JP4618601B2 - Behavior monitoring system - Google Patents

Description

  The present invention relates to a technique for monitoring the behavior of employees and the like in order to prevent leakage of information related to secrets such as confidential information from a desktop computer and a telephone.

  Organizations such as corporations possess various so-called “confidential” information such as know-how, customer information, transaction / contract information, and the like.

  And with the progress of information communication technology, it is obliged to prevent the leakage of personal information possessed by the current situation where, for example, confidential electronic documents can be easily transmitted via the network, or the enforcement of the Personal Information Protection Law In response to the current situation, these organizations now need to take measures to prevent the confidential information from leaking outside the company.

  Here, as a cause of secret leakage, for example, according to a survey by the NPO Japan Network Security Association, it is reported that 7.9% is internal leakage by human hands inside the organization.

  For this reason, in some organizations, for example, all the contents of e-mails sent and received by employees are checked to monitor for information leakage. However, such measures are not so preferable from the viewpoint of protecting the privacy of individual employees.

As another method, Patent Document 1 discloses a technique of designating a file existence range and issuing a warning or the like that there is a risk of information leakage when the file is detected at a position other than the existence position. Yes. Patent Document 2 discloses a technique for monitoring data access and extracting unauthorized operations and program execution before and after the event processing when processing such as data update or recording output to a portable disk is performed. It is disclosed.
Japanese Patent Laid-Open No. 2003-036208 JP 2005-222216 A

  However, the above conventional techniques have the following problems. That is, since information access other than information access on a desktop computer is not monitored, information leakage in conversations using other means such as IRC (Internet Relay Chat) or telephone cannot be monitored. is there.

  Moreover, since only the access to information on the desktop computer and the processing instructions before and after the information are monitored, there is a problem that a warning or the like may be executed even in normal information access.

  In order to solve the above-described problems, the present invention provides an employee behavior monitoring system that monitors the presence of leakage of confidential information in both a telephone and a desktop computer used by an employee with a monitoring server device. provide.

  Specifically, the monitoring server device includes an ID determination unit that determines whether the telephone call destination ID is a monitoring target ID, and a conversion unit that acquires call voice and converts it to text characters when the determination result is the monitoring target ID. And a confidentiality determination unit that determines whether the information being accessed by the desktop computer is a secret object, and if the determination result by the confidentiality determination unit is a determination result that the information is a secret object, the conversion unit And a search unit that searches whether the text characters obtained by the conversion are included in the access information that is the secret object. The telephone also includes an ID transmission unit that transmits a call destination ID to the monitoring server device, and a voice transmission unit that transmits call voice to the monitoring server device. The desktop computer is a behavior monitoring system including a confidentiality identification information transmitting unit that transmits confidentiality identification information for identifying whether the information being accessed is a secret object to the monitoring server device. .

  According to the present invention configured as described above, it is possible to monitor information leakage on the telephone in addition to the desktop computer.

  In other words, it is determined whether or not there is an information leak by monitoring the call destination identification from the telephone and the conversation content in the call voice, and monitoring whether there is information access to the data related to the conversation content on the desktop computer It becomes possible to do. Accordingly, it is possible to suppress the execution of a warning or the like in normal information access as much as possible, and to take a countermeasure such as outputting a warning only when there is an information leakage action in both telephone and information access.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that the present invention is not limited to these embodiments, and can be implemented in various modes without departing from the spirit of the present invention.

  In the first embodiment, claims 1 and 4 will be mainly described. In the second embodiment, claims 2 and 5 will be mainly described. In the third embodiment, claims 3 and 6 will be mainly described.

  Example 1

    <Overview>

  FIG. 1 is a conceptual diagram for explaining an example of employee behavior monitoring by the behavior monitoring system of the present embodiment. As shown in this figure, (1) an employee starts a desktop computer and starts a telephone call (including an IP telephone program embedded in the desktop computer). At this time, the monitoring server obtains the telephone call number “123-xxx”, refers to the call OK list, and the call number is, for example, the telephone number of a company branch or a company counsel. If it becomes clear, the monitoring is terminated.

  (2) On the other hand, there is a risk of information leakage if it is determined that the acquired call number “123-xxx” is a phone number other than that not on the call OK list. Continue monitoring as

  (3) When it is decided to continue the monitoring, the monitoring server acquires the packet data of the call voice from the telephone and converts it into text data by the voice-text conversion engine. Further, the identification information “confidential file A” of the information file accessed by the desktop computer is also acquired by the monitoring server.

  (4) Then, the monitoring server determines whether the NG word related to the confidential file A is not included in the text data, that is, whether confidential information related to the confidential file A is not spoken to the other party. Here, if the conversation (text) does not contain an NG word related to the confidential file A, it is determined that the access to the confidential file A is not an access intended for information leakage. On the other hand, if an NG word related to a contract fee of “$ 1,000,000”, for example, is searched for in the conversation (text), access to the confidential file A has a high risk of information leakage. For example, a warning message is displayed on the screen.

  In this way, monitoring across the telephone and desktop computer minimizes the execution of warnings during normal information access and responds only when there is an information leak in both telephone and information access. Can take.

    <Functional configuration>

  FIG. 2 is a diagram illustrating an example of functional blocks in the behavior monitoring system of the present embodiment. As shown in this figure, the behavior monitoring system of the present embodiment includes a “telephone” (0210) used by employees, a “desktop computer” (0220) used by employees, and a “monitoring server device” (0200). Is an action monitoring system consisting of However, the telephone and the desktop computer are not devices that are required for use by employees, but may be devices that constitute the system on the premise of use by employees. “Employees” are not only members of the company, but also government offices, public institutions, educational institutions, research institutions, hospitals, law / patent / accounting offices, NPO (Non Profit Organization) / NGO (Non Governmental) Organization), the Self-Defense Forces, and so on.

