JP6699377B2 - Communication data relay device and program - Google Patents

Description

  The present invention relates to a communication data relay device and a program.

  TLS (Transport Layer Security) is a transport layer protocol capable of encrypting and transmitting and receiving data on the Internet. In communications such as HTTP (Hyper Text Transfer Protocol) and FTP (File Transfer Protocol) between the client terminal and the web server, highly confidential data such as personal information and credit card information can be encrypted and safely exchanged by TLS. .

  However, TLS communication, which is supposed to be used for safe information communication, may be used as a loophole for information leakage. Therefore, a technique for analyzing/monitoring TLS communication and performing content filtering has been proposed. The TLS communication data from the client terminal is received and decrypted by the proxy server, and if there is no problem, the data is encrypted again and transmitted to the original web server. Independently encrypted communication paths are established between the client terminal and the proxy server, and between the proxy server and the web server.

  There is also known a technique of acquiring the host name of the web server from the CONNECT method sent from the client terminal to the proxy server and performing content filtering at the host name level. This method has an advantage that decoding processing is unnecessary.

  Patent Document 1 describes that the relay device confirms the connection destination (verification of the server certificate) with the object of reducing the workload for confirming the security of the connection destination from the client terminal.

  Patent Document 2 discloses that direct authentication between a client terminal and a server is possible when the client terminal and the server perform encrypted communication using different sessions via a relay device. As a problem, the relay device verifies the temporary digital certificate of the server, issues an electronic certificate including the session data and the temporary digital certificate, and sends the digital certificate to the client terminal. It is described that the certificate is verified and the electronic certificate of the server is verified.

  Patent Document 3 aims to provide an information processing device capable of grasping access to an external device by an encrypted protocol, and detects a CONNECT notification to determine whether or not communication is prohibited from setting information. Have been described.

JP2012-137975A JP, 2003-124926, A JP, 2014-206929, A

  In the technology of receiving the TLS communication data from the client terminal by the proxy server and decrypting it, and if there is no problem, the data is re-encrypted and transmitted to the web server, the privacy information such as credit card number and password or confidential information is also decrypted. There is a problem that ends up. On the other hand, in the technique of acquiring the host name of the web server and filtering the content at the host name level, there is a problem that the filtering accuracy is poor because the information used for filtering is only the host name.

  An object of the present invention is to provide a device and a program that exclude decryption when privacy information (confidential information) is included.

  According to a first aspect of the present invention, a receiving unit that receives encrypted communication data, a decrypting unit that decrypts the encrypted communication data received by the receiving unit, and confidential information in the communication data decrypted by the decrypting unit. The communication data relay apparatus includes a control unit that controls so that the communication data received by the receiving unit after that is not decoded when the information requesting the request is included.

  In the invention described in claim 2, when the control means receives again the encrypted communication data from the sender or the destination of the communication data including the information requesting confidential information in the communication data, the encrypted communication is performed. The communication data relay device according to claim 1, wherein the communication data relay device is controlled so as not to decrypt the data.

  The invention according to claim 3 is the communication data relay device according to any one of claims 1 and 2, which includes expiration date information as destination information to be excluded from decryption.

  In the invention according to claim 4, the control means detects that the information requesting the confidential information is included by using at least one of the input type, the input format, and the content of the display text included in the communication data. The communication data relay device according to any one of claims 1 to 3.

  According to a fifth aspect of the invention, the proxy server receives the encrypted communication data, the decrypted received encrypted communication data, and the confidential information requesting the decrypted communication data. Is included in the program, the program executes the step of controlling not to decode the communication data received thereafter.

  According to the invention described in claims 1 and 5, when the encrypted communication data includes information requesting confidential information (privacy information), the decryption can be excluded to protect the confidential information.

  According to the second aspect of the present invention, further, filtering at the host name level can be executed even when decryption is excluded.

  According to the invention of claim 3, the information can be further updated.

  According to the invention of claim 4, further, it is possible to reliably detect information requesting confidential information.

It is a system configuration diagram of an embodiment. It is a processing flowchart of an embodiment. It is a detailed flowchart of the data analysis of embodiment. It is explanatory drawing of the information memorize|stored in the memory|storage means (database) of embodiment. It is explanatory drawing which shows an example of the communication data of embodiment. It is a processing flowchart of other embodiment.

  Embodiments of the present invention will be described below with reference to the drawings.

  First, the basic principle of this embodiment will be described.

  Receiving encrypted communication data such as TLS communication, decrypting it, and executing content filtering may cause a problem when privacy information (confidential information) is included.

