JP6948008B2 - Security monitoring device and security monitoring program - Google Patents

Description

The present invention relates to a device and a program for ensuring higher security when browsing a Web page disclosed on the Internet.

A wide variety of Web pages are disclosed on the Internet, and anyone can freely use them using a personal computer or the like. However, some web pages contain harmful content. In this case, even if a part of the Web page contains harmful content, if the entire Web page is disabled, the useful content included in the Web page cannot be used.

Therefore, Patent Document 1 described later discloses an invention relating to a browsing restriction measure or the like that restricts browsing of a Web page containing partially harmful content. The invention disclosed in Patent Document 1 determines whether or not browsing prohibited content is included in the Web page based on the text data included in the acquired resource data of the Web page. Then, when it is determined that the content is included, the range (viewing prohibited range) in the Web page where the viewing prohibited content is displayed is specified, and other display contents replacing the viewing prohibited content are displayed in this viewing prohibited range. It is to replace it so that it does.

As a result, even if the Web page is a mixture of useful contents and harmful contents (viewing prohibited contents), it is possible to use only the useful contents without providing the harmful contents.

Japanese Unexamined Patent Publication No. 2014-56612

However, in some Web pages, an image (so-called advertisement image, etc.) for guiding to a predetermined site for, for example, an affiliate may be displayed. Such images are often images obtained from linked sites rather than text data. Therefore, when an image acquired from another Web page is displayed in the Web page, if the image is viewing prohibited content, the invention disclosed in Patent Document 1 cannot prohibit viewing. Therefore, when it is determined that there is a possibility of a harmful image based on the URL (uniform resource locator) of the link destination, it is conceivable to delete the image so that the image is not displayed. However, in this case, it is considered that the layout of the Web page may be disrupted and useful contents may not be used appropriately.

In addition, when it is determined that there is a possibility of a harmful image, it is conceivable to invalidate the link for displaying the image. However, when the link is disabled, the display area of the image is outlined or the link invalid icon is displayed. For this reason, there is a possibility that the Web page becomes difficult to see, or the user misunderstands that some kind of error has occurred. In addition, if an image that is determined to be a harmful image is deleted or the link is invalidated without the user's recognition, the user will not notice even if the determination is incorrect. .. In this case, you will not be able to use useful sites.

In view of the above, the present invention can appropriately block harmful images from images to be displayed by obtaining information from a link destination in a Web page, and there is an image to be blocked. The purpose is to make it recognizable to the user.

In order to solve the above problems, the security monitoring device of the invention according to claim 1 is
The first receiving means for receiving requests for Web pages from information processing devices,
A request transmission means for transmitting a request to the Web page to a server device on the Internet when a request for the Web page is received through the first reception means.
A response receiving means for receiving a response about the Web page from the server device in response to a request to the Web page.
When a response for the Web page is received through the response receiving means, a determination means for determining whether or not an image acquired from another Web page and displayed is a block target in the Web page.
An original image data storage means that stores and holds image data that forms an image that is determined to be a block target by the determination means.
A pseudo display processing means for processing an image determined to be a block target by the determination means so as to display a pseudo image in the display area without changing the display area of the image on the Web page. ,
A first providing means for providing a response of the Web page processed by the pseudo display processing means, to the requesting information processing apparatus of the Web page,
A second receiving means for receiving a request for returning the pseudo image to the original image from the information processing apparatus provided with the response of the Web page processed by the pseudo display processing means.
When the request for returning the pseudo image to the original image is received through the second receiving means, the pseudo image displayed in the display area is stored in the original image data storage means. Pseudo-display canceling means that performs processing to return to the original image using the image data stored in
It is characterized by comprising a second providing means for providing the response of the Web page processed by the pseudo display canceling means to the information processing apparatus of the request source for returning the pseudo image to the original image. And.

As a result, even if the Web page to be browsed includes an image that is acquired from another Web page and is to be blocked and is to be blocked, a pseudo image is displayed in the display area of the image. By displaying, it is possible to prevent the provision of harmful image content. Moreover, by displaying a pseudo image, it is possible to inform the user that the image to be blocked exists.

According to the present invention, it is possible to appropriately block harmful images from images that are displayed by obtaining information from a link destination in a Web page. In addition, the user can recognize that the image to be blocked exists.

It is a block diagram for demonstrating an example of a security monitoring system configured by using a security monitoring device. It is a block diagram for demonstrating the configuration example of the UTM apparatus. It is a figure for demonstrating the display example of a Web page. It is a figure for demonstrating the display example of a Web page. It is a block diagram for demonstrating the configuration example of a user PC. It is a sequence diagram for demonstrating the operation at the time of performing the restriction processing of the image included in the Web page in the security monitoring system of embodiment. It is a flowchart for demonstrating the detail of the process at the time of performing the display restriction with respect to the image included in the Web page performed by the UTM apparatus 1.

Hereinafter, an embodiment of the apparatus and program of the present invention will be described with reference to the drawings.

[Overall configuration of security monitoring system]
FIG. 1 is a block diagram for explaining an example of a security monitoring system configured by using the UTM (Unified Threat Management) device 1. The UTM device 1 is the one to which one embodiment of the security monitoring device of the present invention is applied. Further, the UTM device 1 is called an integrated threat management device or the like, and as will be described in detail later, the UTM device 1 integrates a plurality of different security functions into one hardware and centrally performs security management related to the network.

As shown in FIG. 1, a plurality of user PCs (Personal Computers) 2 (1), 2 (2), ..., 2 (n) are connected to the UTM device 1 via a LAN (Local Area Network) 3. As a result, a security monitoring system is configured. This security monitoring system is formed in the company, for example, and each of the user PCs 2 (1), 2 (2), ..., 2 (n) is a business PC used by an employee.

