JP4802732B2 - Data communication monitoring program, system and method - Google Patents

Description

  The present invention relates to a technique for monitoring data transmission from a computer to the outside or from an internal network to which the computer belongs to an external network.

  Information leakage, in which important information or personal information leaks intentionally or unintentionally from a computer to the outside or from a corporate network to the outside, is a major problem. Therefore, conventionally, it is determined whether or not it is important data to be monitored based on the contents and feature quantities of the transferred data, and if it is determined that the data is to be monitored, a warning is sent to the administrator. Monitoring technology has been developed and used to abort the transfer.

  On the other hand, data encryption is being enforced in order to keep data confidential.

  However, when data is encrypted in this way, monitoring cannot be performed because a device that performs monitoring based on the data content or feature amount cannot determine the data content. However, there was a contradiction that keeping the data in clear text would compromise confidentiality.

  As a data monitoring technique, for example, Patent Document 1 discloses a method of encrypting data so that only a part can be decrypted by the auditor so that the auditor can also audit encrypted transmission data. However, in this method, since a part of the data is encrypted with the auditor's decryption key so that the decryption key can be decrypted, the influence when the decryption key is leaked is great.

  Further, in claim 5 of Patent Document 2, mail transmission communication is acquired, and mail transmission is canceled based on the presence or absence of an attached file and / or determination that a prohibited character string is not included. And a system for generating a report to an administrator is disclosed. However, in this device, communication of mail transmission is acquired and analyzed. When data is encrypted, such a character string analysis method cannot be used. In the method of this document, a case where data that is encrypted and cannot be analyzed is included in the communication of mail transmission is not considered.

  Patent Document 3 discloses that character data is inspected when character data is transmitted to a network, and data that should not be leaked is inspected using a profile in which a specific character string is stored in advance. A method for determining whether or not to be sent is shown. However, this method checks whether or not a specific character string is included in the document data in transmission, and does not consider transmission of document data that cannot be inspected because of encryption.

  Patent Document 4 discloses a method for determining whether or not data transfer is possible based on the contents of a digital watermark included in data to be transferred. However, in this method, a determination is made based on a digital watermark given in advance, but the handling when the digital watermark is converted into a form in which the digital watermark cannot be acquired by encryption or the like is not clearly shown.

  As mentioned above, the problem in the case where the data to be transmitted is encrypted has been described. However, in addition to encryption, for example, there are many processes for converting data from the original contents, such as data compression. The general data conversion process also has the same problem as when data is encrypted.

Japanese Patent No. 3604264 Japanese Patent Laid-Open No. 2002-232451 JP 2004-227056 A JP 2001-5757 A

  The present invention makes it possible to monitor data outflow in a system for monitoring data outflow even if the data is converted.

In one aspect of the present invention, whether data to get away from a computer or network to the outside is monitored, it is determined based on at least one decision rule is registered, if the data is on the monitored A monitoring processing unit that executes a predetermined process for monitoring when the determination is made, and the at least one registered determination rule includes data to be output to the outside including a character string to be monitored. If you are, monitoring processing part included the data first determination rule determining monitored, a data communication monitoring system for working capital together, when the encryption processing is performed, the subject of encryption process inspection unit data to check whether a monitoring target on the basis of the first determination rule stand by the inspection of the inspection unit and the target data of the encryption process is monitored When the said monitoring processor a request for registering a second determination rule determining monitored data encryption result obtained as a result of implementing the encryption process on the monitoring processor for the data A data communication monitoring system comprising: a notification unit that does not notify the monitoring processing unit of the request when it is found by inspection of the inspection unit that the data to be encrypted is not a monitoring target provide.

In the reference example , when data conversion is performed, the inspection unit that checks whether the conversion target data is a monitoring target, the converted data obtained as a result of performing the data conversion on the conversion target data, An information adding unit for adding information on the inspection result of the inspection unit, determining whether or not the data to be externally output from the computer or the network is a monitoring target, and when the data is the monitoring target, a predetermined for monitoring A monitoring processing unit that executes the above-described processing, and when information related to the inspection of the inspection unit is added to the data, a monitoring processing unit that determines whether the data is a monitoring target based on the information; and A data communication monitoring system is provided.

