Packet security system, network system, packet security method, and packet security program

Abstract

To provide a packet security system, a network system, a method, and a program that reduce the costs of security scan processing and communication traffic.SOLUTION: In a network system 100, a packet security system 102 has a content rewriting function 121 that acquires content from an HTTP server 104 according to a request from a client 101, inspects safety of the content, and rewrites safe link information contained in the content to character string information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a packet security system, a network system, a packet security method, and a packet security program. [Background technology]

[0002] Methods for inspecting packets on a network can be roughly divided into SPI (Stateful Packet Inspection) and DPI (Deep Packet Inspection). Conventionally, SPI was mainstream, which inspected the destination and source IP addresses contained in the header, but there are cases where the header of a packet looks normal but a virus is embedded in the body, so DPI, which inspects the contents of the data body of the packet (body), is also being used (see Patent Document 1, for example). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-107935 A Summary of the Invention [Problem to be solved by the invention]

[0004] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis was conducted by the present inventors.

[0005] However, in a security system that performs DPI scanning of packet communications on a network route, when scanning communications that provide multiple contents by HTTP (HTTPS) on a single domain, even if some of the communications contain contents that have been confirmed to be safe, it becomes redundant to perform security scanning on all of them. This increases the costs of security scanning processing and communication volume for the security system, and increases service costs.

[0006] In view of the above-mentioned problems, an object of the present invention is to provide a packet security system, a network system, a packet security method, and a packet security program that contribute to reducing costs for security scan processing and communication traffic. [Means for solving the problem]

[0007] In a first aspect of the present invention, there is provided a packet security system having a content rewriting function that, in response to a request from a client, retrieves content from an HTTP server, inspects the safety of the content, and rewrites safe link information contained in the content to character string information.

[0008] In a second aspect of the present invention, there is provided a network system comprising: a packet security system having a content rewriting function that, in response to a request from a client, obtains content from an HTTP server, inspects the safety of the content, and rewrites safe link information contained in the content to character string information; a DNS server that responds to an inquiry about an IP address related to the link information rewritten by the packet security system so that the HTTP server can be accessed without going through the packet security system; and a proxy that reverse-converts the link information rewritten by the packet security system to restore the original link information, and then requests content based on the original link information.

[0009] In a third aspect of the present invention, there is provided a packet security method for obtaining content from an HTTP server in response to a request from a client, inspecting safety of the content, and rewriting safe link information included in the content into character string information.

[0010] In a fourth aspect of the present invention, there is provided a packet security program that causes a computer to execute a process of retrieving content from an HTTP server in response to a request from a client, inspecting safety of the content, and rewriting safe link information included in the content into character string information. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, an optical recording medium, etc. The present invention can also be embodied as a computer program product. Effect of the Invention

[0011] According to each aspect of the present invention, it is possible to provide a packet security system, a network system, a packet security method, and a packet security program that contribute to reducing costs for security scan processing and communication traffic. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of a network system. [Diagram 2] FIG. 2 is a system diagram showing an example of the operation of the network system. [Diagram 3] FIG. 3 is a flowchart illustrating an example of processing of the packet security system. [Figure 4] FIG. 4 is a flowchart showing an example of a process of the DNS server A. [Diagram 5] FIG. 5 is a flowchart showing an example of proxy processing. [Figure 6] FIG. 6 is a diagram showing a modified configuration example of a network system. [Figure 7] FIG. 7 is a diagram illustrating an example of a hardware configuration of the packet security system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiment described below. In addition, in each drawing, the same or corresponding elements are appropriately assigned the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationship of each element, the ratio of each element, etc. may differ from the actual ones. There may also be parts in which the dimensional relationship and ratio differ between the drawings.

[0014] 1 is a diagram showing an example of the configuration of a network system. As shown in Fig. 1, a network system 100 includes a client 101, a packet security system 102, a DNS server A 103, an HTTP server 104, a gateway 105, and a DNS server B 106.

