JP2017219776A - Communication data relay device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a device and a program for excluding decryption when privacy information (secret information) is included.SOLUTION: A proxy server device 12 is arranged between a client terminal 10 and a Web server device 14. A proxy server device 12 comprises decryption exclusion information storage means 125 for storing destination information of a decryption exclusion object. Decryption exclusion determination means 121 is configured to, when the destination of encrypted communication data is stored in the decryption exclusion information storage means 125, relay, without decrypting, the encrypted communication data, and to, otherwise, decrypt the encrypted communication data, and to execute content filtering. Data analysis means 126 is configured to, when information for requesting privacy information is included in the decrypted communication data, newly store the destination information of the communication data in the decryption exclusion information storage means 125.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a communication data relay device and a program.

  TLS (Transport Layer Security) is a transport layer protocol capable of transmitting and receiving data encrypted on the Internet. In communications such as HTTP (Hyper Text Transfer Protocol) and FTP (File Transfer Protocol) between the client terminal and the web server, highly confidential data such as personal information and credit card information can be securely exchanged by TLS. .

  However, since TLS communication that is supposed to be performed safely for information communication may be used as an escape route for information leakage, a technique for analyzing and monitoring TLS communication and performing content filtering has been proposed. The TLS communication data from the client terminal is received and decrypted by the proxy server. If there is no problem, the data is encrypted again and transmitted to the original web server. Independently encrypted communication paths are established between the client terminal and the proxy server and between the proxy server and the web server.

  There is also known a technique of acquiring a web server host name from a CONNECT method sent from a client terminal to a proxy server, and performing content filtering at the host name level. This method has the advantage that no decoding process is required.

  Patent Document 1 describes that a relay device performs connection destination verification (server certificate verification) with the object of reducing the security check workload of a connection destination from a client terminal.

  Patent Document 2 describes that direct authentication between a client terminal and a server is possible when the client terminal and the server perform encrypted communication using different sessions via a relay device. As a problem, the relay device verifies the temporary electronic certificate of the server, issues an electronic certificate including session data and a temporary electronic certificate, and transmits it to the client terminal. The client terminal transmits the temporary electronic certificate of the relay device. It is described that the electronic certificate of the server is verified by verifying the certificate.

  In Patent Document 3, it is an object to provide an information processing apparatus capable of grasping access to an external apparatus using an encrypted protocol, and detecting a CONNECT notification and determining whether communication is prohibited from setting information. Have been described.

JP 2012-137975 A JP 2003-124926 A JP 2014-206929 A

  In the technology of receiving and decrypting TLS communication data from the client terminal with a proxy server, and if there is no problem, encrypting the data again and sending it to the web server, the privacy information such as credit card number and password or confidential information is also decrypted. There is a problem. On the other hand, in the technique of acquiring the host name of the web server and performing content filtering at the host name level, there is a problem that the filtering accuracy is inferior because the information used for filtering is only the host name.

  An object of the present invention is to provide an apparatus and a program that exclude decryption when privacy information (confidential information) is included.

  The invention according to claim 1 is a receiving means for receiving encrypted communication data, a decrypting means for decrypting encrypted communication data received by the receiving means, and confidential information in the communication data decrypted by the decrypting means. The communication data relay apparatus includes control means for controlling so that communication data received by the receiving means is not decrypted thereafter when the information requesting is included.

  According to the second aspect of the present invention, when the control means receives the encrypted communication data again from the sender or destination of the communication data including the information requesting the confidential information in the communication data, the encrypted communication is performed. The communication data relay apparatus according to claim 1, wherein the communication data relay apparatus is controlled so as not to decode data.

  The invention according to claim 3 is the communication data relay apparatus according to claim 1, which includes expiration date information as destination information to be excluded from decoding.

  According to a fourth aspect of the present invention, the control means detects that information requesting confidential information is included using at least one of the input type, the input format, and the content of the display text included in the communication data. It is a communication data relay apparatus in any one of Claims 1-3.

