JP2024038784A - Information processing system, server device, server device control method, client terminal device, client terminal device control method and program - Google Patents

Abstract

The present invention provides an information processing system, a server device, a client terminal device, and a control method and program therefor that easily identifies a transmission source of communication. In an information processing device, a server device receives a request packet from a client terminal device, determines whether the received packet includes information indicating the destination of a specific packet, and determines whether the received packet includes information indicating the destination of a specific packet. If it is determined that information indicating the destination is included, a packet with specific information added is transmitted to the client terminal device. The client terminal device receives a packet from the server device, determines whether the received packet contains specific information, and if it determines that specific information is included, adds client-specific information to the packet. and send it to the server device. The server device further receives packets transmitted from the client terminal, and extracts client-specific information from the received packets. [Selection diagram] Figure 1

Description

The present invention relates to an information processing system, a server device, a method of controlling a server device, a client terminal device, a method of controlling a client terminal device, and a program.

Some malware communicates with dangerous connections, such as command and control (C&C) servers, to receive instructions from hackers or send stolen confidential information. To deal with this, countermeasures can be taken such as making a list of connection destination information (URLs, IP addresses, etc.) of dangerous connection destinations in advance and blocking communication to the destinations on the list to prevent damage caused by malware. It has been taken. Although this method can prevent direct damage caused by malware, there is a problem in that it cannot take measures against malware remaining on the client side. Therefore, it is necessary to identify the source of the communication and take countermeasures.

Therefore, as a method for identifying the source of network communication, there is a technique of referring to the MAC address in the Ethernet (registered trademark) frame. However, since the MAC address is information that can be transmitted only within the same segment, it is assumed that no other network device exists between the source client and the network device that performs the identification. However, in the case of a typical network configuration within a company or government office, various external devices such as routers and firewalls exist along the network. Therefore, in such an environment, the source of network communication becomes the MAC address of the external device, making it impossible to identify the client. There is also a method of managing the transmission source of network communication using an external device, but the management becomes complicated.

Another technique is to refer to the source IP address. However, IP addresses are not always fixed to one computer, so if you try to identify the computer name from the IP address regarding a communication from a month ago, for example, you will find that the IP address has already changed. Often cannot be identified. Therefore, Prior Art Document 1 discloses a technique of specifying the client that is the sender by embedding client information in the request URL.

Japanese Patent Application Publication No. 2004-240559

However, in Prior Art Document 1, since the location where the URL is analyzed is a Web server, the scope is beyond the control of the user or administrator, and it cannot be applied to unmanaged communications. For example, this technology cannot be applied to C&C servers used by malware because they are installed and managed by cybercriminals. Therefore, an object of the present invention is to easily and accurately identify the source of communication.

The present invention is, for example, an information processing system that includes:
It has a client terminal device, an information device, and a server device,
The server device includes:
first receiving means for receiving a request packet from the client terminal device via the information device;
first determining means for determining whether the request packet received by the first receiving means includes information indicating a destination of a specific packet;
If the first determining means determines that information indicating the destination of the specific packet is included, the first determining means transmits the packet with the specific information added to the client terminal device via the information device. and a transmission means,
The client terminal device includes:
second receiving means for receiving packets from the server device via the information device;
a second determining means for determining whether or not the specific information is included in the packet received by the second receiving means;
If the second determining means determines that specific information is included, a second transmitting means adds client-specific information to the packet and transmits the packet to the server device via the information device. Prepare,
The server device further includes:
third receiving means for receiving packets transmitted from the client terminal via the information device;
The present invention is characterized by comprising an extraction means for extracting information specific to the client from the packet received by the third reception means.

According to the present invention, it is possible to easily specify the source of communication.

FIG. 1 is a system configuration diagram showing an example of the configuration of an information processing system. 3 is a flowchart showing the processing of the server device 20. FIG. 3 is a flowchart showing the processing of the client terminal device 10. FIG. 3 is a flowchart showing the processing of the server device 20. FIG. FIG. 3 is a diagram showing an example of a packet. FIG. 3 is a diagram showing an example of a packet. An example of information recorded in the database is shown below. 2 is a flowchart showing the processing of the server device 20. It is a figure showing an example of operation history. 3 is a flowchart showing the processing of the server device 20. FIG. It is a figure showing an example of operation history. 3 is a flowchart showing the processing of the server device 20. FIG. It is a figure showing an example of operation history. 3 is a flowchart showing the processing of the server device 20. FIG. FIG. 1 is a system configuration diagram showing an example of the configuration of an information processing system. FIG. 3 is a sequence diagram showing login restrictions. It is a diagram showing an example of an account management table.

[First embodiment]
<System configuration diagram>
First, the information processing system configuration according to this embodiment will be explained using the system configuration diagram of FIG. 1. As shown in FIG. 1, the information processing system according to the present embodiment includes computers, that is, information processing devices 10, 20, and 50, and each information processing device is connected to a network 30 such as a LAN or the Internet. . Hereinafter, the information processing device 10 will be referred to as a client terminal device, the information processing device 20 will be referred to as a server device (for example, a proxy server) that manages the client terminal device 10, and the information processing device 50 will be referred to as an information device (for example, a router, a firewall, etc.). do. Note that there may be a plurality of client terminal devices 10 and information devices 50. Further, the client terminal device 10, the server device 20, and the information device 50 may be any device as long as it is capable of executing each process described later as being performed by an information processing device such as a PC or a mobile terminal device. do not have.

