JP6278934B2 - Server apparatus, server apparatus control method, and program - Google Patents

Description

  The present invention relates to a server apparatus, a server apparatus control method, and a program.

  Spam access is known as an unauthorized access to a server that is open to a network such as the Internet.

  A large amount of spam access may be made to a specific server such as a search server in order to search for specific information. Conventionally, when a large amount of spam access has arrived at a search server, if there is an amount of access that cannot be performed by a general user from one IP (Internet Protocol) address that is a sender, the access is spam access. The access block is performed. However, recently, there are cases where spam access is performed from a plurality of distributed computers.

  In Patent Document 1, as a typical example of cyber attack, DDoS (Distributed Denial Services) attack and spam using malware, which is an attack tool program used by an attacker for unauthorized access to a legitimate user's server or terminal. A method for protecting against transmission is disclosed. The DDoS attack is an attack in which a large number of computers distributed over a plurality of networks simultaneously send connection requests to a specific network or computer, overflowing communication capacity and stopping the function.

JP 2011-087189 A

  However, in the above conventional method, when there is a large amount of access from one IP address, the access is blocked as spam access, so there is not a large amount of spam access from each IP address from a plurality of IP addresses. If there was, there was a problem that this could not be blocked as spam access.

  In addition, by analyzing known software vulnerabilities and malware as in the method described in Patent Document 1, a transmission message pattern that an attacker can take to the server is signatureed, and the transmission message matches the signature. There is a problem that one access itself cannot be blocked as spam access for spam access that is not much different from that of a general user.

  Therefore, the present invention has been made in view of the above-described conventional problems, and an object thereof is to provide a server device, a server device control method, and a program capable of blocking access from a malicious user. To do.

  In order to solve the above-described problem, the server device according to the present invention described in claim 1 is configured to determine whether or not a predetermined parameter is added to a request for obtaining specific information transmitted from a terminal; And a blocking unit that blocks access from the terminal to the specific information when the determination unit determines that the predetermined parameter is not added to the request for obtaining the specific information. And

  In order to solve the above problem, the server device control method according to the present invention described in claim 10 determines whether or not a predetermined parameter is added to a request for obtaining specific information transmitted from a terminal. And when the determination step determines that the predetermined parameter is not added to the request for obtaining the specific information, blocking the access from the terminal to the specific information. It is characterized by including.

  Furthermore, in order to solve the above problem, a program according to the present invention as set forth in claim 11 is a program for causing a computer of a server device to execute, and a predetermined parameter for a request for obtaining specific information transmitted from a terminal. When it is determined that the predetermined parameter is not added to the request for obtaining the specific information by the process for determining whether or not the predetermined parameter is added, and the terminal to the specific information And a process of blocking access from the network.

  ADVANTAGE OF THE INVENTION According to this invention, the server apparatus which can interrupt | block the access from a malicious user, the control method of a server apparatus, and a program are obtained.

It is a figure explaining the structure of the whole system with which the server apparatus, user terminal, and other server apparatus in embodiment of this invention were connected via the network. It is a figure explaining the functional block of the server apparatus in embodiment of this invention. It is a sequence diagram explaining operation | movement when a user terminal accesses (a) a user terminal with respect to the server apparatus in embodiment of this invention, (b) It is a sequence diagram explaining operation | movement when a spam terminal accesses. It is a figure explaining the parameter produced | generated in the server apparatus in embodiment of this invention. It is a figure explaining the relationship between the change of the parameter when a user terminal accesses the server apparatus in embodiment of this invention, and the screen transition of a user terminal. The figure explaining the relationship between the change of the parameter and the screen transition of the spam terminal when the terminal (spam terminal) to which the malicious program is installed (a) is accessed for the server device in the embodiment of the present invention, (B) It is a figure explaining the relationship between the change of the parameter when the user terminal of a general user accesses, and the screen transition of a user terminal.

  Next, embodiments for carrying out the present invention will be described in detail with reference to the drawings. In addition, in each figure, the same code | symbol is attached | subjected to the part which is the same or it corresponds, The duplication description is simplified thru | or abbreviate | omitted suitably. Briefly explaining the contents of the present invention, it is determined whether or not a valid parameter is added to a request for obtaining specific information, for example, a search request for requesting specific information related to input information, If it is determined that a valid parameter is not added, access to the specific information is blocked. In addition, it is determined whether or not the parameter added to the request for obtaining specific information as an example of the search request matches the parameter generated and stored in advance, and the added parameter is generated and stored in advance. If it is determined that the parameter does not match, access to the specific information is blocked. Thereby, it is possible to block access from a malicious user.

<Configuration of this embodiment>
First, the configuration of the entire system in which a server device, a user terminal, and other server devices in an embodiment of the present invention are connected via a network will be described. FIG. 1 is a diagram illustrating a configuration of an entire system in which a server device, a user terminal, and another server device according to an embodiment of the present invention are connected via a network.

