JP4328285B2 - Relay device, relay method, and relay program - Google Patents

Description

  The present invention relates to a relay device, a relay method, and a relay program.

In the conventional fraud detection method shown in Patent Document 1, when searching for a server that is published by copying the content that has been illegally leaked, the server is more efficient than performing a brute force search. Therefore, the inspection object is limited based on the associative information included in the content.
JP 2001-282749 A

  In the conventional fraud detection method, although content that has already been illegally leaked on the network can be found, it cannot be found when the content leaks illegally.

  An object of the present invention is to detect a content when it is illegally leaked to an external network, prevent illegal leak of the content, and warn a user to that effect.

The relay device of the present invention
In a relay device connected between a transmission device that generates a plurality of packets by dividing data and transmits the generated plurality of packets and a reception device that receives the plurality of packets transmitted by the transmission device ,
A packet receiver for receiving the plurality of packets transmitted by the transmitter;
A packet storage unit for storing the plurality of packets received by the packet reception unit;
A data assembly unit that assembles the data from the plurality of packets stored in the packet storage unit;
An information extraction unit for extracting data information related to the data from the data assembled by the data assembly unit;
A transmission determination unit for determining whether to transmit the plurality of packets stored in the packet storage unit to the reception device based on the data information extracted by the information extraction unit;
The packet storage unit transmits all the packets except the at least one packet among the plurality of packets stored in the packet storage unit to the receiving device, and based on the result of the determination by the transmission determination unit A packet transmission unit that transmits a packet that is not transmitted to the receiving device among the plurality of packets stored in the packet.

  In the present invention, data assembled from received packets in a relay apparatus that receives packets from a transmission apparatus that transmits data (hereinafter also referred to as contents or files) divided into a plurality of packets and transfers the packets to the reception apparatus. Since the information extraction unit extracts data information from the data and the transmission determination unit determines whether or not all received packets can be transferred to the receiving device, the content leaks illegally to the external network. At this point, it becomes possible for the relay device to detect the unauthorized outflow. In addition, in the relay device, the packet transmission unit cancels transfer of at least one of the packets of data that the transmission determination unit has determined not to transfer, so that the relay device can prevent content from being illegally leaked. Become. Further, since the warning output unit outputs warning information indicating that there has been unauthorized leakage in the relay device, the relay device can warn the user of unauthorized leakage of content.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In each embodiment, a Web server that is an example of a transmission device divides and transmits data such as images, audio, and video into a plurality of packets, and an unauthorized outflow detection device that is an example of a relay device inspects the transmitted data. Then, the data is transferred to a terminal which is an example of a receiving device.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a configuration of a relay device according to the present embodiment.

  In FIG. 1, an internal network 1 is connected to a target device that prevents unauthorized outflow. Here, it is assumed that the Web server 2 is connected to the internal network 1 and needs to be protected, so that the image A3 signed with the digital watermark signature x is disclosed on the Web server 2. On the other hand, the external network 4 is connected to a terminal 5 that intends to take out the image A3.

  An unauthorized outflow detection device 6 is installed between the internal network 1 and the external network 4.

  In the unauthorized outflow detection device 6, the packet receiver 7 receives packets from the internal network 1 and the external network 4. The data assembling unit 8 refers to the header of the received packet and assembles data from a plurality of packets. The assembly buffer 9 is an example of a packet storage unit, and stores data that has been assembled by the data assembly unit 8 and packets that are being assembled.

  The signature extraction unit 10 is an example of an information extraction unit, and extracts a digital watermark signature x from the contents of the assembly buffer 9 that has been assembled. The signature DB (database) 11 is an example of an information storage unit, and manages signature data corresponding to content to be prevented from being illegally leaked. The signature data managed by the signature DB 11 is, for example, a content ID (IDentification) that uniquely identifies each content encrypted with the content manager's private key. In this case, the content manager Set the content ID. The signature determination unit 12 is an example of a combination of an information comparison unit and a transmission determination unit, and determines whether the signature x extracted by the signature extraction unit 10 is included in the signature DB 11.

