JP6529033B2 - INFORMATION PROCESSING APPARATUS, METHOD, AND PROGRAM - Google Patents

Description

  The present disclosure relates to techniques for inspecting data on a network.

  Conventionally, as a method for inspecting a data packet stream on a computer network to search for patterns divided at data packet boundaries, it is determined whether two or more data packets are continuous in the data packet stream. , Combining payloads from consecutive data packets, analyzing combined payloads from consecutive data packets, and searching for a plurality of patterns of character combinations, and the data packets are in the system for a predetermined time or more At the same time, a method has been proposed in which data packets are returned to the output data stream based on predetermined judgment criteria (see Patent Document 1).

  Also, conventionally, packet data transferred between the user terminal of each subscriber terminal and the Internet is stored in a zone center station connected to a group center station accommodating a plurality of subscriber terminals connected to the Internet. A computer virus exists in the assembled data by assembling a storage device for temporary storage and a plurality of packet data stored in the storage device corresponding to an IP address in the Internet and a regional IP address in the network into file data There is proposed a gateway having a function of determining whether or not there is a computer virus and transferring data determined to have no computer virus to a subscriber terminal (see Patent Document 2).

JP 2009-510815 gazette JP 2001-256045 A

  Conventionally, in order to inspect data on a network, there is a technique of capturing and inspecting data before the data reaches the destination, and transferring the data to the destination after the inspection is completed. However, such a technique requires a large storage area because it is necessary to buffer data until the examination of the entire data is completed.

  In view of the above-described problems, the present disclosure has an object to reduce the size of a storage area required for a buffer of data to be inspected when acquiring and inspecting data on a network.

  An example of the present disclosure includes data acquisition means for acquiring data including content, which flows through a network, before reaching a destination, and buffer means for buffering the acquired data in a buffer area having a predetermined size; Inspection means for inspecting the content by referring to the data buffered by the buffer means in the order corresponding to the order from front to back of the file obtained by being assembled at the destination, and buffer by the buffer means An information processing apparatus comprising: transfer means for transferring a portion of the data that has been referred to by the inspection means to the destination before the inspection of the entire content is completed.

  The present disclosure can be understood as an information processing apparatus, a system, a method executed by a computer, or a program executed by a computer. The present disclosure can also be grasped as recording of such a program on a recording medium readable by a computer or other device, machine or the like. Here, a recording medium readable by a computer etc. means a recording medium which can store information such as data and programs by electrical, magnetic, optical, mechanical or chemical action and read from a computer etc. Say.

  According to the present disclosure, when acquiring and inspecting data on a network, it is possible to reduce the size of a storage area required for a buffer of data to be inspected.

It is a schematic diagram showing composition of a system concerning an embodiment. It is a figure which shows the hardware constitutions of the communication test | inspection apparatus which concerns on embodiment. It is a figure showing an outline of functional composition of a communication inspection device concerning an embodiment. It is the flowchart A which shows the outline | summary of the flow of the packet processing which concerns on embodiment. It is the flowchart B which shows the outline | summary of the flow of the packet processing which concerns on embodiment. It is a figure which shows the mode of the buffer process in the whole content at the time of the packet process which concerns on embodiment being performed, and the test | inspection of a content. It is a flowchart which shows the outline | summary of the flow of the header transmission process which concerns on embodiment. FIG. 6 is a diagram showing a flow of packets when packet processing and header transmission processing are performed in the embodiment. FIG. 7 is a diagram showing a variation of packet flow when packet processing and header transmission processing are performed in the embodiment.

  Hereinafter, embodiments of an information processing apparatus, method, and program according to the present disclosure will be described based on the drawings. However, the embodiments to be described below exemplify the embodiments, and the information processing apparatus, method, and program according to the present disclosure are not limited to the specific configurations described below. In the implementation, a specific configuration according to the embodiment is adopted as appropriate, and various improvements and modifications may be performed.