  In FIG. 1, the server apparatus according to the embodiment of the present invention is a Web server 100 as an example. The Web server 100 is connected to a plurality of user terminals 300 via a network network using the Internet 400 as an example. In addition, the user terminal 300 is pretending to appear, but in reality, a spam terminal 350 in which a program for performing spam access targeting the Web server 100 is installed is connected to the Web server 100 via the Internet 400. .

  In FIG. 1, the Web server 100 includes a CGI (Common Gateway Interface) 151 that starts or executes its own program in response to a request from the user terminal 300 having a Web browser function. Then, the Web server 100 accepts access based on the URL (Uniform Resource Locator) of the home page of the Web server 100 input from the user terminal 300, and information (characters or numbers) to be searched on the home page provided to the user terminal 300. , A keyword using symbols, etc. Sounds, images, etc. may be used.Hereinafter referred to as “search keywords”), a search input field 152 for inputting is displayed. The search keyword input in the search input field 152 is searched by the Web server 100 connected via the Internet 400 using the search API 500. The number of search results obtained as a search result, the URL of the search target Web server 200, and the like are transmitted from the Web server 100 to the user terminal 300 via the Internet 400.

  The server device in the present embodiment refers to the Web server 100 including the CGI 151. Here, the CGI 151 is a mechanism for the Web server 100 to start its own server-side program in response to a request from a terminal-side program such as a Web browser. Hereinafter, the Web server 100 including the CGI 151 is also referred to as a CGI server 100. In the following description, the CGI server 100 causes the search server including the search API 500 to search based on the search keyword transmitted from the user terminal, and generates a search result homepage using the searched search result. Is described as an example. The server device may be one in which the CGI server 100 and the search server are integrally formed, or the CGI server 100 and the search server are formed separately and connected via a network. May be.

  The CGI server 100 includes an input field (hereinafter also referred to as “search input field”) for inputting a search keyword and a home page (hereinafter also referred to as “search screen”) having regular parameters. It transmits to the terminal 300. The user terminal 300 has a function of transmitting a search keyword to the CGI server 100 by installing a Web browser, accessing a home page of each server, and used by a general user who searches for a search target Web server 200 that matches the search keyword. Computer. For example, a smart phone, a mobile phone, a tablet computer, a personal computer, a smart TV, or the like.

  When the CGI server 100 receives a search keyword to which a valid and regular parameter is added from the user terminal 300, the CGI server 100 performs a search by itself using the search keyword or transmits the search keyword to the search server (search API 500). To do. Then, the CGI server 100 generates a search result home page based on the search result executed by itself or the return of the search result executed by the search server (search API 500), and transmits the search result home page to the user terminal 300. Here, the regular parameters are newly generated at a predetermined timing, and at least two are set as valid parameters in the order of generation, and old parameters are invalidated. This point will be described later.

  A user terminal (hereinafter also referred to as a spam terminal) 350 that performs spam access includes a URL of the search target Web server 200 having a vulnerability, a telephone number, an e-mail address, and the like described on the home page of the search target Web server 200. A search keyword for searching and collecting information for specifying an individual / corporation such as the URL of the search target Web server 200 in which the information is described (hereinafter referred to as “specific information”). A type of user terminal in which a malicious program that is automatically transmitted to the CGI server is installed.

  Note that the spam terminal 350 is not limited to a user terminal directly used by a malicious user, but is a general user terminal installed without knowing a malicious program, a company server, or the like. There are many. For example, in addition to the above-described smartphones, mobile phones, tablet computers, personal computers, smart TVs, servers, and the like, computers connected to the Internet, such as routers and Web cameras, may be targeted. Therefore, the search target web server 200 is a web server searched by a general user who uses the user terminal 300 or a malicious program.

  Further, the search server (search API 500) is based on the search keyword transmitted by the user terminal 300, and the URL (Uniform Resource Locator) of the Web server having a home page in which information matching the search keyword is described, Information to be retrieved and extracted from a database (hereinafter also referred to as DB). The server includes an API (Application Programming Interface) that returns the extracted search result to the CGI server 100.

  Although FIG. 1 illustrates a case in which a search based on a search keyword is performed using a search API 500 provided outside the CGI server 100, the CGI server 100 itself incorporates the search API 500, and the CGI server 100 A search may be performed by itself, a search result homepage may be generated based on the search result, and transmitted to the user terminal 300 via the Internet 400.

  In FIG. 1, the CGI server 100 that executes the search is described as an example of the server device that the user terminal 300 accesses, but the server device is not limited to the CGI server 100 that executes the search. That is, the screen display state of the home page of the CGI server 100 provided to the user terminal 300 changes in time series from the screen at the time of requesting to receive specific information to the screen at the time of providing specific information. If it is good. In other words, the CGI server 100 may be any server as long as the homepage providing the product / service information has a function of changing the state. In addition, a program other than CGI may be used as long as the program starts or executes its own program in response to a request from the user terminal 300.