  Therefore, in the present embodiment, when encrypted communication data is received, it is not uniformly decrypted and content filtering is executed, but when communication requiring privacy information is performed, and thereafter The communication data is controlled not to be decrypted.

  In the present embodiment, when the decrypted communication data includes information requesting privacy information, the sender or the destination of the communication data is automatically registered in the storage means in sequence, so that the user is not subject to decryption exclusion. There is no need to manually create a whitelist for Further, once registered as a decryption exclusion target in the storage means, the communication data thereafter is not decrypted and the security is secured.

  The information stored in the storage means is the sender or destination of the communication data, but the expiration date of the information may be set together with the information, and the information stored in the storage means is automatically updated using the expiration date. You may.

  Next, the present embodiment will be specifically described by taking as an example a proxy server device that relays communication data via a client terminal and a server device.

  FIG. 1 is a system configuration diagram of the present embodiment. The system includes a client terminal 10, a proxy server device 12 as a relay device, and a web server device 14. The client terminal 10 and the proxy server device 12 are connected by a communication line, and the proxy server device 12 and the web server device 14 are also connected by a communication line. The communication line is, for example, the Internet.

  The proxy server device 12 includes a transmission/reception unit 120, a decryption exclusion determination unit 121, a transmission/reception unit 122, a content filtering unit 123, a decryption/encryption unit 124, a decryption exclusion information storage unit 125, and a data analysis unit 126.

  The transmitting/receiving means 120 is an interface for transmitting/receiving communication data to/from the client terminal 10. The transmission/reception unit 122 is an interface that transmits/receives communication data to/from the web server device 14.

  The decryption exclusion information storage unit 125 is a database that stores the decryption exclusion information.

  The data analysis unit 126 determines whether or not the communication data includes information requesting privacy information, and when the communication data includes information requesting privacy information, the subsequent communication data is excluded from decoding information. Is registered in the decryption exclusion information storage means 125. Specifically, the sender or the host name of the communication data including the information requesting the privacy information is registered as the exclusion target host name.

  The decryption exclusion determination unit 121 determines whether the communication data received from the client terminal 10 is a decryption exclusion target based on the decryption exclusion information stored in the decryption exclusion information storage unit 125, and decrypts the determination result. /Supply to the encryption means 124.

  The decryption/encryption unit 124 decrypts the communication data and supplies the decrypted communication data to the content filtering unit 123 when the communication data received from the client terminal 10 is not a decryption exclusion target according to the determination result of the decryption exclusion determination unit 121. After executing the content filtering, the decrypted communication data is encrypted again and supplied to the transmitting/receiving means 122. The decryption/encryption unit 124 supplies the communication data to the transmission/reception unit 122 without decrypting the communication data when the communication data received from the client terminal 10 is an object of the decryption exclusion according to the determination result of the decryption exclusion determination unit 121. To do.

  The content filtering unit 123 processes the decrypted communication data, determines whether it is safe (Safety) or not (NG), and supplies the result to the decryption/encryption unit 124. If it is safe, the decryption/encryption means 124 re-encrypts the communication data and supplies it to the transmission/reception means 122 as described above, and if it is not safe, cuts off the communication data or executes a process corresponding thereto. To do.

  The proxy server device 12 has a configuration as a server device, that is, a database including a storage device such as a CPU, a ROM, a RAM, an input/output interface, a communication interface, and an HDD (hard disk drive). The decryption exclusion determination means 121, the content filtering means 123, the decryption/encryption means 124, and the data analysis means 126 function as control means, and one or a plurality of CPUs reads out the processing program stored in the ROM and the RAM. Is realized as a working memory by executing the processing program. Note that at least one of the decryption exclusion determination unit 121, the content filtering unit 123, the decryption/encryption unit 124, and the data analysis unit 126 may be realized by hardware such as PLD or FPGA.

  FIG. 2 shows a processing flowchart of the proxy server device 12. This is the process realized by the processing program.

  First, the transmitting/receiving unit 120 receives communication data from the client terminal 10 (S101). Alternatively, the transmitting/receiving unit 122 receives the communication data from the web server device 14 (S101).

  Next, the decryption exclusion determination unit 121 determines whether or not the received communication data is subject to decryption exclusion (S102). Specifically, it is determined whether or not the sender host name or the destination host name of the communication data and the exclusion target host name stored in the decryption exclusion information storage unit 125 match, and if they match, the decryption exclusion target. Is determined (YES), and if they do not match, it is determined that they are not targets of decryption exclusion (NO).

  When it is a target of the decryption exclusion, the decryption exclusion determining unit 121 does not decrypt the received communication data, and the content filtering is not executed. The transmitting/receiving means 122 or 120 transmits the communication data to the web server device 14 or the client terminal 10.