  In addition, the “secret held by the organization” means, for example, personal information stipulated in the Personal Information Protection Law, confidential information related to confidentiality agreements, information on know-how, and other confidential matters related to politics, economy, business, military, etc. , Etc.

  In the following, the configuration requirements of the “phone”, “desktop computer”, and “monitoring server device” constituting the behavior monitoring system of this embodiment for monitoring the behavior of employees so as not to leak such secret information will be described respectively. .

  Note that the functional blocks of each device constituting the system described below can be realized as hardware, software, or both hardware and software. Specifically, if a computer is used, a CPU, a main memory, a bus, or a secondary storage device (a storage medium such as a hard disk, a nonvolatile memory, a CD-ROM or a DVD-ROM, and a reading drive for these media) Etc.), hardware components such as printing devices, display devices, other external peripheral devices, I / O ports for the external peripheral devices, driver programs for controlling the hardware, other application programs, and information input Examples include user interfaces that are used.

  In addition, these hardware and software process the program developed on the main memory with the CPU, and process, store, and output data stored on the memory and hard disk, and data input via the interface. It is used for processing or controlling each hardware component.

  The present invention can be realized not only as a system but also as a method. A part of the invention can be configured as software. Furthermore, a software product used for causing a computer to execute such software and a recording medium in which the product is fixed to a recording medium are naturally included in the technical scope of the present invention (the same applies throughout the present specification). Is).

  First, the “monitoring server device” (0200) includes an “ID determination unit” (0201), a “conversion unit” (0202), a “confidentiality determination unit” (0203), a “search unit” (0204), Have

  The “ID determination unit” (0201) has a function of determining whether the telephone call destination ID is a monitoring target ID. The “telephone call destination ID” includes a dial number and an abbreviated number, and an IP address for an IP phone. The call destination ID includes a call destination ID that is called from another phone to this phone, that is, a callee ID when a call is received from this phone.

  As will be described later, when a calling operation or an incoming operation is performed on a telephone used by an employee, the call destination ID is transmitted to the monitoring server device. The determination method in the ID determination unit refers to, for example, the “call permission ID list” or “monitoring target ID list” stored in the secondary storage device or the like, and the telephone call destination ID is monitored. For example, a method of determining whether the ID is obtained by an arithmetic process such as a CPU.

  FIG. 3 is a conceptual diagram for explaining an example of the “call permission ID list” and the “monitoring target ID list”. As shown in FIG. 3A, for example, in the case of a call permission ID list, “321-ΔΔΔΔ” which is a contact address of the company branch “ABC Corp.” and “D Office” which is a company counsel attorney. “555- □□□□” or “456-XXX” which is the contact information of the employee “EF” is listed and stored in the HDD or the like. Then, the callee ID of the telephone currently used by the employee is acquired, and matching processing is performed to determine whether the callee list matches the ID included in the call permission ID list. If there is a matching ID, the call destination ID is determined not to be a monitoring target ID, and if there is no matching ID, it is determined to be a monitoring target ID.

  Alternatively, as shown in FIG. 3B, for example, a monitoring target ID list which is a call destination ID list such as a rival company “Black Company” or a troubled partner “Guil Office” is stored in the HDD or the like, A matching process may be performed to determine whether the destination list matches the ID included in the call permission ID list. In this case, if there is no matching ID, it is determined that the call destination ID is not a monitoring target ID, and if there is a matching ID, a determination is made that it is a monitoring target ID.

  Further, the determination process as to whether or not this call destination ID is the monitoring target ID may be determined in relation to the confidential information to be monitored. That is, when secret leak monitoring is performed for the contract A, the call destination ID of the contract partner α that is a party to the contract is a call permission ID. However, when secret leakage is monitored with respect to the contract B, the destination ID of α that is not a party in the contract is an ID to be monitored.

  This is because the callee ID is the monitoring target ID when the confidentiality identification information is acquired in the monitoring server device using a table in which the confidentiality identification information described later is associated with the callee ID related to the secret. It may be realized by performing a determination process of whether or not.

  In this way, by performing the process of determining whether or not to make a monitoring target using the call destination ID, the monitoring process for all calls of all employees is executed, and the processing limit of the monitoring server device is exceeded. Can be prevented.

  The “conversion unit” (0202) has a function of acquiring a call voice and converting it into text characters when the determination result is a monitoring target ID. For example, a method of acquiring the call voice can be obtained by incorporating an application for copying the voice packet and transferring it to a monitoring server device in a router installed in the company to transmit the voice packet to the network. Alternatively, if the telephone used by the employee is a software IP phone incorporated in a desktop computer or the like, a method for obtaining the IP phone client application by implementing a function of copying a voice packet and transferring it to the monitoring server device is also available. Can be mentioned.

  Then, the voice packet acquired in such a manner is subjected to voice recognition processing and converted into text by arithmetic processing such as a CPU. As a speech recognition processing method, for example, phoneme information obtained by removing individual difference information such as voice pitch is obtained by performing Fourier inverse transform on a frequency domain signal indicated by the obtained speech packet. Then, the phoneme information is matched with words registered in the recognition dictionary using an acoustic model (speech pattern analogy model using acoustic proximity between words) or a grammar model. Perform voice recognition. Then, the recognized voice information is converted into text.