  In the present embodiment, an information processing apparatus, method, and program according to the present disclosure will be described in an embodiment in which the communication inspection apparatus is implemented. However, the information processing apparatus, method, and program according to the present disclosure can be widely used for techniques for inspecting data on a network, and the application target of the present disclosure is limited to the example shown in the present embodiment. I will not.

<System configuration>
FIG. 1 is a schematic view showing the configuration of a system 1 according to the present embodiment. A system 1 according to the present embodiment includes a network segment 2 to which a plurality of information processing terminals 90 (hereinafter referred to as “clients 90”) are connected, and a communication inspection apparatus 20 for relaying communication related to the clients 90, Equipped with The client 90 in the network segment 2 can communicate with various servers connected at a remote location via the Internet or a wide area network via the communication inspection device 20. In the present embodiment, the communication inspection apparatus 20 is connected between the client 90 and the Internet in the network segment 2 to acquire passing packets. Then, the communication inspection apparatus 20 transfers, among the acquired packets, a packet not to be inspected and a packet determined to be transferred as a result of the inspection.

  FIG. 2 is a diagram showing a hardware configuration of the communication inspection apparatus 20 according to the present embodiment. The communication inspection apparatus 20 includes a central processing unit (CPU) 11, a read only memory (ROM) 12, a random access memory (RAM) 13, and a memory such as an electrically erasable and programmable read only memory (EEPROM) or a hard disk drive (HDD). It is a computer provided with an apparatus 14, a communication unit such as a NIC (Network Interface Card) 15, and the like. However, with regard to the specific hardware configuration of the communication inspection apparatus 20, omission, replacement, or addition can be appropriately made according to the embodiment. Also, the communication inspection device 20 is not limited to a single device. The communication inspection device 20 may be realized by a plurality of devices using so-called cloud, distributed computing technology or the like.

  FIG. 3 is a diagram showing an outline of a functional configuration of the communication inspection apparatus 20 according to the present embodiment. In the communication inspection apparatus 20, the program recorded in the storage device 14 is read out to the RAM 13 and executed by the CPU 11, whereby the content request detection unit 21, the data acquisition unit 22, the transmission number prediction unit 23, the extraction unit 24 functions as an information processing apparatus including a header generation unit 25, an inspection unit 26, an inspection transmission unit 27, a transfer unit 28, a cancellation unit 29, an inspection result notification unit 30, a buffer unit 31, and a determination unit 32. In the present embodiment, each function provided in the communication inspection apparatus 20 is executed by the CPU 11 which is a general-purpose processor, but some or all of these functions may be executed by one or more dedicated processors. . Also, some or all of these functions may be executed by a device installed at a remote value or a plurality of devices installed in a distributed manner using cloud technology or the like.

  The content request detection unit 21 detects a content request (connection request) in which at least one of the transmission source, the destination, and the type of requested content meets a predetermined condition.

  The data acquisition unit 22 acquires data including a header and content according to communication transmitted and received by a terminal connected to the network before reaching the destination. In the present embodiment, the communication inspection apparatus 20 can set all communication via the communication inspection apparatus 20 as an inspection target in addition to the communication by the client 90 connected to the network segment 2.

  The buffer unit 31 buffers the acquired data in the content buffer area on the RAM 13 having a predetermined size. Here, when the data is divided into a plurality of packets and sequentially acquired, the buffer unit 31 excludes the portion included in the newly acquired packet of the data except the region in which the untransferred data is buffered. Buffer in In other words, the buffer unit 31 buffers the portion included in the newly acquired packet of the data in the area in which the data is not buffered or the area in which the transferred data is buffered. Hereinafter, the area excluding the area in which the untransferred data is buffered is referred to as “empty area”. In the present embodiment, what is buffered in the content buffer area having a predetermined size by the buffer unit 31 is the content portion of the data, and the header of the content is buffered in another area on the RAM 13 .

  The determination unit 32 determines whether or not there is enough free space in the content buffer area to buffer a portion included in a newly acquired packet of data. Specifically, the determination unit 32 compares the size of the part included in the newly acquired packet of the data with the size of the free area of the content buffer area, and the free area is sufficient in the content buffer area. Determine if there is. Here, when it is determined that the free space is not sufficient, the transfer unit 28 transfers the part of the data buffered by the buffer unit 31 to which the reference by the inspection unit 26 is completed, thereby making the content buffer area available. Secure.

