constituting the communication content was intercepted by the network interface 51. As described above, when there are a plurality of packets constituting the communication content, for example, the date and time when the first packet was intercepted by the network interface 51 is indicated.

  In the example illustrated in FIG. 3, the communication source address 1, the communication destination address 2, and the date 1 are stored in association with the communication content 1. Further, a communication source address 2, a communication destination address 2, and a date 2 are stored in association with the communication content 2.

  Next, the processing procedure of the communication screen reproduction device 50 will be described with reference to the flowchart of FIG.

  First, the network interface 51 intercepts, for example, a packet on the network (step S1).

  Next, the packet data capture unit 52 captures a packet intercepted by the network interface 51 (step S2). At this time, the packet data capture unit 52 gives the date and time when the packet was intercepted by the network interface 51 to the captured packet.

  The communication content reconstruction unit 53 reconstructs the communication content based on the packet captured by the packet data capture unit 52, and stores the reconstructed communication content in the communication content storage unit 42 (step S3). At this time, the communication content reconstruction unit 53 stores the communication source address, the communication destination address, and the date and time of the communication executed with the communication content in the communication content storage unit 42 in association with the reconstructed communication content. Note that the communication content restructuring unit 53 may store the index data used when executing the search process in the communication content storage unit 42.

  Next, the communication content search unit 54 searches the communication content storage unit 42 for communication content that matches the search condition, for example, according to the search condition specified by the user (step S4).

  For example, when a search condition is specified by a user (viewer), for example, the reproduction screen display unit 55 provides an interface for the user to input a keyword and search for communication contents.

  FIG. 5 shows an example of an input screen on which a user inputs a keyword for searching for communication contents.

  The input screen 100 shown in FIG. 5 is provided with an input field 101 and a search button 102. For example, the user can input a keyword in the input field 101 in the input screen 100, for example. In this case, the user can input not only one but a plurality of keywords, for example. For example, when a keyword is input to the input field 101 by the user and the search button 102 is pressed, the communication content search unit 54 searches for communication content including the keyword.

  The communication content search unit 54 outputs the search result to the reproduction screen display unit 55. The reproduction screen display unit 55 displays, for example, a list of search results obtained by the communication content search unit 54 for the user.

  FIG. 6 shows an example of a display screen when the search result by the communication content search unit 54 is displayed. As shown in FIG. 6, as search results, for example, the date and time, the communication source address (network address) and the communication destination address (URL) stored in association with the communication content searched by the communication content search unit 54 are displayed. The

  In the example shown in FIG. 6, there are four communication contents as search results, and the date, client terminal (network address), and URL are displayed for each of the four communication contents. For example, regarding the communication content of “No. 1”, the date and time “April 3, 2006 15:23”, the client terminal “192.168.123.234”, and the URL “http://example.com/” are displayed. Has been.

  A description will be given with reference to FIG. 4 again. Here, for example, it is assumed that one communication content is selected for browsing by the user from among the communication content displayed as a list as shown in FIG. As a method for selecting communication contents, a method of clicking a corresponding line in the list display with a pointing device such as a mouse or the number of communication contents to be selected (in the above example of FIG. ) Is input from an input device such as a keyboard.

  In this case, the input value determination unit 541 of the communication content search unit 54 determines whether the communication content selected by the user includes, for example, an input value input to the input screen displayed on the client terminal. (Step S5). At this time, if the communication executed with the communication content selected by the user is, for example, HTTP communication, the input value determination unit 541 may, for example, include a variable in the URL included in the communication content. It is determined that the content includes an input value. Further, for example, in the communication content selected by the user, the input value determination unit 541 determines that the communication content includes an input value when the HTTP request transmitted from the client terminal to the Web server is based on the POST method.

  When the input value determination unit 541 determines that the communication content includes the input value (YES in step S5), the input screen acquisition unit 542 includes the communication content including the input screen in which the input value included in the communication content is input. Is acquired from the communication content storage unit 42 (step S6). The input screen acquisition unit 542 acquires the communication source address, the communication destination address, or the date / time stored in the communication content storage unit 42. Hereinafter, the communication content determined by the input value determination unit 541 to include the input value is referred to as input value communication content. Further, the communication content including the input screen acquired by the input screen acquisition unit 542 is referred to as input screen communication content.