In another reference example , a monitoring processing unit that determines whether or not data that is about to go out from a computer or a network is a monitoring target, and executes predetermined processing for monitoring when the data is a monitoring target A data communication monitoring system that cooperates with an inspection unit that inspects whether or not the data to be converted is a monitoring target when data conversion is performed; Provided is a data communication monitoring system including a control unit that cancels data conversion of data when it is found by inspection.

  Hereinafter, embodiments of the present invention (hereinafter referred to as “embodiments”) will be described with reference to the drawings.

  FIG. 1 is a functional block diagram illustrating an example of the configuration of the communication monitoring system according to the embodiment. The system shown in FIG. 1 includes an encryption tool 10, a monitoring device 20, and a firewall 30.

  In one example, the encryption tool 10, the monitoring device 20, and the firewall 30 are provided in the same computer. In this case, the “inside” protected by the monitoring device 20 and the firewall 30 is the computer itself, and the “outside” is a network outside the computer. The firewall 30 is configured as a program executed on the computer, and blocks unauthorized data flow between the computer and the outside. The firewall 30 is also configured such that the monitoring device 20 is configured as software executed on the computer, and determines whether data (or a file) to be transmitted to the outside from the computer is a monitoring target. Processing according to the determination result is executed.

  As another example, a system configuration in which the computer on which the encryption tool 10 is executed, the monitoring device 20, and the firewall 30 are mounted on another computer connected to the same network is also conceivable. In this case, “inside” protected by the monitoring device 20 and the firewall 30 is an internal network to which the three parties are connected, and “external” corresponding thereto is a network outside the internal network.

  In the present embodiment, monitoring is performed when the data encrypted by the encryption tool 10 tries to go from “inside” to “outside”.

  In this system, the monitoring device 20 includes a determination rule storage unit 22, a monitoring processing unit 24, and a rule registration unit 26. In the determination rule storage unit 22, one or more determination rules for determining whether data is a monitoring target are registered. The determination rule is, for example, a rule relating to data contents and attributes such as “includes a specific keyword ***”, “includes a specific keyword ***, and the transmission destination is XXX”, and the like. The determination rule may be a rule that satisfies the data corresponding to the monitoring target or a rule that satisfies the data that is not the monitoring target.

  The monitoring processing unit 24 receives information on the data itself or the feature amount of the data from another device or program (for example, the firewall 30 or the encryption tool 10), and stores each determination stored in the determination rule storage unit 22 It is checked against the rule whether the data is a monitoring target. The monitoring processing unit 24 returns the determination result to the inquiry source. The inquiry source executes processing according to the determination result. In addition, when the monitoring processing unit 24 determines that the data is a monitoring target, the monitoring processing unit 24 may issue a warning to the administrator using e-mail or a dedicated application, and indicates that the monitoring target data has been detected. For example, the log may be recorded in a log recording unit (not shown) together with the data itself, information of an inquiry source (and / or a user who requested transmission of data), and information such as time.

  The rule registration unit 26 registers or deletes a determination rule from the determination rule storage unit 22 or has already been registered in response to a request from a specific user such as an administrator of the monitoring device 20. It has a function to edit judgment rules.

  The functions of the determination rule storage unit 22, the monitoring processing unit 24, and the rule registration unit 26 as described above are the same as the functions that the conventional monitoring device 20 has. That is, the contents of the determination rule, the determination performed by the monitoring processing unit 24 based on the determination rule, and the post-processing (answer, warning, log recording, etc.) corresponding to the determination result may basically be the same as conventional processing contents. . However, the monitoring processing unit 24 can receive an inquiry from the encryption tool 10, the rule registration unit 26 can receive a determination rule registration request from the encryption tool 10, and encrypted data as a monitoring target. The point that a determination rule for determination can be registered in the determination rule storage unit 22 is a function that has not existed before.