  The invention according to claim 5 is a step of receiving encrypted communication data from the proxy server, a step of decrypting the received encrypted communication data, and information requesting confidential information from the decrypted communication data. Is included, a program for executing a step of controlling not to decode communication data received thereafter.

  According to the first and fifth aspects of the present invention, when the encrypted communication data includes information requesting confidential information (privacy information), the confidential information can be protected by excluding the decryption.

  According to the second aspect of the present invention, filtering at the host name level can be executed even when decryption is excluded.

  According to invention of Claim 3, information can be updated further.

  According to the fourth aspect of the present invention, it is possible to reliably detect information requesting confidential information.

It is a system configuration figure of an embodiment. It is a processing flowchart of an embodiment. It is a detailed flowchart of the data analysis of embodiment. It is explanatory drawing of the information memorize | stored in the memory | storage means (database) of embodiment. It is explanatory drawing which shows an example of the communication data of embodiment. It is a processing flowchart of other embodiments.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  First, the basic principle of this embodiment will be described.

  When encrypted communication data such as TLS communication is received and decrypted and content filtering is performed, it may be a problem when privacy information (confidential information) is included.

  Therefore, in the present embodiment, when encrypted communication data is received, it is not uniformly decrypted and content filtering is performed, but when communication requiring privacy information is performed, and thereafter The communication data is controlled not to be decrypted.

  In this embodiment, when the decrypted communication data includes information requesting privacy information, the sender or destination of the communication data is automatically registered sequentially in the storage means, so that the user can be excluded from decryption. There is no need to manually create a whitelist. Also, once registered as a subject to be excluded from decryption in the storage means, the subsequent communication data is not decrypted and security is ensured.

  The information stored in the storage means is the sender or destination of the communication data, but the expiration date of the information may be set together with this, and the information stored in the storage means is automatically updated using the expiration date. May be.

  Next, the present embodiment will be specifically described by taking as an example a proxy server apparatus that relays communication data between a client terminal and a server apparatus.

  FIG. 1 is a system configuration diagram of this embodiment. The system includes a client terminal 10, a proxy server device 12 as a relay device, and a web server device 14. The client terminal 10 and the proxy server device 12 are connected via a communication line, and the proxy server device 12 and the web server device 14 are also connected via a communication line. The communication line is, for example, the Internet.

  The proxy server device 12 includes a transmission / reception unit 120, a decryption exclusion determination unit 121, a transmission / reception unit 122, a content filtering unit 123, a decryption / encryption unit 124, a decryption exclusion information storage unit 125, and a data analysis unit 126.

  The transmission / reception means 120 is an interface that transmits / receives communication data to / from the client terminal 10. The transmission / reception means 122 is an interface that transmits / receives communication data to / from the web server device 14.

  The decryption exclusion information storage unit 125 is a database that stores decryption exclusion information.

  The data analysis unit 126 determines whether or not the information requesting privacy information is included in the communication data. If the information requesting the privacy information is included, the data analysis unit 126 decodes the communication data thereafter. Is registered in the decryption exclusion information storage means 125. Specifically, a host name that is the sender or destination of communication data including information that requests privacy information is registered as a host name to be excluded.

  Based on the decoding exclusion information stored in the decoding exclusion information storage unit 125, the decoding exclusion determination unit 121 determines whether the communication data received from the client terminal 10 is a decoding exclusion target, and decodes the determination result. / Supply to encryption means 124.

  The decryption / encryption unit 124 decrypts the communication data and supplies the decrypted communication data to the content filtering unit 123 when the communication data received from the client terminal 10 is not a decryption exclusion target according to the determination result of the decryption exclusion determination unit 121. The communication data decrypted after execution of content filtering is encrypted again and supplied to the transmission / reception means 122. The decryption / encryption unit 124 supplies the communication data as it is to the transmission / reception unit 122 without decrypting the communication data when the communication data received from the client terminal 10 is a decryption exclusion target according to the determination result of the decryption exclusion determination unit 121. To do.