  The transmission number prediction unit 23 predicts the inspection time required for the inspection of the content acquired by the data acquisition unit 22, and predicts the number of transmissions by the transmission unit 27 during inspection based on the predicted inspection time. More specifically, the number-of-transmissions prediction unit 23 predicts the time from when inspection by the inspection unit 26 is started to when transfer of the head portion of the content part by the transfer unit 28 is started.

  The extraction unit 24 extracts, from the header included in the data acquired by the data acquisition unit 22, the header in which the content to be received by the destination is not determined.

  The header generation unit 25 generates a header that does not allow the destination to determine the content to be received.

  The inspection unit 26 inspects, in accordance with a predetermined inspection item, whether the content acquired by the data acquisition unit 22 is the content permitted to be transferred to the destination set in the data. For example, the inspection unit 26 inspects whether the content includes malware, whether the content includes an undesirable expression, and the like. However, specific inspection items and inspection methods that can be adopted in the inspection according to the present disclosure are not limited to the examples in the present embodiment. Specific inspection items and inspection methods may employ various inspection items and inspection methods that are known or developed in the future.

  The inspection unit 26 starts inspection of the content before the acquisition of the entire content by the data acquisition unit 22 is completed. Then, the inspection unit 26 inspects the content by referring to the data buffered by the buffer unit 31 in the order corresponding to the order from the front to the back of the file obtained by being assembled at the destination. More specifically, the inspection unit 26 sets the pointer indicating the reference point of the content buffer area in the order from the front to the back of the file obtained by being assembled at the destination regardless of the order of the data in the content buffer area. Control in the order you want to refer to the buffered data.

  That is, the inspection unit 26 according to the present embodiment inspects the content in a state where the entire content is not held in the content buffer area of the RAM 13. As described above, the inspection unit 26 refers to the data buffered by the buffer unit 31 in the order corresponding to the order from the front to the back of the file obtained by being assembled at the destination. The examination progress is managed on the RAM 13, the examination is performed while referring to the content from the front to the back, and the examination progress is sequentially updated. For example, when the inspection is performed by pattern matching, the presence or absence of the matching by pattern matching is recorded in the inspection progress, and when the inspection is performed by hash calculation or the like, the reference in the content is completed as the inspection progress. The result of the hash operation up to the specified position is recorded.

  During the inspection, the transmission unit 27 transmits data at intervals at which the reception waiting time of the data at the destination does not time out from the start of the inspection by the inspection unit 26 to the start of transfer of the head portion of the content by the transfer unit 28 Send at least part of the header contained in the data to the destination of the data. In the present embodiment, the header is transmitted as data to be transmitted for preventing time out, but the data to be transmitted for preventing time out is the type and size of the subsequent data to be received by the client 90. The header is not limited as long as it does not determine the etc.

  The transfer unit 28 transfers the portion of the data buffered by the buffer unit 31 that has been referred to by the inspection unit 26 to the destination of the data before the inspection of the entire content is completed. Note that, as described above in the description of the determination unit 32, this transfer may be performed when the determination unit 32 determines that the free space is not sufficient. In addition, when the examination of the entire content by the examination unit 26 is completed, the transfer unit 28 determines that the examination result indicates that the content is a content for which transfer to the destination is permitted. Transfer the data excluding the transmitted part of the included data to the destination of the data.

  The cancellation unit 29 cancels the transfer by the transfer unit 28 when the inspection result by the inspection unit 26 is an inspection result that the content is not the content for which transfer of the data to the destination is permitted.

  When the inspection result by the inspection unit 26 is an inspection result that the content is not content for which transfer of the data is permitted, the inspection result notification unit 30 notifies the data destination of the inspection result. The information to be transmitted is transmitted to the destination as a part of the data following the portion already transmitted by the transmitting unit 27 or the transferring unit 28 during inspection.