  The encryption tool 10 is a program for encrypting the plaintext original data 100. In the encryption tool 10, the encryption unit 14 is responsible for encryption processing. The encryption tool 10 includes an inspection unit 12 and a notification unit 16 in addition to the encryption unit 14.

  The inspection unit 12 receives the original data 100 input to the encryption tool 10 and inquires of the monitoring apparatus 20 whether the original data 100 is data to be monitored. At this time, the inspection unit 12 may pass the original data 100 itself to the monitoring device 20 or may obtain a feature amount of the original data 100 and pass the feature amount to the monitoring device 20. Further, along with information on the original data 100 or its feature amount, the attribute information (for example, file name, creator, file size, creation date and time) of the original data 100 and / or identification information of the inspection unit 12 is passed to the monitoring device 20. May be. Further, instead of or in addition to the identification information of the inspection unit 12, the identification information of the encryption tool 10, the identification information of the computer in which the tool 10 is installed (for example, the MAC address), or the encryption of the original data 100 The monitoring device 20 may be notified of the identification information of the user who has instructed the conversion. These pieces of information are used in the monitoring device 20 to determine whether or not the original data 100 is a monitoring target. These pieces of information may be recorded in log data indicating that the monitoring target data has been found.

  Then, the inspection unit 12 receives a determination result as to whether or not the original data 100 is a monitoring target from the monitoring device 20. If the original data 100 is not a monitoring target, the inspection unit 12 does not perform a special process. In this case, the original data 100 is encrypted by the encryption unit 14 and output as a file of the encrypted data 110. On the other hand, when the original data 100 is determined to be a monitoring target, the inspection unit 12 notifies the notification unit 16 to that effect.

  When the original data 100 is the monitoring target, the notification unit 16 receives the encryption result (that is, the encrypted data 110) of the original data 100 from the encryption unit 14, and determines the encrypted data 110 as the monitoring target. The rule registration unit 26 is requested to register a new determination rule. In response to this request, the rule registration unit 26 adds a determination rule for determining the encrypted data 110 as a monitoring target in the determination rule storage unit 22.

  A determination rule newly added in response to a request from the notification unit 16 is, for example, a rule that determines that data to be monitored is a monitoring target when the data to be determined has a predetermined feature amount of the encrypted data 110 It's okay. As the feature amount, for example, a hash value can be used. In this case, the monitoring processing unit 24 obtains the predetermined feature amount from the determination target data sent from the firewall 30, and if there is a determination rule corresponding to the feature amount in the determination rule storage unit 22, the determination is made. It is determined that the target data is a monitoring target. Further, a determination rule incorporating the encrypted data 110 itself may be added. In this case, when the determination target data matches the encrypted data 110, the determination rule is satisfied, and the monitoring processing unit 24 determines that the data is the monitoring target. In addition, a determination rule incorporating a file attribute of the encrypted data 110 (file name, creator, creation date, data size, etc., or a combination of two or more thereof) may be added. In this case, when the attribute of the determination target data matches the attribute indicated in the determination rule, the determination rule is satisfied, and the monitoring processing unit 24 determines that the data is the monitoring target.

  Some examples of determination rules for determining the encrypted data 110 as a monitoring target have been shown, but these are only examples. A plurality of the determination rules exemplified above may be added to the determination rule storage unit 22.

  Such a determination rule may be created by the notification unit 16 and sent to the rule registration unit 26, or the notification unit 16 may include the encrypted data 110 itself, a predetermined feature amount or attribute data of the data 110, or the like (or Two or more of them may be sent to the rule registration unit 26, and the rule registration unit 26 may create a determination rule from the information.

