JP4979127B2 - Account information leak prevention service system - Google Patents

Description

  The present invention is an account that prevents account information composed of a user ID and a password when using an online service using a browser from being stolen by malware or cross-site scripting such as a keylogger. The present invention relates to an information leakage prevention service system.

As user authentication when using various computer systems, there is authentication using a user ID and a password. For this user authentication, it is recommended to use a long password or change the password for each system in order to prevent analogy of the password.
However, when this type of password is used, the password is often forgotten. Therefore, an automatic password input proxy system combined with biometric authentication as described in Patent Document 1 has been proposed. By using this automatic password entry system, you can log in and use various systems without having to remember your password.

JP 2000-293490 A

However, in the case of the technique described in Patent Document 1, there is a risk that the user ID and password are stolen.
As a program for stealing information of computer users such as personal computers, it is pointed out that there is malware that monitors keyboard input and steals user IDs and passwords for online banking. This type of malware monitors the window displayed on the display of the user's computer, detects that the target bank's authentication screen window has been displayed, steals the keyboard input operation entered in that window, The malware creator is notified of the user ID and password, and the malware creator misuses the stolen user ID and password to perform an illegal transfer, thereby damaging a legitimate computer user.
Also, the user ID and password are stolen not only on the user computer but also on a fake online service site, and the user ID and password are stolen by sending the user ID and password to the site. There is also "phishing".
In addition, there are cases where a site that is vulnerable to cross-site scripting is viewed, or a computer is infected with a virus and the session identification information is stolen.

  The object of the present invention has been made in view of the above problems, and in the online service, user account information including a user ID and a password is stolen from a user computer or sent to a fake site. An object of the present invention is to provide an account management service system that can prevent such a situation.

In order to achieve the above object, an account information leakage prevention service system according to the present invention includes a keyboard input monitoring module mounted on a user computer, a URL of an online service site used by the user computer, and a user of the site. An account information leakage prevention service system comprising an agent server having an account database including an ID, a password, and session identification information,
The proxy server is
When the user computer accesses the user authentication page of the online service site and receives user authentication, an account comprising a user ID and password for receiving user authentication of the online service site from the account database Means for acquiring information and session identification information, and transmitting the account information and session identification information to the online service site;
The keyboard input monitoring module of the user computer is
And a means for monitoring an input operation of the user computer and warning the user not to input account information for receiving user authentication of the online service site.
Further, contact information when the account database finds a fake online service site is stored in advance, and the proxy server stores the user ID and password in an online service site with a URL not included in the account database. When trying to send it, it is determined that the site is a fake site, the transmission of the user ID and password is interrupted, and then the URL of the fake online service site is notified to the contact indicated by the contact information. It is characterized by further comprising means for performing.

According to the present invention, a user computer that is likely to infiltrate malware does not input an online service user ID or password and does not store session identification information, so that such information cannot be stolen.
Further, even if the user mistakenly inputs the service user ID or password, the monitoring module warns of this, so that leakage of account information including the user ID is prevented.
In addition, even if an attempt is made to send a user ID or password to a fake site, the proxy server detects this and prohibits access to the fake site. Can be prevented.
Furthermore, even if the user computer is infected with a virus, it is safe because the user computer holds only dummy session identification information.

Embodiments of an account information leakage prevention service system according to the present invention will be described below.
(First embodiment)
FIG. 1 is a system configuration diagram showing a first embodiment of an account information leakage prevention service system according to the present invention.
In FIG. 1, reference numeral 110 denotes a personal computer (hereinafter referred to as a PC) used by a user.
111 is a Web browser that runs on the PC 110, and a user accesses the online service server 140 via the Internet 130 using the browser 111.
Reference numeral 112 denotes an input monitoring module that operates in the PC 110. The input monitoring module 112 monitors the user's keyboard input, and issues a warning to the user when there is an undesirable input. An undesirable input character string is obtained from the proxy server 150.
A biometric information acquisition / sending module 113 on the PC 110 acquires biometric information (information on finger veins, irises, etc.) of the user using the biometric information reading device 120 based on an instruction from the proxy server 150, Send to server 150.