  The alert display unit 13 is an example of a warning output unit. When the signature determination unit 12 determines that the signature x is included in the signature DB 11, the alert display unit 13 warns the user that content has been illegally leaked. Here, the fact that there has been an illegal outflow indicates that there has been an unauthorized access to the data regardless of whether or not the data targeted for preventing the illegal outflow actually leaked to the external network 4. The alert display unit 13 includes a screen, for example, and displays a warning on the screen that data targeted for fraud detection has been transmitted. Further, an e-mail indicating a warning may be transmitted to the content manager. As a result, when there is an illegal outflow, a user such as a content manager can be automatically warned.

  If the data assembling unit 8 has not completed data assembly, or if the signature extraction unit 10 cannot extract the signature data, the packet transmission unit 14 determines that the extracted signature x is not included in the signature DB 11, and the signature determination unit 12 If determined, the packet is transmitted to the destination indicated in the header.

  Next, since the terminal 5 downloads a JPG (Joint Photographic Experts Group) image A3 prohibited from being taken out of the internal network 1, the unauthorized outflow detection device 6 when accessing the Web server 2 is downloaded. Will be described.

  FIG. 2 is a flowchart showing the operation of the unauthorized outflow detection device 6.

  First, when the terminal 5 starts download processing of the image A3 of the Web server 2, the packet receiving unit 7 of the unauthorized outflow detection device 6 receives a packet generated by dividing the data of the image A3 (S101). The packet received by the packet receiver 7 is stored in the assembly buffer 9 (S102), and further input to the data assembly unit 8. The data assembly unit 8 implements TCP (Transmission Control Protocol), and performs data assembly using the received packet (S103). Then, an HTTP (HyperText Transfer Protocol) header in the assembled data is referred to. In the present embodiment, the content is recognized as a JPG image by Content-Type of the HTTP header. Also, the total number of bytes of content is confirmed by Content-Length of the HTTP header.

  Next, it is confirmed whether or not data assembly is completed in the data assembly unit 8 (S104). Specifically, it is confirmed whether the size of the assembled data in the assembly buffer 9 has reached the total number of bytes of the content. A received packet in the middle of assembly is transmitted to the external network 4 by the packet transmission unit 14 after the assembly process in the data assembly unit 8 is completed (S105). Thereafter, the process from step S101 to step S105 is repeated until the packet receiving unit 7 receives the next packet and the data assembly is completed.

  When the final packet in which the assembled data reaches the total number of bytes of content is received, that is, when the data assembly unit 8 completes the data assembly (S104), the content stored in the assembly buffer 9 by the signature extraction unit 10 is stored. It is confirmed whether a digital watermark signature is embedded (S106). If the content is not signed, the received packet is transferred to the packet transmitter 14 and transmitted to the external network 4 (S110). If the content is signed, the signature extraction unit 10 extracts a digital watermark signature from the content (S107). Subsequently, the signature determination unit 12 checks whether signature data that matches the extracted signature is stored in the signature DB 11 (S108 and S109). If there is no matching signature data, the received packet is sent to the packet transmitter 14 and sent to the external network 4 (S110). If there is matching signature data, the alert display unit 13 warns the user that there has been an unauthorized outflow (S111). At this time, the received packet may be discarded.

  As described above, in the present embodiment, the unauthorized outflow is detected in real time by the unauthorized outflow detection device 6 that is a gateway on the network, and the unauthorized outflow can be further prevented. Further, by embedding signature data in each file of the internal network 1 with a digital watermark and registering the signature data in the signature DB 11, an object of preventing unauthorized leakage without changing the setting of the unauthorized leakage detection device 6 can be obtained. Files can be added, reducing management costs. Furthermore, by signing a content file with a digital watermark, the user does not know whether the file is a signed file, thereby increasing the effect of preventing unauthorized outflow.

  In addition, when there is an unauthorized access to content such as image data, it is possible to prevent leakage of complete data by discarding the last received packet including a part of the content. Furthermore, even if data assembly is not completed, packets are transferred at an early stage after receiving the packet other than the last packet to be transmitted, so that data inspection can be performed with little effect on the data transfer speed. Can do. Here, in order to ensure higher security, not only the last received packet but also a plurality of packets may be discarded. In this case, control is performed so that the packet transmission unit 14 does not transmit the plurality of packets until the signature determination unit 12 confirms the signature.