  The text converted from the call voice is used in this system to monitor whether there is a secret leak. In addition, in the text conversion in this conversion section, for the purpose of this system of “acquisition of keywords for secret leak monitoring”, “ha”, “ga”, “is”, “masu”, “wow”, etc. A configuration may be used in which only nouns and important verb words recognized by a grammatical model are converted, excluding particles, auxiliary verbs, and adjectives.

  The “confidentiality determination unit” (0203) has a function of determining whether information being accessed by the desktop computer is a secret object.

  As will be described later, the desktop computer is configured to transmit, for example, access log (history) data to the monitoring server device when accessing the secondary storage device or server device inside the desktop computer. The confidentiality judgment unit refers to, for example, a secret data list and performs a search process to determine whether the file name indicated by the log data is included in the secret data list, and the information being accessed by the desktop computer is secretly stored. It is good to judge whether it is a target.

  FIG. 4 is a conceptual diagram showing an example of the secret data list. As shown in this figure, as a secret data list, information such as the ID of the file, management authority person, authorized user, or directory information on the storage location of the secret file is stored in the secondary storage device of the monitoring server device. Has been. Then, by referring to the secret data list and the obtained access log data of the desktop computer, for example, when the desktop computer is accessing “060201 minutes.doc” that is the secret data, the desktop computer accesses For example, it is judged that the information inside is a secret object.

  Note that the determination method in the confidentiality determination unit is configured to transmit log data or the like only when a secret file is accessed on the desktop computer side, for example, in addition to the determination based on the search using such a list. Thus, there is a method of determining that the information being accessed by the desktop computer is a secret object by acquiring the log data.

  In this way, by determining whether the information being accessed by the desktop computer is a secret object, for example, the keyword of the information to be secretly accessed and the keyword of the voice of the call are matched to prevent secret leakage. Judgment can be made.

  When the determination result in the confidentiality determination unit (0203) is a determination result that the search unit (0204) is a secret object, the “search unit” (0204) is a text character obtained by conversion in the conversion unit (0202). Has a function of searching whether the access information is a secret object. Examples of the search processing method include a method using an NG word list.

  FIG. 5 is a conceptual diagram showing an example of the NG word list. As shown in this figure, the NG word list includes “ABC Corp.”, “$ 1,000,000”, “March 9”, “Patents” as NG words related to the secret file “060201 Minutes.doc”. "300,000" and the like are discussed in the minutes and contain keywords that must be kept secret. In this search unit, a search process is performed to determine whether or not these keywords are included in the text data of the call content converted from the voice packet of the telephone. And if the NG word in the list is hit in the text data, you can talk about the secret matter with the callee to be monitored and access the secret file related to the secret matter on the desktop computer. It is judged that there is a high risk of secret leakage as being inside.

  If it is determined that there is a high risk of secret leakage, for example, a warning message is displayed on the display of the employee's desktop computer, or an internal security department is notified. Alternatively, as will be described later in the second or third embodiment, the confidentiality is protected by sending a command for disabling the telephone call or file access on the desktop computer.

  As shown in the NG word list of FIG. 5, NG words are weighted. For example, it is not determined that there is a risk of secret leakage only by hitting the contract conclusion date “March 9”. A configuration may be employed in which it is determined that there is a risk of secret leakage when the weighted sum including a predetermined value is exceeded.

  In addition to the method of creating and maintaining such an NG word list for each secret object information in advance, if the secret object information is a document file, the character information of the document file is searched. The search process may be executed as follows.

  As described above, the monitoring server device can monitor the risk of secret leakage by cross-monitoring both the content of a telephone call and access by a desktop computer.

  Next, a telephone constituting the behavior monitoring system of this embodiment will be described with reference to FIG.

  As shown in FIG. 2, the “telephone” (0210) includes an “ID transmission unit” (0211) and a “voice transmission unit” (0212). The “telephone” includes, for example, a portable computer such as a desktop computer or a PDA in which a telephone application for realizing an Internet telephone function or an IP telephone function is incorporated in addition to a fixed telephone or a cellular phone.

  The “ID transmission unit” (0211) has a function of transmitting the call destination ID to the monitoring server device (0200). As described above, the ID transmission unit is configured to transmit a call destination ID such as a dial number input with a hardware or software numeric keypad to the monitoring server device. Alternatively, it is configured to transmit a call destination ID when the call is received to the monitoring server device. Therefore, the monitoring server device can determine whether or not to use the callee ID as a monitoring target.

  The ID transmission unit can be realized by an input device such as a numeric key for inputting a callee ID, a communication circuit for data transmission / reception, and an I / O.

  The “voice transmitting unit” (0212) has a function of transmitting a call voice to the monitoring server device (0200). For example, the voice transmission unit may transmit a voice packet obtained by converting an analog voice frequency signal acquired by a sound collecting microphone into a digital signal by an A / D (analog / digital) conversion circuit or the like as a call voice. A configuration in which an analog audio signal is transmitted may be used as a configuration in which the monitoring server device performs A / D conversion.

  In addition, as described above, as a method of transmitting the call voice to the monitoring server device, for example, a method that is executed by incorporating an application that copies a voice packet into the router and transfers the voice packet to the monitoring server device, For example, a method of implementing a function of copying a voice packet to a client application and transferring the voice packet to a monitoring server device may be used.

  As described above, by transmitting “call destination ID” and “call voice” to the monitoring server in the telephone, it becomes possible to monitor the contents of the call according to the telephone call destination in the monitoring server device.

  Finally, a desktop computer constituting the behavior monitoring system of this embodiment will be described with reference to FIG.

  As shown in FIG. 2, the “desktop computer” (0220) includes a “confidentiality identification information transmission unit” (0221). The “desktop computer” refers to a terminal device having a function of accessing secret data stored in a secondary storage device of the computer itself or an external server device. For example, a desktop computer, a laptop computer, PDA etc. are mentioned.