Reference numeral 120 denotes a biometric information reader connected to the PC 110, which directly acquires the user's biometric information according to an instruction from the biometric information acquisition / sending module 113 and sends the biometric information to the module 113. The biometric information is typically fingerprints, irises, veins, etc., but is not limited thereto. In addition, since biometric information and its acquisition method itself are outside the scope of the present invention, they will not be described in detail.
The Internet 130 connects the user PC 110, the proxy server 150, and the online service server 140.
Reference numeral 140 denotes an online service server that provides various online services to the user, and assumes services such as bank transfer, balance inquiry, and stock transactions. The service server 140 authenticates the user using the user ID, password, and biometric information.
Reference numeral 150 denotes a proxy server. It is assumed that the user PC 110 and the online service server 140 communicate using HTTP, and the proxy server 140 corresponds to HTTP PROXY. In the browser 111, the proxy server 150 is set as HTTP PROXY.
151 is an account database held by the proxy server 150, which is configured as illustrated in FIG. 2, and stores the user ID, password, and session identification information (cookie information) of the online service server 140.
Reference numeral 152 denotes a biometric information database held by the proxy server 150, which is configured as illustrated in FIG. 3, and stores a user ID, a password, and biometric information when the proxy server 150 performs user authentication.

FIG. 2 exemplifies the configuration of the account database 151, and each record includes data items 201 to 206 as shown in the figure.
In FIG. 2, 201 is a UID attribute that is an ID for identifying a user. In this database 151, there are a plurality of entries having the same UID. This is because there is a record for each online service to be accessed and information necessary for user authentication of the service.
Reference numeral 202 denotes the URL of the online service site to be accessed.
Reference numerals 203 and 204 denote the names and values of the INPUT tags in the FORM used for user authentication of the online service site.
205 is dummy session identification information (dummy COOKIE) which is exchanged between the browser 111 and the proxy server 150.
206 is genuine session identification information sent from the online service server 140, and is COOKIE exchanged between the proxy server 150 and the online service server 140.

In the first and second records, the user with the UID “3245” accesses the Web page shown at “http://a-bank.jp/login/1.cgi” and authenticates the user of the online service. Indicates that user authentication is performed using the value “3453483” for the INPUT tag whose name is “ID” and the value “Dk # di324cO” for the INPUT tag whose name is PASS. Yes. Dummy COOKIE and COOKIE are “null”.
Contrary to the above, the third record does not have the value of the INPUT tag, and COOKIE used for exchange with the site indicated by the URL is registered. The URL indicates a URL that can be sent by COOKIE, and is determined from the DOMAIN attribute and PATH attribute of COOKIE.

FIG. 3 exemplifies the configuration of the biometric information database 152 held by the proxy server 150, and each record includes items 301 to 304.
Reference numerals 301 and 302 denote HTTP user IDs and passwords used for user authentication of the proxy server 150.
303 is biometric information of the proxy server user of this entry.
Reference numeral 304 denotes a user ID for identifying the user in the account database 151, which corresponds to the UID 201.

Hereinafter, user authentication when the user receives an online service will be described with reference to the flowchart of FIG.
First, in step 410, the URL of the online service server 140 is designated by the browser 111 of the user PC 110, and the service authentication page is accessed. Here, it is assumed that the URL is http://www.a-bank.jp/login/. Although the URL is specified here, this is the same whether accessing this page from a bookmark or accessing this authentication page from the bank's home page. As a premise, the proxy server 150 is designated as HTTP PROXY in the setting of the browser 111, and the browser 111 transmits an HTTP request to the proxy server 150.
In step 420, user authentication at the proxy server 150 is performed using HTTP PROXY authentication. At this time, the proxy server 150 considers that the authentication is successful because there is a record that matches the user attribute 301 and the pass attribute 302 of the biometric information database 152. If it fails, the process is stopped, access to the online service server 140 is prohibited, an error message is sent back to the browser 111, and the process is stopped.