  When the input screen communication content is acquired by the input screen acquisition unit 542 (YES in step S7), the display screen creation unit 543 displays the display screen for displaying to the user from the input value communication content and the input screen communication content. Is created (step S8). The display screen creation unit 543 creates a display screen by embedding input values in the input screen.

  The reproduction screen display unit 55 displays (reproduces) the display screen created by the display screen creation unit 543 to the user (step S9). When the communication executed with the input value communication content and the input screen communication content is, for example, HTTP communication, the reproduction screen display unit 55 is executed with the communication content according to the HTML (HyperText Markup Language) standard or other standards. Reproduce the communication screen of the terminal that performed the communication.

  On the other hand, when the input value determination unit 541 determines that the communication content does not include the input value in step S5, the reproduction screen display unit 55 displays the communication content selected by the user as it is to the user (step S5). S10).

  In step S7, when the communication content including the input screen is not acquired by the input screen acquisition unit 542, the process of step S10 described above is executed.

  FIG. 7 shows an example of a display screen when the reproduction screen display unit 55 displays the display screen created by the display screen creation unit 543.

  In the example illustrated in FIG. 7, a range 121 below “Example.com BBS” in the display screen 120 indicates the input screen. In the display screen 120, input fields 122 and 123 are provided. “Xxxx” and “yyyyyyyy” input in the input fields 122 and 123 are input values. The communication content including the range 121 and the communication content including the input value (value input in the input fields 122 and 123) are different communication content.

  Here, FIG. 8 shows an example of a display screen when the communication contents including the input values (values input in the input fields 122 and 123) shown in FIG. 7 are displayed as they are.

  As shown in FIG. 8, when the communication content including the input value is displayed as it is, only the variable name of the input value and the input value are displayed on the display screen 130, for example.

  As described above, the display screen 120 shown in FIG. 7 can display the meaning of the input value more easily than the display screen 130 shown in FIG.

  Next, the first processing procedure of the input screen acquisition unit 542 will be described with reference to the flowchart of FIG. This first processing procedure is a processing procedure for acquiring communication content including an input screen using a network address (communication source address) stored in the communication content storage unit 42.

  First, the input screen search unit 544 of the input screen acquisition unit 542 is stored in the communication content storage unit 42 in association with the communication content (input value communication content) determined to include the input value by the input value determination unit 541. The network date and time and the network address are extracted from the communication content storage unit 42 (step S11).

  Next, the input screen search unit 544 retrieves the communication content (communication content by the terminal indicated by the network address) stored in the communication content storage unit 42 in association with the retrieved network address, and is retrieved. The communication content (third communication content) associated with the date and time before the date and time is searched (step S12).

  When the communication content is searched by the input screen search unit 544 (YES in step S13), the input screen selection unit 545 is extracted by the input screen search unit 544 from the communication content searched by the input screen search unit 544. The communication content closest to the date and time (fourth communication content) is selected (step S14).

  The input screen determination unit 546 determines whether or not the communication content selected by the input screen selection unit 545 includes an input screen in which an input value included in the input value communication content is input (step S15). The input screen determination unit 546 determines whether or not the communication content selected by the input screen selection unit 545 includes, for example, a form (input screen) that can input an input value included in the input value communication content. Execute. In other words, the input screen determination unit 546 performs determination processing according to whether, for example, an input value included in the input value communication content can be input to the communication content (the input screen included) selected by the input screen selection unit 545. Execute. With this process, the input screen determination unit 546 checks whether or not the communication content selected by the input screen selection unit 545 includes the input screen.

  When the input screen determination unit 546 determines that the communication content includes the input screen (YES in step S15), the search screen acquisition unit 542 acquires the communication content as the input screen communication content (step S16).

  On the other hand, when the communication content is not searched by the input screen search unit 544 in step S13, the communication content including the input screen in which the input value included in the input value communication content is input is not acquired by the input screen acquisition unit 542.

