JP7100265B2 - Information processing equipment, information processing systems, control methods, and programs - Google Patents

Description

The present invention relates to relay control of communication with other devices, and more particularly to a method of registering information for specifying a communication destination resource required for relay control.

With the development of network technology, various information has been distributed, and there are very convenient tools that provide such information to many users.

For example, it is possible to obtain a resource desired by a user by clicking a URL for specifying the location of a resource such as HTML or an image on the Internet.

However, recently, by abusing the convenience of such tools and illegally accessing resources, damages such as virus infection and large payments have been required.

As an example of damage caused by misusing such a tool, an e-mail with a URL that identifies the location of an unauthorized resource is unilaterally sent to a user, and the user opens this e-mail and mistakenly opens the e-mail URL. Damage such as clicking has occurred.

Therefore, as a method to solve such a problem, the URL of the e-mail stored in the folder for storing the unsolicited mail is invalidated, while the URL of the e-mail stored in the folder other than such a folder is used. The technique to be activated is disclosed (see, for example, Patent Document 1).

Japanese Patent No. 04974076

However, in the technique described in Patent Document 1, the URL given to the e-mail determined to be junk e-mail is only invalidated by the function of the existing e-mail application software, and the e-mail not determined to be junk e-mail is used. Even so, there is a problem that it is difficult to deal with the case where a URL for specifying the location of an invalid resource is given.

As a method of solving such a problem, there is a method of registering a URL for controlling access in a DB and prohibiting the access when a user tries to access the URL registered in the DB.

In such a method, in order to improve the accuracy of access control, it depends on the accuracy of the URL registered in the DB, and if the URL given to the e-mail is registered in the DB, the URL can be accessed. It is possible to control access, but if it is not registered in the DB, there will be a problem of accessing the URL.

Therefore, the present invention provides an information processing device, an information processing system, a control method, and a program capable of improving security by controlling access to an inappropriate connection destination attached to an e-mail. The purpose is to do.

The present invention for solving the above problems controls the access to the resource, which is performed by the instruction of the first information processing apparatus for receiving the e-mail and the resource-specific information indicating the information for specifying the resource. Is an information processing system connected to the information processing device of the above via a network, and the first information processing device poses a risk of access to the resource with respect to the resource specific information attached to the e-mail. The second information processing apparatus includes the risk determining means, the resource specifying information, and the transmitting means for transmitting the information related to the risk, and the second information processing apparatus includes the resource specifying information transmitted by the transmitting means and the risk. It is characterized by comprising a receiving means for receiving such information and a determining means for determining an action for the access according to the risk received by the receiving means .

According to the present invention, it is possible to improve security by controlling access to an inappropriate connection destination.

It is a block diagram which shows the schematic structure of an information processing system. It is a block diagram which shows the schematic structure of the hardware of an access relay device, a mail relay device, a mail server, an external server, and a client terminal. It is a block diagram which shows the functional structure of an information processing system. It is a flowchart which shows the registration determination process of threat information. It is a flowchart which shows the registration process of threat information. It is a flowchart which shows the control process of Web access. It is a block diagram which shows the structure of the threat information cooperation destination registration screen. It is a block diagram which shows the structure of the threat information linkage source registration screen. It is a block diagram which shows the structure of a threat operation setting screen. It is a block diagram which shows the structure of the threat information search screen. It is a block diagram which shows the structure of each table.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 shows a schematic configuration diagram of an information processing system according to an embodiment of the present invention.

As shown in FIG. 1, the information system 100 according to the present embodiment includes a configuration including an access relay device 102, a mail server 104, a mail relay device 106, a client terminal 108 (providing at least one), and a LAN 110. It is connected to the external server 114 via the wide area network 112.

The access relay device 102 is a device that functions as an information processing device, and relays data between the client terminal 108 and the external server 114 that communicates data via the wide area network 112.

Further, the access relay device 102 controls the communication of the data according to the relay control rule for determining whether or not to relay the data transmitted / received between the client terminal 108 and the external server 114. ing.

The mail server 104 is an information processing device used for sending and receiving e-mails, and has functions such as e-mail address management of e-mails and storage of e-mails sent to the e-mail addresses. There is.

The mail relay device 106 performs transmission control processing for e-mails transmitted from the mail server 104 and client terminal 108 using transmission control rules, and reception control processing for e-mails transmitted from the external server 114 will be described later. This is done using the reception control rule.

