JP6218058B1 - Service management device - Google Patents

Abstract

The present invention provides a service management apparatus that can collectively limit external services to be used by a website administrator. A use service management apparatus for managing an external service that is used when a user website is accessed, and a CSP tag generation unit that generates a CSP tag that only permits access to a predetermined domain. The CSP tag generation unit 9 is configured to store the generated CSP content in the CSP content storage unit 9a in the use service management server 10, and the CSP tag is an HTML head of the user website. When the HTML of the user website is executed at the visitor terminal 16 that visits the user website, the service management server 10 is accessed from the visitor terminal 16, and the CSP content storage unit 9a is accessed. Includes a script code for additionally writing the content of the CSP stored in the user website. [Selection] Figure 1

Description

  The present invention relates to a service management apparatus that manages an external service used when accessing a website.

  In recent years, an advertisement technique called targeting advertisement has been widely used in Internet advertisement distribution. There are various methods for targeting advertisements. For example, the attributes of the website visited by the user are stored in the cookie of the browser, and the user is interested in the information based on the cookie information. A technique for distributing related advertisements is known.

  As prior art document information related to the invention of this application, there are Patent Documents 1 and 2.

U.S. Pat. No. 9,361,631 U.S. Pat. No. 8,516,601

  In the above-described targeting advertisement, information such as a website visit history is transmitted to a third party such as an advertising company (hereinafter, a service provided by a third party such as an advertising company is referred to as an external service). Therefore, there is an increasing demand for blocking unnecessary external services.

  In recent years, the method of targeting advertising using redirects has become more complex, so even website administrators may not know the external services used when accessing their websites. is there. Conventionally, it has been common for individual users to manage external services (opt-out, etc.) using browser functions, etc., but for the reasons mentioned above, external users used by website administrators There is a request to manage (restrict) services in a batch.

  SUMMARY OF THE INVENTION An object of the present invention is to provide a use service management apparatus that can collectively limit external services to be used by a website administrator.

  The present invention is a service management apparatus for managing an external service used when accessing a user website provided by a user server for the purpose of solving the above-described problem, and provides an access to a predetermined domain. A CSP tag generation unit that generates a CSP tag that is a tag of a content security policy defined by the World Wide Web Consortium that permits only the use, and the CSP tag generation unit is used differently from the user server It is mounted on a server for service management, and has a receiving unit for receiving an external service desired to be blocked from a user who manages the user server, and the external service desired to be blocked received by the receiving unit. Configured to generate a content security policy that prohibits access to the domain And the CSP tag generation unit is configured to store the content of the generated content security policy in a CSP content storage unit in the use service management server, and the CSP tag includes the user When the HTML of the user website is executed at the visitor terminal that is embedded in the head of the website HTML and visits the user website, the visitor terminal accesses the service management server. And a service management apparatus including a script code for adding the content of the content security policy stored in the CSP content storage unit to the user website.

  ADVANTAGE OF THE INVENTION According to this invention, the utilization service management apparatus which can restrict | limit the external service utilized by the website administrator side collectively can be provided.

It is a schematic block diagram of the utilization service management apparatus concerning one embodiment of this invention. It is a figure which shows an example of an external service database. It is explanatory drawing explaining the display of the online privacy notice on a visitor terminal. (A) is a control flow at the time of online privacy notice generation in the use service management apparatus of FIG. 1, (b) is a use service management server for displaying online privacy notice on a visitor terminal, It is a figure which shows the flow of operation | movement of a user server and a visitor terminal. It is explanatory drawing explaining interruption | blocking of an external service. (A) is a control flow at the time of CSP tag generation or update in the CSP tag generation unit, and (b) is a service management server, user server, and visit when applying CSP to a visitor terminal It is a figure which shows the flow of operation | movement of a person terminal.