  In this embodiment, it is assumed that an illegal leak occurred when the digital watermark signature of the accessed content matches the signature of the signature DB 11, but conversely, access to the content is permitted only when the signature matches. The form to do is also possible. In this case, step S110 and step S111 in FIG. 2 are interchanged. Thereby, only the designated content can be distributed outside. In addition, when there are a small number of files to be prevented from being illegally leaked out of an enormous amount of files, it is possible to reduce the trouble of embedding a signature in each file.

  Although this embodiment has been described using an image as data to be prevented from unauthorized leakage, the present embodiment can be applied to any data that can be digitally watermarked, such as moving images and audio.

The content fraud detection device described in this embodiment is
A packet receiver for receiving packets from an internal network or an external network;
A data assembly unit that assembles the packet according to the contents of the header of the received packet;
An assembly buffer for temporarily storing the assembled packet;
A signature extraction unit that extracts signature data of a digital watermark included in the assembled content when the assembly of the packet is completed;
A signature DB that manages a list of signature data in which digital watermarks have been previously signed in order to prevent unauthorized leakage of content;
A signature determination unit that searches the signature DB for a match with the signature data extracted by the signature extraction unit;
An alert display section that warns the user of unauthorized leakage when there is matching signature data in the signature determination section;
The network that has received the packet when the data assembling unit has not completed the assembly, the packet when the signature extracting unit cannot extract the signature data, and the signature determining unit when there is no signature data matching the signature DB And a packet transmission unit relaying to another network.

The content fraud detection device is
An alert is displayed when the determination unit does not match or is not similar, but when it does not match or is not similar.

Embodiment 2. FIG.
In this embodiment, an example in which unauthorized outflow is detected using words included in audio and moving images as keys is shown.

  FIG. 3 is a block diagram showing a configuration of the relay apparatus according to the present embodiment.

  In FIG. 3, an internal network 21 is connected to a target device that prevents unauthorized outflow. Here, it is assumed that the Web server 22 is connected to the internal network 21, and the moving image B23 that needs to be protected is disclosed on the Web server 22. On the other hand, the external network 24 is connected to a terminal 25 that tries to bring out the moving image B23.

  An unauthorized outflow detection device 26 is installed between the internal network 21 and the external network 24.

  In the unauthorized outflow detection device 26, the packet receiving unit 27 receives packets from the internal network 21 and the external network 24. The data assembly unit 28 refers to the header of the received packet and assembles data from a plurality of packets. The assembly buffer 29 is an example of a packet storage unit, and stores data that has been assembled by the data assembly unit 28 and packets that are being assembled.

  The voice character string conversion unit 30 is an example of an information extraction unit, extracts voice from the contents of the assembly buffer 29 that has been assembled, and converts it into a character string. For example, the voice character string conversion unit 30 performs voice recognition using an HMM (Hidden Markov Model) method on a voice data portion of a moving image or a voice file, and converts the recognized content into a character string.

  The character string DB (database) 31 is an example of an information storage unit, and manages character string data that is a key for unauthorized outflow inspection. The voice character string determination unit 32 is an example of a combination of an information comparison unit and a transmission determination unit, and determines whether the character string DB 31 includes the character string converted by the voice character string conversion unit 30.

  The alert display unit 33 is an example of a warning output unit. If the character string DB 31 determines that the character string converted from the sound of the video B23 is included in the character string DB 31, the voice character string determination unit 32 informs the user of the content. Warn that there was an unauthorized spill. Here, the fact that there has been an unauthorized outflow indicates that there has been an unauthorized access to the data regardless of whether the data that is the target of preventing the unauthorized outflow has actually leaked to the external network 24. The alert display unit 33 includes a screen, for example, and displays a warning that data targeted for fraud detection has been transmitted on the screen. Further, an e-mail indicating a warning may be transmitted to the content manager. As a result, when there is an illegal outflow, a user such as a content manager can be automatically warned.