  The content filtering means 123 processes the decrypted communication data, determines whether it is safe (NG), and supplies the result to the decryption / encryption means 124. The decryption / encryption means 124 encrypts the communication data again and supplies it to the transmission / reception means 122 when it is safe, and cuts off the communication data or executes a process equivalent thereto if it is not safe. To do.

  The proxy server device 12 includes a database as a configuration of a server device, that is, a storage device such as a CPU, a ROM, a RAM, an input / output interface, a communication interface, and an HDD (hard disk drive). The decryption exclusion judgment unit 121, the content filtering unit 123, the decryption / encryption unit 124, and the data analysis unit 126 function as a control unit, and one or a plurality of CPUs read a processing program stored in the ROM, and the RAM Is implemented as a working memory by executing the processing program. Note that at least one of the decryption exclusion determination unit 121, the content filtering unit 123, the decryption / encryption unit 124, and the data analysis unit 126 may be realized by hardware such as PLD or FPGA.

  FIG. 2 shows a process flowchart of the proxy server device 12. This process is realized by a processing program.

  First, the transmission / reception means 120 receives communication data from the client terminal 10 (S101). Or the transmission / reception means 122 receives the communication data from the web server apparatus 14 (S101).

  Next, the decoding exclusion determination unit 121 determines whether or not the received communication data is a decoding exclusion target (S102). Specifically, it is determined whether or not the sender host name or destination host name of the communication data and the exclusion target host name stored in the decryption exclusion information storage means 125 match. (YES), and if they do not match, it is determined that they are not subject to decoding exclusion (NO).

  If it is a subject to be excluded from decryption, the decryption exclusion determination unit 121 does not decrypt the received communication data and does not execute content filtering. The transmission / reception means 122 or 120 transmits the communication data to the web server device 14 or the client terminal 10.

  If it is not a decryption exclusion target, the decryption exclusion determination unit 121 supplies the received communication data to the decryption / encryption unit 124. The decryption / encryption unit 124 decrypts the communication data (S103) and supplies the decrypted communication data to the content filtering unit 123. The content filtering unit 123 determines whether or not the decrypted communication data is appropriate. Content filtering is well known, and either URL filtering or dynamic content filtering may be used. If the content of the communication data is appropriate, it is determined as safe, and if it is inappropriate, it is determined as NG. If it is inappropriate, the communication data is blocked or a process corresponding to the blocking is executed (S109). Processing similar to blocking includes connection rejection.

  When the content filtering is safe, the decrypted communication data is supplied to the data analysis unit 126. The data analysis unit 126 analyzes whether or not the decrypted communication data includes information requesting privacy information (confidential information) (S105). Specifically, the data analysis unit 126 performs an HTML analysis on the communication data, and uses the input type, input format, value of a radio button, the content of the display text, etc. It is determined whether information requesting information is included. The privacy information is, for example, a credit card number or a password, and the information requesting privacy information is, for example, text information such as a format for entering a credit card number or “Please enter a password”. It is not limited to. The data analysis unit 126 supplies the determination result to the decryption / encryption unit 124 and newly registers the decryption exclusion information in the decryption exclusion information storage unit 125 according to the determination result.

  That is, when the information requesting the privacy information is not included, the decryption / encryption unit 124 encrypts the decrypted communication data again (S107), and supplies the encrypted communication data to the transmission / reception unit 122 or 120. To do. The transmission / reception unit 122 transmits the encrypted communication data to the web server device 14, or the transmission / reception unit 120 transmits the encrypted communication data to the client terminal 10 (S108).