Then, as shown in FIG. 1, the UTM device 1 is connected to the Internet 4. As is well known, a large number of HTTP (Hypertext Transfer Protocol) server devices 6 exist on the Internet 4, and various Web pages stored in these HTTP server devices are displayed by an unspecified number of people. It is ready for use. Therefore, the user PCs 2 (1), 2 (2), ..., 2 (n) connected to the LAN 3 access the HTTP server device 6 on the Internet 4 through the UTM device 1 and browse the target Web page. Is possible. The HTTP server device 6 is also called a Web server or the like.

Then, the browser is executed on the user PCs 2 (1), 2 (2), ..., 2 (n) connected to the UTM device 1 through the LAN 3, and the request to the Web page is provided to the UTM device 1. Suppose. The request to this Web page includes the URL (uniform resource locator) of the searched Web page and the input URL.

As shown in FIG. 1, a category classification server device 5 is connected to the Internet 4. The category classification server device 5 stores data indicating what kind of category the Web page specified by the URL belongs to. For such information, for example, a research company that conducts a survey on a Web page identifies a category by referring to and analyzing a Web page published daily, and accumulates data in which the URL and the category are associated with each other. I am trying to do it.

Web page categories include entertainment, media and news, hobbies and sports, business and economy, life and culture, crime and violence, illegal drugs (narcotics, etc.), adult-related, gambling-related, alcoholic beverages, etc. It is diverse. Therefore, by referring to the accumulated information of the category classification server device 5 based on the URL, it is possible to specify what kind of category the Web page specified by the URL belongs to.

Then, it is assumed that the Web page requested by the user PC 2 belongs to, for example, a category preset by the operator of the UTM device 1, such as crime and violence, adult-related, and gambling-related. The UTM device 1 has a function of blocking Web pages belonging to such a preset category.

Further, as shown in FIG. 1, the UTM device 1 includes a display limiting unit 124. As described above, it is assumed that the Web page specified by the request to the Web page from the user PC2 received by the UTM device 1 is determined to be available because it does not belong to a predetermined category. In this case, the UTM device 1 transmits a request for the Web page to the HTTP server device 6 specified by the URL via the Internet 4 to obtain a response for the Web page.

In this case, the display restriction unit 124 of the UTM device 1 analyzes the response of the requested Web page, and determines whether there is an image acquired from another Web page and displayed based on the URL described in this response. Determine. Then, the display restriction unit 124 determines whether or not the image is to be blocked when there is an image to be acquired and displayed from another Web page, and if the image is to be blocked, the display of the image is restricted. Realize the function to do.

That is, it is assumed that the requested Web page itself does not belong to the categories such as crime and violence, adult-related, and gambling-related, which are preset by the operator of the UTM device 1. Therefore, the Web page can be used by the user PC2 of the request source, but it is assumed that there is an image in the Web page that is acquired from another Web page and displayed based on the URL described therein. .. In this case, the display restriction unit 124 of the UTM device 1 refers to the accumulated data of the category classification server device 5 based on the URL, and specifies the category of the Web page that provides the image. When the specified category is a category to be blocked, the display restriction unit 124 restricts the display of the image. Specifically, it processes so as to display a pseudo image instead of the image.

That is, if the image to be blocked is simply deleted, the layout of the Web page is broken and useful information cannot be used appropriately. In addition, since the link to the image is removed, the user may mistakenly recognize that a problem has occurred, such as an icon indicating that the link is invalid is displayed. Therefore, the display restriction unit 124 prevents the occurrence of the layout collapse of the Web page and the display of the link invalid icon by displaying the pseudo image while keeping the display area of the blocked image as it is. I am trying to do it.

Hereinafter, the UTM device 1, the user PC 2 (1), 2 (2), ..., 2 (n) constituting the security monitoring system of this embodiment will be specifically described. The basic configurations of the user PCs 2 (1), 2 (2), ..., 2 (n) are the same. Therefore, unless otherwise specified, each of the user PCs 2 (1), 2 (2), ..., 2 (n) is collectively referred to as the user PC2.

[Configuration example of UTM device 1]
FIG. 2 is a block diagram for explaining a configuration example of the UTM device 1. The UTM device 1 includes a connection terminal 101 to the Internet 4, a communication I / F (interface) 102, and a control unit 110. The communication I / F 102 converts the data transmitted to the own machine via the Internet 4 into data in a format that can be processed by the own machine, takes in the data, and supplies the data to the control unit 110. Further, the communication I / F 102 converts the data from the control unit 110 into data in a format for transmission, and performs a process of transmitting this to a target destination via the Internet 4. Communication with the server device or the like connected to the Internet 4 is performed through the connection end 101 and the communication I / F 102.

The control unit 110 is configured by connecting a CPU (Central Processing Unit) 111, a ROM (Read Only Memory) 112, a RAM (Random Access Memory) 113, a non-volatile memory 114, and a pseudo data memory 115 via a bus. Is. The control unit 110 realizes a function of controlling each unit of the UTM device 1. Data required for various programs and processes are recorded in the ROM 112. The RAM 113 is mainly used as a work area, such as temporarily storing the result in the middle of processing.

The non-volatile memory 114 records programs and data that need to be retained even when the power of the UTM device 1 is turned off, such as additional programs for enhancing functions and setting information set by the user (user). Will be done. Further, although the pseudo data memory 115 will be described in detail later, the pseudo data memory 115 stores and holds pseudo image data to be displayed in place of the image to be blocked existing in the Web page. The pseudo data memory 115 is also used as a temporary storage of image data forming an original image to be blocked when an image corresponding to the pseudo image data is displayed.

