JP5952175B2 - Control device, control system, control method and control program - Google Patents

Description

  The present invention relates to a control device and the like.

  2. Description of the Related Art In recent years, techniques for downloading SaaS (Software as a Service) service, application software for mobile terminals, and the like from Web sites and executing them on user terminals have become widespread. Among the application software executed on the user's terminal, there is application software that performs data communication with various servers at the time of execution. Some of such application software communicates in a form that is not noticed by the user. For example, it collects user behavior information (GPS (Global Positioning System), etc.) or information in the terminal (phone book) Information etc.) was illegally collected.

Permissions Android Developers, [online], [October 2, 2012 search], Internet <URL: http://developer.android.com/guide/topics/security/permissions.html> Manifest.permission Android Developers, [online], [October 22, 2012 search], Internet <URL: http://developer.android.com/reference/android/Manifest.permission.html>

  However, the above-described prior art has a problem that the user cannot determine the validity of the application software running on the user's terminal.

  For example, in the prior art, what function an OS (Operating System) uses in an application is defined by a setting file, and the setting file is presented to the user to determine whether the application is intended by the user. It was a thing. However, in the prior art, for example, when a user executes application software on a terminal, the user can easily recognize what kind of communication the application software performs and where the connection destination is. Can not. For this reason, it is difficult for the user to judge the validity of the application software, and if the application software is harmful, the safety may be impaired.

  An embodiment of the disclosure is made in view of the above, and includes a control device, a control system, a control method, and a control program that enable a user to determine the validity of application software that operates on a user's terminal. The purpose is to provide.

  The control device according to the present invention includes a verification unit, an output unit, and a connection destination control unit. The verification unit acquires application software including specific information for uniquely specifying a single or a plurality of connection destinations to be connected at the time of execution, and verifies whether the specific information has been tampered with. When the verification unit verifies that the specific information has not been tampered with, the output unit outputs, to the display device, information on a single or a plurality of connection destinations connected when executing the application software based on the specific information. . When receiving an application software execution instruction, the connection destination control unit executes the application software and suppresses the application software from connecting to a connection destination specified by the specific information.

  According to the control device of the present invention, there is an effect that the user can determine the validity of the application software running on the user's terminal.

FIG. 1 is a diagram illustrating a configuration of a system according to the present embodiment. FIG. 2 is a functional block diagram showing the configuration of the user terminal according to the present embodiment. FIG. 3 is a diagram illustrating an example of a data structure of application information. FIG. 4 is a diagram illustrating an example of attribute information. FIG. 5 is a diagram illustrating an example of information displayed on the display unit. FIG. 6 is a flowchart showing a processing procedure of the system according to the present embodiment. FIG. 7 is a diagram illustrating an example of the data structure of the classification table. FIG. 8 is a diagram illustrating an example of the data structure of the policy table. FIG. 9 is a diagram illustrating an example of a computer that executes a control program that implements the same function as the user terminal.

  Hereinafter, embodiments of a control device, a control system, a control method, and a control program disclosed in the present application will be described in detail with reference to the drawings. In addition, this invention is not limited by this embodiment.

(Embodiment)
An example of a system configuration according to the present embodiment will be described. FIG. 1 is a diagram illustrating a configuration of a system according to the present embodiment. As shown in FIG. 1, this system includes an AP providing server 60, an attribute information management server 70, and a user terminal 100. The AP providing server 60, the attribute information management server 70, and the user terminal 100 are connected to each other via the network 50. Here, for convenience of explanation, the AP providing server 60, the attribute information management server 70, and the user terminal 100 are shown, but this system may include other AP providing servers, attribute information management servers, and user terminals. The user terminal 100 is an example of a control device.

  The AP providing server 60 is a device that provides application software information in response to a request from the user terminal 100.

  The attribute information management server 70 is an apparatus that manages attribute information of a site that is a connection destination of application software executed by the user terminal 100. The attribute information includes the owner of the domain of the site, the name of the company that operates the site, the classification of the site, and the like. For example, the site classification corresponds to an advertisement site, a bank site, an SNS site, and the like.