  Further, FIG. 1 illustrates an example in which the user terminal 300 and the CGI server 100 are connected via the Internet 400. However, the present invention is not limited to the Internet 400, and is not limited to the Internet 400. Any network such as Area Network) may be used.

  The CGI server 100 has a parameter setting file 153 that sets predetermined parameters in order to block access from the spam terminal 350 that performs spam access targeting the CGI server 100 while pretending to be the user terminal 300. . Parameters set by the parameter setting file 153 will be described later.

  FIG. 1 illustrates an example in which three user terminals 300, one spam terminal 350, one CGI server 100, and three search target Web servers 200 are provided. Of course, an arbitrary number of the 350, the CGI server 100, and the search target Web server 200 are provided.

  Next, functional blocks of the server device in the embodiment of the present invention will be described. FIG. 2 is a diagram illustrating functional blocks of the server device according to the embodiment of the present invention.

  The server device (CGI server 100) according to the present embodiment includes at least a control unit 101, a storage unit 102, a screen generation unit 103, a parameter generation unit 104, an interface unit 107, and a comparison determination unit 109, which communicate with each other. They are connected by a bus 110. In addition to these, the CGI server 100 may include a display unit 105, an input unit 106, and a search unit 108.

  The control unit 101 controls the overall operation of the CGI server 100 and is mainly realized by a central processing unit (CPU). The storage unit 102 stores various operation programs such as an OS (Operating System), a CGI program, and a Web server program of the CGI server 100 executed by the control unit 101, and an IP (Internet Protocol) for identifying the user terminal 300. ) Stores an address and stores parameters to be described later. For example, it is realized by a ROM (Read Only Memory), a RAM (Random Access Memory), an HDD (Hard Disk Drive) or the like.

  The screen generation unit 103 generates screen data to be displayed on the display unit of the user terminal 300 when access is received from the user terminal 300. This screen data is, for example, screen data of a home page described by HTML (Hyper Text Markup Language), a script program, and the like, and is displayed on the display unit 105 of the user terminal 300 by the Web browser of the user terminal 300. The parameter generation unit 104 generates parameters to be described later. The display unit 105 includes an LCD (Liquid Crystal Display) display or the like, and the input unit 106 is an operation unit of the CGI server 100. The display unit 105 also serves as a user interface when the input unit 106 has a touch panel configuration.

  Further, the interface unit 107 transmits / receives data to / from the user terminal 300 via the Internet 400 or the like. Based on the search keyword transmitted by the user terminal 300, the search unit 108 stores the URL of the Web server having a home page in which information matching the search keyword is described, and the information stored in the Web server in the storage unit 102 or an external storage Search and extract from the database stored in the device. The search unit 108 is installed when the CGI server 100 is a server having a search function. When the CGI server 100 does not have a search function, the search unit 108 is connected via the Internet 400 or the like using the interface unit 107. It is provided in an external search server. Then, the comparison determination unit 109 determines whether a parameter described later matches a parameter stored in the storage unit 102 in advance. When the comparison determination unit 109 determines that a parameter described later does not match a parameter stored in advance in the storage unit 102, the control unit 101 accesses from the outside such as the user terminal 300 via the interface unit 107. Cut off.

<Operation procedure of this embodiment>
Next, operations when the user terminal accesses the server device according to the embodiment of the present invention and operations when the spam terminal accesses the server device will be described. FIG. 3 is a sequence diagram for explaining the operation when the user terminal accesses the server device according to the embodiment of the present invention, and (b) a sequence diagram for explaining the operation when the spam terminal accesses. is there. In FIG. 3, a case where the CGI server 100 executes a search using the search API 500 provided outside will be described.

  The user terminal 300 connects to the CGI server 100 via the Internet 400 and requests transmission of a search input homepage. When the CGI server 100 receives the search input homepage transmission request, the CGI server 100 reads the most recently generated regular parameter from the storage unit 102 that is currently valid. Then, the regular parameter is described in the data of the search input homepage, and is transmitted to the user terminal 300 that has requested transmission (step S311). Here, the search input home page has a search input field, and when the search request including the search keyword input in the search input field is transmitted to the CGI server 100, the search input home page data is searched. An instruction to transmit the request including the regular parameters is described (step S312).

  Here, regular parameters will be described. The following can be considered as regular parameters. For example, at least one type of alphabetic characters, numbers, symbols, images, etc. is adopted, and the number of characters is a predetermined number (in the case of images, the number of images may be the same as the image size; the same shall apply hereinafter). Is a parameter. Note that the prescribed number of characters may be fixed or variable. Further, although the regular parameter is described in the data of the search input homepage, it is preferably described as information that is not displayed on the display unit of the user terminal 300.

  In addition, a new parameter is generated at every predetermined timing, and the CGI server 100 stores the new parameter in the storage unit 102 (parameter setting file 153) as a valid parameter in the newly generated order including the new parameter. To do. Other parameters are invalid parameters or deleted from the parameter setting file 153. This point will be described later.