A LAN port 131 and a LAN connection end 132 are connected to the control unit 110. In this embodiment, the user PCs 2 (1), 2 (2), ..., 2 (n) shown in FIG. 1 are connected to the LAN connection end 132 to form the LAN 3. Therefore, the UTM device 1 communicates with each of the user PCs 2 (1), 2 (2), ..., 2 (n) through the LAN port 131 and the LAN connection end 132. As a result, each of the user PCs 2 (1), 2 (2), ..., 2 (n) can be connected to the Internet 4 via the UTM device 1.

The UTM device 1 registers and manages what kind of terminal is connected to the LAN 3 in the non-volatile memory 114. Specifically, information that can uniquely identify each terminal such as an IP (Internet Protocol) address or a MAC (Media Access Control address) address as a port number and a terminal ID is associated and managed.

Then, the UTM device 1 includes a P2P countermeasure unit 121, an HP access restriction unit 122, a virus countermeasure unit 123, a display restriction unit 124, a mail countermeasure unit 125, an IPS / IDS unit 126, and a firewall unit 127. Be prepared. These parts realize the function as a security monitoring device.

The P2P countermeasure unit 121 realizes a function of prohibiting P2P connection with a partner who has not taken security measures or a malicious partner. In addition, "P2P" means "Peer to Peer", and means that equal ones directly communicate with each other via the Internet. The function of the P2P countermeasure unit 121 prevents, for example, one-to-one exchange of files such as images with a problematic partner, and realizes a function of preventing virus infection from the partner.

The HP (Home Page) access restriction unit 122 realizes a function of prohibiting access to a homepage corresponding to the category by selecting a homepage category designated in advance, for example. For example, by specifying categories such as illegal drugs (narcotics, etc.), adult-related, and gambling-related, it is possible to filter URLs to inappropriate sites such as drug-related sites, adult sites, and gambling sites.

The antivirus unit 123 verifies the response of the Web page (virus check). More specifically, the antivirus unit 123 realizes a function of monitoring communication when browsing a Web page and verifying (checking) whether or not a virus is mixed in the image to be browsed or the file to be downloaded.

As described above, the display restriction unit 124 blocks this image when there is an image acquired from another Web page based on the URL and displayed in the Web page that has been requested and made viewable. Determine if it is a target. Then, the display restriction unit 124 realizes a function of restricting the display of the image when the image acquired from another Web page and displayed is the block target. The details of the processing performed by the display restriction unit 124 will be described later.

The mail countermeasure unit 125 realizes a function of blocking an e-mail with an unnecessary advertisement or virus attached to the received e-mail. The IPS / IDS unit 126 realizes a function of preventing an inappropriate intrusion and notifying an inappropriate intrusion. Here, IPS is an abbreviation for an intrusion prevention system, and IDS is an abbreviation for an intrusion detection system. The IPS / IDS unit 126 can protect against attacks by so-called malware such as worms and Trojan horses.

The firewall unit 127 determines whether or not to supply data to the internal network based on the data communication status and the software to be used, and realizes a function of protecting the own system from attacks and unauthorized access from the external network. .. In this way, the UTM device 1 is equipped with a plurality of different security functions in one hardware so that it can comprehensively deal with threats that occur in the communication environment.

[Details of processing performed by the display restriction unit 124]
Then, as shown in FIG. 2, the display restriction unit 124 includes a block determination unit 1241, a pseudo display processing unit 1242, and a pseudo display release processing unit 1243. In response to the request from the user PC 2 to the Web page, the UTM device 1 can use the response of the Web page provided by the HTTP server device 6 through the checks in the HP access restriction unit 122 and the antivirus unit 123. Suppose that

In this case, the block determination unit 1241 analyzes the response for the Web page, determines whether or not the Web page has an image acquired from another Web page and displayed based on the URL. If there is, it is determined whether or not the image is to be blocked. Here, the response about the Web page means a resource composed of various information for displaying and making the Web page available. Therefore, the response for the Web page is information in which images, texts, icons, dialogs, menu contents, usage modes, and the like are described in detail.

The block determination unit 1241 of the display restriction unit 124 analyzes the response about the Web page, and first determines whether or not there is an image acquired from another Web page and displayed based on the URL. Here, it is assumed that there is an image acquired from another Web page and displayed based on the URL. In this case, the block determination unit 1241 refers to the accumulated data of the category classification server device 5 based on the URL, and determines whether or not the image is an image provided from a site (Web page) to be blocked. .. When it is determined by this determination that the image is an image provided from a site (Web page) to be blocked, it is determined that the image is an image to be blocked.

When the block determination unit 1241 determines that there is an image to be blocked in the Web page to be viewed, the pseudo display processing unit 1242 functions. The pseudo display processing unit 1242 confirms the response for the Web page, identifies the display area of the image to be blocked in the Web page, and processes so as to display the pseudo image in the display area. ..

3 and 4 are diagrams for explaining a display example of a pseudo image. As shown in FIG. 3A, a viewable Web page is displayed on the screen of the display of the user PC2. In the case of this example, it is assumed that the display area MAR is the display area of the Web page body, and the display areas Ar1, Ar2, and Ar3 of the advertisement image by the image acquired from another Web page are provided on the upper side and the right side thereof. ..

Then, it is assumed that the image of the gambling site is displayed in the display area Ar1, the image of the site of the old book specialty store is displayed in the display area Ar2, and the image of the adult site is displayed in the display area Ar3. As described above, this state can be identified based on the URL used by analyzing the response of the Web page displayed on the screen. In the case of this example, the image of the gambling site in the display area Ar1 and the image of the adult site in the display area Ar3 are the images to be blocked.