  When it is not the target of the decryption exclusion, the decryption exclusion determination unit 121 supplies the received communication data to the decryption/encryption unit 124. The decryption/encryption means 124 decrypts the communication data (S103) and supplies it to the content filtering means 123. The content filtering unit 123 determines whether the decrypted communication data is appropriate. Content filtering is well known and either URL filtering or dynamic content filtering may be used. If the content of the communication data is appropriate, it is determined to be safe, and if it is inappropriate, it is determined to be NG. If it is inappropriate, the communication data is blocked or a process corresponding to the block is executed (S109). The processing according to the cutoff includes connection refusal.

  If the content filtering is safe, the decrypted communication data is supplied to the data analysis means 126. The data analysis unit 126 analyzes whether or not the decrypted communication data includes information requesting privacy information (confidential information) (S105). Specifically, the data analysis unit 126 analyzes the communication data by HTML, and uses the input type, the input format, the value of the radio button or the like, the content of the display text, etc. to perform privacy. It is determined whether the information requesting the information is included. The privacy information is, for example, a credit card number or password, and the information requesting the privacy information is, for example, a format for entering a credit card number or text information such as "Please enter a password". Not limited to. The data analysis unit 126 supplies the determination result to the decryption/encryption unit 124, and additionally additionally registers the decryption exclusion information in the decryption exclusion information storage unit 125 according to the determination result.

  That is, when the information requesting the privacy information is not included, the decryption/encryption means 124 re-encrypts the decrypted communication data (S107), and supplies the encrypted communication data to the transmitting/receiving means 122 or 120. To do. The transmitting/receiving unit 122 transmits the encrypted communication data to the web server device 14, or the transmitting/receiving unit 120 transmits the encrypted communication data to the client terminal 10 (S108).

  On the other hand, when the information requesting the privacy information is included, the data analysis unit 126 newly registers the sender or the destination host name of the decrypted communication data in the decryption exclusion information storage unit 125 as the exclusion target host name ( S106). Then, the decryption/encryption means 124 re-encrypts the decrypted communication data (S107), and supplies the encrypted communication data to the transmitting/receiving means 122 or 120. The transmission/reception unit 122 transmits the encrypted communication data to the web server device 14, or the transmission/reception unit 120 transmits the encrypted communication data to the client terminal 10 (S108). Therefore, from the next time onward, when the host name is the sender or destination of the communication data, the decryption exclusion determining unit 121 determines that the decryption exclusion target is set, and the decryption exclusion determination unit 121 transmits the decrypted data to the web server device 14 or the client terminal 10 without decryption. Therefore, the privacy information is protected. When communication data is transmitted and received between the client terminal 10 and the web server device 14, the communication data is transmitted from the web server device 14 to the client terminal 10 at a certain timing, and as a result of data analysis of this communication data, information requesting privacy information is transmitted. When registered in the decryption exclusion information storage unit 125 as included, when transmitted from the client terminal 10 to the web server device 14 at the next timing, the communication data is targeted for decryption exclusion and is not decrypted. Moreover, the content filtering is not executed, and the content is relayed to the web server device 14 as it is.

  FIG. 3 shows a detailed processing flowchart of S105 of FIG. 2, that is, the data analysis processing in the data analysis means 126.

The data analysis means 126 sequentially performs data analysis on the HTML of the decrypted communication data. First, the attribute of the HTML input tag is analyzed (S201). For example, the HTML source code is
<input type=”password” name=”pass size=”10” maxlength=”8”>
In the case of, the input type=“password” is a tag for requesting password input, and when this is detected by pattern matching, it is determined that the information requesting privacy information is included. In addition to this, when input type=”tel” and input type=”email”, these are tags requesting the input of the telephone number and email address, respectively, and when this is detected by pattern matching, It is determined that the information requesting privacy information is included. It is also possible to make a judgment about check boxes and radio buttons. For example,
input type=”checkbox” name=”card type” value=”1” cheked=”checked”>mastercard
input type=”checkbox” name=”card type” value=”2” cheked=”checked”>visa
input type=”checkbox” name=”card type” value=”3” cheked=”checked”>jcb
If it is, it is determined that the information requesting the privacy information is included. Further, it may be determined from the input format. For example, when the input format is a format corresponding to 4 digits×4 numbers, it may be requested to input the credit card number, and thus it is determined that the information requesting the privacy information is included. If the format corresponds to a digit number, it may be required to enter your My Number, so it is determined that the information requiring privacy information is included, and the format corresponding to a 7-digit number is used. In some cases, it may be requested to input the account number, so it is determined that the information requesting privacy information is included. The attribute of the HTML input tag is analyzed, and if the information requesting privacy information is not included, then the attribute of the title tag is analyzed (S202). For example, the HTML source code
<title>Financial statement screen: Enter purchase order information</title>
If it is, it is determined that the information requesting the privacy information is included. Whether or not there is information requesting privacy information is determined by previously determining a character string that is a criterion such as “credit card” or “input” and determining whether or not the character string is included.