  As described above, according to the embodiment of FIG. 1, when the original data 100 is encrypted by the encryption tool 10, it is determined whether or not the original data 100 is a monitoring target. Makes an inquiry to the monitoring device 20. Since the original data 100 is plain text, the monitoring device 20 can determine whether or not it is a monitoring target. If the original data 100 is a monitoring target, the notification unit 16 adds a determination rule for monitoring the encrypted data 110 obtained by encrypting the original data 100 to the monitoring device 20. Thereby, for example, when the encrypted data 110 whose original data 100 is the monitoring target is going to go outside from the inside through the firewall 30, the firewall 30 sends the encrypted data 110 to the monitoring device 20 for determination. The monitoring device 20 can determine that the encrypted data 110 is a monitoring target based on the added determination rule. For example, the firewall 30 that has received the determination result can cancel the transmission of the encrypted data 110 to the outside. Of course, whether to stop sending the monitored data to the outside depends on the security policy. For example, there is a policy that allows transmission of data to be monitored and records the fact of the transmission in a log or notifies an administrator. In such a policy, the firewall 30 sends the data to the outside. Take measures such as sending out and notifying the administrator.

  As described above, according to the embodiment of FIG. 1, even if the data to be monitored is encrypted and the data content changes, the monitoring device 20 can recognize the encrypted data as the monitoring target. it can.

  In the above description, it has been described that the monitoring device 20 determines whether or not data is a monitoring target. However, even though the monitoring device 20 is the same monitoring target, it should not prevent or prevent data from flowing out. There may be multiple levels of importance (in other words, risk from spills), such as what should be recorded as spills. In such a case, a determination rule for each level is registered in the determination rule storage unit 22 of the monitoring device 20, and the monitoring processing unit 24 performs processing according to the level of the determination rule corresponding to the target data (for example, the firewall 30). Block the transmission of the data or allow the transmission but log the fact of the transmission). As described above, when there is a level classification for the monitoring target, the monitoring processing unit 24 returns information on the level when the data is the monitoring target in response to the inquiry from the inspection unit 12. When receiving the information on the level to be monitored, the inspection unit 12 passes the information to the notification unit 16. The notification unit 16 sends the level information to the rule registration unit 26 together with the encrypted data 110. In response to this, the rule registration unit 26 creates a determination rule for determining the encrypted data 110 as the monitoring target at that level, and registers the determination rule in the determination rule storage unit 22. Alternatively, the notification unit 16 may create a determination rule corresponding to the level and send it to the rule registration unit 26.

  Next, a modification of the embodiment of FIG. 1 will be described with reference to FIG. In the example of FIG. 1, the inspection unit 12 and the notification unit 16 are packaged together as the encryption tool 10 together with the encryption unit 14. On the other hand, FIG. 2 shows an example in which the inspection unit 52 and the notification unit 56 are implemented as programs different from the encryption program 54.

  The encryption program 54 performs an encryption process in the same manner as the encryption unit 14 in FIG. In addition, the monitoring device 20 and the firewall 30 may be the same as those shown in FIG.

  When the user instructs the encryption of the file (original data 100) in which the encryption program 54 is activated, the process of the activated encryption program 54 reads the file from the OS (operating system) 40. Ask. In response to this request, the file reading library 42 is activated and reads the file from the file system 46.

  In this modification, when the process of the encryption program 54 tries to read the original data 100 using the file reading library 42, the OS 40 detects this and calls the inspection unit 52. The program of the inspection unit 52 is thus programmed to be called when a specific program (in this case, the encryption program 54) attempts to read a file, and when the inspection unit 52 is activated, Information necessary for making such a call is registered in the OS 40.

  The called inspection unit 52 hooks the file read by the library 42 and inquires of the monitoring processing unit 24 of the monitoring device 20 whether the file is a monitoring target. Then, a determination result is received from the monitoring processing unit 24 for the inquiry, and the determination result is associated with a process for which the original data 100 is to be encrypted (for example, associated with a process ID), for example. Store in 55.

  In addition, the inspection unit 52 passes the file of the original data 100 to the encryption program 54. The encryption program 54 encrypts the original data 100.