In this case, the pseudo display processing unit 1242 confirms the response of the Web page, and specifies the positions and sizes of the display area Ar1 and the display area Ar3. Then, as shown in FIG. 3B, the pseudo display processing unit 1242 displays the pseudo image data stored in the pseudo data memory in the specified display area Ar1 and the display area Ar3. In the case of FIG. 3 (B), a flower pattern image is displayed in place of the image of the gambling site or the adult site that should be displayed as shown in FIG. 3 (A). .. When a pseudo image is displayed, the image data forming the blocked original image is stored and held in, for example, the original image data area provided in the pseudo data memory 115.

In this way, the pseudo image displayed in place of the image to be blocked is not limited to the case of an image similar to the image to be blocked, and is generally obtained from another Web page and displayed. It has the meaning of various images understood as images. In the case of FIG. 3B, the user of the user PC2 can recognize that the image to be displayed in the display areas Ar1 and Ar3 is blocked by displaying the image of the "flower pattern". ..

Moreover, as can be seen by comparing FIG. 3A and FIG. 3B, since the display areas Ar1 and Ar3 themselves have not changed at all, there is no inconvenience such as the layout of the Web page text being disrupted. In addition, since a pseudo image of "flower pattern" is displayed with respect to the original image, the display areas Ar1 and Ar3 are not outlined and the link invalid icon is not displayed. The user does not misunderstand that some kind of inconvenience has occurred.

In addition, as an example of the description in the case of displaying the image acquired from another Web page in the response about the Web page, for example, there is one using "iframe (inline frame)". More specifically, it is described as "<iframe width =" width "height =" height "src =" absolute path / relative path "scrolling =" auto "> </ iframe>". Thereby, the contents of another Web page specified by the absolute path or the relative path can be displayed in the display area specified by the "width" and the "height" in the Web page.

Therefore, the block determination unit 1241 of the display restriction unit 124 identifies another Web page that specifies the image based on such a description existing in the response about the Web page. When the specified Web page should be blocked, a display area for displaying an image of another Web page is specified, and a process of displaying a pseudo image in the display area is performed. The description using "iframe (inline frame)" is just an example, and the display restriction unit 124 also displays an image acquired from another Web page in the Web page by various other descriptions. , It is possible to distinguish this.

Further, as shown in FIG. 4, the original image may be mosaic-processed and displayed as a pseudo image. That is, FIG. 4A shows the same state as that of FIG. 3A, and the display area Mar of the Web page body and the display areas Ar1, Ar2, Ar3 of the advertisement image are displayed on the display screen of the user PC2. It shows the case where it is done. Then, it is assumed that the images displayed in the display area Ar1 and the display area Ar3 are the images to be blocked by the image from the gambling site and the image from the adult site.

In this case, as shown in FIG. 4B, the pseudo display processing unit 1242 performs mosaic processing on the original image (image acquired from the gambling site) to be displayed in the display area Ar1 to perform pseudo display processing. Image is formed and displayed in the display area Ar1. Similarly, as shown in FIG. 4B, the pseudo display processing unit 1242 performs mosaic processing on the original image (image acquired from the adult site) to be displayed in the display area Ar3 to perform pseudo display processing. An image is formed and displayed in the display area Ar3. As shown in FIG. 4B, by displaying the mosaic-processed pseudo image in place of the image to be blocked to be displayed in the display areas Ar1 and Ar3, the same as in the case described with reference to FIG. The effect of can be obtained.

That is, as can be seen by comparing FIG. 4A and FIG. 4B, since the display areas Ar1 and Ar3 themselves have not changed at all, there is no inconvenience such as the layout of the Web page body being disrupted. Further, by displaying a pseudo image obtained by performing mosaic processing on the original image, the display areas Ar1 and Ar3 are not outlined and the link invalid icon is not displayed. Therefore, the user does not misunderstand that some kind of inconvenience has occurred regarding the link. Further, the user of the user PC2 recognizes that the image that should be originally displayed in the display areas Ar1 and Ar3 is blocked by displaying the pseudo image obtained by performing the mosaic processing in the display areas Ar1 and Ar3. can.

Even when displaying the mosaic-processed pseudo image, the image data forming the blocked original image is stored and held in, for example, the original image data area provided in the pseudo data memory 115.

Then, as described with reference to FIGS. 3 (B) and 4 (B), it is assumed that a pseudo image is displayed in the display areas Ar1 and Ar3 and the requested Web page is displayed. As described above, in the case of FIGS. 3 (B) and 4 (B), the image displayed in the display areas Ar1 and Ar3 is a pseudo image, and the user PC2 indicates that the original image is blocked. I know the user of.

Therefore, when the user of the user PC2 instructs the position on the display area Ar1 using, for example, a mouse, the instruction information is provided to the UTM device 1, and the pseudo display release process is performed under the control of the control unit 110. Unit 1243 functions. In this case, the pseudo display release processing unit 1243 replaces the pseudo image (flower pattern image or mosaic processed image) displayed in the display area Ar1 with the Web page displaying the original image in the display area Ar1. Form the response of.

As the original image, as described above, when the display image is replaced, the original image data stored and held in the original image data area of the pseudo data memory is used. Then, the response of the Web page displaying the original image in the display area Ar1 is provided to the user PC2. As a result, the user PC 2 displays the Web page on which the original image shown in the display area Ar1 of FIGS. 3 (A) and 4 (A) is displayed.

Similarly, when the user of the user PC2 instructs the position on the display area Ar3 using, for example, a mouse, the instruction information is provided to the UTM device 1, and the pseudo display release process is performed under the control of the control unit 110. Unit 1243 functions. Then, the pseudo display release processing unit 1243 replaces the pseudo image (flower pattern image or mosaic processed image) displayed in the display area Ar3, and displays the original image in the display area Ar3 of the Web page. Form a response.