Further, the mail relay device 106 accepts or transmits an input of a transmission control rule (reception control rule) used for the transmission control process (reception control process) of the e-mail in response to a request from the user who operates the client terminal 108. As a result of the control process (reception control process), the input (audit input) of transmission (reception) and transmission prohibition (reception prohibition) for the e-mail whose transmission (reception) is suspended is accepted.

The client terminal 108 is a terminal device operated by a user who exchanges e-mails using an e-mail address managed by a mail server 104.

Further, the client terminal 108 is also a terminal device that provides various contents and the like provided from the external server 114 to the user.

Further, the client terminal 108 can refer to and register the relay control rule, the transmission control rule, and the reception control rule stored in the access relay device 102 and the mail relay device 106 via the LAN 110.

The external server 114 is a device that provides various contents and the like to users, and may be installed by a service provider, an individual user, or the like, or may be installed as a mail server owned by an external user. do.

Next, FIG. 2 describes an example of the hardware configuration of the information processing device applicable to the access relay device 102, the mail server 104, the mail relay device 106, and the client terminal 108.

In FIG. 2, 201 is a CPU that comprehensively controls each device and controller connected to the system bus 204. Further, the ROM 202 or the external memory 211 is necessary to realize a function executed by a BIOS (Basic Input / Output System) or an operating system program (hereinafter, OS) which is a control program of the CPU 201, and each server or each PC. Various programs described later are stored.

Reference numeral 203 denotes a RAM, which functions as a main memory, a work area, and the like of the CPU 201. The CPU 201 realizes various operations by loading a program or the like necessary for executing a process from the ROM 202 or the external memory 211 into the RAM 203 and executing the loaded program.

Further, 205 is an input controller, which controls input from a keyboard (KB) 209, a pointing device such as a mouse (not shown), or the like. Reference numeral 206 denotes a video controller, which controls the display on a display such as a CRT display (CRT) 210.

Although it is described as CRT210 in FIG. 2, the display may be not only the CRT but also another display such as a liquid crystal display. These are used by the administrator as needed.

The 207 is a memory controller, which is connected to a hard disk (HD) for storing boot programs, various applications, font data, user files, edit files, various data, etc., a flexible disk (FD), or a PCMCIA card slot via an adapter. It controls access to an external memory 211 such as a compact flash (registered trademark) memory.

Reference numeral 208 denotes a communication I / F controller, which connects and communicates with an external device via a network (for example, LAN 110 shown in FIG. 1), and executes communication control processing on the network. For example, communication using TCP / IP is possible.

The CPU 201 enables display on the CRT 210 by, for example, executing an outline font expansion (rasterization) process in the display information area in the RAM 203. Further, the CPU 201 enables a user instruction with a mouse cursor or the like (not shown) on the CRT 210.

Various programs described later for realizing the present invention are recorded in the external memory 211, and are executed by the CPU 201 by being loaded into the RAM 203 as needed.

Further, a definition file and various information tables used when executing the above program are also stored in the external memory 211, and detailed explanations thereof will be described later.

Next, the functional configuration of the information processing system 100 will be described with reference to FIG. The details of each function will be described with reference to a flowchart described later.

The mail relay device 106 includes a mail receiving unit 300, a mail acquisition unit 302, a registration determination unit 304, a reception control unit 306, a reception control rule storage unit 308, a display unit 310, an input reception unit 312, a transmission unit 314, and a determination result storage unit. It includes 316 and a setting storage unit 317.

The mail receiving unit 300 receives the e-mail transmitted from the mail server 104, the external server 114, or the like, and the mail acquiring unit 302 acquires the e-mail received by the mail receiving unit 300.

The registration determination unit 304 determines whether or not the URL is subject to the filtering by determining the risk of the URL given to the e-mail.

The reception control unit 306 controls the reception of the e-mail by applying the reception control rule to the e-mail acquired by the mail acquisition unit 302, and the display unit 310 displays various screens on the client terminal 108. Take control.

The input receiving unit 312 receives the input of the information input to various screens displayed by the display unit 310, and the transmitting unit 314 transmits the information regarding the result of the determination by the registration determination unit 304 to the access relay device 102. do.

The determination result storage unit 316 stores information regarding the result of determination by the registration determination unit 304, and the setting storage unit 317 stores information regarding the URL in order to control access by the URL acquired by the mail relay device 106. Stores information related to settings such as whether to turn on or off the function of linking with the access relay device 102 (threat information linkage).

The access relay device 102 includes a reception unit 318, a linked URL storage unit 320, a display unit 322, an access control rule storage unit 324, an access control unit 326, and a URL storage unit 328.

The reception unit 318 receives information on the determination result transmitted from the transmission unit 314 of the mail relay device 106, and the cooperation URL registration determination unit 319 registers the linked URL from the information on the determination result received by the reception unit 318. Determine whether or not to do so.