<Client terminal device>
In the client terminal device 10, the arithmetic device 10C is a processor (CPU). The arithmetic device 10C starts an operating system (OS) stored in the storage device 10B in accordance with a boot program such as a BIOS stored in a ROM in the memory 10E, and further starts various programs in accordance with the OS or user operations. This storage device 10B stores computer programs and data for causing the arithmetic device 10C to execute various processes that will be described later as being performed by the OS and this device. This computer program includes a client program 10F and a browser 10G.

The client program 10F is a program for managing data and programs of the client terminal device 10. For example, the client program 10F is a program for managing data, programs, etc. of the client terminal device 10. It has a function to send packets by adding a name (such as the name of the program that was sent). Further, the client program 10F divides the request packet received from the server device 20 via the network I/F 10D into each message header of the HTTP request, and the server program 20F on the server device 20 divides the request packet into packets by the method described below. Extract the information recorded inside. The client program 10F also has a function of storing the operations of the client terminal device 10 as an operation history in the storage device 10B, and controls according to instructions from the server device 20 (for example, an instruction to apply a patch program, a virus scan instruction, an isolation instruction, etc.). It may have a function.

FIG. 9 is a diagram showing an example of an operation history. In this figure, when a communication request is made from the client terminal device 10, the date and time of the request, the name of the logged-in user, the URL of the request destination, etc. are recorded. For example, in record 901, at 14:00:00 on 2020/08/10, a communication request was issued to "http://aaa.com" from PC-A where userA was logged in. It represents that. Note that the information to be recorded is not limited to what is shown in this figure. The computer programs and data stored in the storage device 10B are appropriately loaded into the RAM of the memory 10E under the control of the arithmetic device 10C, and are processed by the arithmetic device 10C. Further, the OS is, for example, Windows (registered trademark), MacOS (registered trademark), Linux (registered trademark), iOS (registered trademark), Android (registered trademark), or the like.

The storage device 10B is a hard disk drive (HDD), solid state drive (SSD), or the like, and stores the client program 10F that runs on the client terminal device 10 in addition to the OS. The I/O device 10A is an input/output interface (I/F) for connecting to a pointing device (such as a mouse) or a keyboard, or a display incorporating a touch panel. Note that the keyboard may be a software keyboard. Further, the I/O device 10A may be an audio input section including a microphone or the like that recognizes the input operator's voice using a voice recognition function and transmits the recognized voice to the arithmetic device 10C. The I/O device 10A also functions as a user interface (UI) for displaying information.

The network I/F 10D is an interface with the network 30, and is a communication circuit for communicating with other information processing devices (for example, a web server, etc.). The arithmetic device 10C transmits a request packet issued from a program such as the browser 10G to another information processing device (for example, a web server) as a destination via the network I/F 10D.

<Server device>
As shown in FIG. 1, the hardware configuration of the server device is assumed to be similar to the hardware configuration of the client terminal device 10 described above. That is, the computing device 20C of the server device 20 uses computer programs and data stored in the storage device 20B of the server device 20 to communicate with other information processing devices via the network I/F 20D of the server device 20. In addition to data communication, the server device 20 also executes various processes to be described later. Furthermore, a server program 20F is stored in the storage device 20B of the server device 20.

In the server device 20, the arithmetic device 20C is a microprocessor (CPU). The arithmetic unit 20C starts the OS stored in the storage device 20B according to a boot program such as BIOS stored in the ROM of the memory 20E. Then, it receives a request packet from the client terminal device 10 connected via the network 30, and transmits the request packet to another information processing device (for example, a Web server, etc.) that is the destination on the Internet.

The storage device 20B is an HDD, an SSD, or the like, and stores a server program 20F that runs on the server device 20. The network I/F 20D is an interface with the network 30, and is a communication circuit for communicating with other information processing devices such as the client terminal device 10.

The server program 20F divides the request packets received from the plurality of client terminal devices 10 via the network I/F 20D into each message header of the HTTP request, and divides the request packets into the client packets added by the client program 10F on the client terminal device 10. Information on the terminal device 10 is extracted. Furthermore, when a request from the client terminal device 10 is rejected, the reason is added to the reply packet.

Further, the operation history of the client terminal device 10 transmitted from the client terminal device 10 connected via the network 30 can be stored and managed in the storage device 20B, and the modification program can be applied to the client terminal device 10. Application orders, virus scan orders, quarantine orders, etc. can also be sent.

The database 20G stores client-specific information transmitted from the client terminal device 10 when the request from the client terminal device 10 is rejected.

The server device 20 is installed on the boundary between the network 30 on the client terminal device 10 side and the Internet 40. By adopting this configuration, all packets exchanged between the network 30 and the Internet 40 can be passed through the server device 20, and the present invention can be applied to all exchanged packets. .