The original image also corresponds to the original image data stored and held in the original image data area of the pseudo data memory 115. Then, the response of the Web page displaying the original image in the display area Ar3 is provided to the user PC2. As a result, the user PC 2 displays the Web page on which the original image shown in the display area Ar3 of FIGS. 3 (A) and 4 (A) is displayed.

Of course, when the display of the original image is restored, the link to the site corresponding to the original image is also restored. As a result, even if the block determination unit 1241 makes an erroneous determination, it is possible to use a site that is originally linked and can be used. It should be noted that there is a case where the block determination unit 1241 is not erroneously determined, that is, the blocked image is an image to be blocked.

However, when the image is clicked and the link destination is used, the fact of use can be identified by the function of the UTM device 1, for example, by log data or the like. Then, if you unblock the image and use a Web page that should not be used originally without business need, a warning that you may be subject to punishment etc. is displayed or voice output is output. It is also possible to suppress the use by such as.

[Configuration example of user PC2]
FIG. 5 is a block diagram for explaining a configuration example of the user PC 2. As shown in FIG. 5, the user PC 2 includes a LAN connection end 201 and a LAN port 202. Communication is performed with the UTM device 1 through the LAN connection terminal 201 and the LAN port 202. Further, the user PC 2 includes a display controller 203 and a display 204, an audio output processing unit 205 and a speaker 206, an operation input interface (hereinafter, referred to as an operation input I / F) 231 and an operation unit 232. Each of these parts functions as a user interface.

Further, the user PC 2 includes a control unit 210 and a storage device 221. The control unit 210 is formed by connecting the CPU 211, the ROM 212, the RAM 213, and the non-volatile memory 214 through a bus, realizes a function of controlling each unit, and also functions as an application execution unit that executes various application software. The storage device 221 includes, for example, a hard disk as a large-capacity storage medium, and also has a mechanism for writing / reading data to the hard disk.

The user PC 2 is connected to the UTM device 1 through the LAN connection end 201. The LAN port 202 converts the packet data addressed to the own machine transmitted through the UTM device 1 into a format that can be processed by the own machine and captures it, and also converts the packet data transmitted from the own machine into a format for transmission. And send it. The control unit 210 also functions as a packet processing unit that decomposes received and captured packet data so that it can be used, and generates packet data for transmission.

Then, the user PC 2 can receive various instruction inputs from the user (user) through the operation unit 232 and the operation input I / F231. The operation unit 232 is a pointing device such as a keyboard or a so-called mouse. It is assumed that the browser application is executed in the control unit 210 of the user PC 2 by the instruction input input through the operation unit 232 and the operation input I / F 231. In this case, the control unit 210 forms a request for the target Web page and transmits it to the UTM device 1.

The UTM device 1 accesses the HTTP server device 6 on the Internet 4 in response to a request to the Web page, obtains a response of the Web page, and provides the response to the request source user PC2. In this case, the UTM device 1 performs a security check by the various security functions described above, and provides a Web page response to the requesting user PC 2 when there is no problem.

When the request source user PC2 receives the response of the Web page, the control unit 210 decomposes the Web page response (packet data) as described above. Then, the control unit 210 supplies the display data to the display controller 203 and the audio data to the audio output processing unit 205.

The display controller 203 forms a video signal to be supplied to the display from the display data supplied to the display controller 203, and supplies the video signal to the display 204 to display the display information provided by the Web page on the display screen of the display 204. Further, the audio output processing unit 205 forms an audio signal to be supplied to the speaker 206 from the audio data supplied to the audio output processing unit 205, and by supplying this to the speaker 206, the audio information provided by the Web page is released from the speaker 206. Make a sound. Further, various programs can be downloaded from various HTTP server sites and executed by the control unit 210.

In addition to this, in the control unit 210, by executing the mail application, an e-mail is created and sent to the mail server of the target destination, or an e-mail addressed to the own machine is acquired and this is performed. Can also be displayed on the display 204. Of course, the transmitted e-mail and the received e-mail can be stored in the storage device 221 and read out and used as needed. In addition, various information processing can be performed according to various application software executed by the control unit 210.

[Operation of security monitoring system]
FIG. 6 is a sequence diagram for explaining the operation when the image included in the Web page is restricted in the security monitoring system of this embodiment. The security monitoring system of this embodiment is composed of a UTM device 1 and a plurality of user PCs 2. Then, even if the Web page requested by the user PC2 is available, it is an image acquired from another Web page and displayed in the available Web page, which is a harmful image to be blocked. Suppose that exists. In such a case, the UTM device 1 is characterized in that it functions to appropriately block harmful images existing in available Web pages.

It is assumed that the browser is executed on the user PC2 and is operated to display the target Web page (step S1). In this case, the control unit 210 of the user PC 2 forms a request for the instructed Web page and provides the request to the UTM device 1 (step S2). When the control unit 110 of the UTM device 1 receives a request for a Web page from the user PC 2, the HP access restriction unit 122 functions and checks whether the Web page itself should be blocked. If there is no problem in checking the HP access restriction unit 122, the control unit 110 transmits a request to the Web page to the HTTP server device 6 storing the Web page via the Internet 4 (step). S3). In response to this, the HTTP server device 6 transmits a response regarding the Web page to the UTM device 1 (step S4).

In the UTM device 1 that has received the response for the Web page, the antivirus unit 123 functions to perform a virus check for the response for the Web page. If there is no problem in this virus check, the display restriction unit 124 functions and executes the pseudo display process (step S5). In this step S5, the response for the Web page is analyzed, and it is determined whether or not there is an image to be blocked that is an image acquired from another Web page in the Web page. More specifically, the display restriction unit 124 refers to the accumulated data of the category classification server device 5 on the Internet 4 based on the URL of the other Web page, and acquires it from the other Web page in the Web page. Determine if the image is an image that should be blocked.