The linked URL storage unit 320 stores information about the linked URL determined to be registered by the linked URL registration determination unit 319.

The display unit 322 controls the display of various screens on the client terminal 108, and the access control rule storage unit 324 stores rules for controlling relay of access requested from the client terminal 108.

The access control unit 326 controls the access by applying the relay control rule stored by the access control rule storage unit 324 to the access requested from the client terminal 108.

The URL storage unit 328 stores and manages the categorized URLs, and a new categorized URL is registered as appropriate.

Next, the registration determination process of the threat information (described later) in the access relay device 102 will be described with reference to the flowchart shown in FIG.

In step S100, the mail acquisition unit 302 acquires the e-mail received from the external server 114 in the mail receiving unit 300.

In step S102, the registration determination unit 304 determines whether or not the e-mail acquired in step S100 is an e-mail received by an external attack, and determines that the e-mail is received by an external attack. If this is the case, the process proceeds to step S104, and if it is not determined that the e-mail is received due to an attack from the outside, the process proceeds to step S114.

As a determination method in this step, for example, when the e-mail to be determined is a virus e-mail, a spam e-mail, a scattered e-mail, or a free e-mail, it is determined that the e-mail is received by an attack from the outside.

In addition, the file attached to the e-mail to be judged contains a continuous blank character in the file name, the file name is RLO controlled, the file name has a double extension, or the file is invalid. When the program is embedded or the file is in the execution format, it is determined that the e-mail to be determined is the e-mail received by an attack from the outside.

Furthermore, if the URL attached to the e-mail to be judged is disguised as having a different actual access destination from the displayed access destination, or if the link destination contains a script, the e-mail to be judged will be the e-mail to be judged. , Determines that the email was received by an external attack.

In step S104, the registration determination unit 304 determines whether or not the function for linking threat information is ON, and if it is determined that it is ON, the process proceeds to step S106 and the function is ON. If not, the process proceeds to step S114.

As a determination method in this step, the determination is made based on the information set in the threat information linkage destination setting file (top of FIG. 11) in the setting storage unit 317.

The threat information linkage destination setting file stores the linkage function on / off that stores whether the threat information linkage function is turned on or off, and the information required for connection with the threat information linkage destination (for example, IP address, etc.). It is configured to include the linked information to be stored.

These information are registered by the threat information linkage destination registration screen 400 shown in FIG. 7, and the threat information linkage destination registration screen 400 has an off selection unit 402 for selecting when the threat information linkage function is turned off, and an off selection unit 402. It is provided with an on-selection unit 404 for selecting when the function for linking threat information is turned on, and is controlled so that either the off-selection unit 402 or the on-selection unit 404 can be selected.

The threat information linkage destination registration screen 400 is displayed on the linkage destination information input unit 406, the off selection unit 402, or the on selection unit 404 for inputting information (for example, IP address, etc.) required for connecting the threat information to the cooperation destination. It is provided with a registration button 408 for pressing when registering the selected information and the information input to the linkage destination information input unit 406, and a cancel button 410 for pressing when canceling the registration of these information. ..

In this step, if it is determined that ON is stored in the linkage function on / off of the threat information linkage destination setting file, the process proceeds to step S106 and it is determined that OFF is stored in the linkage function on / off. If so, the process proceeds to step S114.

In step S106, the registration determination unit 304 extracts information about the URL attached to the e-mail from the e-mail.

In step S108, the registration determination unit 304 obtains the threat level for the URL attached to the e-mail.

This threat level indicates, for example, the degree of damage that the access source suffers from the resource at the URL destination when accessing using the URL.

As an example of how to obtain the threat level, in step S102, it is determined whether or not the e-mail is received by an attack from the outside, but if the URL attached to the e-mail is spoofed, the threat level is determined. If the e-mail is received by an attack from the outside and the URL attached to the e-mail is not spoofed, the threat level is set to middle.

In step S110, the registration determination unit 304 stores information (threat information) regarding the URL and the threat level in the URL list (second from the top of FIG. 11) of the determination result storage unit 316.

The URL list is an access relay device 102 in which the link source identification information indicating the information for specifying the link source (for example, the product name, etc.), the URL, the registration date and time indicating the date and time when the threat information is stored in the URL list, and the threat information are linked. It is composed of the registration reason indicating the reason for registration and the threat level.