[Embodiment]
Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

  FIG. 1 is a schematic configuration diagram of a use service management apparatus 1 according to the present embodiment. The service management device 1 identifies an external service used when accessing a predetermined website and generates an online privacy notice, and prohibits access to the specific external service (blocks the external service). ) It has both functions. The external service is, for example, advertisement, analysis such as access analysis, data collection, web tool, interaction, and the like.

(Description of configuration to generate online privacy notice)
First, a configuration for generating online privacy notice will be described. As shown in FIG. 1, the usage service management apparatus 1 includes an analysis target URL reception unit 2, an external request extraction unit 3, an external service database (external service DB) 4, a usage service specifying unit 5, an online privacy node, A tis generator 7 and an online privacy notice storage 8 are provided. The URL receiving unit 2 to be analyzed, the external request extracting unit 3, the external service database 4, the used service specifying unit 5, the online privacy notice generating unit 7, and the online privacy notice storage unit 8 are connected to the use service management server 10. It is implemented by combining CPU (Central Processing Unit), semiconductor memory RAM (Random Access Memory) and ROM (Read Only Memory), HDD (Hard Disk Drive), software, interface and the like as appropriate.

  The use service management device 1 generates an online privacy notice for the website by specifying an external service used when accessing the registered website, and generates the online privacy notice for the visitor of the website. Configured to send online privacy notices. Here, as an example, a case where a user website provided by the user server 14 is registered will be described. The user server 14 and the use service management server 10 are different servers.

  The analysis target URL receiving unit 2 receives the analysis target URL, that is, the URL of the user website. In the present embodiment, a predetermined URL is assigned to the use service management server 10, and a website (referred to as a use service management website) can be provided via the Internet. A user 15 who manages the user server 14 uses a terminal such as a personal computer to access the usage service management website provided by the usage service management server 10 and use the usage service management apparatus 1. The URL of a user website (a website that desires to generate online privacy notice) provided by the operator server 14 is registered (input and transmitted). The analysis target URL receiving unit 2 receives the URL of the user website registered through the use service management website as the analysis target URL. The method in which the user 15 transmits the URL of the user website to the use service management server 10 (analysis target URL receiving unit 2) is not limited to this.

  The external request extraction unit 3 accesses the analysis target URL (here, the URL of the user website) received by the analysis target URL reception unit 2, and extracts a URL that causes access to a domain other than the domain of the analysis target URL. . More specifically, the external request extraction unit 3 accesses the user server 14 that activates an Internet browser and provides a user website. In addition, the external request extraction unit 3 monitors an HTTP request transmitted after accessing the user server 14 and extracts a URL where access occurs from a message of the HTTP request. Further, the external request extraction unit 3 excludes URLs having the same domain as the user website from the extracted URL. As a result, the URL of the external service providing server 13 that is accessed when the URL to be analyzed is accessed is specified. Hereinafter, an access request to a domain other than the user website is referred to as an external request. The URL of the extracted external request is stored in a predetermined storage area in the memory of the use service management server 10.

  It is possible to extract the URL of the external request by extracting the URL included in the HTML source received from the user server 14, but in this case, another external service is included in the script of the external service. When a description to be used is included, the other external service cannot be extracted. As in the present embodiment, by monitoring the message of the transmitted HTTP request, it is possible to extract another external service used in the external service as described above.

  The external request extraction unit 3 includes an external request occurrence count counter 31 that counts the number of times an external request has occurred (hereinafter referred to as an external request occurrence count). The external request occurrence count counted by the external request occurrence count counting unit 31 is stored in a predetermined storage area in the memory of the use service management server 10.

  As shown in FIG. 2, the external service database 4 stores the domain and path of the external service, the service name and the service type in association with each other, and is stored in advance in the memory of the service management server 10. Is stored in the storage area. Note that the URL is generally composed of a scheme, a domain, a path, a parameter, and a fragment. In the external service database 4, the path and the subsequent paths (path, parameter, and fragment) are represented by regular expressions. The service name represents the name of an external service such as an advertisement service or an access analysis service, and the service type represents the type of service such as an advertisement or access analysis. Although not shown in FIG. 2, in this embodiment, a service provider of an external service (a company name that provides an external service) is also stored in the external service database 4.