Furthermore, although the server device 20 and the client terminal device 10 are both installed inside the LAN in FIG. It may be installed in

<Information equipment>
In a general network environment such as a company or a government office, an information device 50 is installed between a client terminal device 10 and a server device 20. The information device 50 is a device that relays communication from the client terminal device 10 to the server device 20, and is, for example, another network device such as a router, a firewall, or a UTM (Unified Threat Management). In the case of the configuration shown in FIG. 1, in the case of an Ethernet (registered trademark) frame packet exchanged between the information device 50 and the server device 20, the source MAC address is that of the information device 50, so the MAC address It becomes impossible to identify the source client using

<Additional processing of server device>
FIG. 2 is a flowchart of additional processing performed by the server device 20 according to the present embodiment.

The computing device 20C of the server device 20 monitors request packets being sent from the client terminal devices 10 connected via the network 30 (S-201).

When a request packet is transmitted from the client terminal device 10, the packet reaches the server device 20 via the information device 50 before reaching the Internet 40. When the packet reaches the server device 20, the arithmetic device 20C determines whether the received packet is a request for a dangerous website (or not) (S-202). Note that the determination as to whether a packet is an access to a dangerous website is based on the list of host names of dangerous websites stored in advance in the storage device 20B and the "Host" included in the standard header of the HTTP request header. ” to make a judgment. Note that "Host" is an example, and is not limited to "Referer" as long as access to a dangerous website is known.

If the computing device 20C determines that the connection destination is a dangerous website (YES in S-202), the connection is rejected by discarding the request packet, etc. (S-204). If it is determined that the website is not dangerous (NO in S-202), the request is passed and connection to the website is allowed (S-203).

Thereby, the client terminal device 10 can be prevented from connecting to a dangerous website, and it is possible to obtain the effect of preventing damage such as being infected with a computer virus. However, if the packet is discarded, the client terminal device 10 simply becomes unable to connect, and cannot know the reason why the connection is not possible. Therefore, the computing device 20C adds the reason for rejecting the connection (such as "connected to a dangerous website") to the header of the response packet (S-205) and sends it to the client terminal 10 (S-205). 206). This allows the client terminal device 10 to know the reason why the connection was refused.

FIG. 5 is a diagram showing an example of a packet, and is an example of a message header of an HTTP response in the packet edited by the arithmetic device 20C. In this example, in addition to normal headers such as Content-Type, there is a "DenyReason" header added by the computing device 20C, in which the reason for refusing the connection "malicious web site" is recorded.

The information added by the computing device 20C is not limited to the reason for rejecting the connection (specific information), but includes, for example, a virus scan command for the client terminal device 10, a command to transfer a response packet to another computer, etc. You may.

Furthermore, the location where the arithmetic device 20C adds information is not limited to the message header of the HTTP request, but may also use, for example, the header section or data section of the TCP packet.

<Processing of client terminal device>
FIG. 3 is a flowchart of processing performed by the client terminal device 10 according to this embodiment. When the packet transmitted from the server device 20 reaches the client terminal device 10, the arithmetic device 10C receives the packet (S-301).

The arithmetic device 10C determines, for all received packets, whether the connection request has been rejected. Specifically, the following processing is performed on all received packets.

The computing device 10C divides the message header data of the HTTP request in the packet into units of header names (S-302). Next, the arithmetic device 10C determines whether or not the response packet includes information indicating that the request has been interrupted (S-303). That is, it is determined whether the header name added by the server program 20F (computing device 20C) of the server device 20 exists in the divided headers. The determination is made using a table stored in advance in the storage device 10B, such as whether the header name is a unique one added by the server program 20F (computing device 20C).

The method for determining whether a request has been rejected is not limited to the method using the part described as a unique header as described above; for example, the response code used when the server device 20 returns a reply packet is changed to a unique one. You may also use a method such as In addition, when the server device 20 is used as a proxy server, due to the nature of the proxy server, in the case of encrypted communication such as SSL, it is basically not possible to refer to the header part and data part of the HTTP packet, so such problems can be avoided. To avoid this, information may be recorded in the header of the TCP packet.

As shown in FIG. 5, the reason for refusing the connection, such as "DenyReason", is recorded in the packet. In addition, the above-mentioned "DenyReason" is not a standard HTTP header specified by RFC (Request For Comments), so if the received packet is passed to an application such as a browser with the relevant header left in the received packet, the application There is a risk that the other side will not be able to read the relevant header and an error will occur. Therefore, the arithmetic device 10C deletes the corresponding header and then passes the corresponding packet to the requesting application (S-304).

When it is determined that the connection has been refused through the above-described process, the computing device 10C takes appropriate measures (such as network interruption) to the client terminal device 10 based on the reason recorded in the "DenyReason" field. Do (S-305). For example, if the reason for rejection is access to a dangerous website, it can be said that the client terminal device 10 is at high risk of being infected with malware. Therefore, the computing device 10C blocks the client terminal device 10 from the network in order to prevent the malware from spreading.

A packet to be sent to the server device 20 is created (S-306), and the corresponding packet includes client-specific information indicating information about the client terminal device 10, and the packet is sent for the purpose of transmitting client-specific information. It adds identification information indicating that the packet has been sent (S-307), and transmits the corresponding packet to the server device 20 (S-308).

The client-specific information is, for example, information indicating the client terminal device (computer name, user name, etc.) and information indicating the program that sent the packet (program name that made the request, process name, etc.). These pieces of information are written anywhere within the packet. For example, it may be written in the header part of the packet, or it may be written in the data part of the POST packet.