In this step, the link source specific information in the URL list includes information for specifying the link source (for example, the name of the product executing this process), and the URL in the URL list includes the URL extracted in step S106 and the URL. The date and time for registering the list is the date and time described above, the reason for registering the URL list is the reason for determining that the e-mail was received by an attack from the outside in step S102, and the threat level of the URL list is determined by step S108. Memorize the requested threat level.

If there are a plurality of URLs extracted in step S106, the registration date and time, the reason for registration, and the threat level are stored corresponding to each URL.

In addition, as the reason for registration, as described above, for example, the e-mail is a virus mail, a spam mail, a scattered mail, a free mail, and the file attached to the e-mail has a blank character in which the file name is continuous. URL attached to an email that contains, the file name is RLO controlled, the file name has a double extension, the file has an embedded malicious program, or the file is in executable format. However, the reason why it is determined that the e-mail is received by an attack from the outside is stored, such as the displayed access destination is disguised as different from the actual access destination, or the link destination contains a script.

In step S112, the transmission unit 314 transmits the URL list in which the threat information is stored in step S110 to the access relay device 102.

In step S114, the reception control unit 306 receives, prohibits, or suspends the reception of the e-mail according to the result of applying the reception control rule for determining the reception control method of the e-mail.

The e-mail conditions to which the reception control rule is applied include the sender condition, the recipient condition, the subject / text condition, the attachment file condition, and the like, and the reception control rule includes the electronic data that meets the above-mentioned conditions. It is configured to include operations that indicate the processing to be applied to mail data.

The operation indicates the process to be applied to the e-mail data that matches the conditions, but one of "reception", "reception prohibited", and "hold" is registered.

When "reception" is registered, the e-mail is sent to the designated destination (client terminal 108).

If "Reception prohibited" is registered, reception of e-mail is prohibited. If "hold" is registered, the reception of e-mail is suspended, and the reception control process is performed according to the instruction of "reception" or "reception prohibition" received from the administrator on a screen (not shown). become.

Next, the threat information registration process will be described using the flowchart shown in FIG.

In step S200, the reception unit 318 determines whether or not the URL list transmitted from the mail relay device 106 has been accepted, and if it is determined that the URL list has been accepted, the process proceeds to step S202.

In step S202, the linkage URL registration determination unit 319 determines whether or not the URL of the URL list received in step S200 is an exclusion target for registration in the threat degree list (described later), and determines that the URL is excluded. If so, the process is terminated, and if it is not determined that the object is excluded, the process proceeds to step S204.

As the determination method in this step, a file (not shown) in which the URL to be excluded from the registration in the threat degree list is stored is used, and the URL received in step S200 is the URL stored in the file. If it is determined that they match, the process ends, and if it is not determined that they match, the process proceeds to step S204.

In order to register such a URL, it is registered by the threat information linkage source registration screen 500 shown in FIG.

The threat information linkage source registration screen 500 is a basic setting area 502 for making basic settings related to threat information registration, and when receiving the threat information from the threat information linkage source in a push type, the setting of information related to the linkage source and linkage. To the push-type cooperation source setting area 504 that performs the setting, the pull-type cooperation source setting area 506 that sets the information related to the cooperation with the cooperation source when receiving the threat information in a pull type from the cooperation source of the threat information, and the threat degree list. It is provided with a registration exclusion URL setting area 508 for setting a URL to be excluded from registration.

The basic setting area 502 is a maximum number of registered items input unit 510 for inputting the maximum number of cases in which the threat information received from the cooperation source can be registered in the threat degree list, and a cycle of registering the threat information received from the cooperation source in the threat degree list. Registration interval input unit 512 for inputting, registration interval unit input unit 514 for inputting the unit of the cycle (for example, seconds, minutes, hours, days, etc.), and the date when threat information was registered in the threat level list. It is provided with 516 elapsed days to be deleted for inputting the number of days from to to the date of deletion.

The push-type linkage source setting area 504 is a push-type linkage OFF selection unit 518 for selecting when threat information is not linked by a push-type from a linkage source, and is selected when threat information is linked by a push-type from a linkage source. It is equipped with a push-type cooperation ON selection unit 520.

Further, the push-type linkage source setting area 504 is set in the push-type linkage source connection information input unit 522 and the push-type linkage source connection information input unit 522 for inputting the connection information (for example, IP address, etc.) of the linkage source to be linked. The connection information addition button 524 pressed to add the input connection information, the connection information correction button 526 pressed to correct the already set connection information, and the connection information already set to be deleted. It is provided with a connection information deletion button 528 that is pressed to.