  The attribute information management server 70 stores, for example, a domain, a URI (Uniform Resource Identifier) or IP (Internet Protocol) address, and attribute information in association with each other in the database.

  When the attribute information management server 70 acquires information on the setting file from the user terminal 100, the attribute information management server 70 searches the database for attribute information corresponding to the setting file, and notifies the user terminal 100 of the searched attribute information. A description of the setting file will be described later.

  The user terminal 100 is a device that acquires application software information from the AP providing server 60 and executes the acquired application software. The other processes executed by the user terminal 100 are the same as the processes of the mobile phone, smartphone, tablet terminal, notebook computer, etc. of the prior art, so the description is omitted here.

  An example of the configuration of the user terminal 100 will be described. FIG. 2 is a functional block diagram showing the configuration of the user terminal according to the present embodiment. As illustrated in FIG. 2, the user terminal 100 includes a communication unit 110, an input unit 120, a display unit 130, a storage unit 140, and a control unit 150.

  The communication unit 110 is a processing unit that performs data communication with the AP providing server 60 and the attribute information management server 70 via the network 50. The control unit 150 described later exchanges data with the AP providing server 60 and the attribute information management server 70 via the communication unit 110. The communication unit 110 corresponds to a communication device, for example.

  The input unit 120 is an input device for inputting various types of information to the user terminal 100. For example, the input unit 120 corresponds to an input button, a touch panel, or the like.

  The display unit 130 is a display device that displays various types of information output from the control unit 150. For example, the display unit 130 corresponds to a display or a touch panel.

  The storage unit 140 is a storage device that stores application information 141, certificate information 142, and attribute information 143.

  The application information 141 is information about application software provided from the AP providing server 60. FIG. 3 is a diagram illustrating an example of a data structure of application information. As shown in FIG. 3, the application information 141 includes a setting file 141a.

  The setting file 141a is information for uniquely specifying a single or a plurality of connection destinations to which the application software is connected when the application software is executed using the application information 141. In the example shown in FIG. 3, the connection destination is described in the area 141b of the setting file 141a as a URI (Uniform Resource Identifier). In the example illustrated in FIG. 3, when the application software is executed, it is connected to the site indicated by “uri = h ** ps // ntt.co.jp”. Note that “h ** ps” included in the URI corresponds to “https”.

  In the example illustrated in FIG. 3, the case where the URI is designated as the connection destination has been described. However, the present invention is not limited to this. For example, a domain and an IP address may be set as the connection destination.

  The certificate information 142 is information for verifying whether the setting file 141a included in the application information 141 has been falsified. For example, the certificate information 142 is information obtained by encrypting the hash value of the setting file 141 a with the secret key of the AP providing server 60. The user terminal 100 acquires the application information 141 and the certificate information 142 from the AP providing server 60.

  The attribute information 143 is attribute information of a site to which the application software is connected when the application software is executed. The attribute information includes the owner of the domain of the site, the name of the company that operates the site, the classification of the site, and the like. FIG. 4 is a diagram illustrating an example of attribute information. In the example shown in FIG. 4, “Nippon Telegraph and Telephone Corporation” is included as the name of the company that operates the site.

  The control unit 150 includes an acquisition unit 151, a verification unit 152, an output unit 153, an execution unit 154, and a communication destination control unit 155.

  The acquisition unit 151 is a processing unit that acquires application information and certificate information from the AP providing server 60. The acquisition unit 151 stores application information and certificate information in the storage unit 140 as application information 141 and certificate information 142.

  Further, after acquiring the application information 141, the acquisition unit 151 extracts the information of the setting file 141a of the application information 141 and notifies the attribute information management server 70 of the information of the setting file 141a. The acquisition unit 151 acquires attribute information corresponding to the URI of the setting file 141 a from the attribute information management server 70 and stores the attribute information in the storage unit 140 as attribute information 143.

  The verification unit 152 is a processing unit that verifies whether the setting file 141a of the application information 141 has been falsified. The verification unit 152 outputs the verification result to the output unit 153. For example, the verification unit 152 verifies the signature regarding the setting file 141a using the certificate information 142. If the verification fails, the verification unit 152 determines that the application information 141 (setting file 141a) has been falsified.