The attribute of the HTML title tag is analyzed, and if the information requesting the privacy information is not included, then the attribute of the label (Label) tag is analyzed (S203). For example, the HTML source code
<label for=”credit_card_number”>
If it is, it is determined that the information requesting the privacy information is included.

  The above processing is executed up to a plurality of stages, for example N stages (S204). When the information requesting the privacy information is included in any of the stages, the process is performed in step S106 of FIG. 2, that is, it is registered in the decryption exclusion information storage unit 125 as the decryption exclusion.

  FIG. 4 shows an example of the decryption exclusion information stored in the decryption exclusion information storage unit 125. The host name of the web server device 14 and its expiration date are registered in association with each other. The expiration date can be, for example, the expiration date of the SSL certificate, but is not limited to this. As the expiration date, a predetermined expiration date (two years or the like) may be set in consideration of the general content update frequency. By setting the expiration date, even if the data is once registered in the decryption exclusion information storage unit 125, the data analysis unit 126 will perform data analysis again after the expiration date, so that the content can be updated. The registered contents of the decryption exclusion information storage means 125 can also be updated periodically.

  The process of this embodiment will be described more specifically. This is a case where the client terminal 10 accesses the web server device 14 and performs online shopping at a specific website of the web server device 14.

  It is assumed that the client terminal 10 accesses the web server device 14 and the processing has proceeded to immediately before the settlement of the product. Up to this point, it is assumed that there has been no communication that requires information requesting privacy information.

  The transmission/reception unit 122 of the proxy server device 12 receives the data from the web server device 14 as a response to the Get request of the client terminal 10. The transmission/reception unit 122 supplies the received communication data to the decoding exclusion determination unit 121.

  At this time, if the website of the web server device 14 is not yet registered in the decryption exclusion information storage unit 125, the decryption exclusion determination unit 121 determines that the received data is not the target of the decryption exclusion, and the communication data Is supplied to the decryption/encryption means 124. The decryption/encryption unit 124 decrypts the communication data, and the content filtering unit 123 executes content filtering using the URL of the decrypted communication data. If it is determined that the content filtering is appropriate (safety), the data analysis unit 126 executes data analysis.

  FIG. 5 shows an example of a screen of the decrypted communication data. It is a screen just before the settlement of accounts on a general shopping site. In the HTML source code on this screen, "Enter ID", "Enter password", "Enter credit card number", "Enter security code of credit card" , "Please enter your name", etc., and there is also a field for entering 4 digits x 4 numbers. If the data analysis unit 126 determines that the information requesting privacy information is included by detecting these, the data analysis unit 126 newly registers the host name of the shopping site in the decryption exclusion information storage unit 125. Then, the decryption/encryption unit 124 re-encrypts the decrypted communication data, and the transmission/reception unit 120 transmits the encrypted communication data to the client terminal 10.

  After that, the proxy server device 12 receives the POST data from the client terminal 10 to the web server device 14. The transmission/reception unit 120 supplies the received POST data to the decryption exclusion determination unit 121. At this time, since the host name of the shopping site is already registered in the decryption exclusion information storage unit 125, the decryption exclusion determination unit 121 determines that the received POST data is a decryption exclusion target and does not decrypt the received POST data. The data is directly transmitted to the web server device 14 via the transmission/reception means 122.

  Although the embodiment has been described above, the present invention is not limited to this, and various modifications can be made.

  For example, in the present embodiment, as shown in the process flowchart of FIG. 2, when the decryption exclusion determination unit 121 determines that the decryption exclusion target is the target of the decryption exclusion, the received communication data is relayed as it is. It may be relayed after performing filtering at the level. As described above, the technique of acquiring the host name of the web server from the CONNECT method sent from the client terminal 10 to the proxy server device 12 and performing content filtering at the host name level is a technique of performing content filtering by decoding. Although the filtering accuracy is inferior to that of, the security can be relatively secured to some extent as compared with the case where no filtering is executed.

  FIG. 6 shows a processing flowchart in this case. S301 to S309 are the same as S101 to S109 shown in FIG.

  That is, the communication data from the client terminal 10 to the web server device 14 will be described as an example. The transmitting/receiving unit 120 receives the communication data from the client terminal 10 (S301).