  When the data assembling unit 28 has not completed the data assembly, the packet transmitting unit 34 does not include the voice in the moving image B23, and the character string DB 31 indicates that the character string converted from the voice is not included in the character string DB 31. When it is determined by the determination unit 32, the packet is transmitted to the destination indicated in the header.

  Next, since the terminal 25 downloads the moving picture experts group (MPEG) video B23 which is prohibited from being taken out of the internal network 21, the unauthorized leak detection device 26 when accessing the Web server 22 is downloaded. Will be described.

  FIG. 4 is a flowchart showing the operation of the unauthorized outflow detection device 26.

  First, when the terminal 25 starts the download process of the video B23 of the Web server 22, the packet reception unit 27 of the unauthorized outflow detection device 26 receives a packet generated by dividing the data of the video B23 (S201). The packet received by the packet receiver 27 is stored in the assembly buffer 29 (S202), and further input to the data assembly unit 28. The data assembling unit 28 implements TCP and assembles data using the received packet (S203). Then, the HTTP header in the assembled data is referenced. In the present embodiment, the content is recognized as an MPEG video by the Content-Type of the HTTP header. Also, the total number of bytes of content is confirmed by Content-Length of the HTTP header.

  Next, it is confirmed whether or not data assembly is completed in the data assembly unit 28 (S204). Specifically, it is confirmed whether or not the size of the assembled data in the assembly buffer 29 has reached the total number of bytes of the content. The received packet in the middle of assembly is transmitted to the external network 24 by the packet transmission unit 34 after the assembly processing in the data assembly unit 28 is completed (S205). Thereafter, the process from step S201 to step S205 is repeated until the packet receiving unit 27 receives the next packet and the data assembly is completed.

  When the final packet in which the assembled data reaches the total number of bytes of the content is received, that is, when the data assembly is completed in the data assembly unit 28 (S204), the data is stored in the assembly buffer 9 by the voice character string conversion unit 30. It is confirmed whether or not audio is included in the content (S206). If no audio is included in the content, the received packet is transferred to the packet transmitter 34 and transmitted to the external network 24 (S210). If the content includes audio, the audio character string conversion unit 30 extracts the audio from the content and converts it into a character string (S207). Subsequently, the voice character string determination unit 32 checks whether character string data matching the character string converted from the voice is stored in the character string DB 31 (S208 and S209). If there is no matching character string data, the received packet is sent to the packet transmitter 34 and sent to the external network 24 (S210). If there is matching character string data, the alert display unit 33 warns the user that there has been an unauthorized outflow (S211). At this time, the received packet may be discarded.

  As described above, in the present embodiment, as in the first embodiment, the unauthorized spill detection device 26 that is a gateway on the network detects the unauthorized spill, thereby detecting the unauthorized spill in real time, Can be prevented.

  In addition, when there is an unauthorized access to content such as a moving image, it is possible to prevent complete data from leaking by discarding the last received packet including a part of the content. Furthermore, even if data assembly is not completed, packets are transferred at an early stage after receiving the packet other than the last packet to be transmitted, so that data inspection can be performed with little effect on the data transfer speed. Can do. Here, in order to ensure higher security, not only the last received packet but also a plurality of packets may be discarded. In this case, control is performed so that the packet transmission unit 34 does not transmit the plurality of packets until the voice character string determination unit 32 completes the search for the character string.

  Further, in the present embodiment, by converting sound into a character string, it is possible to detect fraudulent outflow based on the contents of content such as sound and video, and a flexible fraud detection method can be realized. Furthermore, it is not necessary to specify each illegally leaked content one by one, and the management cost can be reduced.

  In the present embodiment, it is assumed that there was an illegal outflow when the character string converted from the audio of the accessed content matches the character string in the character string DB 31, but conversely only when the character strings match. A form of permitting access to the content is also possible. In this case, step S210 and step S211 in FIG. 4 are interchanged. Thereby, only the designated content can be distributed outside.