<Flow of processing>
Next, the flow of processing executed by the system 1 according to the present embodiment will be described using a flowchart. The specific contents and the processing order of the processing illustrated in the flowchart described below are an example for implementing the present disclosure. The specific processing content and the processing order may be appropriately selected according to the embodiment of the present disclosure.

  4 and 5 are flowcharts showing an outline of the flow of packet processing according to the present embodiment. The packet processing according to the present embodiment is executed by the communication inspection apparatus 20 when a connection request packet (for example, a TCP SYN packet) flowing on the network is received.

  In step S101, a connection request is fetched. The content request detection unit 21 refers to the transmission source and destination set in the header of the received packet, and determines whether the packet is a packet to be captured (for example, a connection request packet from the client 90 to the server). The packet to be captured is fetched and stored in the RAM 12 (so-called hook process). The packets determined not to be captured are transferred to the destination without being captured by the communication inspection device 20 (not shown). Whether or not the packet is to be captured is determined by checking whether the source and destination of the packet are registered in a list of preset source IP addresses and destination IP addresses. The list used for this matching may be a white list or a black list. In addition, a method different from that of the present disclosure may be employed to determine whether a packet is a target of capture. Thereafter, the process proceeds to step S102.

  In step S102, it is determined whether the content relating to the request of the client 90 is to be checked. The content request detection unit 21 receives a packet belonging to the connection related to the connection request fetched in step S101, refers to the request line and the header of the packet, and the packet becomes an inspection target of the inspection unit 26. It is determined whether it is a packet requesting content of type Whether or not the packet is for a request for content to be checked is determined by checking whether the request line and the header of the packet match or approximate information registered in a predetermined list of data to be checked. Ru.

For example, if the HTTP packet has the request line and header shown below, it is determined that the packet is for requesting the content to be examined.
GET / HTTP / 1.1
Host: sample.site
Accept: * / *
User-Agent: UserAgent 1.0
Accept-Language: en
Accept-Encoding: gzip, deflate
Connection: keep-alive
If it is determined that the packet is not a packet requiring inspection target content, the content requested by the packet is not inspected, and the packet is transferred (step S119), and the processing illustrated in this flowchart ends. Do. On the other hand, when it is determined that the packet is a packet requesting inspection target content, the content requested by the packet is set as an inspection target in step S113 described later, and the process proceeds to step S103.

  In steps S103 and S104, a connection request and a content request are transmitted. The communication inspection device 20 connects to the server related to the connection request in step S101, and requests the content related to the content request in step S102 to the server. At this time, the communication inspection apparatus 20 may directly transfer the packet received in step S101 and step S102 to the server, or may transmit the IP address of the transmission source to the server after converting it as necessary. Good. Thereafter, the process proceeds to step S105.

  In step S105, a packet including response status and / or header is received. The data acquisition unit 22 acquires data including a response status or a header transmitted from the server as a response packet to the content request packet transmitted in step S104 before reaching the client 90. Here, when the data is divided into a plurality of packets and transmitted, the data acquisition unit 22 assembles the plurality of packets to acquire data including a response status or a header. Further, the communication inspection apparatus 20 refers to the content of the header to determine whether the content following the header is to be inspected by the inspection unit 26 or not. This determination is performed, for example, by collating the type of content specified from the content of the header with the list of types of content to be inspected (or not inspected). Also, this determination may be performed by comparing the size of the content specified from the content of the header with the upper limit of the size to be examined.

For example, if the HTTP data has the response status and header shown below, it is determined that the subsequent content is to be inspected.
HTTP / 1.1 200 OK
Server: Apache
Date: xxxxxxxx GMT
Content-Type: application / octet-stream
Content-Length: 108
Connection: keep-alive
Cache-Control: max-age = 0, no-cache
Pragma: no-cache
As a result of the determination, when it is determined that the content is not to be inspected, the connection relating to the packet is set to be not to be inspected, and the processing illustrated in this flowchart ends (illustration is omitted). On the other hand, when the content is to be inspected, the process proceeds to step S106.