  The “confidentiality identification information transmission unit” (0221) has a function of transmitting confidentiality identification information to the monitoring server device (0200). “Confidentiality identification information” refers to information for identifying whether or not the information being accessed is a secret object. The file name information of the data, storage directory information, file format information such as extension, or data Attribute tag data such as creation date / time information, authorized person information, and available user information. Further, the confidentiality identification information may be associated with processing content information such as processing for the information being accessed, for example, change processing or deletion processing.

  The confidentiality identification information may be transmitted by transmitting, for example, file names of all data files accessed by the desktop computer. For example, only a file name of a data file having confidentiality may be selectively transmitted by referring to the secret data list shown in FIG.

  The transmission timing is not limited to transmission in real time. For example, a configuration may be adopted in which the log is stored as an access log in association with the ID of the logged-in employee and transmitted collectively.

  By transmitting the confidentiality identification information from the desktop computer in this way, the monitoring server device can monitor the contents of the telephone call in association with the data being accessed by the desktop computer.

    <Hardware configuration of this embodiment>

  FIG. 6 is a schematic diagram illustrating an example of a configuration in the behavior monitoring system when the above functional components are realized as hardware. The operation of each hardware component in the employee behavior monitoring process will be described using this figure.

  As shown in this figure, the monitoring server device includes a “CPU (central processing unit) 1” that performs arithmetic processing and a “main memory 1” that stores data for arithmetic processing in the CPU. The processing functions of the ID determination unit, the confidentiality determination unit, the conversion unit, and the search unit are realized by the arithmetic processing in the “CPU 1”.

  In addition, this monitoring server device transmits / receives data to / from the “secondary storage device 1” holding a voice text conversion program and various lists as shown in FIGS. I / O1 ". Then, they are connected to each other through a data communication path such as “system bus” (0808) to transmit / receive information and process information.

  Similarly, the telephone includes “CPU 2” and “main memory 2”. In addition, a “microphone” that acquires call voice as an analog frequency signal, an “A / D circuit” that uses the analog frequency signal as a digital voice packet, and a “communication circuit” that transmits and receives data to and from the monitoring server device. It has.

  Similarly, the desktop computer also includes “CPU 3” and “main memory 3”. In addition, data transmission / reception with a “secondary storage device 3” holding a data file such as a contract document file for work, an “input device” as a user interface, and a monitoring server device, or secret data "I / O3" for accessing a server device that centrally stores and manages the server.

  A plurality of addresses are assigned to the “secondary storage device” and “main memory” of each of the above devices, and various programs executed by the “CPU” specify the addresses and access each other to access data. It is possible to perform processing. The various programs are normally stored in the “secondary storage device”, read out to the work area of the “main memory” as necessary, and executed by the “CPU”.

  Here, when a dial key (not shown) of “telephone” is pressed and a dial number is input, a call with the callee of the dial number is performed via the “communication circuit”. At this time, the dial number that has been pressed is transmitted to the monitoring server device as a call destination ID by using the IP address of the monitoring server device that the telephone holds in advance in the secondary storage device.

  In the monitoring server device, the call destination ID transmitted from the telephone at “I / O1” is received and stored in address 1 of “main memory 1”. Then, the monitoring target determination program included in the monitoring program is executed with the reception of the callee ID as a trigger. The monitoring target determination program reads the permission ID list stored in the address 2 of the “secondary storage device 1” into the main memory, and performs a matching process between the callee ID and the ID included in the list by a comparison operation of the “CPU”. Execute by processing.

  As a result of the matching process, when the determination result that the ID that matches the callee ID is included in the permission ID list is output, for example, at the branch of the company It is judged that the risk of secret leakage is low for some reason. Then, it does not monitor the contents of subsequent telephone calls or monitor the file access log of the desktop computer.

  On the other hand, if the result of the matching process is that a determination result that the ID that matches the callee ID is not included in the permission ID list is output, the partner who is currently calling on the phone is, for example, a rival company and is secret It is judged that there is a risk of leakage. Therefore, it is monitored whether there is a secret leak by the following process.

  First, if the telephone is, for example, an IP phone that transmits a voice packet to a call partner via a company router (not shown), the monitoring server device sends a command to transfer the voice packet to the company router. Thereby, the call data collected by the “microphone” of the telephone and converted into the voice packet by the “A / D circuit” is transmitted to the call partner and also to the monitoring server device.

  The monitoring server device stores the voice data of the telephone call acquired in this way at address 2 of “main memory 1”. Then, the speech-text conversion program is executed, and a matching process using an inverse Fourier transform process, an acoustic model, a grammar model, or the like is performed on the speech data by the arithmetic processing of “CPU1”. The matched text data, for example, “Patent No. 300000” is stored at address 3 of “main memory 1”.

  In addition, the monitoring server device sends a command for acquiring and transmitting an access log to the file to the desktop computer. As a result, the desktop computer can change the access history (accessed file) according to the operation performed by the operation from the “input device” on the file stored in its secondary storage device or other server device. Name, identification information, directory information of the file, access time, file operation content, etc.). Then, the acquired access history information is transmitted as a confidentiality ID from “I / O3” to the monitoring server device.

  The monitoring server device acquires the confidentiality ID transmitted in this way at “I / O1” and stores it at address 4 of “main memory 1”. This time, the confidentiality determination program included in the monitoring program is read and executed by “CPU1”. The confidentiality determination program reads the secret data list stored at address 3 of “secondary storage device 1”, and the file name indicated by the confidentiality ID stored at address 4 of “main memory 1” is Whether it is included in the list or not is determined by a comparison operation process of the CPU.