The content fraud detection device described in this embodiment is
A packet receiver for receiving packets from an internal network or an external network;
A data assembly unit that assembles the packet according to the contents of the header of the received packet;
An assembly buffer for temporarily storing the assembled packet;
An audio string converter that converts the audio part contained in the assembled video / audio content to a character string when the assembly of the packet is completed;
A character string DB for registering a character string of voice prohibited from being leaked in advance in order to prevent unauthorized leakage of content;
A voice character string determination unit that searches the character string DB for a match with the character string data converted by the voice character string conversion unit;
An alert display unit that warns the user of unauthorized leakage when there is matching character string data in the voice character string determination unit;
The packet when the assembly is not completed in the data assembly unit, the packet when the character string data cannot be extracted by the voice character string extraction unit, and the character string data matching the character string DB is not found in the voice character string determination unit The packet transmission unit relays the packet to a network different from the network that received the packet.

The content fraud detection device is
An alert is displayed when the determination unit does not match or is not similar, but when it does not match or is not similar.

Embodiment 3 FIG.
In the present embodiment, an example in which an illegal outflow is detected based on whether or not an image specified in advance and an image included in content such as a moving image are identical or similar is shown.

  FIG. 5 is a block diagram showing a configuration of the relay apparatus according to the present embodiment.

  In FIG. 5, an internal network 41 is connected with a target device that prevents unauthorized outflow. Here, it is assumed that the Web server 42 is connected to the internal network 41 and the image C43 that needs to be protected is disclosed on the Web server 42. On the other hand, a terminal 45 is connected to the external network 44 to take out the image C43.

  An unauthorized outflow detection device 46 is installed between the internal network 41 and the external network 44.

  In the unauthorized leak detection device 46, the packet receiver 47 receives packets from the internal network 41 and the external network 44. The data assembling unit 48 refers to the header of the received packet and assembles data from a plurality of packets. The assembly buffer 49 is an example of a packet storage unit, and stores data that has been assembled by the data assembly unit 48 and packets being assembled.

  An image DB (database) 51 is an example of an information storage unit, and manages image data that is a target for preventing unauthorized outflow. The similar image determination unit 52 is an example of a combination of an information extraction unit, an information comparison unit, and a transmission determination unit, and determines whether the image DB 51 includes an image that matches or is similar to the contents of the assembly buffer 49 that has been assembled. . Here, when the data to be inspected for illegal leakage is not an image but a moving image, for example, the similar image determination unit 52 extracts an image from the data or converts the data into image data. The similar image determination unit 52 performs, for example, wavelet transform on the image data stored in the image DB 51 to extract the features of the periodic pattern of the color scheme, shape, and pattern, and those features and the assembly buffer that has been assembled. The image similarity is determined by comparing the image included in the 49 contents with the similarly extracted feature.

  The alert display unit 53 is an example of a warning output unit. When the similar image determination unit 52 determines that the image C43 is included in the image DB 51, the alert display unit 53 warns the user that content has been illegally leaked. Here, the fact that there has been unauthorized leakage indicates that there has been unauthorized access to the data regardless of whether or not the data to be prevented from unauthorized leakage actually leaked to the external network 44. The alert display unit 53 includes a screen, for example, and displays a warning on the screen that data targeted for fraud detection has been transmitted. Further, an e-mail indicating a warning may be transmitted to the content manager. As a result, when there is an illegal outflow, a user such as a content manager can be automatically warned.

  When the data assembling unit 48 has not completed the data assembling, or when the data does not include the image, the packet transmitting unit 54 matches or is similar to the image data included in the image DB 51. Otherwise, when the similar image determination unit 52 determines that the packet is not transmitted, the packet is transmitted to the destination indicated in the header.

  Next, the operation of the unauthorized outflow detection device 46 when the terminal 45 accesses the Web server 42 in order for the terminal 45 to download the JPG format image C43 that is prohibited from being taken out of the internal network 41 will be described.

  FIG. 6 is a flowchart showing the operation of the unauthorized outflow detection device 46.