  An example of processing of the verification unit 152 will be described. The verification unit 152 calculates a hash value by substituting the setting file 141a for the hash function. The hash value calculated by the verification unit 152 based on the setting file 141a is referred to as a first hash value.

  The verification unit 152 extracts the hash value from the certificate information 142 by decrypting the certificate information 142 with the public key of the AP providing server 60. The hash value extracted from the certificate information 142 is expressed as a second hash value. The verification unit 152 determines that the setting file 141a has not been tampered with when the first hash value and the second hash value match. On the other hand, when the first hash value and the second hash value are different, the verification unit 152 determines that the setting file 141a has been falsified. Note that the processing shown here is an example, and the verification unit 152 may determine whether the setting file 141a has been tampered with using other known techniques.

  When the verification unit 152 determines that the setting file 141a has not been tampered with, the output unit 153 outputs the connection destination information and attribute information 143 included in the setting file 141a to the display unit 130 for display. Part.

  FIG. 5 is a diagram illustrating an example of information displayed on the display unit. In the example shown in FIG. 5, the display unit 130 displays the connection destination URI 130 a and the name 130 b of the company that operates the site. The user presses the OK button 131 when executing an application connected to the connection destination displayed on the display unit 130. On the other hand, the user presses the stop button 132 when not executing the application connected to the displayed connection destination.

  The execution unit 154 is a processing unit that reads the application information 141 and executes the application software when the OK button 131 displayed on the display unit 130 is pressed by the user.

  The communication destination control unit 155 is a processing unit that monitors the connection destination of the application software executed by the execution unit 154 and suppresses application software from connecting to a connection destination other than the connection destination set in the setting file 141a.

  For example, the connection destination set in the setting file 141a is “uri = h ** ps // ntt.co.jp”. In this case, the communication destination control unit 155 permits the connection when the application software connects to “uri = h ** ps // ntt.co.jp”. On the other hand, when the application software makes a connection to “uri = h ** ps // maru.example.jp”, the communication control unit 155 suppresses the connection. As a result, the application software can connect to `` uri = h ** ps // ntt.co.jp '' and perform data communication, but `` uri = h ** ps // maru.example. Data communication cannot be performed by connecting to "jp".

  Next, a processing procedure of the system according to the present embodiment will be described. FIG. 6 is a flowchart showing a processing procedure of the system according to the present embodiment. As shown in FIG. 6, the AP providing server 60 transmits application information 141 and certificate information 142 to the user terminal 100 (step S101), and the user terminal 100 receives the application information 141 and the certificate from the AP providing server 60. Document information 142 is received (step S102). The user terminal 100 verifies whether or not the setting file 141a of the application information 141 has been falsified (step S103).

  If the setting file 141a has been falsified (step S104, Yes), the user terminal 100 ends the process. On the other hand, when the setting file 141a has not been falsified (No at Step S104), the user terminal 100 requests attribute information from the attribute information management server 70 (Step S105). The attribute information management server 70 receives a request for attribute information (step S106), and transmits the attribute information to the user terminal 100 (step S107). The user terminal 100 acquires attribute information from the attribute information management server 70 (step S108).

  The user terminal 100 displays the connection destination and attribute information on the display unit 130 (step S109). In step S109, the user terminal 100 causes the display unit 130 to display the screen illustrated in FIG. The user terminal 100 determines whether an application software execution request has been received (step S110). If the stop button 132 is pressed and the execution request is not accepted (No at Step S110), the user terminal 100 ends the process.

  On the other hand, when the OK button 131 is pressed and an execution request is accepted (step S110, Yes), the user terminal 100 controls the application software so as not to connect to a connection destination other than the connection destination set in the setting file 141a. Is executed (step S111). In step S111, for example, when the setting file 141a is as shown in FIG. 3, the user terminal connects only to the site indicated by “uri = h ** ps // ntt.co.jp”. To do.