  In step S15, when the input screen determination unit 546 determines that the communication content does not include the input screen, the communication content including the input screen in which the input value included in the input value communication content is input is input screen acquisition. It is not acquired by the part 542.

  Next, the second processing procedure of the input screen acquisition unit 542 will be described with reference to the flowchart of FIG. This second processing procedure is a processing procedure for acquiring the communication content including the input screen using the Referer header included in the HTTP request of the input value communication content.

  First, the input screen search unit 544 of the input screen acquisition unit 542 is stored in the communication content storage unit 42 in association with the communication content (input value communication content) determined to include the input value by the input determination unit 541. The current date and time is taken out (step S21). Also, the input screen search unit 544 takes out a Referer header included in, for example, an HTTP request for input value communication content (step S21). Here, the Referer header indicates a URL (reference source address) indicating a page (that is, an input screen) referred to by the user during communication executed with the input value communication content.

  Next, the input screen search unit 544 correlates with the URL (communication destination address) that matches the URL indicated in the retrieved Referer header, and accesses the communication content (accessed to the URL) stored in the communication content storage unit 42. (Communication content) and the communication content (third communication content) corresponding to the date and time earlier than the date and time stored in the communication content storage unit 42 in association with the input value communication content (step) S22).

  Thereafter, processes in steps S23 to S26 corresponding to the processes in steps S13 to S16 in FIG. 9 are executed.

  Next, the third processing procedure of the input screen acquisition unit 542 will be described with reference to the flowchart of FIG. This third processing procedure is a processing procedure for acquiring the communication content including the input screen using both the network address stored in the communication content storage unit 42 and the Referer header included in the HTTP request of the input value communication content. is there.

  First, the input screen search unit 544 of the input screen acquisition unit 542 is stored in the communication content storage unit 42 in association with the communication content (input value communication content) determined to include the input value by the input value determination unit 541. The network date and time and the network address are taken out from the communication content storage unit 42 (step S31). Further, the input screen search unit 544 extracts, for example, a Referer header of an HTTP request of input value communication content (step S31).

  Next, the processes of steps S32 and S33 corresponding to the processes of steps S12 and S13 of FIG. 9 are executed.

  Next, steps S34 and S35 corresponding to the steps S22 and S23 of FIG. 10 are executed.

  Thereafter, the processes of steps S36 to S38 corresponding to steps S14 to S16 of FIG. 9 or steps S24 to S26 of FIG. 10 are executed.

  As described above, the communication screen reproduction device 50 according to the present embodiment, when it is determined that the communication content selected by the viewer includes the input value input to the input screen (input value communication content), The communication content including the input screen can be acquired in accordance with, for example, the date and time stored in association with the input value communication content, the network address, or the Referer header included in the HTTP request of the input value communication content. As a result, it is possible to reproduce the screen during communication of the terminal that has performed communication with the input value communication content together with the input screen into which the input value included in the input value communication content is input. In addition, communication including the input screen according to either the date / time and the network address or the date / reference header is obtained by acquiring the communication content including the input screen in consideration of all of the above date / time, network address and Referer header. Compared to the case where the content is acquired, the communication content including the input screen on which the input value included in the input value communication content is input can be acquired more reliably.

[Modification]
Next, a modification of this embodiment will be described. The modification of the present embodiment is different from the above-described embodiment in the process of the input screen acquisition unit 542.

  Specifically, when the input screen selection unit 545 included in the input screen acquisition unit 542 determines that the communication content does not include the input screen by the input screen determination unit 546, the communication content searched by the input screen search 544 The communication content is selected according to the date and time stored in the communication content storage unit 42 in association with the communication content.

  Next, the processing procedure of the input screen acquisition unit 542 will be described with reference to the flowchart of FIG.

  First, steps S41 to S45 corresponding to steps S11 to S15 of FIG. 9 are executed.

  Here, if the input screen determination unit 546 determines that the communication content does not include the input screen (NO in step S45), whether or not the processing has been executed for all of the communication content searched by the input screen search unit 544 Is determined (step S46).