[0015] The client 101 has a proxy 112 including a Web browser 111 and an inverse conversion unit 113. The Web browser 111 is an interface for a user to obtain information via a network. The inverse conversion unit 113, as will be described later, has a function of inversely converting the contents of the HTML content rewritten by the packet security system 102 and rewriting it to the original contents. The proxy 112 has a role of executing communication received from the Web browser 111.

[0016] The packet security system 102 has a content rewriting function 121. In response to a request from the client 101, the packet security system 102 acquires content from the HTTP server 104, inspects the safety of the content, and rewrites safe link information included in the content to character string information, as will be described later.

[0017] The DNS server A 103 includes an address response unit 131 and a domain threat level DB 132. The DNS server A 103 selects an IP address to respond to the request from the client 101 while referring to the domain threat level DB 132 in accordance with the request from the client 101.

[0018] The HTTP server 104 responds to the request and provides HTML content. In the example shown in Fig. 1, the HTTP server 104 is assumed to provide HTML content A141, and the HTML content A141 includes link information Link(B) and Link(C) relating to content B142 and content C143.

[0019] The gateway 105 is a device that enables the client 101 to communicate with the network, and the DNS server B 106 is an arbitrary DNS server different from the DNS server A 103. As shown in Fig. 1, the client 101 can access the HTTP server 104 via either a route A 107 or a route B 108. The route A 107 provides direct access, while the route B 108 provides access via the packet security system 102.

[0020] 2 is a system diagram showing an example of the operation of the network system, which includes a Web browser 111, a proxy 112, a packet security system 102, a DNS server A 103, an HTTP server 104, and a DNS server B 106.

[0021] The Web browser 111 queries the DNS server A 103 for IP address information as a domain resolution (S221) of the HTTP server 104. In response, the DNS server A 103 responds with the IP address of the packet security system 102, not the IP address of the HTTP server 104 (S222).

[0022] The Web browser 111 requests the HTML content A141 from the packet security system 102 (S223), and the packet security system 102 transfers the request to the HTTP server 104 (S224) and receives a response of the HTML content A141 from the HTTP server 104 (S225). The packet security system 102 then inspects the content and converts the link information Link(B) to the content B142 into Link(B)' (S201).

[0023] FIG. 3 is a flowchart showing an example of processing of the packet security system. After acquiring HTML content (S301), the packet security system 102 checks whether link information or an src file provided by the same server is included (S302). If included, it checks whether this information is registered in the database 306 as information on a safe link or src file (S303). If registered, the link information is converted to Base64 character string information, and replaced (S304) with a TLD (Top Level Domain) and SLD (Second Level Domain) for identification on the HTML content, such as <character string information>.cloffload.exsecurity. If src file information is included instead of link information, the src file information is restored as URL information and replaced in the same manner. For example, if the src information is / videos / content B, the url is restored to the abbreviated host information, such as http server domain / videos / content B. Then, it is sent as HTML content (S305).

[0024] In the example of HTML content A141 shown in FIG. 1, there are links to content B142 and content C143. However, if only content B142 is registered in database 306, only link (B) 144 will be rewritten by packet security system 102.

[0025] Returning now to the explanation of the process in Fig. 2, the replaced HTML content is returned to the Web browser as HTML content A' (S226). The Web browser 111 first performs DNS resolution with the DNS server A 103 to obtain content B as an src file required for rendering from HTML content A' (S227). The DNS server A 103 determines that this query is for the converted domain (S202), and returns the address of the proxy 112 as the IP address (S228).

[0026] 4 is a flowchart showing an example of the process of DNS server A. After receiving a DNS resolution request (S401), the address response unit 131 judges whether or not the identification TLD and SLD are assigned (S402), and if the identification TLD and SLD are assigned, the address of the proxy 112 is set as the domain resolution result (S403), and if not, normal domain resolution is performed (S404). DNS server A transmits a response based on the result of the domain resolution (S405). In this example, which is a query about content B, the identification TLD and SLD are assigned, so it is determined that the query is for a converted domain.