  Here, as the predetermined timing, the timing described below can be considered. For example, a new parameter may be generated every two hours or every predetermined time such as 2 am and 3 pm. Alternatively, when it is determined that there is an access from the spam terminal 350, such as when a search request with no parameter added or an invalid parameter added is received more than a predetermined frequency (number per unit time) A parameter may be generated.

  In addition to this, when a search request to which an invalid parameter is added is received more than a predetermined frequency (number per unit time), the transition of the search keyword included in the search request is used to acquire the specific information. A new parameter may be generated when the search keyword condition is met, that is, when it is determined that the access is from a predetermined spam terminal 350.

  Also, when a request for a homepage with a search input field added is made from the user terminal 300, a new parameter uniquely corresponding to the request for the homepage may be generated. In this case, at least two parameters are not stored as effective parameters in the storage unit 102 (parameter setting file 153), but newly generated parameters are stored as effective parameters in the storage unit 102 (parameter setting file 153). When performing an operation of verifying whether or not a parameter is valid, if it is determined that the parameter matches the valid parameter, the parameter is invalidated.

  Furthermore, you may make it produce | generate a parameter separately for every terminal of the user terminal 300. FIG. For example, a cookie is sent to the accessed web browser. When the accessed user terminal 300 is a PC or the like, an IP (Internet Protocol) address, a MAC (Media Access Control) address, or the like of the terminal is acquired. When the accessed user terminal 300 is a smartphone or the like, a telephone number, an identifier unique to a SIM (Subscriber Identity Module) card such as an IMSI (International Mobile Subscriber Identity) or MSISDN (Mobile Station International Subscriber Directory Number), an IMEI ( Get an identifier unique to a communication device such as International Mobile Equipment Identity. The user terminal 300 is identified using these identifiers.

  The user terminal 300 acquires search input homepage data provided from the CGI server 100, and displays the search input homepage on the display unit based on the acquired data using a Web browser. When a search keyword is input from the input unit to the search input field and a send button is specified (click, tap, etc.), the parameters described in the data of the search input home page are executed by the Web browser according to the above-described command. Is added to the search request for the search keyword and transmitted to the CGI server 100 (step S312).

  When receiving a search request from the user terminal 300, the CGI server 100 determines whether a parameter is added to the search request. If it is determined that a parameter is added, a verification operation for the parameter is executed. If no parameter is added, it is determined that the access is from the spam terminal 350, and an access block operation is performed.

<Parameter verification operation>
The CGI server 100 determines whether or not the parameter added to the search request matches the parameter in the valid state stored in the storage unit 102 (parameter setting file 153) (step S313). If it matches the parameter in the valid state, the verification result is OK (step S314), and the search is executed by itself using the search keyword included in the search request or included in the search query to the search server (search API 500). Transmit (step S315). On the other hand, if the parameter does not match the valid parameter (step S318, step S319), the verification result is NG (step S320), it is determined that the access is from the spam terminal 350, and the access block operation is performed (step S320). S321).

  When the search server (search API 500) receives the search query (inquiry) from the CGI server 100 (step S315), the search server (search API 500) selects a homepage on which information matching the search keyword is described based on the search keyword included in the received search query. The URL of the Web server and the information held by the Web server are searched and extracted from the Web server DB, and the search result including the extracted information is returned to the CGI server 100 (step S316). Further, an advertisement that matches the search keyword may be searched and extracted from the advertisement DB, and the extracted advertisement may be included in the search result.

  When the CGI server 100 receives a search result that has been searched by itself or a search result from the search server (search API 500), the CGI server 100 generates a search result homepage based on information included in the search result, and the generated search result homepage. Is transmitted to the user terminal 300 to which the search request has been sent (step S317).

  For example, the search result homepage is a homepage that lists Web servers having homepages in which information that matches the search keyword is described, and information, URL links, advertisements, and the like that are added at that time are also added. When the CGI server 100 also adds a search input field and a send button to the search result home page, the CGI server 100 uses the normal parameter that has been generated most recently from the storage unit 102 (parameter setting file 153). , And associates the regular parameter with a command to add the regular parameter to the search request for transmission.

  When receiving the search result home page data from the CGI server 100, the user terminal 300 displays the search result home page on the display unit based on the data.

  With reference to FIGS. 3A and 3B, these procedures will be described separately for (a) an operation when a user terminal accesses and (b) an operation when a spam terminal accesses. In FIG. 3A, when access based on the URL of the CGI server 100 is received from the user terminal 300 in which the Web browser is installed, the CGI server 100 searches the search screen to which the regular parameters are attached in the process of step S311. Is transmitted to the user terminal 300. In the process of step S312, the user terminal 300 transmits a search request with a regular parameter to the CGI server 100 using a Web browser.