  The used service specifying unit 5 refers to the external service database 4 and refers to the service name, service type, and service provider (hereinafter referred to as service name) corresponding to the URL and domain of the URL of the external request extracted by the external request extraction unit 3. Is specified. The use service specifying unit 5 stores the specified service name or the like in a predetermined storage area in the memory of the use service management server 10.

  If the service name corresponding to the domain and path of the URL of the external request does not exist in the external service database 4, the use service specifying unit 5 sets the service name or the like as “under investigation”. When there is a URL of an external request whose service name or the like is unknown, the use service specifying unit 5 may be configured to notify the administrator who manages the use service management apparatus 1 of the URL of the external request.

  The used service specifying unit 5 includes a used service number counting unit 51 that counts the number of used external services. The number of used external services counted by the used service number counting unit 51 is stored in a predetermined storage area in the memory of the used service management server 10.

  The online privacy notice generation unit 7 stores the service name specified by the use service specifying unit 5 in the online privacy notice storage unit 8 as an online privacy notice.

  The online privacy notice generation unit 7 includes a display tag generation unit 71 that generates a display tag for displaying the online privacy notice on the user website. The display tag generation unit 71 transmits the generated display tag to the user 15 (such as a personal computer of the user 15). The user 15 can display the online privacy notice by embedding the received display tag in the HTML of the user website and uploading it to the user server 14. The display tag includes script code, and when the visitor visits the user website, accesses to the use service management server 10 and obtains / displays the online privacy notice.

  As shown in FIG. 3, when a user visits a user website, the visitor terminal 16 sends an HTTP request to the user server 14, and the user server 14 responds to the display tag. HTML data in which is embedded is transmitted. At the visitor terminal 16, the received HTML data is read and executed, but the access service management server 10 is accessed by the display tag embedded at this time, and the service management server 10 is online. Request transmission of privacy notices. In response to a request from the visitor terminal 16, the online privacy notice generation unit 7 of the use service management server 10 extracts and extracts the online privacy notice stored in the online privacy notice storage unit 8. The online privacy notice is transmitted to the visitor terminal 16. Thereby, the online privacy notice of the user website (a list of service names of external services used when accessing the user website) is displayed on the visitor terminal 16.

  By the way, the external services used when accessing the website are not always the same, and the external services used may increase or decrease or may be changed to other external services. Therefore, it is desirable to update the online privacy notice every predetermined period (for example, every few days). In other words, the online privacy notice generation unit 7 is configured to repeatedly execute identification of a service name or the like by the external request extraction unit 3 and the used service identification unit 5 and update the online privacy notice every predetermined period. Is more desirable.

  FIG. 4A is a control flow when online privacy notice is generated in the usage service management apparatus 1, and FIG. 4B is usage service management when displaying online privacy notice on the visitor terminal 16. It is a figure which shows the flow of operation | movement of the server 10, the user server 14, and the visitor terminal 16. FIG.

  As shown in FIG. 4A, the use service management apparatus 1 receives the URL of the user website as an analysis target URL in step S21. Thereafter, in step S22, the external request extraction unit 3 activates the Internet browser and accesses the URL to be analyzed (URL of the user website). In step S23, the external request extraction unit 3 sets the URL of the external request. Extract. In subsequent step S24, the external request occurrence count counting unit 31 counts the external request occurrence count and proceeds to step S25. In step S <b> 25, the used service specifying unit 5 refers to the external service database 4 and specifies a service name corresponding to the URL of the external request extracted by the external request extracting unit 3. Thereafter, in step S26, the used service number counting unit 51 counts the number of used external services, and the process proceeds to step S27.