  As a result, if the judgment result that the file name of the file accessed on the desktop computer is not included in the secret data list is output, the monitoring server device will at least carry out the secret leakage by both the call and the file operation. Judge that it is not.

  On the other hand, if a determination result is output that the file name of the file accessed on the desktop computer is included in the secret data list, it is determined that there is a risk of secret leakage due to the operation on the file. To do.

  Therefore, in the monitoring server device, the call content search program included in the monitoring program is executed, and the NG word list stored in the “secondary storage device 1” is read first. Then, the read NG word list is searched by using the voice conversion text data converted into text and stored in the address 3 of the “main memory 1” as a key. As a result of the search, when a keyword corresponding to the NG word, for example, “Patent No. 300000” hits in the call voice conversion text data, the monitoring server device determines that the file being accessed by the desktop computer is a secret file. Further, it is determined that the user is talking about matters related to the secret file by telephone.

  Then, for example, the monitoring server device sends a warning message to a telephone or a desktop computer, and outputs a warning message to stop secret leakage from the speaker or display. Or, an instruction to turn off the power of the telephone or the desktop computer or an instruction to block the call or file access as described later in the second or third embodiment is sent to prevent further leakage of confidential information. It is.

    <Process flow>

  FIG. 7 is a flowchart showing an example of a processing flow in the telephone, the monitoring server device, and the desktop computer that constitute the behavior monitoring system of the present embodiment. Note that the steps shown below may be processing steps that constitute a program for controlling a computer recorded on a medium.

  As shown in FIG. 7, first, a callee ID is input by telephone, and when a call with the callee is started, the telephone transmits the callee ID to the monitoring server device (step S0701). ).

  The monitoring server device receives the call destination ID and determines whether or not the received call destination ID is a monitoring target ID, for example, referring to a permission ID list or the like (step S0702). If the determination result is a determination result (Y) that is a monitoring target, the monitoring server device starts monitoring the call or file access on the desktop computer. Therefore, for example, a command to transfer call voice is sent from the monitoring server device to the telephone. In addition, a command for obtaining and transmitting, for example, a file access history as confidentiality identification information is output from the monitoring server device to the desktop computer.

  In response to the command, the telephone transmits the call voice to the monitoring server apparatus (step S0703). Then, the monitoring server device receives the call voice transmitted from the telephone and executes conversion processing into text data (step S0704).

  Further, when the desktop computer executes access to a file stored in the secondary storage device or other server device (step S0705), for example, confidentiality identification information such as a file name is acquired, and the monitoring server device receives it. It is transmitted to (step S0706).

  Then, the monitoring server device receives the confidentiality identification information, and based on the confidentiality identification information, determines whether the information being accessed by the desktop computer is a secret object (step S0707). If the determination result is a determination result that the confidential target is (Y), the monitoring server device performs a search process to determine whether the voice conversion text character is included in the access information that is the confidential target (step S0708). ).

  As a result of the search, if the voice conversion text characters are included in the access information that is the secret object, for example, a warning message is sent to the telephone or desktop computer, and the leakage of the secret from the speaker or display is stopped. The warning message is output.

    <Brief description of effect>

  As described above, the behavior monitoring system according to the present embodiment can monitor the identification of a callee from a telephone and the conversation content of the call voice together with information access by a desktop computer to determine whether or not the information is leaked. become. Accordingly, it is possible to suppress the execution of warnings or the like in normal information access as much as possible, and to take a countermeasure such as outputting a warning only when there is an information leaking action in both telephone and information access.

  << Example 2 >>

    <Overview>

  The present embodiment is based on the behavior monitoring system of the first embodiment, and prevents the secret from further leaking when it is determined that there is a risk of secret leakage from both telephone calls and file access on the desktop computer. Therefore, it is characterized in that it has a function of blocking further telephone calls by control of the monitoring server device.

    <Functional configuration>

  FIG. 8 is a diagram illustrating an example of functional blocks in the behavior monitoring system of the present embodiment. As shown in this figure, the behavior monitoring system of the present embodiment is composed of “telephone” (0810), “desktop computer” (0820), and “monitoring server device” (0800) as in the first embodiment. .

  Based on the first embodiment, the “monitoring server device” (0800) is based on “ID determination unit” (0801), “conversion unit” (0802), “confidentiality determination unit” (0803), “ Search unit "(0804). The “telephone” (0810) also includes an “ID transmission unit” (0811) and a “voice transmission unit” (0812) based on the first embodiment.

  Further, the “desktop computer” (0820) has a “confidentiality identification information transmission unit” (0821) as in the first embodiment.

  The constituent elements of these “monitoring server device”, “telephone”, and “desktop computer” are the same as those already described in the first embodiment, and a description thereof will be omitted.

  The feature of the behavior monitoring system of the present embodiment is that the “telephone” further includes a “call blocking unit” (0813) and a “call blocking command receiving unit” (0814), and the “monitoring server device” ”Further includes a“ call cutoff command output unit ”(0805).

  First, the “call blocking unit” and the “call blocking command receiving unit”, which are constituent elements of “phone”, will be described.

  The “call blocking unit” (0813) has a function of blocking a telephone call. The call blocking method by the call blocking unit depends on a call blocking command received by a later-described call blocking command receiving unit. For example, if the call blocking command is a forced power-off command, the call can be blocked by turning off the telephone. Alternatively, if the call blocking command is a forced termination command for a call function or a disconnection command for a connection with a call line, the call call function forcibly terminates or the connection with a connected communication line is forcibly disconnected. The call can be blocked.