In step 430, the proxy server 150 that has succeeded in the user authentication accesses the online service server 140, accesses the authentication page http://www.a-bank.jp/login/, and corresponds to the HTTP of the page data. A response is transmitted to the browser 111. Further, a record having the UID 304 that has been successfully authenticated in 201 and the URL having the URL that matches the ACTION of the FORM included in the HTTP response is searched from the account database 151, and the first number of INPUT tag values included in the authentication page is searched. The character is sent to the input monitoring module 112. The corresponding record is not necessarily one, and there are many cases where there are two corresponding to the user ID and the password.
This character string is a character string to be monitored by the module 112. The character string length is arbitrary, but about 2 to 3 characters are considered desirable. This is because one character increases the probability of coincidence and warns more than necessary. Since the monitoring target character string may be stolen by the user PC 110, when a very long character string is sent, most of the user ID and password are stolen.

When the above steps are completed, an authentication page is displayed on the browser 111. Generally, a user tries to input a user ID and a password. However, the user of this system does not need to input a real user ID or password, and can input a random user ID and password, press the OK button, and transmit the page.
In the following step 440, the user operates the browser 111 to input and send a random user ID and password. The user ID and password are transmitted as parameters included in the HTTP request. The input monitoring module 112 monitors the input of the user ID and password. When a character string to be monitored is input, a warning message is displayed to prevent the input.

  In step 450, the proxy server 150 receives an HTTP request including a random user ID and password. At this time, as in step 410, user authentication is performed using HTTP PROXY. Further, in order to perform user authentication based on biometric information, the biometric information income sending module 113 is instructed, the biometric information of the user is acquired from the biometric information reader 120, and collated with the biometric information in the attribute 303 of the biometric information database 152. To do.

In step 460, the processing differs depending on the collation result with the biometric information in step 450, the presence or absence of a parameter corresponding to the INPUT tag included in the HTTP request in the record whose HTTP request destination matches the URL, and the presence or absence of dummy COOKIE.
If the first verification fails, an error page is transmitted to the browser 111, and the process ends.
If the parameter corresponding to the second INPUT tag is included in the HTTP request, the corresponding record is extracted from the account database in the same manner as 430, the parameter is replaced with the value of the corresponding INPUT tag, and sent to the online service server 140. In the second case, as in step 410, it corresponds to an HTTP request when a user ID and password are entered on the authentication page.
If the third dummy COOKIE is included in the HTTP request, it is replaced with COOKIE and sent to the online service server 140. This third case corresponds to an HTTP request when making a request on, for example, a transfer request page after user authentication.
In other cases, the corresponding dummy COOKIE and COOKIE records are deleted from the account database 151 and an HTTP request is sent to the online service server 140.

In step 470, if an HTTP response is received from the online service server 140 and COOKIE is included, a dummy COOKIE is generated, a URL is generated from the COOKIE DOMAIN and PATH, and a record including this URL, the dummy COOKIE, and COOKIE is accounted. After being added to the database 151, the HTTP reply replaced with the dummy COOKIE is sent back to the browser 111. Here, the EXPIRE attribute of COOKIE is left as it is.
Here, the process returns to step 440. This is a state in which the page in the HTTP response is displayed on the browser 111. This is repeated below.

(Second Embodiment)
In the first embodiment described above, the authentication method using biometric information has been described as the user authentication method in the proxy server 150. However, the authentication method is not limited to biometric information authentication, and any method that does not use a password, such as authentication using an IC card. I do not care. An object of the present invention is to ensure safety even when malware enters a user PC and keyboard input is stolen. Other types of authentication may be used if it is not a password.

(Third embodiment)
In the first and second embodiments described above, when the correct online service server 140 is accessed, the user is prevented from entering a password on the user PC 110. However, in this embodiment, a so-called online service server included in the fake mail is accessed, the user is regarded as a real service site, and the user ID and password are transmitted to the fake server. Phishing cannot be prevented.