  In step S27, the online privacy notice generation unit 7 displays the number of external requests generated in step S24 and the number of used external services counted in step S26, such as the service name specified in step S25. The included analysis result is stored in the online privacy notice storage unit 8 as an online privacy notice. Thereafter, in step S28, the display tag generation unit 71 generates a display tag for displaying the online privacy notice on the user website, and transmits the generated display tag to the user 15. As a result, the online privacy notice for the user website is prepared in the use service management server 10, and the display tag received by the user 15 is embedded in the HTML of the user website in the user server 14. By uploading, online privacy notice can be displayed.

  As shown in FIG. 4B, when accessing the user website from the visitor terminal 16, the user server 14 first receives an HTTP request from the visitor terminal 16 in step S31. In step S32, the user server 14 that has received the HTTP request transmits HTML data in which a display tag is embedded in response to the request. Thereafter, in step S33, the visitor terminal 16 receives and executes the HTML data. Then, in step S34, the visitor terminal 16 accesses the use service management server 10 by the display tag script, and requests the use service management server 10 for the online privacy notice. Thereafter, in step S <b> 35, the use service management server 10 that has received the request for online privacy notice transmits the online privacy notice to the visitor terminal 16. Thereafter, in step S36, the visitor terminal 16 that has received the online privacy notice displays the received online privacy notice on the user website according to the script of the display tag.

(Description of the configuration that prohibits access to specific external services)
Next, a configuration for prohibiting access to a specific external service will be described.

  Returning to FIG. 1, the service management device 1 uses content / content defined by the World Wide Web Consortium (W3C) that allows only access to a predetermined domain in order to prohibit access to a specific external service. A CSP tag generation unit 9 that generates a tag (hereinafter referred to as a CSP tag) of a security policy (Content-Security-Policy) is provided.

  The CSP is originally intended to detect and mitigate attacks such as cross-site scripting, but in this embodiment, the CSP is capable of restricting the domain of the content to be acquired, using a specific external function. The service is interrupted.

  The CSP tag generation unit 9 is mounted on a use service management server 10 different from the user server 14, and is realized by appropriately combining a CPU, a RAM and ROM that are semiconductor memories, an HDD, software, an interface, and the like.

  The CSP tag generation unit 9 includes a reception unit 9b that receives an external service that is desired to be blocked (hereinafter referred to as a desired external service) from the user 15 (such as the personal computer of the user 15). The CSP tag generation unit 9 is configured to generate a CSP that prohibits access to the domain of the external service desired to be blocked received by the reception unit 9b. The “CSP that prohibits access to the domain of the desired external service” means a CSP obtained by excluding the domain of the desired external service from the domain that permits access.

  In the present embodiment, the CSP tag generation unit 9 generates a CSP tag including a script code for adding a CSP that prohibits access to the domain of the external service desired to be blocked to the user website and uses the generated CSP tag as a user. 15 (user 15 personal computer or the like). The user 15 embeds the received CSP tag in the HTML head of the user website and uploads it to the user server 14.

  In the present embodiment, the CSP tag generation unit 9 stores the CSP content (including a specific description of the CSP such as a domain for which content acquisition is permitted) in the CSP content storage unit 9a. The content of the CSP is configured to be transmitted to the visitor terminal 16 in response to a request from the visitor terminal 16 by the CSP tag. As a result, even if the domain for which content acquisition is permitted is changed, it is possible to respond by simply updating the content of the CSP within the use service management server 10, and the user 15 can change the HTML of the user website. This saves the trouble of changing and uploading, and improves convenience.

  There is no particular limitation on the method of receiving an external service desired to be blocked from the user 15 (user 15's personal computer or the like). For example, a dedicated management screen for the user 15 is provided on the web page. Alternatively, an external service that permits access (or an external service that does not permit access) may be selected on the management screen. In this case, the receiving unit 9b of the CSP tag generating unit 9 blocks from the list of service names specified by the used service specifying unit 5 (or the online privacy notice stored in the online privacy notice storage unit 8). Or it is good to be comprised so that provision of the web page for management which can select the external service which is not interrupted is possible, and selection contents in the web page for management concerned can be received. The CSP tag generation unit 9 generates or updates the content of the CSP stored in the CSP content storage unit 9a according to the selection content on the management web page.