  Next, effects of the user terminal 100 according to the present embodiment will be described. When the setting file 141a of the application information 141 is not falsified, the user terminal 100 displays information on a single or a plurality of connection destinations that are connected when the application software is executed based on the setting file 141a. When the user terminal 100 receives an execution instruction of the application software, the user terminal 100 executes the application software and inhibits the application software from connecting to a connection destination other than the connection destination set by the setting file 141a. For this reason, when the application software is executed, the connection destination that is actually connected can be clearly shown to the user, and the user can imagine the operation of the application from the connection destination information. Validity can be determined.

  Further, the user terminal 100 acquires attribute information of a connection destination connected when the application software is executed from the attribute information management server 70, and causes the display unit 130 to display the attribute information together with a URI or the like. For this reason, the connection destination information can be presented to the user more specifically, so that the user can easily determine whether or not to execute the application software.

  By the way, the processing of the first embodiment described above is an example. Hereinafter, other processes of the AP providing server 60 and the user terminal 100 will be described.

  The system shown in FIG. 1 includes the AP providing server 60, the attribute information management server 70, and the user terminal 100, but the configuration of this system is an example. For example, the system according to the first embodiment does not necessarily include the attribute information management server 70. When the attribute information management server 70 does not exist, the user terminal 100 displays connection destination information included in the setting file 141a, and the user refers to the connection destination to determine whether to execute application software. It may be determined.

  When the user terminal 100 causes the user to confirm whether or not to execute the application software, in addition to the information illustrated in FIG. 5, the display unit 130 further indicates whether or not the application software is official application software. May be displayed.

  For example, the verification unit 152 determines whether the application software is official application software. When the setting file 141a has not been tampered with, the verification unit 152 acquires certificate information from the connection destination set in the setting file 141a. Here, for convenience of explanation, the certificate information from the connection destination set in the setting file 141a is expressed as second certificate information. The certificate information 142 is referred to as first certificate information.

  The verification unit 152 determines that the application software is official application software when the first certificate information and the second certificate information are related.

  For example, the verification unit 152 has a relationship between the first certificate information and the second certificate information when the hash value of the first certificate information matches the hash value of the second certificate information. It is determined that Alternatively, when the first certificate information and the second certificate information are certificates of the same company by the same certificate authority, the verification unit 152 associates the first certificate information with the second certificate information. It is determined that it has. For example, the first certificate information includes information indicating that the certificate is a company B certificate generated by the certificate authority A, and the second certificate information is a certificate of the company B generated by the certificate authority A. When the information indicating that the information is present is included, the verification unit 152 determines that the first certificate information and the second certificate information are related, and determines that the application software is official. .

  In this way, the user terminal 100 determines whether or not the first certificate information and the second certificate information are related, and if so, the application software is By further displaying whether or not the application software is official on the display unit 130, the application software can be executed after confirming whether or not the user is the official application software. Note that the user terminal 100 can also implement secure data communication by using the second certificate information as an SSL (Secure Socket Layer) certificate when communicating with a connection destination.

The AP providing server 100 may classify the application software based on the URI included in the setting file 141a, and the user may operate the user terminal 100 to display the classification result of the application software to be downloaded. For example, the AP providing server 100 includes a classification unit (not shown).

  The classification unit classifies the application software based on the classification table. FIG. 7 is a diagram illustrating an example of the data structure of the classification table. The classification unit classifies the application software by comparing the URI set in the setting file 141a with a classification table prepared in advance. For example, when “twister.example.com” is included in the URI set in the setting file 141a, the classification unit classifies the application software in the setting file 141a as a Twister client. Further, when “maru.example.com” is included in the URI set in the setting file 141a, the classifying unit classifies the application software in the setting file 141a as a bank application.

  Further, the classification unit may classify the application software based on the URI and policy included in the setting file 141a.

  The classification unit classifies the application software based on the connection destination corresponding to the URI of the setting file 141a and the policy table. FIG. 8 is a diagram illustrating an example of the data structure of the policy table. For example, the classification unit specifies the connection destination corresponding to the URI of the setting file 141 a based on the attribute information 143.

  As shown in FIG. 8, when the connection destination corresponds only to twister.example.com, the classification unit classifies the corresponding application software as “safe application software”. The classification unit classifies the corresponding application software as “relatively safe application software” when the connection destination is only twist.example.com and the advertisement site. This is because the advertisement site is designated in advance, and the advertisement is only displayed even when connected to the connection destination.