As an example, a method will be described in which client-specific information and identification information indicating that the packet was sent for the purpose of transmitting the client-specific information are written in the header portion of the packet. FIG. 6 is a diagram showing an example of a packet, and is an example of a message header of an HTTP request in the packet edited by the arithmetic device 10C. In this example, in addition to normal headers such as User-Agent, there is an "ADDHEADER" header added by the client program 10F, which includes the computer name of the client terminal device 10 "TestPCNAME.test.com", The name of the program that made the request "iexplore.exe" is recorded. Note that the method for specifying the name of the program that sent the request packet and the destination URL is a known technique (for example, Japanese Patent Application Laid-Open No. 2012-185799), and therefore a description thereof will be omitted.

Furthermore, the packet shown in FIG. 6 has an "IsBlock" header, which serves as identification information indicating that the packet was sent for the purpose of transmitting client-specific information. After adding the relevant information to the packet, the arithmetic device 10C transmits the packet to the server device 20.

<Server device extraction process>
FIG. 4 is a flowchart of the extraction process performed by the server device 20 according to this embodiment. When the packet transmitted from the computing device 10C reaches the server device 20, the computing device 20C receives the packet (S-401).

Next, the computing device 20C determines whether or not the corresponding packet is transmitted for the purpose of transmitting client-specific information, and if so, attempts to extract the transmitting client-specific information. try. Specifically, the following processing is performed on the corresponding packet. The computing device 20C divides the message header data of the HTTP request in the packet into units of header names (S-402). Next, it is determined whether or not there is identification information added by the client program 10F (computing device 10C) of the client terminal device 10 in the divided header, indicating that the information was sent for the purpose of transmitting client-specific information. Determine (S-403).

If it exists (YES in S-403), search for a header that represents client-specific information (computer name, program name, etc.) among the divided headers, and check the string recorded in the header value. is extracted as information specific to the relevant client (S-404).

This will be explained in detail using FIG. 6. For example, when the server program 20F receives a packet as shown in FIG. 6, it first divides it into header names. Since the "IsBlock" header added by the client program 10F is present in the header, it can be determined that this packet was sent for the purpose of transmitting client-specific information. Also, since the "ADDHEADER" header exists, the character string "TestPCNAME.test.co; iexplore.exe" containing the contents is obtained and divided by semicolons. Then, it is found that the sender's computer name is "TestPCNAME.test.co", and the name of the program that sent the packet is "iexplore.exe".

As a result, information about the client that sent the request packet to the dangerous website can be identified on the server device (S-405). Next, the computing device 20C records information that the request of the corresponding client was rejected in the database 20G (S-406).

Further, FIG. 7 shows an example of information recorded in the database 20G. Here, the time of attempted access, computer name, process name, user name, etc. are recorded. For example, if you use the date as a key to aggregate the number of accesses, you can aggregate the number of daily accesses using the computer name as a key. This makes it possible to calculate rankings of computers that have attempted dangerous access.

Note that the header name and header format added by the client program 10F are agreed upon in advance between the server program 20F and the client program 10F, and stored in the storage devices 10B and 20B, respectively.

As described above, in the present invention, the place where packets are analyzed (for example, the place where the source of communication is identified) is not located at the end of the communication path (such as a web server), but is located somewhere along the communication path and can be managed by the administrator. place (such as a proxy server). As a result, all packets can be analyzed without being affected by the destination of the communication, and the source of the communication can be easily and accurately identified.

In addition, by identifying client information, for example, when preventing damage caused by malware by blocking communication to a dangerous connection destination, it is possible to take measures against malware remaining on the client terminal device. . In addition, by referring to the information recorded in the database 20G, it is possible to identify, for example, terminals that frequently attempt to access dangerous sites, and provide useful data for security audits, etc. .

[Second embodiment]
By identifying the source client of the packet, the following effects can be obtained, for example. The computer and program that made the access request to the dangerous website can be identified from the client-specific information added to the received packet. In the following, processing after the server device identifies the source client and program of the packet will be described. Note that since most of the operations of this embodiment are the same as those of the first embodiment, only the operations that are different from the first embodiment will be explained here, and the explanation of the common operations will be omitted.

FIG. 8 is a flowchart showing the processing of the server device 20. The computing device 20C determines whether the received packet is a request to a dangerous website (S-801). Note that determining whether a packet is an access to a dangerous website is based on "Host" included in the standard header of the HTTP request header and the host name of the dangerous website stored in advance in the storage device 20B. Make a decision by comparing with the list. If it is determined that the website is not dangerous (NO in S-801), the packet is sent to the destination and the process ends. Note that in the above explanation, it is determined whether the packet received by the server device 20 is a request to a dangerous website, but it is determined whether the packet received by the server device 20 is a request to a dangerous website. The judgment may be made by In that case, step S-801 is omitted.

Furthermore, if it is determined that the access is to a dangerous website (YES in S-801), the client device 10 and server device 20 will The processes described in S-208 and S-401 to S-406 in FIG. 4 are performed to identify the client (computer name, program name, etc.) (S-802). Since these processes are described in the first embodiment, their description in this embodiment will be omitted.