  When the content of the CSP is updated, the external service being used is also changed. Accordingly, when the CSP tag generator 9 changes the content of the CSP, the external request extraction unit 3 and the service use specification unit 5 repeatedly specify the service name and the like, and update the online privacy notice. Is more desirable.

  As shown in FIG. 5, when a user visits a user website, the visitor terminal 16 sends an HTTP request to the user server 14, and the user server 14 responds to the request by the CSP tag. HTML data in which is embedded is transmitted. At the visitor terminal 16, the received HTML data is read and executed, but the access to the service management server 10 occurs due to the embedded CSP tag, and the service service management server 10 receives the CSP. Request transmission of content. In response to a request from the visitor terminal 16, the CSP tag generation unit 9 of the use service management server 10 transmits the content of the CSP stored in the CSP content storage unit 9a to the visitor terminal 16. Thereby, CSP is applied in the visitor terminal 16, and access to the specific external service provision server 13 from the visitor terminal 16 is prohibited according to the content of CSP. As a result, the external service provided by the external service providing server 13 whose access is prohibited (blocking desired external service) is blocked.

  FIG. 6A is a control flow when a CSP tag is generated or updated in the CSP tag generator 9, and FIG. 6B is a service management server 10 used when applying CSP to the visitor terminal 16. It is a figure which shows the flow of operation | movement of the user server 14 and the visitor terminal 16. FIG.

  As shown in FIG. 6 (a), the CSP tag generator 9 first receives a block request external service from the user 15 by the receiving unit 9b in step S41, and in step S42, the CSP tag generator 9 It is determined whether the CSP tag has been transmitted. If already transmitted, the process proceeds to step S44. If not yet transmitted, a CSP tag is generated and transmitted to the user 15 in step S43. In step S44, the content of the CSP that prohibits access to the domain of the external service desired to be blocked received in step S41 is generated and stored (or updated) in the CSP content storage unit 9a. As a result, the content of the CSP for the user website is prepared in the use service management server 10, and the CSP tag received by the user 15 is embedded in the HTML of the user website and uploaded to the user server 14. As a result, the external service can be blocked by the CSP.

  As shown in FIG. 6B, when accessing the user website from the visitor terminal 16, the user server 14 first receives an HTTP request from the visitor terminal 16 in step S51. In step S52, the user server 14 that has received the HTTP request transmits HTML data in which the CSP tag is embedded in response to the request. Thereafter, in step S53, the visitor terminal 16 receives and executes the HTML data. Then, in step S54, access to the service management server 10 from the visitor terminal 16 is generated by the script of the CSP tag, and the content of the CSP is requested from the service management server 10. Thereafter, in step S55, the use service management server 10 that has received the request for the content of the CSP transmits the content of the CSP to the visitor terminal 16. Thereafter, in step S56, the CSP is applied at the visitor terminal 16 that has received the contents of the CSP, and the external service desired to be blocked is blocked by the access restriction of the CSP.

(Operation and effect of the embodiment)
As described above, the usage service management apparatus 1 includes the CSP tag generation unit 9 that generates a CSP tag that prohibits access to a domain of a predetermined external service. As a result, the website administrator (user 15) can limit the external services to be used in a lump, and a predetermined external operation can be performed by a simple operation such as embedding the generated CSP tag in HTML. It becomes possible to cut off the service.

  In the present embodiment, the case where the user 15 blocks an external service desired to be blocked has been described. However, the present invention is not limited to this, and the CSP tag generation unit 9 is a white list that lists domains of safe external services. And a CSP that allows access only to the whitelisted domains. In this case, the function of identifying the external service being used is not essential, but the analysis target URL receiving unit 2, the external request extracting unit 3, the external service database 4, and the specific configuration for realizing this function The service specifying unit 5, the online privacy notice generation unit 7, and the online privacy notice storage unit 8 can be omitted.