  If the classification is connected only to twister.example.com and the developer site, the classification section “application software that is likely to collect the specified information (may be disadvantageous to the user)” Classify into: When an unknown site is included in the connection destination, the classification unit classifies the application software as “application software with high possibility of collecting predetermined information (highly likely to be disadvantageous to the user)”. If the connection destination is not specified, for example, if the connection destination is not set in the setting file 141a, the classification unit “cannot determine the risk of the application software (the possibility of being extremely disadvantageous to the user is extremely high). High).

  As described above, the AP providing server 10 classifies application software based on the URI and policy included in the setting file 141a, and when the user operates the user terminal 100 to download the application software, Since the classification result is displayed, the user can more accurately determine whether or not to execute the application software. It can also show that a legitimate developer is a legitimate app. That is, the developer can specify not only the application connection destination but also the application classification to the user by describing the connection destination (URL) in the setting file 141a or the like. This allows a legitimate developer to clearly indicate to the user that he / she is not malicious, rather than letting a malicious person do something.

  Next, an example of a computer that executes a control program that implements the same function as the user terminal 100 described in the embodiment will be described. FIG. 9 is a diagram illustrating an example of a computer that executes a control program that implements the same function as the user terminal. As illustrated in FIG. 9, the computer 80 includes, for example, a memory 81, a CPU (Central Processing Unit) 82, a hard disk drive interface 83, a disk drive interface 84, a serial port interface 85, a video adapter 86, A network interface 87, and these units are connected by a bus 88.

  As illustrated in FIG. 9, the memory 81 includes a ROM (Read Only Memory) 81a and a RAM (Random Access Memory) 81b. The ROM 81a stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 83 is connected to the hard disk drive 83a as illustrated in FIG. The disk drive interface 84 is connected to the disk drive 84a as illustrated in FIG. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 84a. The serial port interface 85 is connected to a mouse 85a and a keyboard 85b, for example, as illustrated in FIG. The video adapter 86 is connected to a display 86a, for example, as illustrated in FIG.

  Here, as illustrated in FIG. 9, the hard disk drive 83a stores, for example, an OS (Operating System) 1, an application program 2, a program module 3, and program data 4. That is, the control program for executing the process of the user terminal 100 is stored in, for example, the hard disk drive 83a as the program module 3 in which the command executed by the computer 80 is described. Specifically, the program module 3 in which each procedure corresponding to the acquisition unit 151, the verification unit 152, the output unit 153, the execution unit 154, and the communication destination control unit 155 described in the above embodiment is described in the hard disk drive 83a. Remembered. Further, like the data stored in the storage unit 140 described in the above embodiment, data used for information processing by the control program is stored as the program data 4 in the hard disk drive 83a or the memory 81, for example. Then, the CPU 82 reads the program module 3 and the program data 4 stored in the hard disk drive 83a to the RAM 81b as necessary, and executes each procedure.

  The program module 3 and the program data 4 related to the control program are not limited to being stored in the hard disk drive 83a, but may be stored in a removable storage medium, for example, and read out by the CPU 82 via the disk drive or the like. Good. Alternatively, the program module 3 and the program data 4 relating to the control program are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.), and via a network interface. It may be read by the CPU 82.

1 OS
2 Application program 3 Program module 4 Program data 60 AP providing server 70 Attribute information management server 80 Computer 81 Memory 81a ROM
81b RAM
82 CPU
83 hard disk drive interface 83a hard disk drive 84 disk drive interface 84a disk drive 85 serial port interface 85a mouse 85b keyboard 86 video adapter 86a display 87 network interface 88 bus 100 user terminal 110 communication unit 120 input unit 130 display unit 140 storage unit 141 application Information 142 Certificate information 143 Attribute information 150 Control unit 151 Acquisition unit 152 Verification unit 153 Output unit 154 Execution unit 155 Communication destination control unit

Claims (6)