  On the other hand, when information requesting privacy information is included, the data analysis unit 126 registers the sender or destination host name of the decrypted communication data as a new exclusion target host name in the decryption exclusion information storage unit 125 ( S106). Then, the decryption / encryption means 124 encrypts the decrypted communication data again (S107), and supplies the encrypted communication data to the transmission / reception means 122 or 120. The transmission / reception means 122 transmits the encrypted communication data to the web server device 14, or the transmission / reception means 120 transmits the encrypted communication data to the client terminal 10 (S108). Therefore, from the next time, if the host name is the sender or destination of the communication data, the decryption exclusion determination unit 121 determines that it is a decryption exclusion target and transmits it to the web server device 14 or the client terminal 10 without being decrypted. So privacy information is protected. When communication data is transmitted and received between the client terminal 10 and the web server device 14, the communication data is transmitted from the web server device 14 to the client terminal 10 at a certain timing, and information requesting privacy information as a result of data analysis for this communication data. When it is registered in the decryption exclusion information storage means 125 as being included, when it is transmitted from the client terminal 10 to the web server device 14 at the next timing, the communication data is subject to decryption exclusion and is not decrypted. In addition, the content filtering is not executed and is relayed to the web server device 14 as it is.

  FIG. 3 shows a detailed processing flowchart of data analysis processing in S105 of FIG.

The data analysis unit 126 sequentially performs data analysis on the decoded communication data HTML. First, an HTML input attribute is analyzed (S201). For example, the HTML source code is
<input type = ”password” name = ”pass size =” 10 ”maxlength =” 8 ”>
In this case, input type = “password” is a tag for requesting password input, and when this is detected by pattern matching, it is determined that information requesting privacy information is included. In addition to this, when input type = ”tel” and input type = “email”, these are tags that request input of phone number and email address, respectively, and when this is detected by pattern matching, It is determined that information requesting privacy information is included. Also, check boxes and radio buttons can be determined. For example,
input type = ”checkbox” name = ”card type” value = ”1” cheked = ”checked”> mastercard
input type = ”checkbox” name = ”card type” value = ”2” cheked = ”checked”> visa
input type = ”checkbox” name = ”card type” value = ”3” cheked = ”checked”> jcb
In this case, it is determined that information requesting privacy information is included. Further, it may be determined from the input format. For example, if the input format is a format corresponding to a number of 4 digits × 4, it may be requested to input a credit card number, so it is determined that information requesting privacy information is included. If the format corresponds to a digit number, it may be requested to enter My Number, so it is determined that the information requesting privacy information is included, and the format corresponds to a seven digit number. In some cases, it may be requested to input an account number, so it is determined that information requesting privacy information is included. An analysis is performed on the attributes of the HTML input tag, and if the information requesting privacy information is not included, the attribute of the title (Title) tag is analyzed (S202). For example, the HTML source code
<title> Financial screen: Enter purchase order information </ title>
If it is, it is determined that information requesting privacy information is included. The presence or absence of information that requests privacy information is determined by determining in advance whether or not a character string that is a criterion for determination, such as “credit card” and “input”, is included.

Analysis is performed regarding the attribute of the HTML title tag, and when information requesting privacy information is not included, the attribute of the label tag is analyzed (S203). For example, the HTML source code
<label for = ”credit_card_number”>
If it is, it is determined that information requesting privacy information is included.

  The above processing is executed up to a plurality of stages, for example, N stages (S204). When information requesting privacy information is included in any stage, the process is registered in the decryption exclusion information storage unit 125 as the processing of S106 in FIG.

  FIG. 4 shows an example of the decoding exclusion information stored in the decoding exclusion information storage unit 125. The host name of the web server device 14 and its expiration date are registered in association with each other. The expiration date can be, for example, the expiration date of the SSL certificate, but is not limited to this. As the expiration date, a predetermined time limit (2 years or the like) may be set in consideration of a general content update frequency. By setting the expiration date, even if it is registered once in the decryption exclusion information storage means 125, the data analysis means 126 will perform data analysis again after the expiration date has passed. The registered contents of the decryption exclusion information storage means 125 can be updated periodically.