  The notification unit 56 is called from the OS 40 when the process of the encryption program 54 completes the output of the encryption result file (encrypted data 110). The program of the notification unit 56 is programmed to be called from the OS 40 with the completion of file output of a specific program as a trigger. The called notification unit 56 obtains a determination result corresponding to the process of the encryption program 54 from the monitoring information storage unit 55, and if the determination result indicates “being monitored”, the encrypted data 110 The rule registration unit 26 is requested to register a new determination rule for the file to be monitored. If the determination result is “not subject to monitoring”, the notification unit 56 performs no particular processing. The file writing library 44 writes the encrypted data 110 output by the encryption program 54 to the file system 46 as a file.

  As described above, the basic functions of the inspection unit 52 and the notification unit 56 may be the same as those of the inspection unit 12 and the notification unit 16 having the configuration illustrated in FIG.

  As described above, as in the modification of FIG. 2, even if the inspection unit 52 and the notification unit 56 and the encryption program 54 are different programs, the same function as that of the embodiment of FIG. 1 can be realized.

  As described above, the inspection unit 52 stores the determination result of the monitoring processing unit 24 in association with the process of the encryption program 54 in the monitoring information storage unit 55, but the data to be stored in the monitoring information storage unit 55 is this. It is not limited to. Any information may be stored as long as the information specifies the processing to be performed by the notification unit 56 for the file output of the encryption program 54.

  As described above, even in the modified example of FIG. 2, even if the original data 100 to be monitored is encrypted, the data 110 as a result of the encryption is registered in the monitoring device 20 as the monitoring target. When trying to go outside through the firewall 30, the monitoring device 20 can detect it.

  In the configuration of FIG. 1, the inspection unit 12 and the notification unit 16 are incorporated in the encryption tool 10, whereas in the configuration of FIG. 2, the inspection unit 52, the monitoring information storage unit 55, and the notification unit 56 are encrypted programs. 54 and the monitoring device 20 are configured as independent programs. Thus, there is a degree of freedom in how each functional module such as the inspection unit 52 and the notification unit 56 is mounted. For example, in the case of a system that monitors the outflow of data from a single computer (that is, when the monitoring device 20 and the firewall 30 are on the same computer as the encryption program 54 and the OS 40), the inspection unit 52 and the monitoring information storage unit 55 The notification unit 56 may be incorporated in the monitoring device 20. The inspection unit 52, the monitoring information storage unit 55, and the notification unit 56 may be in a computer in which the encryption program 54 and the OS 40 are installed.

  Next, a further modification will be described with reference to FIG. In the modification of FIGS. 1 and 2, when the original data 100 is determined to be monitored, the notification unit 16 registers a determination rule for monitoring the encrypted data 110 that is the encryption result in the monitoring device 20. did. On the other hand, in the modification of FIG. 3, an information adding unit 18 is provided instead of the notification unit 16. When it is determined that the original data 100 is a monitoring target, the information adding unit 18 adds information of the determination result to the encryption result of the original data 100. For example, information indicating that may be added to the encrypted result only when it is determined to be a monitoring target, and conversely, only when it is determined that it is not a monitoring target You may add to an encryption result. Further, whether the monitoring target or not, the determination result information may be added to the encryption result. Instead of adding the determination result information as described above, information indicating how the monitoring apparatus 20 should handle the encryption result data may be added. For example, a code indicating a measure such as prohibiting data transmission to the outside is added. When the determination result of the monitoring processing unit 24 includes information on the level to be monitored, the information adding unit 18 adds the information on the level to the encryption result. Various kinds of attribute information (or a combination of two or more of them) such as the identification information of the user who instructed the encryption, the time (date and time) when the encryption process was performed, or the identification information of the computer that performed the encryption May be added to the encrypted result as tracking information.

  As an example, the information adding unit 18 can add information to the encryption result by, for example, embedding the information in the encryption result by a technique such as digital watermarking or steganography. The information to be added may be collected into a file of a predetermined data format together with the encryption result. This is a method of encapsulating encrypted data and additional information. Further, the information adding unit 18 may add an electronic signature to the data obtained by collecting the encrypted data and the additional information. The electronic signature may be performed, for example, by a method in which a hash value of the data encrypted with the secret key of the information adding unit 18 is added to the data. In any method, additional information can be extracted if the monitoring processing unit 24 knows the format.