Further, the push-type linkage source setting area 504 includes a connection information display unit 530 for displaying the connection information that has already been set, and when the connection information addition button 524 is pressed, the push-type linkage source connection information The connection information input to the input unit 522 is additionally displayed on the connection information display unit 530, and when the connection information displayed on the connection information display unit 530 is selected, the connection information is the push-type linkage source connection information input unit 522. When the displayed connection information is corrected and the connection information correction button 526 is pressed, the selected connection information is updated with the corrected connection information in the push-type linkage source connection information input unit 522. Will be done.

Further, when the connection information displayed on the connection information display unit 530 is selected and the connection information deletion button 528 is pressed, the selected connection information is deleted from the connection information display unit 530.

The push-type cooperation source setting area 504 includes a high threat degree designation value input unit 532 for inputting a specified value for classifying which level of threat degree the threat degree received from the cooperation source is. There is.

The threat level is assumed to be high and medium, and if the threat level of the cooperation source corresponds to the value input to the high threat level specified value input unit 532, it is classified as a high threat level and corresponds. If not, it will be classified as a medium threat level.

The pull-type linkage source setting area 506 is a pull-type linkage OFF selection unit 534 for selecting when threat information is not linked by pull-type from the linkage source, and is selected when threat information is linked by pull-type from the linkage source. The pull-type cooperation ON selection unit 536 is provided.

The pull-type linkage source setting area 506 is for inputting a pull-type linkage source connection information input unit 538 for inputting connection information (for example, URL, etc.) of the linkage source to be linked, and a cycle for acquiring threat information to the linkage source. Threat information acquisition interval unit input unit 540, threat information acquisition interval unit input unit 542 for inputting the unit of the cycle (for example, seconds, minutes, hours, days, etc.), threat level received from the cooperation source It is provided with a high threat degree designated value input unit 544 for inputting a designated value for classifying whether it is a level threat level.

The registration exclusion URL setting area 508 is pressed to add the URL input to the exclusion target URL input unit 546 and the exclusion target URL input unit 546 for inputting the URL to be excluded from the registration in the threat degree list. It includes a URL addition button 548, a URL correction button 550 that is pressed to modify an already set URL, and a URL deletion button 552 that is pressed to delete an already set URL.

Further, the registration exclusion URL setting area 508 includes a URL display unit 554 for displaying a URL that has already been set, and when the URL addition button 548 is pressed, the URL is input to the exclusion target URL input unit 546. When the URL is additionally displayed on the URL display unit 554 and the URL displayed on the URL display unit 554 is selected, the URL is displayed on the exclusion target URL input unit 546, and the displayed URL is corrected to correct the URL. When the button 550 is pressed, the selected URL is updated with the corrected URL in the exclusion target URL input unit 546.

Further, when the URL displayed on the URL display unit 554 is selected and the URL deletion button 552 is pressed, the selected URL is deleted from the URL display unit 554.

When the update button 556 is pressed, the threat information linkage source registration screen 500 is input to the basic setting area 502, the push-type linkage source setting area 504, the pull-type linkage source setting area 506, and the registration exclusion URL setting area 508. Information is registered in the threat information linkage setting file (third row from the top row in FIG. 11) and the threshold information file (fourth row from the top row in FIG. 11).

The threat information linkage setting file includes the maximum number of registrations, registration interval, elapsed days to be deleted, linkage function on / off (push), access permission (push), linkage source specific information (push), linkage function on / off (pull). , Data acquisition destination (pull), acquisition interval (pull), and linkage source specific information (pull) are included.

The threshold value information file is configured to include cooperation source specific information, a list item indicating the threat degree (for example, high threat degree, medium threat degree) existing in the cooperation source, and a high threat degree designated value.

The information input on the threat information linkage source registration screen 500 is registered in each of these items. Regarding the threat information linkage setting file, the maximum number of registrations includes the information input to the maximum number of registrations input unit 510. The registration interval is the information input to the registration interval input unit 512 and the registration interval unit input unit 514, and the deletion target elapsed days is the information input to the deletion target elapsed days 516. Is the information selected by the push-type linkage OFF selection unit 518 or the push-type linkage ON selection unit 520, and the access permission (push) includes the information displayed on the connection information display unit 530 and the linkage source specific information (push). Is selected by the pull-type cooperation OFF selection unit 534 or the pull-type cooperation ON selection unit 536 for the information for specifying the cooperation source to be linked by the push type (preset), and for the cooperation function on / off (pull). For the information and data acquisition destination (pull), the information input to the pull-type linkage source connection information input unit 538, and for the acquisition interval (pull), the threat information acquisition interval input unit 540 and the threat information acquisition interval unit input unit. In the information input in 542 and the link source specific information (pull), information (preset) for specifying the link source to be linked by the pull type is registered.