The computing device 20C determines whether the program specified in S-802 is a web browser (S-803). Whether or not it is a Web browser is determined based on program information indicating the Web browser that is stored in advance in the storage device 20B. If the identified program is a web browser, it can be inferred that the user jumped from a dangerous URL written in a phishing email, for example. Therefore, if it is determined that the client is a Web browser (YES in S-803), the computing device 20C changes the client's email settings (S-804). For example, in order to prevent phishing emails from being delivered, the destination to which the phishing email was sent is checked from the operation history of the client identified in step S-803, and settings are made to not receive emails from that destination. Note that the email settings may be stored in the server device 20, the client terminal device 10, or a mail server (not shown).

The arithmetic device 20C determines whether the identified program is a general application (S-805). Whether or not the application is a general application is determined based on program information indicating the general application that is stored in advance in the storage device 20B. If the request is for a general application (for example, spreadsheet software, document processing software, etc.), it is assumed that the request takes advantage of a vulnerability in the general application. Therefore, if it is determined that the application is a general application (YES in S-805), the computing device 20C applies a modification program to modify the vulnerability to the client terminal device 10 (S-806). Note that general applications and update program acquisition sources (download servers) are stored in advance in the storage device 20B in association with each other, the corresponding acquisition source is accessed to obtain the correction programs, and the correction programs are transferred to the client terminal device 10. The program may be applied. Further, the modification program may be stored in advance in the storage device 20B in association with a general application.

If it is determined that the identified program is not a general application (NO in S-805), the computing device 20C transmits a virus scan or isolation command to the client terminal device 10 (S-807). If the identified program is not a web browser or a general application, it can be assumed that the malware itself is communicating with a dangerous connection destination such as a C&C server. Therefore, it is necessary to take measures such as scanning the client terminal device 10 for viruses, isolating it from the network, and preventing the spread of infection. Note that the predetermined program that is used as the determination criterion in step S-803 and step S-805, such as a web browser or a general application, is an example, and is not limited thereto.

As described above, by adding client-specific information (client information), it is possible to grasp the situation on the client terminal device side, which cannot be understood from ordinary packets alone, and to take appropriate measures immediately.

[Third embodiment]
In this embodiment, a process of discovering and dealing with damage from seemingly harmless websites by using operation history will be described. Note that most of the operations of this embodiment are the same as those of the first embodiment and the second embodiment, so only the operations that are different from the first and second embodiments will be explained here. , description of common operations will be omitted.

FIG. 9 is a diagram showing an example of an operation history. Referring to the operation history in Figure 9, in record 902, on the date "2020/11/18" and the time "11:00:00", the user name "userC" accessed "http" on the PC name "PC-C". It is recorded that the URL "://aaa.com" was accessed. If "http://aaa.com" is found to be a dangerous website, first perform a virus scan on the "PC-C" that accessed the URL "http://aaa.com". It is necessary to take measures such as calling the URL or prohibiting access to the URL in question.

However, not all dangerous websites are created by malicious parties; instead, the URL of a normal website is hijacked by a malicious third party and performs dangerous activities such as distributing malware. In some cases, it may be falsified. Furthermore, since the determination as to whether the URL is dangerous or not is made after an investigation by the antivirus vendor, it is not determined at the moment when the website is tampered with, but after some time has elapsed. Therefore, even if the website is determined to be harmless, there is a possibility that it has already been modified into a dangerous website, so please be aware that the website may not be able to be accessed on any PC that accessed the URL before it was determined to be dangerous. However, it is necessary to take measures such as virus scanning.

FIG. 10 is a flowchart showing the processing of the server device 20. Note that in the flowchart of FIG. 10, the same processing steps as those shown in FIG. 8 are given the same step numbers, and a description of these processing steps will be omitted.

First, in step S-801, the computing device 20C determines that the URL (for example, "http://aaa.com") that a certain client terminal device 10 (for example, "PC-C") attempted to access is dangerous. Suppose that it is determined that After that, the computing device 20C refers to the operation history recorded in all the client terminal devices 10 recorded in the storage device 20B (S-1001). Next, the computing device 20C determines that the URL determined to be dangerous cannot be accessed from anyone other than the client terminal device 10 (for example, "PC-C") that transmitted the packet detected in step S-801. , determines whether it exists in the operation history (S-1002).

Referring to the operation history in Figure 9, in record 901, for the URL "http://aaa.com", the date "2020/08/10" and the time "14:00:00" are also It can be seen that the name "PC-A" is accessing. If access by another client terminal device 10 is not confirmed (NO in S-1002), the computing device 20C does nothing and shifts the process to step S-803. If access is confirmed (YES in S-1002), the computing device 20C sends a virus scan or isolation command to the corresponding client terminal device 10 (for example, "PC-A") (S-1003) . For example, in the case of the operation history in FIG. 9, since access to the corresponding URL "http://aaa.com" by "PC-A" has been confirmed, the computing device 20C performs a virus scan on "PC-A". Issue instructions such as:

As described above, by referring to the operation history, damage caused by seemingly harmless websites can be discovered and countermeasures can be taken.

[Fourth embodiment]
In this embodiment, a process for discovering and dealing with damage from a website even when the local time is changed on the client terminal device 10 will be described.