  The “call blocking command receiving unit” (0814) has a function of receiving a call blocking command for executing the call blocking of the call blocking unit. The call blocking command receiving unit is realized by, for example, “I / O”, and receives a call blocking command output from a monitoring server device via an in-house LAN (Local Area Network) or the like.

  Next, a “call cutoff command output unit” that is a configuration requirement of the “monitoring server device” will be described.

  The “call cutoff command output unit” (0805) has a function of outputting a call cutoff command to the telephone when the search result indicates that the search result in the search unit is included.

  In this way, when it is determined that there is a risk of secret leakage from both telephone calls and file access on the desktop computer, in order to prevent further leakage of the secret, Further calls can be blocked.

    <Hardware configuration of this embodiment>

  FIG. 9 is a schematic diagram illustrating an example of a configuration in the behavior monitoring system when the above functional components are realized as hardware. The operation of each hardware component in the telephone call blocking process will be described with reference to this figure.

  First, by the processing of each hardware component as described in the first embodiment, the monitoring server device determines that there is a risk of secret leakage from both the telephone and the desktop computer.

  Then, the monitoring server device reads the shut-off code for turning off the telephone stored in the address 5 of the “secondary storage device 1” to the address 5 of the “main memory 1”. Then, the blocking code is output from “I / O1” via the network based on the telephone identification information.

  In the telephone, the blocking code output from the monitoring server device is received by the “communication circuit” and stored in the address 2 of the “main memory 2”. Then, “CPU2” interprets the cutoff code, and executes a process of forcibly turning off its own power supply according to the code instruction.

    <Process flow>

  FIG. 10 is a flowchart illustrating an example of a processing flow in the telephone, the monitoring server device, and the desktop computer that configure the behavior monitoring system of the present embodiment. Note that the steps shown below may be processing steps that constitute a program for controlling a computer recorded on a medium.

  As shown in FIG. 10, first, a callee ID is input by telephone, and when a call with the callee is started, the telephone transmits the callee ID to the monitoring server device (step S1001). ).

  The monitoring server device receives the call destination ID, and determines whether or not the received call destination ID is a monitoring target ID, for example, referring to a permission ID list or the like (step S1002). If the determination result is a determination result (Y) that is a monitoring target, the monitoring server device starts monitoring the call or file access on the desktop computer. Therefore, for example, a command to transfer call voice is sent from the monitoring server device to the telephone. In addition, a command for obtaining and transmitting, for example, a file access history as confidentiality identification information is output from the monitoring server device to the desktop computer.

  In response to the command, the telephone transmits the call voice to the monitoring server apparatus (step S1003). Then, the monitoring server device receives the call voice transmitted from the telephone and executes conversion processing into text data (step S1004).

  In addition, when the desktop computer accesses a file stored in the secondary storage device or other server device (step S1005), confidentiality identification information such as a file name is acquired, and is sent to the monitoring server device. It is transmitted to (step S1006).

  Then, the monitoring server device receives the confidentiality identification information, and determines whether the information being accessed on the desktop computer is a secret object based on the confidentiality identification information (step S1007). If the determination result is a determination result (Y) that is a secret object, the monitoring server device performs a search process to determine whether the voice conversion text characters are included in the access information that is a secret object (step S1008). ).

  As a result of the search (step S1009), if the voice converted text character is included in the access information that is the secret object, the monitoring server device outputs a call blocking command to the telephone (step S1010). .

  In the telephone, the call cut command output from the monitoring server device is received, and the call is cut off by executing processing such as forcible power off according to the command (step S1011).

    <Brief description of effect>

  As described above, when it is determined by the behavior monitoring system of this embodiment that there is a risk of secret leakage in telephone calls and information access on a desktop computer, it is possible to control The above call can be blocked. Therefore, it is possible to prevent further leakage of secrets promptly.

  Example 3

    <Overview>

  In the present embodiment, based on the behavior monitoring system of the first and second embodiments, when it is determined that there is a risk of secret leakage from both telephone calls and file access on the desktop computer, the secret is further leaked. In order to prevent this, it is characterized by having a function of blocking access to further information on the desktop computer by controlling the monitoring server device.

    <Functional configuration>

  FIG. 11 is a diagram illustrating an example of functional blocks in the behavior monitoring system of the present embodiment. As shown in this figure, the behavior monitoring system according to the present embodiment includes a “telephone” (1110), a “desktop computer” (1120), and a “monitoring server device” (1100) as in the first embodiment. .

  The “monitoring server device” (1100) is based on the first embodiment, and includes an “ID determination unit” (1101), a “conversion unit” (1102), a “confidentiality determination unit” (1103), and “ Search section "(1104). Although not shown, this monitoring server device may include a “call cutoff command output unit” based on the second embodiment. The “desktop computer” (1120) is based on the first embodiment and includes a “secretity identification information transmission unit” (1121).

  Similarly to the first embodiment, the “telephone” (1110) includes an “ID transmission unit” (1111) and a “voice transmission unit” (1112). Although not shown, this telephone may include a “call blocking unit”, a “call blocking command receiving unit”, etc. based on the second embodiment.

  The constituent requirements of these “monitoring server device”, “telephone”, and “desktop computer” are the same as those already described in the first and second embodiments, and the description thereof is omitted.

  The feature of the behavior monitoring system of this embodiment is that the “desktop computer” further includes an “access blocking unit” (1122) and an “access blocking command receiving unit” (1123), and the “monitoring server” The “device” further includes an “access cutoff command output unit” (1105).

  Here, the “access blocking unit” and the “access blocking command receiving unit”, which are the configuration requirements of the “desktop computer”, will be described first.