  In the usage service management apparatus 1, the CSP tag generation unit 9 is configured to store the generated CSP contents in the CSP content storage unit 9 a in the usage service management server 10. It includes a script code for accessing the management server 10 and adding the content of the CSP stored in the CSP content storage unit 9a to the user website. As a result, even if the external service to be blocked is changed, it is possible to cope with it only by updating the content of the CSP in the use service management server 10, and the user 15 changes the HTML of the user website and uploads it. This can save time and effort and improve convenience.

  Further, the service management apparatus 1 accesses the user website and extracts an external request extraction unit 3 that extracts a URL where access to other than the domain of the user website occurs, the domain and path of the external service, and the service An external service database 4 in which names are associated and stored; a service utilization specifying unit 5 that refers to the external service database 4 and specifies a service name corresponding to the domain and path of the URL extracted by the external request extraction unit 3; The receiving unit 9b is configured to be able to provide a management web page capable of selecting an external service to be blocked or not blocked from the list of service names specified by the use service specifying unit 5.

  As a result, the website administrator (user 15) can grasp the external services used when accessing his / her website, and can easily select an external service to be blocked. Can be improved. In addition, it is possible to easily check on the management website whether the external service desired to be blocked is actually blocked.

  Moreover, it is difficult to understand what the service content is simply by displaying the domain and path of the external request, and it is difficult for the user 15 to intuitively understand the external service used. By specifying the service name or the like as in the service management device 1, the user 15 can intuitively understand the external service being used.

  In the present embodiment, the contents of the CSP are stored in the use service management server 10, but the present invention is not limited to this, and the contents of the CSP may be included in the CSP tag. In this case, the user 15 can block unnecessary external services by the CSP by embedding and uploading the received CSP tag as a meta tag in HTML of the user website. However, in this case, every time the content of the CSP is changed, that is, every time an external service that permits access is changed, the user 15 needs to upload the content of the CSP again.

  As mentioned above, although embodiment of this invention was described, these embodiment is only an example and does not limit the invention which concerns on a claim. These novel embodiments can be implemented in various other forms, and various omissions, replacements, changes, and the like can be made without departing from the scope of the present invention. In addition, not all the combinations of features described in these embodiments are essential to the means for solving the problems of the invention. Furthermore, these embodiments are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 1 ... Utilization service management apparatus 2 ... Analysis object URL receiving part 3 ... External request extraction part 31 ... External request generation frequency counting part 4 ... External service database 5 ... Utilization service specific | specification part 51 ... Utilization service number counting part 7 ... Online privacy information Tis generation unit 71 ... display tag generation unit 8 ... online privacy notice storage unit 9 ... CSP tag generation unit 9a ... CSP content storage unit 9b ... reception unit 10 ... use service management server 11 ... user terminal 12 ... analysis target server 13 ... External service providing server 14 ... User server 15 ... User 16 ... Visitor terminal

Claims (1)

A service management device for managing an external service used when accessing a user website provided by a user server,
A CSP tag generator that generates a CSP tag that is a content security policy tag defined by the World Wide Web Consortium that allows only access to a predetermined domain;
The CSP tag generation unit is mounted on a usage service management server different from the user server, and has a reception unit for receiving an external service desired to be blocked from a user managing the user server, It is configured to generate a content security policy that prohibits access to a domain of an external service that is received by the receiving unit and that is desired to be blocked.
The CSP tag generation unit is configured to store the generated content security policy content in the CSP content storage unit in the service management server,
The CSP tag is embedded in the HTML head of the user website, and when the HTML of the user website is executed at the visitor terminal that has visited the user website, Including script code for accessing the use service management server and adding the contents of the content security policy stored in the CSP content storage unit to the user website;
Use service management device.

Images