  In step S106, the number of transmissions by header transmission processing described later is predicted. First, the number-of-transmissions prediction unit 23 refers to the header of the packet received in step S105 to grasp the size of the header and the head portion of the content (the content portion included in the first packet including the content). Is divided by the processing capacity of the inspection unit 26 (for example, the data size that can be inspected per predetermined time), the inspection of the header and the inspection of the head portion of the content are completed, and the transfer of the head portion of the content is started. Estimate the inspection time required to Then, the transmission number prediction unit 23 predicts the number of transmissions by dividing the predicted inspection time by the transmission interval by the transmission unit 27 during inspection. Here, in the transmission interval by the transmission unit 27 during inspection, an interval at which the waiting time for packet reception related to the content does not time out is set in advance in the client 90 that receives the content. Thereafter, the process proceeds to step S107.

  In step S107, a portion of the transmittable header is extracted during inspection. The extraction unit 24 extracts, from the header received in step S105, a header portion in which the content to be received by the destination is not determined. In other words, the extraction unit 24 transmits data other than the data transmitted from the server (for example, inspection result) to the destination as part of the data following the portion transmitted by the transmission unit 27 during inspection. Then, by excluding the header portion that causes inconvenience (for example, data size inconsistency or content type inconsistency) in the processing of the data by the destination, a header which does not make the content to be received by the destination be extracted.

For example, among the headers exemplified in the description of step S105, the following portions are header portions that limit the type and size of content, and are header portions that limit data that can be transmitted thereafter.
Content-Type: application / octet-stream
Content-Length: 108
Therefore, the extraction unit 24 extracts the part excluding the above-described header part as a header that does not determine the content.

  Although the case where HTTP (Hypertext Transfer Protocol) is used for transmission and reception of content is described as an example in the present embodiment, the present disclosure is applicable to other protocols. For example, if the protocol used to transmit and receive content is POP3 (Post Office Protocol Version 3), the From field, To field, Cc field, Subject field, etc. in the header will limit the type and size of the content. Therefore, the extraction unit 24 extracts the header excluding these parts.

  In addition, the extraction unit 24 determines from the header included in the data acquired by the data acquisition unit 22 the header that does not determine the content to be received at the destination by the amount determined according to the number of transmissions predicted in step S106. It may be extracted. Specifically, the extraction unit 24 may extract a transmittable amount and a header portion by dividing the number of transmissions predicted in step S106. When the amount of extractable header portions is less than the number of transmissions, the extraction unit 24 extracts all header portions whose content is not determined. Thereafter, the process proceeds to step S108.

  In steps S108 and S109, a packet including content is received, and it is determined whether or not the free space of the content buffer is sufficient. The data acquisition unit 22 receives the packet including the content transmitted from the server as a response packet to the content request packet transmitted in step S104 (step S108). Then, the determination unit 32 compares the size of the free space of the content buffer with the size of the next buffered data to determine whether there is a free space for buffering the content included in the received packet. It is determined (step S109).

  Specifically, when the size of the free space of the content buffer is larger than the size of the content portion included in the received packet, the determination unit 32 has enough free space for buffering the received content. It is determined that If it is determined that the free space is sufficient, securing of the free space is unnecessary, so the process proceeds to step S112. On the other hand, when the size of the free space of the content buffer is smaller than the size of the received content, the determination unit 32 determines that the free space for buffering the received content is insufficient. If it is determined that the free space is insufficient, it is necessary to secure the free space, so the process proceeds to step S110.

  In steps S110 and S111, a free area of the content buffer is secured. The transfer unit 28 transfers (sends) the buffered data at the oldest point in time (FIFO: First In, First Out) to the client 90 that is the destination of the data (step S110). . Also, the buffer unit 31 deletes the data transferred in step S109 from the content buffer (step S111). Note that deletion from the content buffer mentioned here is to make it possible to record the data of the packet to be received next in the area in which the transferred data has been recorded, and complete deletion of the data (zero clear etc. Does not mean). Thereafter, the process proceeds to step S112.