  The “access blocking unit” (1121) has a function of blocking access to information on the desktop computer. As with the call blocking unit of the second embodiment, the file blocking method by the access blocking unit executes the access blocking process depending on an access blocking command received by an access blocking command receiving unit described later. For example, if the access cutoff command is a forced power-off command, the file access can be blocked by turning off the power of the desktop computer. Alternatively, if the access blocking command is a file management application forced termination command or target file encryption command, file access can be blocked by performing a forced termination of the application or encryption processing of all files. It can be done. Other access blocking commands include input device lock commands and file access authority rewrite commands.

  The “access blocking command receiving unit” (1122) has a function of receiving an access blocking command for executing access blocking in the access blocking unit. Similar to the call blocking command receiving unit, this access blocking command receiving unit is realized by, for example, “I / O”, and receives an access blocking command output from the monitoring server device via an in-house LAN (Local Area Network) or the like.

  Next, the “access cutoff command output unit” that is a configuration requirement of the “monitoring server device” will be described.

  The “access cutoff command output unit” (1105) has a function of outputting an access cutoff command to the desktop computer when the search result indicates that the search result in the search unit is included.

  In this way, when it is determined that there is a risk of secret leakage from both telephone calls and file access on the desktop computer, the desktop computer is controlled by the monitoring server device to prevent the secret from leaking further. Can block further file access.

    <Hardware configuration of this embodiment>

  FIG. 12 is a schematic diagram illustrating an example of a configuration in the behavior monitoring system when the above functional components are realized as hardware. The operation of each hardware component in the information access blocking process of the desktop computer will be described with reference to this figure.

  First, by the processing of each hardware component as described in the first embodiment, the monitoring server device determines that there is a risk of secret leakage from both the telephone and the desktop computer.

  Then, the monitoring server device reads the shutdown code for turning off the power of the desktop computer stored in the address 5 of the “secondary storage device 1” to the address 5 of the “main memory 1”. Then, the cut-off code is output from “I / O1” via the network based on the IP address of the desktop computer.

  In the desktop computer, the blocking code output from the monitoring server device is received by “I / O 3” and stored in address 2 of “main memory 3”. Then, “CPU3” interprets the interruption code, and executes a process of forcibly turning off its own power supply according to the instruction of the code.

    <Process flow>

  FIG. 13 is a flowchart illustrating an example of a processing flow in the telephone, the monitoring server device, and the desktop computer that configure the behavior monitoring system of the present embodiment. Note that the steps shown below may be processing steps that constitute a program for controlling a computer recorded on a medium.

  As shown in FIG. 13, first, a callee ID is input by telephone, and when a call with the callee is started, the telephone transmits the callee ID to the monitoring server device (step S1301). ).

  The monitoring server device receives the call destination ID and determines whether or not the received call destination ID is a monitoring target ID, for example, referring to a permission ID list or the like (step S1302). If the determination result is a determination result (Y) that is a monitoring target, the monitoring server device starts monitoring the call or file access on the desktop computer. Therefore, for example, a command to transfer call voice is sent from the monitoring server device to the telephone. In addition, a command for obtaining and transmitting, for example, a file access history as confidentiality identification information is output from the monitoring server device to the desktop computer.

  In response to the command, the telephone transmits the call voice to the monitoring server device (step S1303). Then, the monitoring server device receives the call voice transmitted from the telephone and executes conversion processing into text data (step S1304).

  When the desktop computer accesses a file stored in the secondary storage device or other server device (step S1305), confidential identification information such as a file name is acquired and is sent to the monitoring server device. It is transmitted to (step S1306).

  Then, the monitoring server apparatus receives the confidentiality identification information and determines whether the information being accessed on the desktop computer is a secret object based on the confidentiality identification information (step S1307). If the determination result is a determination result (Y) that is a secret object, the monitoring server device performs a search process to determine whether the voice-converted text character is included in the access information that is a secret object (step S1308). ).

  As a result of the search (step S1309), if the voice-converted text character is included in the access information that is a secret object, the monitoring server device outputs an access blocking command to the desktop computer (step S1310). ).

  Then, the desktop computer receives the access blocking command output from the monitoring server device, and blocks information access by executing processing such as forcible power-off according to the command (step S1311).

    <Brief description of effect>

  As described above, when it is determined by the behavior monitoring system of this embodiment that there is a risk of secret leakage in telephone calls and information access on a desktop computer, the monitoring server device controls the desktop computer. Further calls can be blocked. Therefore, it is possible to prevent further leakage of secrets promptly.

Conceptual diagram for explaining an example of employee behavior monitoring by the behavior monitoring system of the first embodiment The figure showing an example of the functional block in the action monitoring system of Example 1. The conceptual diagram of the list | wrist for demonstrating an example of the judgment process in the ID judgment part of the action monitoring system of Example 1 Conceptual diagram of a list for explaining an example of determination processing in the confidentiality determination unit of the behavior monitoring system according to the first embodiment. List conceptual diagram for explaining an example of search processing in the search unit of the behavior monitoring system of the first embodiment Schematic showing an example of the hardware constitutions in the action monitoring system of Example 1. The flowchart showing an example of the flow of a process in the action monitoring system of Example 1. The figure showing an example of the functional block in the action monitoring system of Example 2. Schematic showing an example of the hardware constitutions in the action monitoring system of Example 2. The flowchart showing an example of the flow of the process in the action monitoring system of Example 2. The figure showing an example of the functional block in the action monitoring system of Example 3. Schematic showing an example of the hardware constitutions in the action monitoring system of Example 3. The flowchart showing an example of the flow of a process in the action monitoring system of Example 3.