In the third embodiment, the computing device 20C performs a process of determining whether a dangerous URL has been accessed from another client terminal device 10 in the past by referring to the operation history. . However, if the "time" of the operation history is recorded based on the local time of the client terminal device 10, if the local time is changed from the original time, the time of the operation history will also change.

Prohibiting changes to the local time itself can prevent the above-mentioned problems from occurring, but it also prevents time changes for non-malicious purposes, such as program testing, and impairs convenience. It is not appropriate to prohibit time changes in general. Therefore, there is a need for a means that can obtain the correct time in the operation history while allowing the local time to be changed. Therefore, when the local time of the client terminal device 10 is changed, the arithmetic device 10C stores the time difference before and after the change, and records the difference (offset) in the operation history. FIG. 11 shows an example of recording the time difference (offset) in the operation history. FIG. 11 is a diagram showing an example of an operation history.

FIG. 12 is a flowchart showing the processing of the server device 20. Note that in the flowchart of FIG. 12, the same processing steps as those shown in FIG. 8 are given the same step numbers, and a description of these processing steps will be omitted.

In step S-801, the URL "http://aaa.com" accessed by the PC name "PC-C" on the date "2020/11/18" and the time "11:00:00" is Assume that the website is determined to be dangerous. The computing device 20C checks all the client terminals stored in the storage device 20B in order to determine whether the same URL "http://aaa.com" has been previously accessed by another client terminal device 10. Refer to the operation history recorded in the device 10 (S-1201).

The arithmetic device 20C recalculates the time using the offset value (S-1202). For example, in record 1101 in Figure 11, there is an operation history in which "PC-A" accessed "http://aaa.com" on date "2020/11/19" and time "14:00:00". However, the time offset records that this operation history is 48 hours ahead of the original time, so if you recalculate the time by taking the offset into account, the date will be "2020/11/17" , the time becomes "14:00:00".

The computing device 20C applies the time recalculated in step S-1202 and determines whether there is a history of accessing the URL "http://aaa.com" in the past (S-1203 ). For example, the record 1101 in FIG. 11 is "http://" on "PC-A" on the date "2020/11/17" and the time "14:00:00" recalculated in step S-1202. It can be confirmed that ``aaa.com'' was accessed.

If access by another client terminal device 10 is not confirmed (NO in S-1203), the computing device 20C does nothing and shifts the process to step S-803. If access is confirmed (S-1203: YES), the computing device 20C sends a virus scan or isolation command to the corresponding client terminal device 10 (for example, "PC-A") (S-1204) .

For example, in the case of the operation history in FIG. 11, since access to the corresponding URL "http://aaa.com" by "PC-A" has been confirmed, the computing device 20C performs a virus scan on "PC-A". Issue instructions such as: Therefore, it is possible to take measures such as issuing a virus scan command for "PC-A" as well.

As described above, even if the local time is changed in the client terminal device 10, the same measures as in the third embodiment can be taken by recording the offset value of the changed time in the operation history. Can be done.

[Fifth embodiment]
In this embodiment, a process of discovering and dealing with a client terminal device in which latent malware exists by using a hash value will be described. Note that since most of the operations of this embodiment are the same as those of the first to fourth embodiments, only the operations that are different from the first to fourth embodiments will be explained here. , description of common operations will be omitted.

In the third and fourth embodiments, the processing device 20C refers to the operation history to determine whether a dangerous website has been accessed from another client terminal device 10 in the past. was going on. In this embodiment, the hash value of the program that transmitted the packet from the client terminal device 10 (the program that operates on the client terminal device 10 and transmits the request packet to the outside via the network I/F 10D and the network 30) is transmitted to the client terminal device 10. The unique information is transmitted from the client terminal device 10 to the server device 20 via a packet that transmits client-specific information created by the operations S-306 to S-308 shown in FIG. The hash value of the program that sent the packet (the program that made the communication request) is recorded in the history.

FIG. 13 shows an example in which a hash value is added to the operation history. FIG. 13 is a diagram showing an example of an operation history. It has the same meaning as the operation history shown in FIGS. 9 and 11, but in addition to FIG. 11, the hash value of the program that made the communication request is recorded. The hash value is calculated by the client program 10F using an algorithm such as SHA-1 or SHA-256 using the binary value of the program as a key, and is then recorded in the storage device 10B as an operation history.

In the record 1301, the value "AAAAAA..." is recorded as a hash value, which indicates that the program with the hash value "AAAAAA..." has made the communication request. Also, the hash values of records 1301 and 1302 match as "AAAAAA...", which means that the two communication requests are from different client terminal devices 10 (PC-A, PC-C). Despite the fact that they are being issued, it indicates that they were carried out by the exact same program.

FIG. 14 is a flowchart showing the processing of the server device 20. The following description will be made assuming that the operation history shown in FIG. 13 is recorded as an example.

First, assume that in step S-801, the arithmetic device 20C determines that a URL (for example, "http://01234.com") that a certain client terminal device 10 attempts to access is dangerous. Below, on the date "2020/11/21" and the time "16:00:00", a program with hash value "AAAAAA..." is sent from "PC-X" to "http://01234.com". The following explanation assumes that a URL has been accessed.