In the pseudo display process of step S5, it is assumed that an image acquired from another Web page exists in the Web page, and it is determined that the image is an image to be blocked. In this case, the display limiting unit 124 identifies the display area of the image to be blocked, accesses the pseudo data memory 115 to acquire the pseudo image to be displayed in the display area (step S6), and acquires the pseudo image. (Step S7). Then, a response of the Web page so as to display the acquired pseudo image in the specified display area is formed, and this is provided to the user PC2 of the request source (step S8).

If there are multiple images to be acquired and displayed from other Web pages in the requested Web page, it is determined whether or not each of them is an image to be blocked and an image to be blocked. If, the replacement with a pseudo image is performed. Also, even if there is an image acquired from another Web page and displayed in the requested Web page, if it is determined that the image does not need to be blocked, it can be replaced with a pseudo image. It will never be done.

Then, the request source user PC 2 processes the response for the provided Web page, and the control unit 210 functions the browser to output the Web page (step S9). Specifically, the image of the Web page is displayed on the display 204 through the display controller 203, and the sound of the Web page is emitted from the speaker 206 through the sound output processing unit 205.

Therefore, in step S2, conventionally, as shown in FIG. 3A, a Web page is requested in which the image of the gambling site is displayed in the display area Ar1 and the image of the adult site is displayed in the display area Ar3. Suppose you did. In the UTM device 1 of this embodiment, the display limiting unit 124 functions, and the image displayed in the display area Ar1 and the display area Ar3 by the pseudo display process in step S5 is a pseudo image without changing the display area. Can be replaced with. As a result, when the browser functions in step S9 and the Web page is output, harmful images that should be displayed in the display area Ar1 and the display area Ar3 can be prevented from being displayed as shown in FIG. 3 (B). (Can be blocked).

In this way, it is possible to block harmful images, but there is a possibility that the display limiting unit 124 may make a mistake in determining whether or not the images are harmful. Therefore, in the UTM device 1 of this embodiment, it is possible to display a blocked image in response to an instruction from the user of the user PC 2. That is, it is assumed that a predetermined operation such as clicking on the display areas Ar1 and Ar3 replaced with the pseudo image is performed on the user PC2. In this case, the display restriction unit 124 of the user PC 2 forms a release request requesting that the original image be displayed in the instructed display area, and provides this to the UTM device 1 (step S10).

In the UTM device 1, the display limiting unit 124 functions to perform a pseudo display release process (step S11). In this step S11, the pseudo data memory 115 is requested with image data for forming the original image to be originally displayed in the instructed display area (step S12), and the image data of the original image is acquired (step S13). Then, instead of the pseudo image displayed in the instructed display area, a release response of the Web page that displays the original image is formed, and this is provided to the requesting user PC2. (Step S14).

Then, the request source user PC 2 processes the release response for the provided Web page, and the control unit 210 functions the browser to output the Web page (step S15). The process of step S15 is the same process as the process of step S9. However, in step S15, as shown in FIG. 3A, a Web page displaying the original image before being blocked is displayed in the display areas Ar1 and Ar3.

[Details of processing of UTM device 1]
FIG. 7 is a flowchart for explaining a process for restricting the display of an image included in a Web page performed by the UTM device 1. The processing of the flowchart shown in FIG. 7 is a processing mainly executed by the control unit 110 and the display limiting unit 124.

The control unit 110 of the UTM device 1 monitors whether or not a request has been provided by the user PCs 2 (1), 2 (2), ..., 2 (n) connected to the UTM device 1 via LAN3 ( Step S101). When it is determined in the determination process of step S101 that the request from the user PC 2 has not been provided, the process of step S101 is repeated and the arrival of the request from the user PC 2 is awaited.

It is assumed that in the determination process of step S101, it is determined that the request provided by the user PC2 has been received. In this case, the control unit 110 determines whether or not the received request is a request to the Web page (requesting the provision of the Web page) (step S102). It is assumed that it is determined that the request to the Web page has been accepted in the determination process in step S102. In this case, the control unit 110 controls the HP access restriction unit 122 and performs a category check. If there is a problem in this category check, the Web page is disabled, but if there is no problem, a request for the Web page is transmitted to the target HTTP server device 6 via the Internet 4 (step S103).

After that, since the response about the Web page is transmitted from the HTTP server device 6, the control unit 110 of the UTM device 1 receives this (step S104). Then, the control unit 110 controls the antivirus unit 123 to perform a virus check. If there is a problem in this virus check, the Web page is disabled, but if there is no problem, the control unit 110 controls the display restriction unit 124 to execute the pseudo display process (step S105).

In the pseudo display process performed in step S105, first, the block determination unit 1241 of the display restriction unit 124 functions, analyzes the response about the Web page received in step S104, acquires the image from another Web page, and displays the image. Check if there is. Then, when there is an image acquired from another Web page and displayed, the block determination unit 1241 refers to the accumulated data of the category classification server device 5 based on the URL of the other Web page, and refers to the image. Determines if is an image to block.

It is assumed that the requested Web page is an image acquired from another Web page and displayed, and it is determined that there is an image to be blocked. In this case, the pseudo display processing unit 1242 functions to specify the display area of the image to be blocked, and the image corresponding to the image data forming the pseudo image acquired from the pseudo data memory in the specified display area. Is displayed. As a result, a response is formed for the Web page in which a pseudo image is displayed in the display area of the image to be blocked. The image data of the blocked original image is stored in the original image data area of the pseudo data memory 115 and made available as needed.