Explanation of symbols

0200 Monitoring server device 0201 ID determination unit 0202 Conversion unit 0203 Confidentiality determination unit 0204 Search unit 0210 Telephone 0211 ID transmission unit 0212 Audio transmission unit 0220 Desktop computer 0221 Confidentiality identification information transmission unit

Claims (6)

An action monitoring system comprising a telephone used by an employee, a desktop computer used by the employee, and a monitoring server device,
The monitoring server device
An ID determination unit for determining whether the telephone call destination ID is a monitoring target ID;
When the determination result is the monitoring target ID, a conversion unit that acquires the call voice and converts it into text characters;
A confidentiality determination unit that determines whether the information being accessed by the desktop computer is a secret object;
If the result of the determination by the confidentiality determination unit is a determination result that is a secret object, a search is performed to determine whether the text characters obtained by conversion by the conversion unit are included in the access information that is the secret object And a search unit to
Phone
An ID transmission unit that transmits a call destination ID to the monitoring server device;
A voice transmission unit that transmits the call voice to the monitoring server device,
Desktop computer
A behavior monitoring system comprising: a confidentiality identification information transmitting unit that transmits confidentiality identification information for identifying whether or not the information being accessed is a secret object to the monitoring server device. The phone
A call blocking unit;
A blocking command receiving unit for receiving a call blocking command for executing the call blocking of the call blocking unit,
The monitoring server device
The behavior monitoring system according to claim 1, further comprising: a call blocking command output unit that outputs a call blocking command to the telephone when the search result indicates that the search result in the search unit is included. The desktop computer
An access blocker that blocks access to information;
An access blocking command receiving unit for receiving an access blocking command for executing access blocking of the access blocking unit,
The monitoring server device
The behavior monitoring system according to claim 1, further comprising an access blocking command output unit that outputs an access blocking command to the desktop computer when the search result indicates that the search result in the search unit is included. A behavior monitoring method by a system comprising a telephone used by an employee, a desktop computer used by the employee, and a monitoring server device,
The call destination ID of the phone, the call voice in the phone ID transmission step in which the telephone is transmitted to the monitoring server device, and the audio transmission step in which the telephone is transmitted to the monitoring server,
An ID determination step of determining whether the call destination ID is a monitoring target ID by a calculation process of a CPU of a monitoring server device;
When the determination result is a monitoring target ID, the call voice is acquired by the monitoring server device, and converted into text characters by the arithmetic processing of the CPU of the monitoring server device ;
Confidentiality identification information transmitting step for transmitting confidentiality identification information for identifying whether or not the information being accessed on the desktop computer is a secret object, to the monitoring server device by the desktop computer ;
A confidentiality determination step of determining whether the information being accessed by the desktop computer is a secret object based on the confidentiality identification information, by a calculation process of the CPU of the monitoring server device ;
If the determination result is a determination result that is a secret object, the monitoring server device searches whether the text characters obtained by conversion in the conversion step are included in the access information that is the secret object. A search step;
A behavior monitoring method. The call destination ID of the phone, the call voice in the phone ID transmission step in which the telephone is transmitted to the monitoring server device, and the audio transmission step in which the telephone is transmitted to the monitoring server,
An ID determination step of determining whether the call destination ID is a monitoring target ID by a calculation process of a CPU of a monitoring server device;
When the determination result is a monitoring target ID, the call voice is acquired by the monitoring server device, and converted into text characters by the arithmetic processing of the CPU of the monitoring server device ;
Confidentiality identification information transmitting step for transmitting confidentiality identification information for identifying whether or not the information being accessed on the desktop computer is a secret object, to the monitoring server device by the desktop computer ;
A confidentiality determination step of determining whether the information being accessed by the desktop computer is a secret object based on the confidentiality identification information, by a calculation process of the CPU of the monitoring server device ;
If the determination result is a determination result that is a secret object, the monitoring server device searches whether the text characters obtained by conversion in the conversion step are included in the access information that is the secret object. A search step;
A call blocking command output step for outputting a call blocking command for the monitoring server device to execute a call blocking for the phone when the search result indicates that the search result in the search step is included;
A call blocking command receiving step for receiving the call blocking command by phone;
A call blocking step in which a telephone call is blocked;
A behavior monitoring method. The call destination ID of the phone, the call voice in the phone ID transmission step in which the telephone is transmitted to the monitoring server device, and the audio transmission step in which the telephone is transmitted to the monitoring server,
An ID determination step of determining whether the call destination ID is a monitoring target ID by a calculation process of a CPU of a monitoring server device;
When the determination result is a monitoring target ID, the call voice is acquired by the monitoring server device, and converted into text characters by the arithmetic processing of the CPU of the monitoring server device ;
Confidentiality identification information transmitting step for transmitting confidentiality identification information for identifying whether or not the information being accessed on the desktop computer is a secret object, to the monitoring server device by the desktop computer ;
A confidentiality determination step of determining whether the information being accessed by the desktop computer is a secret object based on the confidentiality identification information, by a calculation process of the CPU of the monitoring server device ;
If the determination result is a determination result that is a secret object, the monitoring server device searches whether the text characters obtained by conversion in the conversion step are included in the access information that is the secret object. A search step;
An access blocking instruction output step for outputting an access blocking instruction for the monitoring server device to execute an access blocking for the desktop computer, when the search result indicates that the search result in the search step is included;
An access blocking command receiving step of receiving the access blocking command with a desktop computer;
An access blocking step for the desktop computer to block access to information on the desktop computer ;
A behavior monitoring method.

Images