  The processing of this embodiment will be described more specifically. This is a case where the client terminal 10 accesses the web server device 14 and performs online shopping at a specific website of the web server device 14.

  Assume that the client terminal 10 accesses the web server device 14 and the process has progressed until just before the product settlement. Up to this point, it is assumed that there has been no communication that requires information requesting privacy information.

  The transmission / reception means 122 of the proxy server device 12 receives data as a response to the Get request of the client terminal 10 from the web server device 14. The transmission / reception unit 122 supplies the received communication data to the decoding exclusion determination unit 121.

  At this time, if the website of the web server device 14 is not yet registered in the decryption exclusion information storage unit 125, the decryption exclusion determination unit 121 determines that the received data is not subject to decryption, and the communication data Is supplied to the decryption / encryption means 124. The decryption / encryption unit 124 decrypts the communication data, and the content filtering unit 123 executes content filtering using the URL of the decrypted communication data. If it is determined that the content filtering is appropriate, the data analysis unit 126 performs data analysis.

  FIG. 5 shows a screen example of the decrypted communication data. This is a screen just before the settlement of accounts at a general shopping site. In the HTML source code on this screen, “Enter ID”, “Enter password”, “Enter credit card number”, “Enter credit card security code” , “Please enter your name”, etc., and there is also a 4-digit × 4 numeric entry field. If the data analysis unit 126 detects these and determines that information requesting privacy information is included, the data analysis unit 126 newly registers the host name of the shopping site in the decryption exclusion information storage unit 125. Then, the decryption / encryption unit 124 encrypts the decrypted communication data again, and the transmission / reception unit 120 transmits the encrypted communication data to the client terminal 10.

  Thereafter, the proxy server device 12 receives the POST data from the client terminal 10 to the web server device 14. The transmission / reception unit 120 supplies the received POST data to the decryption exclusion determination unit 121. At this time, since the host name of the shopping site is already registered in the decryption exclusion information storage unit 125, the decryption exclusion determination unit 121 determines that the received POST data is a decryption exclusion target without decrypting it. The data is transmitted to the web server device 14 via the transmission / reception means 122 as it is.

  Although the embodiment has been described above, the present invention is not limited to this, and various modifications can be made.

  For example, in the present embodiment, as shown in the processing flowchart of FIG. 2, the received communication data is relayed as it is when the decoding exclusion determination unit 121 determines that it is a target of decoding exclusion. Relaying may be performed after performing filtering at the level. As described above, the technique of acquiring the web server host name from the CONNECT method sent from the client terminal 10 to the proxy server apparatus 12 and performing content filtering at the host name level is the technique of performing content filtering by decoding. Although the filtering accuracy is inferior to that of, the security can be relatively ensured to some extent as compared with the case where no filtering is performed.

  FIG. 6 shows a processing flowchart in this case. S301 to S309 are the same as S101 to S109 shown in FIG.

  In other words, the communication data from the client terminal 10 to the web server device 14 will be described as an example. The transmission / reception unit 120 receives the communication data from the client terminal 10 (S301).

  Next, the decoding exclusion determination unit 121 determines whether or not the received communication data is a decoding exclusion target (S302). When it is a subject of decryption exclusion, the decryption exclusion determination unit 121 does not perform content filtering without decrypting the received communication data. The transmission / reception means 122 transmits the encrypted communication data to the web server device 14 and relays it.

  If it is not a decryption exclusion target, the decryption exclusion determination unit 121 supplies the received communication data to the decryption / encryption unit 124. The decryption / encryption means 124 decrypts the communication data (S303) and supplies it to the content filtering means 123. The content filtering unit 123 determines whether or not the decrypted communication data is appropriate. If the content of the communication data is appropriate, it is determined as safe, and if it is inappropriate, it is determined as NG. If it is inappropriate, the communication data is blocked or a process corresponding to the blocking is executed (S309).