  Next, the decryption exclusion determination unit 121 determines whether or not the received communication data is subject to decryption exclusion (S302). When it is a target of the decryption exclusion, the decryption exclusion determining unit 121 does not decrypt the received communication data and does not execute the content filtering. The transmission/reception unit 122 transmits the encrypted communication data to the web server device 14 and relays it.

  When it is not the target of the decryption exclusion, the decryption exclusion determination unit 121 supplies the received communication data to the decryption/encryption unit 124. The decryption/encryption means 124 decrypts the communication data (S303) and supplies it to the content filtering means 123. The content filtering unit 123 determines whether the decrypted communication data is appropriate. If the content of the communication data is appropriate, it is determined to be safe, and if it is inappropriate, it is determined to be NG. If it is inappropriate, the communication data is blocked, or a process corresponding to the blocking is executed (S309).

  If the content filtering makes the content safe, the decrypted communication data is supplied to the data analysis unit 126. The data analysis unit 126 analyzes whether the decrypted communication data includes privacy information (confidential information) (S305). Specifically, the data analysis unit 126 analyzes the communication data by HTML, and uses the input type, the input format, the value of the radio button or the like, the content of the display text, etc. to perform privacy. It is determined whether the information requesting the information is included. When the information requesting the privacy information is not included, the decryption/encryption means 124 re-encrypts the decrypted communication data (S307) and supplies the encrypted communication data to the transmitting/receiving means 122. The transmission/reception unit 122 transmits the encrypted communication data to the web server device 14 (S308).

  On the other hand, when the information requesting the privacy information is included, the data analysis unit 126 newly registers the destination host name of the decrypted communication data in the decryption exclusion information storage unit 125 as the exclusion target host name (S106). . At this time, the expiration date may be registered in association with the host name. The decryption/encryption means 124 re-encrypts the decrypted communication data (S307), and supplies the encrypted communication data to the transmitting/receiving means 122. The transmission/reception unit 122 transmits the encrypted communication data to the web server device 14 (S308).

  If it is determined in S302 that the decryption target is excluded, the content filtering unit 123 does not decrypt the communication data and relays the communication data to the web server device 14 by relaying the communication data as it is. Content filtering at the level is executed (S310). The CONNECT method requests the proxy server to transmit (tunnel) the HTTPS session without relaying the session, and executes filtering using the host name. If it is appropriate, it is relayed as it is, and if it is inappropriate, it is cut off or a process similar to this is executed as in the case of being determined to be inappropriate (NG) in S304 (S309).

  Even in the process shown in FIG. 6, when the information requesting the privacy information (confidential information) is included, the decryption of the communication data after that can be excluded to protect the privacy information, and the whitelist of the exclusion of decryption is automatically performed. Can be created in Further, even in the case of decryption exclusion, inappropriate communication data can be blocked by executing filtering to some extent (host name level).

  Further, in the present embodiment, as shown in FIG. 3, it is determined whether or not the information requesting the privacy information is included in a plurality of stages, but whether or not the information requesting the privacy information is included. May be quantitatively evaluated as the number of points and compared with a threshold value to integrally determine whether or not the information requesting the privacy information is included. In this case, different weights may be added in each of a plurality of stages for quantitative evaluation. This is because information that requires privacy information differs in confidentiality.

  Further, in the present embodiment, when the content filtering is executed, the fact may be notified to the client terminal 10 as necessary.

10 client terminals, 12 proxy server devices, 14 web server devices, 120, 122 transmission/reception means, 121 decryption exclusion determination means, 123 content filtering means, 124 decryption/encryption means, 125 decryption exclusion storage means, 126 data analysis means.

Claims (5)

Receiving means for receiving the encrypted communication data,
Decoding means for decoding the encrypted communication data received by the receiving means,
When the communication data decrypted by the decrypting means includes information requesting confidential information, control means for controlling not to decrypt the communication data received by the receiving means thereafter.
And a communication data relay device. The control means controls so as not to decrypt the encrypted communication data when the encrypted communication data is received again from the sender or the destination of the communication data including the information requesting confidential information in the communication data. Item 1. The communication data relay device according to Item 1. The communication data relay device according to claim 1, wherein the destination information of the decryption exclusion target includes expiration date information. The control unit detects that the information requesting confidential information is included using at least one of the input type, the input format, and the content of the display text included in the communication data. The described communication data relay device. On the proxy server,
Receiving encrypted communication data,
Decrypting the received encrypted communication data,
When the decrypted communication data includes information requesting confidential information, a program for executing the step of controlling not to decrypt the communication data received thereafter.

Images