  The encrypted data with additional information 120 to which the determination result information is added in this way is output from the encryption tool 10 as a processing result.

  In the determination rule storage unit 22, a determination rule for determining whether or not the data is a monitoring target and a level of the monitoring target is registered based on the additional information extracted from the determination target data.

  When the monitoring processing unit 24 receives data from the firewall 30, the monitoring processing unit 24 extracts additional information from the data, searches the determination rule storage unit 22 for a determination rule corresponding to the additional information, and performs determination according to the determination rule.

  If the data includes additional information with an electronic signature, the monitoring processing unit 24 verifies the electronic signature. If the verification succeeds (provides that it is a correct signature), the monitoring processing unit 24 responds to the additional information. It is determined whether or not the data is a monitoring target. In addition, if the verification of the electronic signature fails (it turns out that the signature is invalid), there is a possibility that the data has been tampered with. May be determined as the highest level monitoring target. In this example, when the electronic signature is not correct, the data is the highest level of monitoring target. However, this is only an example, and how the data is handled when the electronic signature is incorrect is the system security policy. by. In any case, the monitoring processing unit 24 determines whether or not the data to be monitored is the verification result of the electronic signature attached to the data to be leaked to the outside or the additional information included therein. It can be used as a basis for determining the level of importance, and can also be used as a basis for determining the level of importance as a monitoring target.

  3 may be the same as that of the embodiment of FIG. 1 except for the matters described above.

  In this way, even in a method in which the determination result for the original data 100 and information instructing handling in accordance with this are added to the encryption result, and the monitoring processing unit 24 performs the determination according to the added information. As with the above embodiment, the outflow of encrypted data can be monitored.

  Next, a modification of the configuration of FIG. 3 will be described with reference to FIG. The configuration of FIG. 4 is an example in which the inspection unit 52 and the information addition unit 58 are configured as a program different from the encryption program 54.

  The inspection unit 52 is called from the OS 40 when the process of the encryption program 54 attempts to read the original data 100 using the file reading library 42, as in the case of the inspection unit 52 configured as shown in FIG. Then, the inspection unit 52 passes the file read by the library 42 to the monitoring processing unit 24 to make a determination. The subsequent processing may be the same as that of the inspection unit 52 in FIG.

  The information adding unit 58 is called from the OS 40 when the process of the encryption program 54 completes the output of the encryption result file, as in the notification unit 56 having the configuration shown in FIG. 2, and the information adding unit 58 shown in FIG. The same information as 18 is added. As a result, the encrypted data 120 with additional information is stored in the file system 46.

  In addition, the basic functions of the inspection unit 52 and the information addition unit 58 may be the same as those of the inspection unit 12 and the information addition unit 18 of FIG.

  Next, a further modification will be described with reference to FIG. In FIG. 5, the same or similar components as those shown in FIG.

  In the modification of FIG. 5, the inspection unit 12 passes the input original data 100 to the monitoring processing unit 24 and determines whether or not the original data 24 is a monitoring target. If it is determined that the data is to be monitored, the inspection unit 12 causes the encryption unit 14 to stop encrypting the original data 100. On the other hand, if the original data 100 is not a monitoring target, the inspection unit 12 permits the encryption unit 14 to encrypt the original data 100.

  In this way, according to the modification of FIG. 5, if the original data 100 is a monitoring target, the encryption of the original data 100 is prohibited, so that the original data 100 is encrypted and flows out to the outside. Can be prevented.

  In the above modification examples of FIGS. 1 to 5, the case where the original data 100 is encrypted has been described. However, the method of the present invention can also be applied when data conversion other than encryption is applied to the original data 100. FIG. 6 shows an example in which the original data 100 is converted into an image file by a virtual printer driver as an example of data conversion other than encryption. Virtual printer drivers, such as Adobe Systems' Acrobat (registered trademark) and Fuji Xerox Co., Ltd. DocuWorks (registered trademark), process application files such as word processors and print the files. Generate image data to represent. The image data generated in this way may not include character string information contained in the original file, and even if the original file is registered in the monitoring device 20 as a monitoring target, it is generated from it. An image data file may not be recognized as a monitoring target. The modification of FIG. 6 is for dealing with such a case.