  First, when the terminal 45 starts download processing of the image C43 of the Web server 42, the packet reception unit 47 of the unauthorized outflow detection device 46 receives a packet generated by dividing the data of the image C43 (S301). The packet received by the packet receiver 47 is stored in the assembly buffer 49 (S302) and further input to the data assembly unit 48. The data assembling unit 48 implements TCP and assembles data using the received packet (S303). Then, the HTTP header in the assembled data is referenced. In the present embodiment, the content is recognized as a JPG image by Content-Type of the HTTP header. Also, the total number of bytes of content is confirmed by Content-Length of the HTTP header.

  Next, in the data assembling unit 48, it is confirmed whether or not the data assembling is completed (S304). Specifically, it is confirmed whether the size of the assembled data in the assembly buffer 49 has reached the total number of bytes of the content. The received packet in the middle of assembly is transmitted to the external network 44 by the packet transmission unit 54 after the assembly process in the data assembly unit 48 is completed (S305). Thereafter, the process from step S301 to step S305 is repeated until the packet receiving unit 47 receives the next packet and completes the data assembly.

  When the final packet in which the assembled data reaches the total number of bytes of the content is received, that is, when data assembly is completed in the data assembly unit 48 (S304), the content stored in the assembly buffer 9 by the similar image determination unit 52 (S306). Here, as in the case of the image C43 in the present embodiment, when the type of content to be prevented from being illegally leaked is limited to only images, step S306 may be omitted.

  If no image is included in the content, the received packet is transferred to the packet transmitter 54 and transmitted to the external network 44 (S309). When the content includes an image, the similar image determination unit 52 extracts the image from the content, and checks whether image data that matches or is similar to the image is stored in the image DB 51 (S307 and S308). If there is no matching or similar image data, the received packet is sent to the packet transmitter 54 and sent to the external network 44 (S309). If there is matching or similar image data, the alert display unit 53 warns the user that there has been an unauthorized outflow (S310). At this time, the received packet may be discarded.

  As described above, in the present embodiment, in the same manner as in the first embodiment, an unauthorized outflow is detected in real time by detecting an unauthorized outflow with the unauthorized outflow detection device 46 that is a gateway on the network. Can be prevented.

  In addition, when there is an unauthorized access to content such as an image, it is possible to prevent complete data from leaking by discarding the last received packet including a part of the content. Furthermore, even if data assembly is not completed, packets are transferred at an early stage after receiving the packet other than the last packet to be transmitted, so that data inspection can be performed with little effect on the data transfer speed. Can do. Here, in order to ensure higher security, not only the last received packet but also a plurality of packets may be discarded. In this case, control is performed so that the packet transmission unit 54 does not transmit the plurality of packets until the similar image determination unit 52 completes the search for similar images.

  Further, in this embodiment, by analyzing the similarity of images, it is possible to detect fraudulent outflow based on the contents of content such as images and moving images, and a flexible fraud outflow detection method can be realized.

  In the present embodiment, it is assumed that there is an illegal outflow when the image included in the accessed content matches or resembles the image in the image DB 51, but conversely, only when the image matches or resembles the content to the content A form of permitting access is also possible. In this case, step S309 and step S310 in FIG. 6 are interchanged. Thereby, only the designated content can be distributed outside.

The content fraud detection device described in this embodiment is
A packet receiver for receiving packets from an internal network or an external network;
A data assembly unit that assembles the packet according to the contents of the header of the received packet;
An assembly buffer for temporarily storing the assembled packet;
A video or video content that is similar to the image included in the image DB and has been assembled when the assembly of the image DB and the packet in which the image of prohibition of leakage is registered in advance in order to prevent unauthorized leakage of content is completed. A similar image determination unit that determines whether the image is included in
An alert display unit that warns the user of unauthorized outflow when there is similar image data in the similar image determination unit;
Receives a packet when assembly is not completed by the data assembly unit, a packet when image data cannot be extracted by the similar image determination unit, and a packet when there is no image data similar to the image DB by the similar image determination unit And a packet transmission unit that relays to another network.

The content fraud detection device is
An alert is displayed when the determination unit does not match or is not similar, but when it does not match or is not similar.