  When it is determined that the processing has not been executed for all the communication contents (NO in step S46), the input screen selection unit 545 selects the communication content storage unit 42 from the communication contents searched by the input screen search unit 544. The content of communication is selected according to the date and time stored in (step S47). The input screen selection unit 545 is associated with the input value communication content after the date and time stored in the communication content storage unit 42 in association with the communication content determined not to include the input screen by the input screen determination unit 546. The communication content stored in the communication content storage unit 42 is selected in association with the date and time close to the stored date and time. And it returns to step S45 and a process is repeated.

  That is, in the present embodiment, communication contents (input screen communication contents) including an input screen in which an input value included in the input value communication contents is input are obtained from the communication contents searched by the input screen search unit 544. The process is repeated until

  On the other hand, when the input screen determination unit 546 determines that the communication content includes the input screen in step S45, the communication content is acquired as the input screen communication content (step S48).

  If it is determined in step S46 that the processing has been executed for all of the communication contents, the communication contents including the input screen (input screen communication contents) are not acquired.

  In addition, in FIG. 12, although the process was repeated until the input screen communication content in which the input value included in the input value communication content was input in the first processing procedure shown in FIG. 9 described above, The second processing procedure shown in FIG. 10 or the third processing procedure shown in FIG. 11 may be applied.

  In the above-described modification of the present embodiment, for example, when the input screen is stored in the cache by a relay device on the route of the terminal or the network, etc. The communication content of the closest communication or the communication content of the communication that accessed the same URL one time before includes only information indicating that the input screen stored in the cache is the latest, for example. As such, it is assumed that what is included in the previous communication content may be used.

  As described above, in the modified example of the present embodiment, not only the communication content of the communication executed one time before the communication executed with the input value communication content, or the communication content of the communication accessed once before the same URL, Since it is a configuration that determines whether or not the communication content includes the input screen retroactively, the screen during communication of the terminal that performed the communication executed with the input value communication content is the same even in the case described above. The input value included in the input value communication content can be reproduced together with the input screen on which the input value is input.

  Note that the present invention is not limited to the above-described embodiment or modification as it is, and can be embodied by modifying the components without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment or the modification. For example, some components may be deleted from all the components shown in the embodiment or the modification. Furthermore, you may combine suitably the component covering embodiment or a modification.

The block diagram which shows the hardware constitutions of the client-server system containing the communication screen reproduction apparatus which concerns on embodiment of this invention. The block diagram which mainly shows the function structure of the communication screen reproduction apparatus 50 shown by FIG. The figure which shows an example of the data structure of the communication content storage part. 10 is a flowchart showing a processing procedure of the communication screen reproduction device 50. The figure which shows an example of the input screen in which a user inputs the keyword for searching the communication content. The figure which shows an example of the display screen when the search result by the communication content search part 54 is displayed. The figure which shows an example of the display screen when the reproduction screen display part 55 displays the display screen produced by the display screen creation part 543. The figure which shows an example of the display screen at the time of displaying the communication content containing an input value as it is. The flowchart which shows the 1st process sequence of the input screen acquisition part 542. The flowchart which shows the 2nd process sequence of the input screen acquisition part 542. 14 is a flowchart showing a third processing procedure of the input screen acquisition unit 542. The flowchart which shows the process sequence of the input screen acquisition part 542 applied in the modification of this embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Computer, 20 ... Client terminal, 30 ... Network, 40 ... External storage device, 42 ... Communication content storage part, 50 ... Communication screen reproduction apparatus, 51 ... Network interface (interception means), 52 ... Packet data capture part, 53 ... communication content reconstruction unit, 54 ... communication content search unit, 55 ... reproduction screen display unit, 60 ... server, 541 ... input value determination unit, 542 ... input screen acquisition unit, 543 ... display screen creation unit, 544 ... input screen Search unit, 545... Input screen selection unit, 546... Input screen determination unit.