  In the process of step S313, the CGI server 100 stores, in the parameter setting file 153, the parameters attached to the search request with regular parameters transmitted from the user terminal 300 in the process of step S312 in the parameter setting file 153. The parameter setting verification for verifying whether or not the parameter matches is performed. Here, since the user terminal 300 is a terminal used by a general user who is not the spam terminal 350, the parameter setting file 153 stores the same parameters as the regular parameters attached to the search request as valid parameters. Therefore, the verification result OK is returned to the CGI server 100 in the process of step S314.

  In accordance with the search request transmitted from the user terminal 300 in the process of step S312, the CGI server 100 transmits a search query (inquiry) to the external search API 500 in the process of step S315. The search API 500 executes a search, and transmits a search result response to the CGI server 100 in the process of step S316. In the process of step S317, the CGI server 100 transmits a search result response to the user terminal 300 and ends the process. Then, a search result screen is displayed on the display unit of the user terminal 300. The above is the operation when the authorized user terminal 300 makes a search request with the authorized parameters to the CGI server 100.

  In FIG. 3B, the spam terminal 350 generates a search request that mechanically adds the search keyword to the CGI server 100 without inputting the search keyword in the search input field of the search screen by the Web browser. A malicious program that provides spam access is installed. Therefore, in the process of step S318, the spam terminal 350 sends to the CGI server 100 a search request with an invalid parameter that is not a regular parameter described in FIG. 3A or a search request without a parameter in the first place. Send to.

  In the process of step S319, the CGI server 100 sets the parameter setting file 153 to the parameter setting file 153, the parameter added to the parameter setting file 153 with the invalid parameter added or the no parameter search request transmitted from the spam terminal 350 in the process of step S318. The parameter setting verification for verifying whether or not it matches the parameter stored in is performed. Here, since the search request transmitted from the spam terminal 350 has an invalid parameter or no parameter, the parameter setting file 153 determines that the verification result NG is CGI server 100 in the process of step S320. Returned for.

  Since the CGI server 100 has received the verification result NG from the parameter setting file 153 in the process of step S320, the CGI server 100 determines that the search request received in the process of step S318 is transmitted from the spam terminal 350, and step S321. In this process, the access block is transmitted to the spam terminal 350 and the process is terminated. And the spam terminal 350 receives the data of the re-search screen, and the malicious program cannot obtain the data of the search result screen that was assumed. The above is the operation when the spam terminal 350 makes a search request with or without an invalid parameter to the CGI server 100.

  Next, parameters generated in the server device according to the embodiment of the present invention will be described. FIG. 4 is a diagram illustrating parameters generated in the server device according to the embodiment of the present invention.

  In FIG. 4, it is assumed that a new parameter is generated every hour, the effective period of one parameter is 2 hours, and the two parameters are in an effective state. First, after the first parameter is generated, the second parameter is generated when the first one hour of the effective period (A) of the first parameter has elapsed.

  Furthermore, at the time when the first 1 hour of the effective period (B) of the second parameter has passed, that is, when the 2 hours of the effective period (A) of the first parameter has passed, the first parameter is A third parameter is generated along with the invalid state. Therefore, in the effective period (A) of the first parameter, after the first parameter is generated, the first parameter and the second parameter are between 1 hour and 2 hours. Both are enabled.

  However, for convenience of explanation, the first parameter valid period (A) after the start of the service is generated until the first parameter is generated until one hour elapses after the first parameter is generated. Only one parameter is active. However, if the service has not started before the validity period (A) of the first parameter, there is no search request with addition of the first parameter, so only one parameter is valid during this period. It does not matter. Of course, if the service is started before the effective period (A) of the first parameter, another parameter is in an effective state, and two parameters are in an effective state during this period. When the first one hour elapses in the valid period (A) of the parameter, the other parameter becomes invalid.

  Further, at the time when the first 1 hour of the effective period (C) of the third parameter has passed, that is, when 2 hours of the effective period (B) of the second parameter has passed, the second parameter is A fourth parameter is generated along with the invalid state. Therefore, in the effective period (B) of the second parameter, after the second parameter is generated, the second parameter and the third parameter are between 1 hour and 2 hours. Both of them become valid. Similarly, after the third parameter is generated, both the third parameter and the fourth parameter are in a valid state between 1 hour and 2 hours.

  FIG. 4 illustrates an example in which a new parameter is generated every hour, and a new parameter is valid for 2 hours. However, the timing when the parameter is generated and the valid period of the parameter are It can be set arbitrarily. For example, after a predetermined period, at least two parameters among the generated parameters may be in a valid state. Furthermore, FIG. 4 illustrates an example in which two parameters are valid in one hour, but there are a plurality of parameters that are valid in one hour without being limited to two. Also good.

  Next, a description will be given of a relationship between a change in parameters and a screen transition of the user terminal when the user terminal accesses the server device according to the embodiment of the present invention. FIG. 5 is a diagram illustrating a relationship between a change in parameters and a screen transition of the user terminal when the user terminal accesses the server device according to the embodiment of the present invention.