  In steps S112 to S115, the received content is inspected. The data acquisition unit 22 acquires data including content before reaching the client 90, and records the acquired data in the content buffer to obtain at least a portion related to the data among the content included in the data. The transfer to the destination client 90 is suspended until the examination is completed (step S112).

  Then, while transfer of data is suspended, the inspection unit 26 inspects according to a predetermined inspection item whether the acquired content is content permitted to be transferred to the client 90. (Step S113). Here, when the data is divided into a plurality of packets and transmitted, the inspection unit 26 extracts and buffers data from the packets each time the plurality of packets are acquired by the data acquisition unit 22. Perform inspections one after another. If it is determined that the content is not permitted to be transferred to the client 90 before the inspection of the entire content is completed, ie, in the middle of the inspection (step S114), the content inspection is interrupted, and the process The process proceeds to step S118. If the examination is not interrupted, the processes from step S108 to step S115 are repeated until the examination of the entire content is completed, and when the examination of the entire content is completed (step S115), the process proceeds to step S116.

  In addition, while the reception and inspection of the content from step S108 to step S115 are performed, the communication inspection apparatus 20 executes the header transmission process in order to prevent timeout of the reception waiting time in the client 90. The details of the header transmission process will be described later with reference to FIG.

  In step S116, the inspection result is determined. If it is determined that the content is content permitted to be transferred to the client 90 as a result of the check in steps S108 to S115, the process proceeds to step S117. On the other hand, if it is determined that the content is content that is not permitted to be transferred to the client 90, the process proceeds to step S118.

  At step S117, data is transferred. The transfer unit 28 transfers (sends) the data excluding the already transmitted portion of the data including the content, that is, the buffered data to the client 90 which is the destination of the data. Thereafter, the process shown in the present flowchart ends.

  In step S118, the transfer of data is stopped, and inspection result information is notified. The cancellation unit 29 cancels the transfer by the transfer unit 28 when the inspection result by the inspection unit 26 is an inspection result that the content is not the content for which transfer of the data to the destination is permitted. Therefore, according to the system of the present embodiment, it is possible to prevent undesired content from being transmitted to the client 90. Then, the inspection result notification unit 30 sets the information for notifying the destination of the data of the inspection result as the part of the data (header, content, etc.) following the portion already transmitted by the transmitting unit 27 during inspection. Send to Specifically, the inspection result notification unit 30 notifies the user of the client 90 that the content requested by the client 90 includes malware or an undesirable expression (for example, a Web page). And a header suitable for the content (for example, a header that limits the type and size of the content), and sends it to the client 90. Thereafter, the process shown in the present flowchart ends.

  FIG. 6 is a diagram showing how buffer processing and content inspection are performed on the entire content when packet processing according to the present embodiment is performed. Here, the inspection of the content is an inspection in which the entire content is integrated into one, and is different from a packet inspection which inspects packets transmitted in sequence. In the present embodiment, in the content inspection, the entire content is inspected as one file, sequentially from the top.

  The content of the inspection is, for example, pattern matching or hash operation, but such processing does not necessarily require that the entire content (file) be loaded on the RAM 13. That is, since these inspections are possible if the contents of the content can be referred to in order from the top, the communication inspection apparatus 20 according to the present embodiment stores the entire content (file) in the RAM 13 (content buffer). The inspection is performed by sequentially referring to the portion buffered by the FIFO method from the beginning of the content without doing so. The portion where the inspection is completed is transferred by the FIFO method according to the free space of the content buffer and is deleted from the content buffer, so it becomes “transferred” in order from the top of the content. Also, content behind the buffered portion is "not received" from the server. However, when there is room in the content buffer, the entire content (file) may be stored in the RAM 13 (content buffer).

  FIG. 7 is a flowchart showing an outline of the flow of header transmission processing according to the present embodiment. The header transmission process according to the present embodiment is executed when the content inspection shown in step S108 to step S115 is started in the packet processing shown in FIG. 4 and FIG.