  When it is determined that the content filtering is safe, the decrypted communication data is supplied to the data analysis unit 126. The data analysis means 126 analyzes whether or not privacy information (confidential information) is included in the decrypted communication data (S305). Specifically, the data analysis unit 126 performs an HTML analysis on the communication data, and uses the input type, input format, value of a radio button, the content of the display text, etc. It is determined whether information requesting information is included. When the information requesting the privacy information is not included, the decryption / encryption unit 124 encrypts the decrypted communication data again (S307), and supplies the encrypted communication data to the transmission / reception unit 122. The transmission / reception means 122 transmits the encrypted communication data to the web server device 14 (S308).

  On the other hand, when information requesting privacy information is included, the data analysis unit 126 newly registers the destination host name of the decrypted communication data in the decryption exclusion information storage unit 125 as a host name to be excluded (S106). . At this time, the expiration date may be registered in association with the host name. The decryption / encryption unit 124 encrypts the decrypted communication data again (S307), and supplies the encrypted communication data to the transmission / reception unit 122. The transmission / reception means 122 transmits the encrypted communication data to the web server device 14 (S308).

  When it is determined in S302 that the data is to be excluded from decryption, the content filtering unit 123 does not decrypt the communication data, instead of relaying the communication data as it is and transmitting it from the transmission / reception unit 122 to the web server device 14. Content filtering at the level is executed (S310). The CONNECT method requests the proxy server to transmit (tunneling) without relaying the HTTPS session, and performs filtering using the host name. If it is appropriate, it is relayed as it is, and if it is inappropriate, similar to the case where it is determined to be inappropriate (NG) in S304, a blocking process or an equivalent process is executed (S309).

  Even in the processing shown in FIG. 6, when information that requests privacy information (confidential information) is included, it is possible to protect the privacy information by excluding the decryption of communication data thereafter, and the decryption exclusion whitelist is automatically set. Can be created. Further, even when decryption is excluded, inappropriate communication data can be blocked by performing filtering at a certain level (host name level).

  Further, in this embodiment, as shown in FIG. 3, it is determined whether or not information requesting privacy information is included in a plurality of stages, but whether or not information requesting privacy information is included. May be quantitatively evaluated as the number of points, and it may be comprehensively determined whether or not information requesting privacy information is included by comparing with a threshold value. In this case, quantitative evaluation may be performed by adding different weights in each of a plurality of stages. This is due to the fact that there is a difference in the sensitivity of information that requests privacy information.

  Further, in the present embodiment, when content filtering is executed, the client terminal 10 may be notified as necessary.

DESCRIPTION OF SYMBOLS 10 Client terminal, 12 Proxy server apparatus, 14 Web server apparatus, 120,122 Transmission / reception means, 121 Decryption exclusion judgment means, 123 Content filtering means, 124 Decryption / encryption means, 125 Decryption exclusion memory means, 126 Data analysis means

Claims (5)

Receiving means for receiving encrypted communication data;
Decryption means for decrypting encrypted communication data received by the reception means;
Control means for controlling not to decrypt the communication data received by the receiving means thereafter when the communication data decrypted by the decrypting means includes information requesting confidential information;
A communication data relay device comprising: The control means performs control so that the encrypted communication data is not decrypted when the communication data encrypted from the sender or destination of the communication data including the information requesting confidential information in the communication data is received again. Item 4. The communication data relay device according to Item 1. The communication data relay device according to claim 1, wherein expiration date information is included as destination information to be excluded from decoding. The control means detects that information requesting confidential information is included using at least one of the input type, the input format, and the content of the display text included in the communication data. The communication data relay device described. To the proxy server,
Receiving encrypted communication data; and
Decrypting the received encrypted communication data;
A program for executing a step of controlling not to decrypt communication data received after that when the decrypted communication data includes information requesting confidential information.

Images