  As shown in FIG. 5A, even when a new parameter is generated in the CGI server 100 during the display of the operation screen (search screen) of the user terminal 300, as described in FIG. Since there is a period in which both newly generated parameters and existing parameters (parameters generated at the previous timing) are in a valid state, they are generated at the previous timing on the search screen of the user terminal 300. The parameters are also valid. Therefore, even if a search request with the previous parameter added is transmitted to the CGI server 100, it is recognized as a valid terminal search request, and a search result as shown in FIG. 5B can be obtained. .

  In addition, as illustrated in FIG. 5B, when a search request for the CGI server 100 is transmitted from the user terminal 300 at a timing immediately after a new parameter is generated, the search that the CGI server 100 transmits to the user terminal 300 The newly created parameter is described in the result screen, and the parameter is in the latest valid state. Therefore, by transmitting a search request with a new parameter added to the CGI server 100, it is determined that the terminal is a valid terminal based on the newly generated parameter, and a search result as shown in FIG. 5C is obtained. be able to.

<Access block operation>
Next, the relationship between the change in parameters and the screen transition of the spam terminal when a terminal (spam terminal) on which a malicious program is installed accesses the server device in the embodiment of the present invention, and general users The relationship between the change of the parameter when the user terminal accesses and the screen transition of the user terminal will be described. FIG. 6 shows the relationship between a change in parameters and a screen transition of a spam terminal when a terminal (spam terminal) on which a malicious program is installed accesses the server apparatus according to the embodiment of the present invention. FIG. 3B is a diagram for explaining a relationship between a change in parameters and a screen transition of the user terminal when a user terminal of a general user accesses.

  As shown in FIG. 6A, the user terminal (spam terminal) 350 in which a malicious program is installed sends a search request with an invalid parameter or no parameter to the CGI server 100. Send. Then, as described with reference to FIG. 3B, the parameter setting file 153 is verified as a result of the parameter setting verification, and the verification result is determined to be NG. In other words, since it is not a search request to which valid parameters are added in a valid state, the search result screen in which information that is expected to be searched as a search result in a malicious program is described as being blocked by sending a re-search screen or the like. Without giving it, stop the malicious program from working.

  In addition, as shown in FIG. 6B, even if the search request is from the user terminal 300 to which the regular parameter is added, other things are performed for a long time while the search screen is displayed. In such a case, the valid period of the regular parameter added as described with reference to FIG. 4 ends and the search request may be invalidated. Then, since the search request to which the invalid parameter is added is transmitted from the user terminal 300, the verification result is determined to be NG, and the CGI server 100 transmits a re-search screen to the user terminal 300. To do. The CGI server 100 transmits a re-search screen to the user terminal 300 to determine that the verification result is NG. However, a legitimate user who is not the spam terminal 350 can perform a search again using the Web browser.

  The re-search screen is a message that the CGI server 100 transmits to the user terminal 300 to which a search request has been sent, and displays a message to request that the search keyword be re-transmitted, a search input field, a send button, and a storage unit Re-search that associates the most recently generated regular parameter among the parameters in the valid state read from 102 (parameter setting file 153) and the command to send the regular parameter by adding the regular parameter to the search request This is homepage data. As an example of a text that displays a request to resend the search keyword, a text such as “Enter the search keyword again and click the send button” can be considered. This re-search screen may be the top screen of the home page of the CGI server 100 or the like.

  However, when the access block operation is performed when there is no parameter in the search request, the data of the re-search homepage is not transmitted to the user terminal 300 but is read from the storage unit 102 (parameter setting file 153). Data of a home page having a word indicating that the retrieved search has not been performed may be transmitted to the user terminal 300.

  Here, when the access block operation is performed when the parameter added to the search request does not match the parameter in the valid state, the search keyword transmitted in advance is left in the search input field. It is desirable to keep it in a state. If there is no parameter, there is a high possibility that it is a search request from the spam terminal 350. However, depending on the use conditions of the user terminal 300, the parameter may not match, so inconvenience to a legitimate user is minimized. It is to do.

  When the user terminal 300 receives the data of the re-search homepage from the CGI server 100, the user terminal 300 displays the search result homepage on the display unit based on the data. Here, when the user terminal 300 is a spam terminal 350, a search request including a search keyword is created by an arbitrary program and automatically transmitted without using a Web browser. Is a re-search homepage. Therefore, since the specific information such as the URL of the expected search target Web server that matches the search keyword cannot be obtained, the program does not operate normally.

  On the other hand, the user terminal 300 may be a user terminal 300 used by a general user. For example, this corresponds to the case where the time passed with the home page having the search input field displayed on the display unit of the user terminal 300 and the valid period of the regular parameter has expired. In this case, since the re-search homepage in which the parameters that are valid at that time are described is displayed as a web browser on the display unit of the user terminal 300, if the search keyword is transmitted again, the regular parameters that are valid are displayed. Since the added search request is transmitted to the CGI server (search server) 100, a search result homepage can be obtained.