Hereinafter, details of preventing transmission of a user ID and password to a fake site will be described according to the flowchart of FIG. Here, it is assumed that the user has been deceived and led to a fake online site server authentication page.
First, in step 510, the deceived user inputs and transmits a real user ID and password in the browser 111. As a premise, the proxy server 150 is designated as HTTP PROXY in the setting of the browser 111, and the browser 111 accesses the proxy server 150.
In step 520, user authentication at the proxy server 150 is performed using HTTP PROXY authentication. At this time, the proxy server 150 considers that the authentication is successful because there is a record that matches the user attribute 301 and the pass attribute 302 of the biometric information database 152. If it fails, the process is stopped, access to the online service server is prohibited, an error message is sent back to the browser 111, and the process is stopped.
In step 530, the proxy server 150 searches for a record having the UID corresponding to the user authenticated in step 520 in 201, and does not correspond to any of the URLs having the transmission destination 202, and is included in the HTTP request If the value matches the value 204 in the account database 151, the transmission is stopped. If not, send it as it is to allow user access.

(Fourth embodiment)
In the process of Step 530 of the third embodiment described above, if the value of 204 included in the database 151 is included in the URL not included in the account database 151, the user is deceived. It is considered that they are accessing fake sites. In such a case, if the real site is notified of the existence of this fake site, damage to other users can be prevented in advance. For this purpose, a fake site notification destination 207 may be added to the account database 151 of FIG. The processing of the proxy server 150 for this purpose is shown in the flowchart of FIG.
First, in step 701, a random value is entered in place of the user ID and password values included in the parameters in the HTTP request that the user is trying to send to a server that may be a fake site. Send to server.
Next, if the user authentication request in step 701 is successful in step 702, it is determined that the site is collecting the user ID and password, and the record of the account database 151 corresponding in step 530 in FIG. Is notified of the URL of the fake site.

(Fifth embodiment)
In the above-described embodiment, the proxy server 150 is realized on a computer different from the user PC 110, but may be on the same PC as long as it is isolated from the user PC 110. For example, a virtual machine tool can be used to run multiple operating systems on one PC, one of which is assigned to the user PC and the other is assigned to the proxy server. May be. If a secure OS such as SELinux can be isolated for each process even on one OS, the same effect can be expected by implementing the proxy server as an isolated process.

It is a system configuration figure showing a 1st embodiment of the present invention. It is a figure which shows the structural example of an account database. It is a figure which shows the structural example of a biometric information database. It is a flowchart which shows a password substitution process. It is a flowchart which shows an account information transmission monitoring process. It is a figure which shows the structural example of the account database containing a notification destination. It is a flowchart which shows a fake site determination notification process.

Explanation of symbols

110: User PC
111: Web browser 112: Input monitoring module 113: Biometric information acquisition and sending module 120: Biometric information reader 130: Internet 140: Online service server 150: Proxy server 151: Account database 152: Biometric information database

Claims (2)

Account information leakage comprising a keyboard input monitoring module implemented in a user computer, and a proxy server having an account database including the URL of the online service site used by the user computer, the user ID and password of the site, and session identification information Prevention service system,
The proxy server is
When the user computer accesses the user authentication page of the online service site and receives user authentication, an account comprising a user ID and password for receiving user authentication of the online service site from the account database Means for acquiring information and session identification information, and transmitting the account information and session identification information to the online service site;
The keyboard input monitoring module of the user computer is
An account information leakage prevention service system, comprising: means for monitoring an input operation of the user computer and warning not to input account information for receiving user authentication of the online service site.   The account database stores in advance contact information when a fake online service site is found, and the proxy server attempts to send a user ID and password to an online service site with a URL not included in the account database. In such a case, it is determined that the site is a fake site, and after sending the user ID and password is interrupted, means for contacting the URL of the fake online service site to the contact indicated by the contact information The account information leakage prevention service system according to claim 1, further comprising:

Images