Further, the pseudo display process of step S105 is performed for each of a plurality of images acquired from other Web pages in the Web page. As a result, even if images that should be blocked and images that do not need to be blocked are mixed in one Web page, the images that should be blocked are replaced with pseudo images, and the images that do not need to be blocked are replaced with pseudo images. The image is displayed as it is.

The response for the Web page formed by the pseudo display process of step S105 is provided to the request source user PC2 (step S106), and the process from step S101 is repeated. As a result, on the display screen of the user PC2 of the request source, the target Web page in which the pseudo image is displayed in the display area of the image to be blocked is displayed and made available.

Further, it is assumed that in the determination process of step S102, it is determined that the received request is not a request to the Web page. In this case, the control unit 110 determines whether the received request is a display request for the blocked original image (original image), in other words, a request for canceling the display-restricted image (step S107). ..

In the determination process of step S107, it is assumed that the received request is determined to be a blocked original image display request. In this case, the control unit 110 controls the pseudo display release processing unit 1243 of the display restriction unit 124 to perform the pseudo display release process (step S108). In step S108, the pseudo display release processing unit 1243 acquires the image data of the original image that should be originally displayed in the instructed display area from the original image data area of the pseudo data memory. Then, the pseudo display release processing unit 1243 forms a response (release response) for canceling the pseudo display by displaying an image based on the acquired original image data in the instructed display area.

Then, the pseudo display release processing unit 1243 provides the release response formed in step S108 to the request source user PC 2 (step S109), and repeats the process from step S101. As a result, the user PC2 that provides the cancellation request displays the target Web page on which the original image that should be blocked is displayed and makes it available.

In the determination process of step S107, it is determined that the received request is not a blocked original image display request. In this case, the control unit 110 executes the process according to the received request (step S110), and repeats the process from step S101. As a result, the original Web page on which images acquired from other Web pages are also displayed is displayed on the display 204 of the requesting user PC2.

Further, in FIGS. 6 and 7, the image to be blocked is described as being replaced with a pseudo image, but the present invention is not limited to this. In the pseudo image display process shown in step S5 of FIG. 6 and the pseudo image display process shown in step S105 of FIG. 7, as described above, the image to be blocked is subjected to mosaic processing, and the image after the mosaic processing is performed. May be displayed in the original display area.

[Effect of Embodiment]
As is clear from the explanation of the sequence diagram of FIG. 6 and the explanation of the flowchart of FIG. 7, if the requested Web page can be used without any problem in the category check and the virus check on the user PC 2, the request is made. Be made available. However, if there is an image to be blocked that is an image acquired from another Web page in the Web page, the image can be blocked by the function of the UTM device 1.

In this case, the method of blocking the image is not a method of deleting the image including the display area or disconnecting a link to another Web page that acquires the image, but a process of replacing the display area with a pseudo image as it is. conduct. Therefore, there is no problem that the layout of the Web page body is deviated or the link invalid icon is displayed. In addition, the display of the original image can be restored if necessary.

[Modification example]
In the above-described embodiment, for example, a flower pattern image is displayed instead of the original image (image to be blocked), or a mosaic-processed image is displayed on the image to be blocked, but the present invention is limited to this. It's not a thing. Instead of the original image that should be blocked, for example, a message image such as "This is an image of a gambling site. It was blocked." Is displayed, the original image is processed to be blurred, and the original image is blurred. You may display a message to the effect that it has been blocked. That is, as the pseudo image to be displayed instead of the image to be blocked, various forms can be used.

Further, in the above-described embodiment, the image data prepared in advance in the pseudo data memory 115 is used instead of the original image (image to be blocked), but the present invention is not limited to this. For example, the URL of the Web page for acquiring the pseudo image may be used instead of the URL of the Web page for acquiring the original image, and the original image may be replaced with the pseudo image. That is, the image file can be replaced by replacing the URL.

Further, in the above-described embodiment, the category classification server device 5 is provided on the Internet 4, but the present invention is not limited to this. For example, the UTM device 1 may be provided with a storage device, and the information stored and managed by the category classification server device 5 may be stored and managed by the storage device of the UTM device 1 and used.

Further, in the above-described embodiment, the image data of the pseudo image to be displayed instead of the image to be blocked has been described as being stored and held in the pseudo data memory 115 of the UTM device 1, but the present invention is limited to this. It's not a thing. The image data of the pseudo image is prepared in a predetermined server device on the Internet 4, and the UTM device 1 accesses the server device through the Internet 4 and uses the data stored in the server device. It may be.

Further, an information processing device having the same function as the category classification server device 5 may be provided on the LAN connected to the UTM device 1 and used. Similarly, a pseudo data memory may be provided in an information processing device provided on the LAN connected to the UTM device 1 and used.

In addition, if there is an image to be blocked in the requested Web page, and after blocking the image to display a pseudo image, if a request is made to display the original image, in that case Make sure to accumulate log data. Then, the administrator of the security management system can check the log data at any time to prevent unauthorized use.

In addition, if there is an image to be blocked in the requested Web page, and after blocking the image to display a pseudo image, if a request is made to display the original image, the request is made. The occurrence may be notified to the system administrator. In this case, an image to be unblocked may be provided to the system administrator, and a blocked image to be notified in real time may be displayed when the approval of the system administrator is obtained.

[others]
As can be seen from the description of the above-described embodiment, the function of the security monitoring device is realized by the UTM device 1. Corresponding the constituent means of the security monitoring device according to the claim with the constituent portion of the UTM device 1 of the embodiment is as follows. The functions of the first receiving means and providing means are realized by the LAN port 131 and the LAN connection end 132. Further, the functions of the request transmitting means and the response receiving means are realized by the connection terminal 101 to the Internet 4 and the communication I / F 102. Further, the function of the discriminating means is realized by the block discriminating unit 1241 of the display limiting unit 124, and the function of the pseudo display processing means is realized by the pseudo display processing unit 1242 of the display limiting unit 124.