After that, the computing device 20C refers to the operation history recorded in all the client terminal devices 10 recorded in the storage device 20B (S-1401).

Next, the client device 10 and the server device 20 perform the processes shown in FIGS. 3 and 4 to identify the client (hash value) (S-802). Next, the arithmetic unit 20C determines from the operation history referred to in step S-1401 whether there is communication by a program having the same hash value as the hash value obtained in S-802 (S -1402).

If there has been communication by a program with the same hash value in the past (YES in step S-1402), it is determined that there is a program that is exactly the same as the one that accessed the dangerous URL ("http://01234.com"). In the case of the operation history shown in Figure 13, there is no trace of the URL "http://01234.com" being accessed in the past, but the communication using the hash value "AAAAAA..." Two records, record 1301 and record 1302, correspond to this.

If the program with the hash value "AAAAAA..." is malware, even if the URLs "http://aaa.com" and "http://ddd.com" stored in the operation history are determined to be not dangerous, there is a high possibility that they are dangerous sites such as unknown C&C servers. Therefore, since it is clear that the same malware has already infiltrated PCs named "PC-A" and "PC-C," the computing device 20C sends a virus scan or quarantine command to these client terminal devices 10 (S-1403).

As described above, by using the hash value, it is possible to discover a client terminal device that has hidden malware without accessing a dangerous URL, and take countermeasures against that client terminal device.

[Sixth embodiment]
In this embodiment, a process will be described in which, by using a user account, the same user who attempts to access a dangerous website is restricted from logging in on another client terminal device.

In the first embodiment, the computer name of the client terminal device 10 is added as client-specific information to the message header of the HTTP request sent from the client terminal device 10, thereby allowing access to a dangerous website. The client terminal device 10 that attempted to do so was identified and measures such as isolating it from the network were taken. However, even if some action is taken on the client terminal device 10, if the user who used that client terminal device 10 uses another client terminal device 10, there is a possibility that the user may attempt to connect to a similar dangerous website. There is sex. Therefore, in the present embodiment, the computing device 10C adds a user account (user name), which is information indicating the logged-in user, as client-specific information, so that the server device 20 can access dangerous websites. The user account that was logged in to the client terminal device 10 at the time of access can be identified, and the identified user account can be used to restrict logins to the client terminal device 10 by the same user.

FIG. 15 is a system configuration diagram showing an example of the configuration of an information processing system. The information processing system shown in FIG. 15 includes a server device 60 and a plurality of client terminal devices 11 in addition to the configuration of the information processing system shown in FIG. Most of the server device 60 is the same as the server management device 20, so the explanation will be omitted below, and only the different parts will be explained. Note that since most of the operations of this embodiment are the same as those of the first to fifth embodiments, only the operations that are different from the first to fifth embodiments will be explained here. , description of common operations will be omitted.

The server device 60 stores a login management program 60F that manages logins of all client terminal devices 10 existing within the network 30. Note that the login management program 60F and the server program 20F may be implemented on the same server device.

Further, the storage device 60B records an account management table in which user accounts (account names) of all the client terminal devices 10 existing in the network 30 are associated with login restrictions (permit/deny). FIG. 17 shows an example of an account management table. The account management table is recorded by identifying user accounts that have accessed dangerous websites, as will be described later. Note that the account management table may be recorded by an administrator. The login management program 60F that manages login is appropriately loaded into the RAM of the memory 60E under the control of the arithmetic device 60C, and is processed by the arithmetic device 60C.

Furthermore, in this embodiment, when logging in to the client terminal device 10, the process shown in FIG. 16 is performed. FIG. 16 is a sequence diagram showing login restrictions. In any client terminal device 10, the computing device 10C of the client device 10 detects that a user attempts to log in (S-1601).

The computing device 10C makes an inquiry to the server device 60 via the network I/F 10D and the network 30 as to whether login is possible (S-1602). In addition, when making an inquiry, the user account that the user is trying to log in to is also sent together.

Upon receiving the inquiry, the computing device 60C compares the loaded user account with the user account included in the inquiry based on the account management table stored in the storage device 60B, and determines whether login is possible (S -1603).

The computing device 60C returns a response of the determination result (login permission or denial) to the client terminal device 10 that made the inquiry (S-1604). The arithmetic device 10C of the client terminal device 10 permits/rejects login based on the received determination result. For example, as shown in FIG. 17, login from userA is permitted, and login from userB is denied.

Assume that a certain user accesses a dangerous website (assuming that the determination in step S-801 in FIG. 8 is YES). As described above, in this embodiment, since the computing device 10C adds the logged-in user account to the request packet, the computing device 20C can identify the user account that made the request. Therefore, the computing device 20C, via the network I/F 20D and the network 30, corresponds to the user account of the user who accessed the dangerous website in the account management table recorded in the storage device 60B of the server device 60. Record the login restriction as "denied".

As described above, when a user who attempts to access a dangerous website attempts to log in from another client terminal device, that login can be prohibited. This makes it possible to prevent the same user from accessing dangerous websites.

[Other embodiments]
The present invention provides a system or device with a program that implements one or more functions of the embodiments described above via a network or a storage medium, and one or more processors in a computer of the system or device reads and executes the program. This can also be achieved by processing. It can also be realized by a circuit (for example, an ASIC) that realizes one or more functions.