  In step S201, part of the header is transmitted. The in-inspection transmission unit 27 transmits at least a part of the header included in the data to the client 90 which is the destination of the data. In the present embodiment, a part of the header extracted by the extraction unit 24 or the header generated by the header generation unit 25 is used as data to be transmitted for the timeout prevention, but the timeout is prevented. The data to be transmitted is not limited to the header as long as it does not allow the client 90 to determine the type, size, etc. of the subsequent data to be received. Thereafter, the processing proceeds to step S202.

  In step S202, it is determined whether the end of the examination or the start of data transfer has been made. The in-inspection transmission section 27 determines whether the content inspection shown in step S108 to step S115 of the packet processing described above is completed and whether data transfer for securing a free area of the content buffer is started or not. Do. If it is determined that the content inspection has not ended, the process proceeds to step S203. On the other hand, if it is determined that the content inspection has ended, the processing shown in this flowchart ends. In the present embodiment, it is determined whether the content inspection by the inspection unit 26 is completed to determine whether to continue the header transmission process, but the determination of the continuation / end of the header transmission process May be determined based on whether or not the examination time (calculated in step S106) has elapsed from the start of the examination.

  In steps S203 and S204, when there is no unsent header, a header for preventing time-out is generated. When all the headers extracted in step S107 are transmitted to the client 90 and the transmittable headers are exhausted (NO in step S203), the header generation unit 25 generates a header for time-out prevention (step S204). . The header generated here is, like the header extracted in step S107, a header that does not allow the destination to determine the content to be received. In addition, the header generation unit 25 may generate, for example, an original header whose name starts with "X-" as a header that does not allow the destination to determine the content to be received.

  In the present embodiment, when the extracted header is exhausted, the header generation unit 25 generates a header for time-out prevention and transmits it to the transmission unit 27 during inspection. However, instead of such a configuration, Alternatively, a configuration may be adopted in which the transmitting unit 27 transmits a portion other than the header in the data received from the server (for example, a portion in the content that may be transmitted to the client 90) little by little.

  In step S205, the elapse of the transmission interval is awaited. During the examination, the transmission unit 27 waits for a preset transmission interval to elapse. As described above, in the transmission interval, in the client 90 that receives the content, an interval in which the waiting time for packet reception related to the content does not time out is set in advance. When the transmission interval has elapsed, the process proceeds to step S201, and a part of the continuation of the header is transmitted (step S201). That is, according to the system according to the present embodiment, the transmission unit 27 during inspection checks the headers included in the data at intervals at which the reception waiting time of the data at the destination does not time out while the inspection by the inspection unit 26 is performed. Send part of the data to the destination.

  FIG. 8 and FIG. 9 are diagrams showing flows of packets when packet processing and header transmission processing are performed in the present embodiment. According to the information processing apparatus, the method, and the program according to the present embodiment, while the communication inspection apparatus 20 inspects the data transmitted from the server in response to the content request, the portion (the header Can be divided and sent to the client 90 to prevent timeout during content inspection.

  Also, FIG. 9 shows the flow of packets when the data buffered during inspection is transferred to the client because the size of the content is larger than the size of the content buffer. For example, when the size of the content buffer allocated to one connection or client is equivalent to two packets, the head content is sequentially distributed to the client before buffering the packet including the third of the divided content Transfer and removal from the content buffer are initiated. The processing of transfer / deletion from the content buffer is performed by the FIFO method as described above.

  As a technique for preventing timeout of reception waiting time, conventionally, a technique for preventing timeout in a lower layer such as a TCP (Transmission Control Protocol) layer by transmitting an empty packet at regular intervals (for example, Although, keep-alive in TCP may be used, this did not prevent timeout in the application layer. According to the information processing apparatus, method, and program described in the present embodiment, not only timeout in the lower layer such as the TCP layer but also timeout in the application layer can be prevented.

  Further, according to the information processing apparatus, method, and program according to the present embodiment, the client 90 is prevented from receiving the content until the examination of the entire content is completed without causing the client 90 to time out the reception waiting time. I can do it. Furthermore, when inappropriate content is detected, the user can be notified as response data to the content request of the client 90 without using a dedicated application or the like.