Further, the functions of the second receiving means and the second providing means are realized by the LAN port 131 and the LAN connection end 132. Further, the function of the pseudo display release means is realized by the pseudo display release processing unit 1243 of the display restriction unit 124.

Further, a program that executes the process executed by the UTM device 1 in the timing chart of FIG. 6 and the process performed by the UTM device 1 shown in the flowchart of FIG. 7 is an embodiment of the security monitoring program of the present invention. It has been applied. Therefore, the functions of at least the display limiting units 124 of the UTM device 1 shown in FIG. 2 can be realized as the functions of the control unit 110 by the program executed by the control unit 110.

1 ... UTM device, 101 ... Connection end to the Internet, 102 ... Communication I / F, 110 ... Control unit, 111 ... CPU, 112 ... ROM, 113 ... RAM, 114 ... Non-volatile memory, 115 ... Pseudo data memory, 121 ... P2P countermeasure unit, 122 ... HP access restriction unit, 123 ... Virus countermeasure unit, 124 ... Display restriction unit, 1241 ... Block discrimination unit, 1242 ... Pseudo display processing unit, 1243 ... Pseudo display cancellation processing unit, 125 ... Mail countermeasure unit , 126 ... IPS / IDS unit, 127 ... firewall unit, 131 ... LAN port, 132 ... LAN connection end, 2 ... user PC, 201 ... LAN connection end 201, 202 ... LAN port, 203 ... display controller, 204 ... display, 205 ... Audio output processing unit, 206 ... Speaker, 210 ... Control unit, 211 ... CPU, 212 ... ROM, 213 ... RAM, 214 ... Non-volatile memory, 221 ... Storage device, 231 ... Operation input I / F, 232 ... Operation Department, 3 ... LAN, 4 ... Internet, 5 ... Category classification server device, 6 ... HTTP server device

Claims (5)

The first receiving means for receiving requests for Web pages from information processing devices,
A request transmission means for transmitting a request to the Web page to a server device on the Internet when a request for the Web page is received through the first reception means.
A response receiving means for receiving a response about the Web page from the server device in response to a request to the Web page.
When a response for the Web page is received through the response receiving means, a determination means for determining whether or not an image acquired from another Web page and displayed is a block target in the Web page.
An original image data storage means that stores and holds image data that forms an image that is determined to be a block target by the determination means.
A pseudo display processing means for processing an image determined to be a block target by the determination means so as to display a pseudo image in the display area without changing the display area of the image on the Web page. ,
A first providing means for providing a response of the Web page processed by the pseudo display processing means, to the requesting information processing apparatus of the Web page,
A second receiving means for receiving a request for returning the pseudo image to the original image from the information processing apparatus provided with the response of the Web page processed by the pseudo display processing means.
When the request for returning the pseudo image to the original image is received through the second receiving means, the pseudo image displayed in the display area is stored in the original image data storage means. Pseudo-display canceling means that performs processing to return to the original image using the image data stored in
It is characterized by comprising a second providing means for providing the response of the Web page processed by the pseudo display canceling means to the information processing apparatus of the request source for returning the pseudo image to the original image. Security monitoring device. The security monitoring device according to claim 1.
The pseudo-display processing means is a security monitoring device that uses other image data to form the pseudo-image to be displayed in the display area. The security monitoring device according to claim 1.
The pseudo display processing means performs a mosaic process on the image determined to be a block target by the discriminating means to form the pseudo image to be displayed in the display area. Device. The security monitoring device according to claim 1.
The pseudo display canceling means returns the original image including a link to a site corresponding to the original image in the process of returning to the original image.
When a site corresponding to the original image is used through the information processing device, a usage fact-finding means that forms and holds data that makes it possible to identify the fact of use, and a usage fact-identifying means.
An output instruction means for instructing the information processing device to output a warning when the site corresponding to the original image is used through the information processing device.
A security device characterized by being equipped with. A security monitoring program executed by a computer installed in a security monitoring device.
The first reception step of receiving a request to a Web page from an information processing device through the first reception means,
In the first reception step, when a request to the Web page is received, a request transmission step of transmitting a request to the Web page to a server device on the Internet through a request transmission means, and a request transmission step.
A response receiving step of receiving a response about the Web page from the server device in response to a request to the Web page through the response receiving means.
When a response for the Web page is received in the response receiving step, the determination means determines whether or not the image acquired from another Web page and displayed in the Web page is a block target. ,
An original image data recording step in which the recording means records the image data forming the image determined to be the block target in the determination step in the original image data storage means.
For an image determined to be a block target in the determination step, the pseudo display processing means processes the image so that the pseudo image is displayed in the display area without changing the display area of the image on the Web page. Pseudo-display processing steps to be performed and
The first providing step of providing the response of the Web page processed in the pseudo display processing step to the information processing device of the request source of the Web page through the first providing means .
A second reception means for receiving a request for returning the pseudo image to the original image from the information processing apparatus provided with the response of the Web page processed in the pseudo display processing step. Reception step and
When the request for returning the pseudo image to the original image is received through the second reception step, the pseudo display canceling means displays the pseudo image displayed in the display area. A pseudo display release step of performing a process of returning to the original image using the image data stored and held in the original image data storage means, and
A second provision step of providing the response of the Web page processed in the pseudo display release step to the information processing apparatus of the request source for returning the pseudo image to the original image through the second providing means. A security monitoring program characterized by running and.

Images