  In the case of the modification shown in FIG. 5, the inspection unit 52 can be configured as a separate program from the encryption tool 10.

  In the configuration of FIG. 6, the virtual printer driver application 11 includes an inspection unit 12, an image file generation unit 15, and a watermark embedding unit 19. An application such as a word processor inputs a series of print commands (for example, expressed by GDI (Graphic Device Interface)) indicating the original data 100 to the virtual printer driver application 11. Upon receiving this, the inspection unit 12 passes the command string data to the monitoring processing unit 24 to determine whether or not it is a monitoring target. Instead, the inspection unit 12 generates data to be inspected by, for example, extracting only the character parts to be printed from these print commands and connecting them to generate a character string. You may make it determine whether it is a monitoring object by transmitting.

  The image file generation unit 15 converts the input print command sequence into an image file.

  The inspection unit 12 passes the determination result information received from the monitoring processing unit 24 (or information indicating the processing content of the monitoring processing unit 24 determined according to the determination result) to the watermark embedding unit 19. The watermark embedding unit 19 embeds the received information as an electronic watermark in the image file generated by the image file generation unit 15. In addition to information such as the determination result, information such as the name of the user who has instructed generation of the image file, the date and time, and the name of the computer may be embedded as a digital watermark.

  When the monitoring processing unit 24 receives the determination target data from the firewall 30, the monitoring processing unit 24 extracts information embedded as a digital watermark from the data, and based on the information, whether the data is the monitoring target and / or Alternatively, the level or the like is determined, and the firewall 30 is instructed whether to prevent the outflow of the data according to the determination result. In addition, the monitoring processing unit 24 may record the user name, date and time, computer name, and the like extracted from the digital watermark in a log.

  As described above, the case where the original data 100 is encrypted or the case where the original data 100 is converted into image data is taken as an example. However, there are various other data conversions in which the content of the original data 100 is changed, for example, when data is compressed. The method of the present invention is applicable to such data conversion in general.

  In the above embodiment and each modification, the inspection unit 12 or 52 has requested the monitoring device 20 that monitors data to be leaked in cooperation with the firewall 30 to determine the original data 100. However, the present invention is not limited to this, and the inspection unit 12 or 52 itself may perform the determination according to the same determination rule as the monitoring device 20.

  In the above example, the firewall 30 controls the outflow of data from “inside” to “outside”. However, the firewall 30 is not limited to the firewall 30, and other software having such a control function such as a forward proxy or the like Hardware may be used instead of the firewall 30.

  The system described above is typically realized by executing a program describing the function or processing content of each element described above on a general-purpose computer. As shown in FIG. 7, the computer is a circuit in which a CPU (Central Processing Unit) 60, a memory (primary storage) 62, various I / O (input / output) interfaces 64, and the like are connected via a bus 66 as hardware. It has a configuration. Further, a hard disk drive 68 and a disk drive 70 for reading portable non-volatile recording media of various standards such as a CD, a DVD, and a flash memory are connected to the bus 66 via an I / O interface 64, for example. . Such a drive 68 or 70 functions as an external storage device for the memory. A program describing the processing contents of the system in each example is stored in a fixed storage device such as the hard disk drive 68 via a recording medium such as a CD or DVD or via a network, and installed in a computer. The programs stored in the fixed storage device are read into the memory and executed by the CPU, whereby the processes of the above examples are realized. Even when the encryption tool 10 and the monitoring device 20 are mounted on different computers, a program describing each function may be executed on each computer.

  As described above, according to the embodiment or the modification, when the original data is converted, the use of the important data can be monitored or inappropriate use can be suppressed by examining the original data. Furthermore, in the data conversion, the converted data (by itself or its feature amount) is registered as a monitoring target, or information on the determination result of whether or not the monitoring target is added to the converted data. It is possible to monitor data while enjoying the convenience of data conversion.