Regarding the threshold information file, the information that identifies the link source regardless of whether it is a pull type or push type (preset) is included in the list item, and the threat level that exists in the link source is included in the list item (preset). Information input to the high threat level designated value input unit 532 or the high threat level designated value input unit 544 is registered in the high threat level designated value.

The threat levels registered in the list items are displayed in a list so that they can be selected in the high threat level designated value input unit 532 or the high threat level designated value input unit 544.

The URL displayed on the URL display unit 554 is stored in a file (not shown) in which the URL to be excluded from the registration in the threat degree list is stored.

In step S204, the cooperation URL registration determination unit 319 determines whether or not the URL of the URL list received in step S200 is a URL stored in the URL storage unit 328, and if it is determined to be a URL, If the process is completed and the URL is not determined, the process proceeds to step S206.

In step S206, the cooperation URL registration determination unit 319 acquires the threshold information for classifying into the high threat degree regarding the cooperation specific source information of the URL list received in step S200 from the high threat degree designated value of the threshold information file.

In step S208, the linked URL registration determination unit 319 determines whether the threat level of the URL list received in step S200 is a high threat level or a medium threat level based on the threshold information acquired in step S206.

In the judgment in this step, when the threshold information has a medium threat level, if the threat level of the linked URL is medium threat level or higher, it is regarded as high threat level, and the high threat level is set in the threshold information. If the threat level of the linked URL is high, the threat level is set to high.

In step S210, the cooperation URL registration determination unit 319 stores the URL of the URL list received in step S200 in the threat information control setting file (the fifth row from the top of FIG. 11).

The threat information control setting file is configured to include an existing threat category indicating a dangerous URL category, a high threat URL indicating a high threat level URL, and a medium threat URL indicating a medium threat level URL.

A dangerous URL category is registered in advance in the existing threat category, a URL determined to have a high threat level in step S210 is registered in the high threat URL, and a medium threat level is registered in the medium threat URL in step S210. The URL determined to be is registered.

Next, the Web access control process will be described using the flowchart shown in FIG.

In step S300, the access control unit 326 determines whether or not there is a Web access request from the client terminal 108, and if it is determined that there is a request, proceeds to step S302.

In step S302, the access control unit 326 determines whether or not the Web access requested in step S300 corresponds to the predetermined exception rule, and if it determines that it corresponds, proceeds to step S310. If it is not determined to be applicable, the process proceeds to step S304.

As an exception rule, regarding Web access that normally has a condition for prohibiting access, Web access is exceptionally permitted, and as a specific example, a URL, a time zone, and an IP address of an access source are conditions. Can be given as.

In step S304, the access control unit 326 determines whether or not the information regarding the URL for specifying the Web access destination requested in step S300 is registered in the threat information control setting file of the linked URL storage unit 320, and registers the information. If it is determined that the processing has been performed, the process proceeds to step S310, and if it is not determined that the registration has been performed, the process proceeds to step S306.

In this step, first, the URL storage unit 328 is inquired as to which category the URL that specifies the Web access destination belongs to, and if the category to which the URL belongs exists, it is determined whether or not the URL belongs to the existing threat category. If it is determined that it is registered, the process proceeds to step S310, and if it is not determined that it is registered, it is determined whether or not the URL that specifies the Web access destination is registered in the high threat URL.

If it is determined that it is registered, the process proceeds to step S310, and if it is not determined that it is registered, then it is determined whether or not the URL that specifies the Web access destination is registered in the medium threat URL. ..

If it is determined that it is registered, the process proceeds to step S310, and if it is not determined that it is registered, the process proceeds to step S306.

In step S306, the access control unit 326 determines whether or not the Web access requested in step S300 corresponds to the predetermined regulation rule, and if it determines that it corresponds, proceeds to step S310. If it is not determined to be applicable, the process proceeds to step S308.

As a regulation rule, accessible time zone, day of the week, URL group that groups URLs, communication method from client terminal 108, data content to be communicated (MIME type, keyword, personal information, size, file type, etc.) are conditions. Can be given as.

In step S308, the access control unit 326 relays the Web access requested in step S300 (permits access and communicates with the URL destination).

In step S310, the access control unit 326 determines that the Web access corresponds to the exception rule, the URL for specifying the Web access destination exists in the threat degree list, or the Web access corresponds to the regulation rule. Take action as the case may be.

In this step, as described in step S304, the action to be executed depending on whether the information regarding the URL for specifying the Web access destination is registered in the existing threat category, the high threat URL, or the medium threat URL is the threat information operation. Since it is registered in the setting file (bottom of FIG. 11), the corresponding action is executed.