  In the present embodiment, an example in which the present invention is used in HTTP 1.1 has been described, but a protocol to which the present invention can be applied is not limited to the disclosure in the present embodiment. For example, the present invention can be applied to a protocol (e.g., HTTP 2.0) in which the order of packets including content returned for a request in the same session is not limited.

1 system 20 communication inspection device 90 client

Claims (9)

Data acquisition means for acquiring data including content, which flows through the network, before reaching the destination;
Buffer means for buffering the acquired data in a buffer area having a predetermined size;
An inspection unit that inspects the content by referring to the data buffered by the buffer unit in the order corresponding to the order from front to back of the file obtained by being assembled at the destination;
Transfer means for transferring a part of the data buffered by the buffer means, to which the reference by the inspection means is completed, to the destination before the inspection of the entire content is completed;
Determining means for determining whether or not an empty area for buffering a portion included in a newly acquired packet of the data in the buffer area is sufficient ;
The transfer means transfers the portion of the data buffered by the buffer means, which has been referred to by the inspection means, when it is determined by the determination means that the free space is insufficient.
Information processing device. When the data is divided into a plurality of packets and sequentially acquired, the buffer means sets a portion included in the newly acquired packet of the data to an area excluding an area where untransferred data is buffered. Buffer,
An information processing apparatus according to claim 1. The inspection means refers to the buffered data in the above order by controlling the pointer indicating the reference point of the buffer area in the order corresponding to the order from front to back of the file obtained by being assembled at the destination Do,
The information processing apparatus according to claim 2. The determination means compares the size of the part included in the newly acquired packet of the data with the size of the free area of the buffer area to determine whether the free area is sufficient in the buffer area. judge,
The information processing apparatus according to any one of claims 1 to 3 . The inspection unit starts inspection of the content before acquisition of the entire content by the data acquisition unit is completed.
The information processing apparatus according to any one of claims 1 to 4 . The inspection unit inspects whether the content is content permitted to be transferred to the destination.
When the inspection result by the inspection means is the inspection result that the content is the content permitted to be transferred to the destination, the transfer means excludes the transmitted portion of the data including the content Forwarding the data to the destination;
The information processing apparatus according to any one of claims 1 to 5 . The information processing apparatus further comprises abortion means for aborting the transfer by the transfer means when the check result by the check means is a check result that the content is not the content permitted to be transferred to the destination.
The information processing apparatus according to claim 6 . The computer is
A data acquisition step of acquiring data including content, which flows through the network, before reaching the destination;
Buffering the acquired data in a buffer area having a predetermined size;
Examining the content by referring to the data buffered in the buffer step in the order corresponding to the order from front to back of the file obtained by being assembled at the destination;
Transferring the portion of the data buffered in the buffer step, for which the reference in the inspection step is completed, to the destination before the inspection of the entire content is completed;
A determination step of determining whether or not an empty area for buffering a portion included in the newly acquired packet of the data is sufficient in the buffer area ;
In the transfer step, when it is determined in the determination step that the free space is not sufficient, a portion of the data buffered in the buffer step, for which the reference in the inspection step is completed, is transferred.
Method. Computer,
Data acquisition means for acquiring data including content, which flows through the network, before reaching the destination;
Buffer means for buffering the acquired data in a buffer area having a predetermined size;
An inspection unit that inspects the content by referring to the data buffered by the buffer unit in the order corresponding to the order from front to back of the file obtained by being assembled at the destination;
Transfer means for transferring a part of the data buffered by the buffer means, to which the reference by the inspection means is completed, to the destination before the inspection of the entire content is completed;
In the buffer area, it functions as a determination unit that determines whether a free area for buffering a portion included in a newly acquired packet of the data is sufficient ,
The transfer means transfers the portion of the data buffered by the buffer means, which has been referred to by the inspection means, when it is determined by the determination means that the free space is insufficient.
program.

Images