A verification unit that obtains application software including specific information that uniquely identifies a single or a plurality of connection destinations to be connected at the time of execution, and verifies whether the specific information has been falsified;
When it is verified that the specific information has not been tampered with by the verification unit, depending on the risk level of a single or a plurality of connection destinations that are connected when the application software specified using the specific information is executed An acquisition unit for acquiring a classification result of the classified application software;
A single or plurality of connection destination information is connected to the time of execution of the application software that is based on the specific information, and an output unit for outputting to the display device in association with information indicating a risk of the application software,
A connection destination control unit that , when receiving an execution instruction of the application software, causes the application software to be executed and prevents the application software from connecting to a connection destination specified by the specific information ;
A control device comprising: It further includes an acquisition unit that acquires attribute information of a single or a plurality of connection destinations specified by the specific information,
The control device according to claim 1, wherein the output unit further outputs information of a single or a plurality of connection destinations connected when the application software is executed and the attribute information to the display device. The verification unit acquires the application software and a first certificate of the application software, performs a process of verifying whether the specific information has been falsified based on the first certificate, and , Obtaining second certificate information from a single or a plurality of connection destinations specified by the specific information, and verifying whether the first certificate and the second certificate have relevance And
The output unit further outputs information on whether or not the first certificate and the second certificate are related to a display device. Control device. A control system comprising a providing server for providing application software and a control device,
The providing server is
Based on identification information that uniquely identifies a single or a plurality of connection destinations to be connected at the time of execution, the single or a plurality of connection destinations to be connected at the time of execution of the application software are specified, and the risk level of the specified connection destination A classification unit for classifying the application software including the specific information according to
The controller is
A verification unit that obtains the classification result of the application software and the classification unit from the providing server, and verifies whether the specific information has been tampered with;
Wherein when said specific information is verified as not been tampered by the verification unit, a single or plurality of connection destination information is connected to the time of execution of the application software that is based on the specific information, included in the classification result An output unit for associating information indicating the risk level of the application software to be output to a display device;
A connection destination control unit that , when receiving an execution instruction of the application software, causes the application software to be executed and prevents the application software from connecting to a connection destination specified by the specific information ;
A control system comprising: A control method executed by a control device that controls execution of application software,
The control device includes a storage unit that stores specific information that is specific information included in the application software and uniquely specifies a single or a plurality of connection destinations to be connected when the application software is executed ,
The control device acquires application software including the specific information , and verifies whether the specific information has been tampered with;
When the control device verifies that the specific information has not been tampered with by the verification step, the single or plural connection destinations to be connected when the application software specified using the specific information is executed An acquisition step of acquiring a classification result of the application software classified according to the degree of risk;
Wherein the controller outputs to the single or plurality of connection destination information is connected to the time of execution of the application software that is based on specific information on the display device in association with information indicating a risk of the application software output Process,
Wherein the controller, when receiving the execution instruction of the application software, the to execute the application software, if the application software to connect to the destination specified by the specifying information stored in the storage unit Connection destination control step of permitting connection to the application software and inhibiting the application software from connecting when the application software is connected in addition to the connection destination specified by the specific information stored in the storage unit and,
The control method characterized by including. A control program for causing a control device that controls execution of application software to execute,
The control device includes a storage unit that stores specific information that is specific information included in the application software and uniquely specifies a single or a plurality of connection destinations to be connected when the application software is executed ,
A verification step in which the control device acquires application software including the specific information and verifies whether the specific information has been tampered with;
When the control device verifies that the specific information has not been tampered with by the verification step, the single or plural connection destinations to be connected when the application software specified using the specific information is executed. An obtaining step of obtaining a classification result of the application software classified according to the degree of risk;
Wherein the controller outputs to the single or plurality of connection destination information is connected to the time of execution of the application software that is based on specific information on the display device in association with information indicating a risk of the application software output Steps,
Wherein the controller, when receiving the execution instruction of the application software, the to execute the application software, if the application software to connect to the destination specified by the specifying information stored in the storage unit Connection destination control step for permitting connection to the application software and for preventing the application software from connecting when the application software is connected in addition to the connection destination specified by the specific information stored in the storage unit and,
A control program for causing the control device to execute the program.

Images