Embodiment 4 FIG.
FIG. 7 is a diagram showing an example of the appearance of the unauthorized spill detection device 6 in the first embodiment, the unauthorized spill detection device 26 in the second embodiment, and the unauthorized spill detection device 46 in the third embodiment.
In FIG. 7, the unauthorized leak detection device includes a system unit 910, a CRT (Cathode Ray Tube) display device 901, a keyboard (K / B) 902, a mouse 903, a compact disc device (CDD) 905, and a printer device 906. Are connected by a cable.
Further, the unauthorized leak detection device is connected to a local area network (LAN) 942 and the Internet 940.

  The LAN 942 is an example of an internal network. The Internet 940 is an example of an external network.

FIG. 8 is a diagram illustrating an example of the hardware configuration of the unauthorized outflow detection device 6 in the first embodiment, the unauthorized outflow detection device 26 in the second embodiment, and the unauthorized outflow detection device 46 in the third embodiment.
In FIG. 8, the unauthorized leak detection device includes a CPU (Central Processing Unit) 911 that executes a program. The CPU 911 is connected to the ROM 913, RAM 914, communication board 915, CRT display device 901, K / B 902, mouse 903, FDD (Flexible Disk Drive) 904, magnetic disk device 920, CDD 905, and printer device 906 via the bus 912. Yes.
The RAM 914 is an example of a volatile memory. The ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are examples of nonvolatile memories. These are examples of “˜DB” or “˜storage unit” or “˜storage unit”.
The communication board 915 is connected to the LAN 942 or the like.
For example, a CRT display device 901, a printer device 906, a communication board 915, and the like are examples of a warning output unit.

  The magnetic disk device 920 stores an operating system (OS) 921, a window system 922, a program group 923, and a file group 924. The program group 923 is executed by the CPU 911, the OS 921, and the window system 922.

The program group 923 stores a program for executing the function described as “˜unit” in the description of the first to third embodiments. The program is read and executed by the CPU 911.
In the file group 924, the determination result, calculation result, and processing result of each step described using the flowchart in the description of the first to third embodiments are stored as files.
The portion of the line connecting the blocks in the block diagrams described in the first to third embodiments mainly indicates data input / output, and for the data input / output, data is stored in the magnetic disk device 920, FD. (Flexible Disk), optical disc, CD (compact disc), MD (mini disc), DVD (Digital Versatile Disc), and other recording media. Alternatively, it is transmitted through a signal line or other transmission medium.

  In addition, what is described as “˜unit” in the description of the first to third embodiments may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  The programs for carrying out the first to third embodiments include other magnetic disk devices 920, FD (Flexible Disk), optical disk, CD (compact disk), MD (mini disk), DVD (Digital Versatile Disk), and the like. You may memorize | store using the recording device by a recording medium.

FIG. 3 is a block diagram illustrating a configuration of a relay device according to the first embodiment. FIG. 3 is a flowchart showing the operation of the relay device according to the first embodiment. FIG. 4 is a block diagram illustrating a configuration of a relay device according to a second embodiment. FIG. 9 is a flowchart showing the operation of the relay device according to the second embodiment. FIG. 4 is a block diagram illustrating a configuration of a relay device according to a third embodiment. FIG. 9 is a flowchart showing the operation of the relay device according to the third embodiment. The figure which shows an example of the external appearance of the relay apparatus in Embodiment 1-3. FIG. 4 is a diagram illustrating an example of a hardware configuration of a relay device according to the first to third embodiments.

Explanation of symbols

  1, 21, 41 Internal network, 2, 22, 42 Web server, 3 image A, 4, 24, 44 External network, 5, 25, 45 terminal, 6, 26, 46 Unauthorized leak detection device, 7, 27, 47 Packet receiver, 8, 28, 48 Data assembly unit, 9, 29, 49 Assembly buffer, 10 Signature extraction unit, 11 Signature DB, 12 Signature determination unit, 33, 53 Alert display unit, 14, 34, 54 Packet transmission unit , 23 Movie B, 30 Voice character string conversion unit, 31 Character string DB, 32 Voice character string determination unit, 43 Image C, 51 Image DB, 52 Similar image determination unit, 901 CRT display device, 902 K / B, 903 mouse , 904 FDD, 905 CDD, 906 Printer device, 910 system unit, 911 CPU, 912 bus, 913 RO , 914 RAM, 915 communication board, 920 a magnetic disk device, 921 OS, 922 Window system, 923 Program group, 924 File group, 940 Internet, 942 LAN.