  That is, when a new search request is transmitted from the user terminal 300 to the CGI server 100 using the re-search screen, the newly generated regular parameter in the valid state is added to the search request. It will be. In other words, the CGI server 100 displays the top screen of the home page of the CGI server 100 on the user terminal 300, thereby allowing access from the user terminal 300 to which the newly generated regular parameter in the valid state is added. Receive it again. Then, as described with reference to FIG. 3A, as a result of the parameter setting verification performed in the parameter setting file 153, the verification result is determined to be OK. That is, since it is a search request to which a valid parameter in the valid state is added, a response as a search result can be received.

  Since the spam terminal 350 is installed with a program that mechanically and repeatedly performs spam access to the CGI server 100, if the spam terminal 350 repeatedly performs spam access, by accidentally determining the regular parameter, There is a possibility that a search request to which the found regular parameter is added is transmitted to the CGI server 100.

  However, since it takes a lot of labor and time to find the regular parameter, even if the regular parameter is found, there is a high possibility that the valid period of the regular parameter is about to end. Therefore, the identified regular parameter becomes invalid and cannot correspond to the newly generated parameter in the valid state, so that the spam terminal 350 receives an access block from the CGI server 100. .

  As described above, in the present embodiment, by sequentially changing the parameters, it is possible to increase the deterrence of the malicious spam terminal 350 against spam access and protect access from the legitimate user terminal 300.

  The operation of each functional block constituting the server device in the embodiment of the present invention shown in FIG. 3 can be executed by a program on a computer. That is, a central processing unit (CPU) (not shown) that constitutes the control unit 101 that controls the overall operation of the server device loads a program stored in the storage unit 102 and sequentially executes each processing step of the program. Is done by.

  As described above, according to the present invention, it is possible to block access from a malicious user.

  The present invention has been described above by the preferred embodiments of the present invention. While the invention has been described with reference to specific embodiments thereof, various modifications and changes can be made to these embodiments without departing from the broader spirit and scope of the invention as defined in the claims. is there.

100 Web server (CGI server)
DESCRIPTION OF SYMBOLS 101 Control part 102 Storage part 103 Screen generation part 104 Parameter generation part 105 Display part 106 Input part 107 Interface part 108 Search part 109 Comparison determination part 110 Communication bus 151 CGI
152 Search input field 153 Parameter setting file 200 Search target server 300 User terminal 350 User terminal (spam terminal)
400 Internet

Claims (12)