Claims (5)

In a communication screen reproduction device connected to a network capable of communicating packets in which communication contents of communication between a terminal and a server are divided,
Intercepting means for intercepting packets on the network;
Reconstructing means for reconstructing the communication content from the packet intercepted by the intercepting means;
Corresponding to the communication content, a communication source address indicating a terminal that has performed communication performed with the communication content reconstructed by the restructuring unit and a communication destination address including a server that performed communication performed with the communication content Storage means for attaching and storing,
In accordance with a search condition designated by the user, communication content search means for searching the storage means for communication contents that match the search condition;
An input value for determining whether the communication content searched by the communication content search means is the first communication content including the input value input to the input screen displayed on the terminal according to the communication content A determination means;
When the input value determination unit determines that the first communication content is included, the second communication content including the input screen on which the input value included in the first communication content is input is used as the first communication content. Input screen acquisition means for acquiring from the storage means according to the communication source address or communication destination address stored in association with the content;
Display screen creation means for creating a display screen by embedding an input value included in the first communication content in an input screen included in the second communication content;
A communication screen reproduction apparatus comprising: display means for displaying the display screen created by the display screen creation means to the user. The storage means stores date and time information indicating the date and time when a packet obtained by dividing the communication content reconstructed by the reconstructing means was intercepted by the intercepting means, in association with the communication content,
The input screen acquisition means includes
If it is determined by the input value determination means that the first communication content is the communication content stored in the storage means in association with the communication source address associated with the first communication content, In addition, the third communication content before the first communication content is searched based on the communication source address and date / time information stored in the storage means in association with the first and third communication content. Input screen search means;
Of the third communication contents searched by the input screen search means, the communication associated with the date and time information indicating the date and time closest to the date and time indicated by the date and time information associated with the first communication content Input screen selection means for selecting the content as the fourth communication content;
Input screen determination means for determining whether the fourth communication content is the second communication content based on the first communication content and the fourth communication content;
The fourth communication content is acquired as the second communication content when the input screen determination means determines that the fourth communication content is the second communication content. Item 2. The communication screen reproduction device according to Item 1. The storage means stores date and time information indicating the date and time when a packet obtained by dividing the communication content reconstructed by the reconstructing means was intercepted by the intercepting means, in association with the communication content,
The communication content stored in the storage means includes a reference source address indicating information of a reference source referred to by the user when performing communication executed with the communication content,
The input screen acquisition means includes
When it is determined by the input value determination means that the content is the first communication content, it is stored in the storage means in association with the communication destination address that matches the reference source address included in the first communication content. Communication destination address and date and time stored in the storage means in correspondence with the first communication content and the third communication content before the first communication content. An input screen search means for searching based on information;
Of the third communication contents searched by the input screen search means, the communication associated with the date and time information indicating the date and time closest to the date and time indicated by the date and time information associated with the first communication content Input screen selection means for selecting the content as the fourth communication content;
Input screen determination means for determining whether the fourth communication content is the second communication content based on the first communication content and the fourth communication content;
The fourth communication content is acquired as the second communication content when the input screen determination unit determines that the fourth communication content is the second communication content. The communication screen reproduction device according to 1.   The input screen selection unit is indicated by date and time information associated with the fourth communication content when the input screen determination unit determines that the fourth communication content is not the second communication content. The communication content associated with the date and time information indicating the date and time close to the date and time indicated by the date and time information associated with the first communication content is selected from the third communication content. The communication screen reproduction device according to claim 2 or 3, wherein the communication screen reproduction device is selected. A communication screen reproduction program executed by a computer of a communication screen reproduction device connected to a network capable of communicating packets in which communication contents of communication between a terminal and a server are divided,
In the computer,
Intercepting packets on the network;
Reconstructing the communication content from the intercepted packet;
A storage unit that associates a communication source address indicating a terminal that has performed communication performed with the reconstructed communication content and a communication destination address including a server that has performed communication with the communication content with the communication content. Storing in the step,
In accordance with a search condition designated by the user, searching the storage means for communication contents that match the search condition;
Determining whether the retrieved communication content is first communication content including an input value input to an input screen displayed on the terminal, according to the communication content;
When it is determined that the communication content is the first communication content, the second communication content including the input screen in which the input value included in the first communication content is input is used as the first communication content. Obtaining from the storage means based on the communication source address or communication destination address stored in association with each other;
Creating a display screen by embedding an input value included in the first communication content in an input screen included in the second communication content;
A communication screen reproduction program for executing the step of displaying the created display screen to the user.

Images