The threat information operation setting file determines whether the web access carries a risk for the web access, apart from the exception rule and the regulation rule (whether the URL that specifies the web access destination exists in the threat degree list). It is equipped with an access control on / off for setting whether to turn on or off the function for determining (determining).

If the access control on / off is ON, the process of step S304 is executed, and if it is OFF, the process of step S304 is skipped and the process of step S306 is performed.

In the threat information operation setting file, the existing threat action for setting the action to be executed when the category to which the URL specifying the Web access destination belongs is registered in the existing threat category, and the URL specifying the Web access destination are High threat action to set the action to be executed when registered in the high threat action, action to be executed when the URL specifying the Web access destination is registered in the medium threat action It has a medium threat action.

This information is registered on the threat operation setting screen 600 shown in FIG. The threat operation setting screen 600 includes a URL access regulation off selection unit 602 and a URL access regulation on selection unit 604, and any of these selection units can be selected, and the URL access regulation off selection unit 602 is selected. When the registration is performed, the access control on / off is set to OFF, and when the URL access regulation on selection unit 604 is selected and registered, the access control on / off is set to ON.

The threat operation setting screen 600 is an input area 606 for setting an action to be executed when the information about the URL for specifying the Web access destination is registered in the existing threat category, and is registered in the high threat action. It is provided with an input area 608 for setting an action to be executed, and an input area 610 for setting an action to be executed when registered in the medium threat action.

The input area 606 permits access by inputting a selection unit 612 for selecting a trial (relay), a selection unit 614 for selecting to output a warning, and a password as actions to be executed for Web access. It includes a selection unit 616 for selecting to override, a selection unit 618 for selecting to prohibit access, and a selection unit 620 for selecting to redirect to another URL.

A screen to be output can be selected for each of the selection unit 614, the selection unit 616, and the selection unit 618, and information for specifying the screen displayed on the screen selection unit 622 is selected.

The input area 606 includes a redirect destination URL input unit 624 for inputting a URL to be redirected to the selection unit 620.

Since the input area 608 and the input area 610 have the same input items as the input area 606, the description thereof will be omitted.

When information is input to each of these input areas and the update button 626 is pressed, the information regarding the action input to the input area 606 is registered in the existing threat action, and the information regarding the action input to the input area 608 is high. Information about the action registered in the threat action and input to the input area 610 is registered in the medium threat action.

FIG. 10 shows a threat information search screen 700 for searching a threatening URL. The threat information search screen 700 includes a high threat selection unit 702 for pressing when a high threat URL is targeted for search, and a medium threat selection unit 704 for pressing when a medium threat URL is targeted for search. ing.

If only the high threat selection unit 702 is selected, the URL of the high threat is searched, and if only the medium threat selection unit 704 is selected, the URL of the medium threat is searched and the high threat selection unit is selected. When 702 and the medium threat selection unit 704 are selected, the URLs of the high threat and the medium threat are searched.

The threat information search screen 700 has a search URL input unit 706 for inputting a URL to be searched, a display number input unit 708 for inputting the number of items to be displayed based on the search result, a high threat selection unit 702, and a medium threat selection unit. Unit 704, search button 710 to be pressed when performing a search based on the information input to the search URL input unit 706, clear to be pressed when clearing the information input to each selection unit and input unit. It has a button 712.

The threat information search screen 700 includes a threat level display unit 714 that displays the threat level to be searched, and a URL display unit 716 that displays the URL that is the search target. The threat level display unit 714 has a high threat level. It is displayed based on the input of the selection unit 702 and the middle threat selection unit 704, and the URL input to the search URL input unit 706 is displayed on the URL display unit 716.

Further, the threat information search screen 700 displays a list of search results, and has a deletion target selection unit 718 for selecting a URL to be deleted, a URL display unit 720 that displays the searched URL, and a URL threat. Threat degree display unit 722 that displays the degree, last update date and time display unit 724 that displays the date and time when the URL was registered, cooperation source display unit 726 that displays the cooperation source specific information for specifying the cooperation source of the URL, to the cooperation source It is provided with a linkage source threat degree display unit 728 that displays the threat degree of the URL determined by the above, and a registration reason display unit 730 that displays the reason why the URL is registered.

As for the information related to these search results, first, supplementary information is acquired from the URL list regarding the URL obtained by searching the high threat URL and the medium threat URL from the threat information control setting file.