It is a functional block diagram which shows the example of a structure of the communication monitoring system of embodiment. It is a functional block diagram which shows the system configuration | structure of the modification of the structure of FIG. It is a functional block diagram which shows the system configuration | structure of the further modification. It is a functional block diagram which shows the system configuration | structure of the modification of the structure of FIG. It is a functional block diagram which shows the system configuration | structure of the further modification. It is a functional block diagram which shows the system configuration | structure of the further modification. It is a figure which shows an example of the hardware constitutions of a general purpose computer.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 Encryption tool, 12 Inspection part, 14 Encryption part, 16 Notification part, 20 Monitoring apparatus, 22 Judgment rule memory | storage part, 24 Monitoring processing part, 26 Rule registration part, 30 Firewall, 100 original data, 110 Encryption data.

Claims (6)

Whether data to get away from a computer or network to the outside is monitored, determined based on at least one decision rule is registered, for monitoring if the data is determined to be monitored A monitoring processing unit that executes a predetermined process, and monitors the data when the registered data includes at least one character string to be monitored in the registered determination rule. A computer that cooperates with the monitoring processing unit including the first determination rule to be determined as a target ,
An inspection unit that inspects whether data to be encrypted is a monitoring target based on the first determination rule when the encryption process is performed;
If the target data of the encryption process has been found by the examination of the measurement part to be monitored to determine the encrypted results of the data obtained as a result obtained by performing an encryption process for the data monitored When a request for registering the second determination rule in the monitoring processing unit is notified to the monitoring processing unit, and it is found by inspection of the inspection unit that the data to be encrypted is not a monitoring target, the A notification unit that does not notify the monitoring processing unit of the request ;
Program to function as. The program according to claim 1,
The notification unit obtains a predetermined feature quantity of data of the encryption result, a request to register with the monitoring processor determines rule that data with its feature amount monitored as the second determination rule To the monitoring processing unit ,
A program characterized by that. 3. The program according to claim 2, wherein the feature amount is a hash value of the data of the encryption result . The program according to any one of claims 1 to 3 , wherein the inspection unit inquires of the monitoring processing unit whether or not the data to be encrypted is a monitoring target. Program. Whether data to get away from a computer or network to the outside is monitored, determined based on at least one decision rule is registered, for monitoring if the data is determined to be monitored A monitoring processing unit that executes a predetermined process, and monitors the data when the registered data includes at least one character string to be monitored in the registered determination rule. A data communication monitoring system that cooperates with a monitoring processing unit that includes a first determination rule for determining a target ,
An inspection unit that inspects whether data to be encrypted is a monitoring target based on the first determination rule when the encryption process is performed;
When the data to be encrypted is found to be a monitoring target by inspection by the inspection unit, the encryption result data obtained as a result of performing the encryption processing on the data is determined as the monitoring target . If the request for registering the determination rule of 2 in the monitoring processing unit is notified to the monitoring processing unit, and the inspection unit finds that the data to be encrypted is not the monitoring target, the request A notification unit that does not notify the monitoring processing unit;
A data communication monitoring system comprising: Whether data to get away from a computer or network to the outside is monitored, determined based on at least one decision rule is registered, for monitoring if the data is determined to be monitored A monitoring processing unit that executes a predetermined process, and monitors the data when the registered data includes at least one character string to be monitored in the registered determination rule. A method for monitoring data communication in cooperation with a monitoring processing unit including a first determination rule for determining a target ,
When the inspection unit performs the encryption process , it checks whether the data to be encrypted is a monitoring target based on the first determination rule ,
If the target data of the encryption process has been found by the inspection of the inspection unit to be monitored, the notification unit, the data monitoring encrypted result data obtained as a result of implementing the encryption process on The monitoring processing unit is notified of a request for registering the second determination rule to be determined as a target in the monitoring processing unit, and it is found by inspection of the inspection unit that the data to be encrypted is not the monitoring target In this case, the notification unit does not notify the monitoring processing unit of the request .
Data communication monitoring method.

Images