Claims (8)

In a relay device connected between a transmission device that generates a plurality of packets by dividing data and transmits the generated plurality of packets and a reception device that receives the plurality of packets transmitted by the transmission device ,
A packet receiver for receiving the plurality of packets transmitted by the transmitter;
A packet storage unit for storing the plurality of packets received by the packet reception unit;
A data assembly unit that assembles the data from the plurality of packets stored in the packet storage unit;
An information extraction unit for extracting data information related to the data from the data assembled by the data assembly unit;
A transmission determination unit for determining whether to transmit the plurality of packets stored in the packet storage unit to the reception device based on the data information extracted by the information extraction unit;
The packet storage unit transmits all the packets except the at least one packet among the plurality of packets stored in the packet storage unit to the receiving device, and based on the result of the determination by the transmission determination unit And a packet transmission unit that transmits a packet that is not transmitted to the reception device among the plurality of packets stored in the relay device. The relay device further includes:
An information storage unit for storing comparison information;
An information comparison unit that compares the comparison information stored in the storage unit with the data information extracted by the information extraction unit;
The transmission determination unit
2. The method according to claim 1, wherein whether or not to transmit the plurality of packets stored in the packet storage unit to the receiving device is determined based on a result of comparison performed by the information comparison unit. Relay device. The information extraction unit includes:
An electronic signature embedded in the data by digital watermark is extracted as the data information,
The information storage unit
The relay apparatus according to claim 2, wherein an electronic signature is stored as the comparison information. The information extraction unit includes:
The voice contained in the data is converted into a character string and extracted as the data information,
The information storage unit
The relay apparatus according to claim 2, wherein a character string is stored as the comparison information. The information extraction unit includes:
An image included in the data is extracted as the data information;
The information storage unit
The relay apparatus according to claim 2, wherein an image is stored as the comparison information. The relay device further includes:
The apparatus according to claim 1, further comprising a warning output unit that outputs warning information indicating that the transmission determination unit has determined that the plurality of packets stored in the packet storage unit are not transmitted to the reception device. The relay device according to any one of 1 to 5. A relay device connected between a transmitting device that divides data to generate a plurality of packets, transmits the generated plurality of packets, and a receiving device that receives the plurality of packets transmitted by the transmitting device. In the relay method used,
The relay device is
A packet receiving step of receiving the plurality of packets transmitted by the transmitting device;
A packet storing step for storing the plurality of packets received in the packet receiving step;
A data assembly step of assembling the data from the plurality of packets stored in the packet storage step;
An information extraction step of extracting data information relating to the data from the data assembled in the data assembly step;
Based on the data information extracted in the information extraction step, a transmission determination step for determining whether to transmit the plurality of packets stored in the packet storage step to the receiving device;
All the packets except for at least one of the plurality of packets stored in the packet storing step are transmitted to the receiving device, and based on the result determined in the transmission determining step, the packet storing step A packet transmission step of transmitting a packet that has not been transmitted to the receiving device among the plurality of packets stored in step (b). A relay device connected between a transmitting device that divides data to generate a plurality of packets, transmits the generated plurality of packets, and a receiving device that receives the plurality of packets transmitted by the transmitting device. In the relay program to be executed,
A packet reception process for receiving the plurality of packets transmitted by the transmission device;
A packet storing process for storing the plurality of packets received by the packet receiving process;
A data assembly process for assembling the data from the plurality of packets stored by the packet storage process;
An information extraction process for extracting data information relating to the data from the data assembled by the data assembly process;
Based on the data information extracted by the information extraction process, a transmission determination unit that determines whether to transmit the plurality of packets stored by the packet storage process to the receiving device;
All the packets other than at least one of the plurality of packets stored by the packet storage process are transmitted to the receiving device. Based on the result of the determination by the transmission determination process, the packet storage process A relay program that causes a computer to execute a packet transmission process of transmitting a packet that has not been transmitted to the receiving device among the plurality of stored packets.

Images