A parameter generating means for generating a new parameter having a valid state different from the existing parameter and disabling the existing parameter in the valid state;
Determining means for determining whether or not a parameter in a valid state is added to a request for obtaining specific information transmitted from a terminal;
And a blocking unit that blocks access from the terminal to the specific information when the determination unit determines that the parameter in the valid state is not added to the request for obtaining the specific information. See
The server device characterized in that the parameter generation means controls generation of a new parameter in a valid state and invalidation of an existing parameter so that at least two parameters are in a valid state . A parameter generating means for generating a new parameter having a valid state different from the existing parameter and disabling the existing parameter in the valid state;
Determining means for determining whether or not a parameter in a valid state is added to a request for obtaining specific information transmitted from a terminal;
And a blocking unit that blocks access from the terminal to the specific information when the determination unit determines that the parameter in the valid state is not added to the request for obtaining the specific information. See
The parameter generation means generates a new parameter different from the existing parameter when a request for obtaining the specific information to which the parameter in the valid state is not added is received at a predetermined frequency or more, and the existing parameter in the valid state A server device characterized in that the server device is set in an invalid state . A parameter generating means for generating a new parameter having a valid state different from the existing parameter and disabling the existing parameter in the valid state;
Screen data having an input field for inputting a keyword, a parameter generated most recently among parameters in a valid state, and a command for transmitting the parameter in addition to a request for obtaining specific information matching the keyword Information providing means for generating and providing to the terminal;
Determination means for determining whether parameters in the valid state in the request to obtain the specific information transmitted from the terminal is added,
And a blocking unit that blocks access from the terminal to the specific information when the determination unit determines that the parameter in the valid state is not added to the request for obtaining the specific information. See
The parameter generation means generates a new parameter different from the existing parameter when the transition of the keyword included in the request for obtaining the specific information matches a predetermined condition, and invalidates the existing parameter in the valid state. A server device characterized by that. A parameter generating means for generating a new parameter having a valid state different from the existing parameter and disabling the existing parameter in the valid state;
Screen data having an input field for inputting a keyword, a parameter generated most recently among parameters in a valid state, and a command for transmitting the parameter in addition to a request for obtaining specific information matching the keyword Information providing means for generating and providing to the terminal;
Determination means for determining whether parameters in the valid state in the request to obtain the specific information transmitted from the terminal is added,
And a blocking unit that blocks access from the terminal to the specific information when the determination unit determines that the parameter in the valid state is not added to the request for obtaining the specific information. See
The parameter generation unit generates a new parameter different from the existing parameter when there is a request for screen data for requesting to obtain the specific information, and the determination unit obtains the specific information. When it is determined that the parameter in the valid state is added to the existing parameter, the existing parameter in the valid state is invalidated . A parameter generating means for generating a new parameter having a valid state different from the existing parameter and disabling the existing parameter in the valid state;
Determining means for determining whether or not a parameter in a valid state is added to a request for obtaining specific information transmitted from a terminal;
And a blocking unit that blocks access from the terminal to the specific information when the determination unit determines that the parameter in the valid state is not added to the request for obtaining the specific information. See
The blocking means, when blocking access from the terminal to the specific information, a statement that requests the terminal to retransmit a request to obtain the specific information, and among parameters in the valid state A server for generating retransmission screen data in which a parameter generated most recently and a command for transmitting the parameter added to the request for obtaining the specific information are associated with each other, and provided to the terminal apparatus. Has an input field for inputting a keyword, and parameters generated most recently among the valid state near Rupa parameter, instructions for the parameters transmitted in addition to the request to obtain the specific information that matches the keyword, the It generates screen data, further seen including information providing means for providing to said terminal,
The information providing means is in the valid state when the judgment means determines that a parameter in a valid state is added to the request for obtaining the specific information. Generating specific information screen data having a parameter generated most recently among the parameters, and a command to add the parameter to the request for obtaining the specific information, and providing the generated data to the terminal,
The blocking means, either with the input field for inputting a keyword in advance enter keywords previously sent, to generate a re-transmission screen data, according to claim 1 to 5, characterized in that it provides to the terminal The server device according to claim 1 . A control step of generating a new parameter in a valid state different from the existing parameter and disabling the existing parameter in the valid state;
A determination step of determining whether or not a parameter in a valid state is added to a request for obtaining specific information transmitted from the terminal;
The higher the-size Teiko, when the parameter is in said enabled state to a request to obtain the specific information is determined not to be added, the blocking step for blocking access from said terminal to said specific information, only including,
In the control step, a server device control method is characterized in that generation of a new parameter in a valid state and invalidation of an existing parameter are controlled so that at least two parameters are in a valid state . Determining whether a parameter in a valid state is added to the request for obtaining specific information transmitted from the terminal; and
If the determining step determines that the parameter in the valid state is not added to the request for obtaining the specific information, blocking the access from the terminal to the specific information ;
Generating a new parameter with an effective state different from an existing parameter when a request for obtaining the specific information to which no effective parameter is added is received at a predetermined frequency or more;
A method of controlling a server device, comprising: a step of invalidating an existing parameter in a valid state . Screen data having an input field for inputting a keyword, a parameter generated most recently among parameters in a valid state, and a command for transmitting the parameter in addition to a request for obtaining specific information matching the keyword Generating and providing to the terminal;
A step of determining whether parameters in the valid state in the request to obtain the specific information transmitted from the terminal is added,
If the determining step determines that the parameter in the valid state is not added to the request for obtaining the specific information, blocking the access from the terminal to the specific information ;
When a transition of a keyword included in the request for obtaining the specific information matches a predetermined condition, generating a new parameter having an effective state different from the existing parameter;
A method of controlling a server device, comprising: a step of invalidating an existing parameter in a valid state . Screen data having an input field for inputting a keyword, a parameter generated most recently among parameters in a valid state, and a command for transmitting the parameter in addition to a request for obtaining specific information matching the keyword Generating and providing to the terminal;
When there is a request for screen data for requesting to obtain the specific information, generating a new parameter in a valid state different from the existing parameter;
A step of determining whether parameters in the valid state in the request to obtain the specific information transmitted from the terminal is added,
The step of determining, if it is determined that a parameter in a valid state is added to the request to obtain the specific information, a step of invalidating an existing parameter in a valid state;
And a step of blocking access from the terminal to the specific information when it is determined by the determining step that the parameter in the valid state is not added to the request for obtaining the specific information. And a control method for the server device. Generating a new parameter in a valid state different from the existing parameter;
Disabling existing parameters in the enabled state; and
Determining whether a parameter in a valid state is added to the request for obtaining specific information transmitted from the terminal; and
And a step of blocking access from the terminal to the specific information when it is determined by the determining step that the parameter in the valid state is not added to the request for obtaining the specific information. See
In the blocking step, when blocking access from the terminal to the specific information, a description of requesting the terminal to retransmit the request for obtaining the specific information, and a parameter in the valid state Retransmission screen data in which the most recently generated parameter is associated with a command for adding the parameter to the request for obtaining the specific information and transmitted is generated and provided to the terminal. A method for controlling a server device. The program for making a computer perform each process of the control method of the server apparatus of any one of Claim 7 to 11 .

Images