The URL display unit 720 is the URL of the URL list, the threat level display unit 722 is the high threat URL and the medium threat URL of the threat information control setting file, and the last update date and time display unit 724 is the registration date and time of the URL list. , The linkage source specific information of the URL list is displayed on the linkage source display unit 726, and the registration reason of the URL list is displayed on the registration reason display unit 730.

The threat information search screen 700 includes a delete button 732 to be pressed when deleting the URL selected by the deletion target selection unit 718. When the delete button 732 is pressed, the information about the corresponding URL is deleted from the threat information control setting file and the URL list.

As described above, according to the present invention, it is possible to accurately register information regarding an inappropriate connection destination.

It should be noted that the structure and contents of the various data described above are not limited to this, and it goes without saying that the structure and contents are various depending on the intended use and purpose.

Although one embodiment has been described above, the present invention can take an embodiment as, for example, a method, a program, a recording medium, or the like.

Further, the program in the present invention is a program in which a computer can execute the processing method of the flowchart shown in FIGS. 4 to 6.

As described above, a recording medium recording a program that realizes the functions of the above-described embodiment is supplied to the system or device, and the computer (or CPU or MPU) of the system or device stores the program in the recording medium. Needless to say, the object of the present invention is achieved by reading and executing.

In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program constitutes the present invention.

Recording media for supplying programs include, for example, flexible disks, hard disks, optical disks, optical magnetic disks, CD-ROMs, CD-Rs, DVD-ROMs, magnetic tapes, non-volatile memory cards, ROMs, EEPROMs, and silicon. A disk, solid state drive, etc. can be used.

Further, by executing the program read by the computer, not only the function of the above-described embodiment is realized, but also the OS (operating system) or the like running on the computer is actually realized based on the instruction of the program. Needless to say, there are cases where a part or all of the processing is performed and the processing realizes the functions of the above-described embodiment.

Further, after the program read from the recording medium is written in the memory provided in the function expansion board inserted in the computer or the function expansion unit connected to the computer, the function expansion board is based on the instruction of the program code. It goes without saying that there are cases where the CPU or the like provided in the function expansion unit performs a part or all of the actual processing, and the processing realizes the functions of the above-described embodiment.

It goes without saying that it can also be applied when it is achieved by supplying a program to a system or device. In this case, by reading the recording medium containing the program for achieving the present invention into the system or the device, the system or the device can enjoy the effect of the present invention.

Further, by downloading and reading a program for achieving the present invention from a server, database, or the like on the network by a communication program, the system or device can enjoy the effect of the present invention.

It should be noted that the present invention also includes all the configurations in which each of the above-described embodiments and modifications thereof are combined.

100 Information processing system 102 Access relay device 104 Mail server 106 Mail relay device 108 Client terminal 110 LAN
112 Wide area network 114 External server

Claims (3)

A first information processing device that receives e-mail and a second information processing device that controls access to the resource, which is instructed by the resource-specific information indicating information that identifies the resource, are connected via a network. It is a connected information processing system
The first information processing device is
With respect to the resource-specific information attached to the e-mail, a risk determination means that determines the risk of access to the resource and
A transmission means for transmitting the resource-specific information and the information related to the risk, and
Equipped with
The second information processing device is
A receiving means for receiving the resource-specific information and the risk-related information transmitted by the transmitting means, and the receiving means.
A decision-making means that determines an action for the access according to the risk received by the receiving means.
An information processing system characterized by being equipped with. A first information processing device that receives e-mail and a second information processing device that controls access to the resource, which is instructed by the resource-specific information indicating information that identifies the resource, are connected via a network. It is a control method of the connected information processing system.
The first information processing device is
With respect to the resource-specific information attached to the e-mail, the risk determination step that defines the risk of access to the resource and the risk determination step.
A transmission step for transmitting the resource-specific information and the information related to the risk, and
And run
The second information processing device is
A reception step for receiving the resource-specific information and information related to the risk transmitted in the transmission step, and
A decision step that determines the action for the access according to the risk received in the receive step, and
A method of controlling an information processing system, which is characterized by executing. A first information processing device that receives e-mail and a second information processing device that controls access to the resource, which is instructed by the resource-specific information indicating information that identifies the resource, are connected via a network. A program that can be executed in a connected information processing system
The first information processing device
With respect to the resource-specific information attached to the e-mail, a risk determination means that determines the risk of access to the resource and
A transmission means for transmitting the resource-specific information and the information related to the risk, and
To function as
The second information processing device
A receiving means for receiving the resource-specific information and the risk-related information transmitted by the transmitting means, and the receiving means.
A decision-making means that determines an action for the access according to the risk received by the receiving means.
A program to function as.

Images