Claims (18)

An information processing system,
It has a client terminal device, an information device, and a server device,
The server device includes:
first receiving means for receiving a request packet from the client terminal device via the information device;
first determining means for determining whether the request packet received by the first receiving means includes information indicating a destination of a specific packet;
If the first determining means determines that information indicating the destination of the specific packet is included, the first determining means transmits the packet with the specific information added to the client terminal device via the information device. and a transmission means,
The client terminal device includes:
second receiving means for receiving packets from the server device via the information device;
a second determining means for determining whether or not the specific information is included in the packet received by the second receiving means;
If the second determining means determines that specific information is included, a second transmitting means adds client-specific information to the packet and transmits the packet to the server device via the information device. Prepare,
The server device further includes:
third receiving means for receiving packets transmitted from the client terminal via the information device;
An information processing system comprising: extraction means for extracting the client-specific information from the packet received by the third reception means. The information processing system according to claim 1, wherein the server device is a proxy server. 3. The information processing system according to claim 1, wherein the information device is a router, a firewall, or a UTM. The information according to claim 1, wherein the client-specific information is any one or a combination of information indicating the client terminal device, information indicating a user, and information indicating a program that transmitted the packet. processing system. The server device further comprises third determining means for determining whether information indicating a program that transmitted the packet, which is information unique to the client, is information indicating a predetermined program. The information processing system according to item 1. 1. The monitoring means monitors the operation of the client terminal device, and the client terminal device further includes an output means for outputting the operations monitored by the monitoring means as an operation history. The information processing system described in . The operation history includes information indicating a destination of the packet,
7. The information processing system according to claim 6, wherein the server device further includes fourth determining means for determining whether or not the operation history includes information indicating a destination of a specific packet. The operation history includes an offset value that is the difference between the time before the change and the time after the change of the client terminal device,
The server device further includes calculation means for calculating the time of the client terminal device based on the value of the offset,
8. The information processing system according to claim 7, wherein the fourth determining means makes the determination based on the time calculated by the calculating means. The operation history includes a hash value of a program that sent the packet,
7. The information processing system according to claim 6, wherein the server device further includes a fifth determination unit that determines whether or not the operation history includes a specific hash value. The client-specific information is information indicating a user,
The extracting means extracts information indicating the user from the packet received by the third receiving means, and associates the information indicating the user with information regarding restrictions on login to the client terminal device. 2. The information processing system according to claim 1, wherein information indicating the user is recorded in the table. The client terminal device includes:
transmitting information including information indicating a user of the client terminal device to the server device when a login to the client terminal device is attempted;
The server device includes:
The information processing system according to claim 10, wherein a restriction on login to the client terminal device in the received information indicating the user of the client terminal device is determined based on the table. 2. The information processing system according to claim 1, wherein the specific information is any one or a combination of information regarding the determination by the first determining means, a virus scan command, and a transfer command. a first receiving means for receiving a request packet from a client terminal device via the information device;
first determining means for determining whether the request packet received by the first receiving means includes information indicating a destination of a specific packet;
a transmitting means for transmitting a packet to which specific information is added, to the client terminal device via the information device when the first determining means determines that information indicating a destination of the specific packet is included; ,
second receiving means for receiving packets transmitted from the client terminal via the information device;
and extracting means for extracting client-specific information from the packet received by the second receiving means. a first receiving step of receiving a request packet from the client terminal device via the information device;
a first determination step of determining whether the request packet received in the first reception step includes information indicating a destination of a specific packet;
If it is determined in the first determination step that information indicating the destination of the specific packet is included, a transmission step of transmitting the packet with the specific information added to the client terminal device via the information device; ,
a second receiving step of receiving a packet transmitted from the client terminal via the information device;
A method for controlling a server device, comprising: an extraction step of extracting client-specific information from the packet received in the second reception step. computer,
a first receiving means for receiving a request packet from a client terminal device via the information device;
first determining means for determining whether the request packet received by the first receiving means includes information indicating a destination of a specific packet;
If the first determining means determines that information indicating a destination of the specific packet is included, transmitting means transmits the packet with the specific information added to the client terminal device via the information device; ,
second receiving means for receiving packets transmitted from the client terminal via the information device;
A program for functioning as an extraction means for extracting client-specific information from a packet received by the second reception means. receiving means for receiving packets from the server device via the information device;
determining means for determining whether specific information is included in the packet received by the receiving means;
If the determination means determines that specific information is included, the information processing apparatus further comprises a transmission means for adding client-specific information to the packet and transmitting the packet to the server device via the information device. Client terminal device. a receiving step of receiving the packet from the server device via the information device;
a determination step of determining whether specific information is included in the packet received in the receiving step;
If it is determined in the determination step that specific information is included, the packet includes a sending step of adding client-specific information to the packet and transmitting the packet to the server device via the information device. A method of controlling a client terminal device. computer,
receiving means for receiving packets from the server device via the information device;
determining means for determining whether specific information is included in the packet received by the receiving means;
If the determination means determines that specific information is included, the program adds client-specific information to the packet and causes the program to function as a transmission means for transmitting the packet to the server device via the information device.

Images