[0027] Returning now to the explanation of the processing in Fig. 2, the Web browser 111 then requests the content B and accesses the proxy 112 (S229). In the proxy 112, the inverse conversion unit 113 converts Link(B)' to Link(B) 144 (S203).

[0028] 5 is a flowchart showing an example of proxy processing. After receiving an HTTP request (S501), the inverse conversion unit 113 checks the URL information (S502). If an identifying TLD and SLD have been added, the Base64 character string information is inversely converted to restore the original URL information and replace it (S503). If not, no particular processing is performed. After that, the HTTP request is sent based on the original URL information (S504). In this case regarding Content B, an identifying TLD and SLD have been added to Link(B)', so replacement is performed.

[0029] Now, return to the explanation of the process in Fig. 2. The proxy 112 executes domain resolution to the DNS server B 106 (S230), and the DNS server B 106 responds with the address of the HTTP server 104 (S231). The proxy 112 acquires the content B 142 from the HTTP server 104 (S232), and the HTTP server 104 responds by sending the content B (S233). The proxy 112 transfers the content B 142 to the Web browser (S234), and the content B 142 is acquired.

[0030] Meanwhile, the Web browser 111 requests content C143 in the same way as content B142 (S235). However, since this is provided in the domain of the HTTP server 104, the request is sent to the packet security system 102 for which the address has already been resolved. The packet security system 102 transfers the request to the HTTP server 104 (S236) and acquires content C143 (S237). After the safety of content C143 is confirmed by the packet security system 102, it is transferred to the Web browser 111 (S238).

[0031] In this manner, in the network system 100 described above, the packet security system 102 obtains content from the HTTP server in response to a request from a client, checks the safety of the content, and rewrites the safe link information contained in this content into character string information. This allows a request to be made to the HTTP server 104 without having to check the safety of the safe link information again, thereby contributing to reducing the costs of security scan processing and communication traffic.

[0032] (Application embodiment 1) 6 is a diagram showing a modified configuration example of a network system. As shown in FIG 6, a network system 100 includes a client 101, a packet security system 102, a DNS server A 103, an HTTP server 104, a gateway 105, and a DNS server B 106.

[0033] In the network system configuration example shown in Fig. 1, the proxy 112 is incorporated in the device of the client 101, but in the network system configuration example shown in Fig. 6, the proxy 112 is incorporated in an external server (gateway 105) of the device of the client 101. However, the network system configuration example shown in Fig. 6 can also execute the processes shown in Fig. 2 to Fig. 5 like the network system configuration example shown in Fig. 1, and can provide the same effects as the network system configuration example shown in Fig. 1.

[0034] (Application embodiment 2) When the packet security system 102 converts link information, if the link information is large and becomes a character string exceeding the domain length, the length of the character string to be rewritten can be kept short by treating the link information as URL path information.

[0035] (Application embodiment 3) In this disclosure, a method of converting to a domain part by BASE64 has been shown as a reversible conversion method, but any conversion method is acceptable as long as it is reversible. For example, if you want to conceal the access destination, you can encrypt it with the content rewriting function 121 and decrypt it with the inverse conversion unit 113.

[0036] (Application embodiment 4) By adding information before link information conversion, it is possible to acquire this information at the time of decoding in the inverse conversion unit 113. For example, by adding client user information or session ID information, traffic traceability is achieved.

[0037] (Application embodiment 5) The IP address of the resolution destination can be controlled by associating a unique TLD and SLD for each user or group, which are assigned by the packet security system 102. This makes it possible to select the destination IP address of the proxy to be used.

[0038] (Hardware configuration example) Fig. 7 is a diagram showing an example of a hardware configuration of a packet security system. That is, the packet security system 102 makes it possible to realize each function of the packet security system 102 by executing the above-described packet security method as a program in an information processing device (computer) 30 employing the hardware configuration shown in Fig. 7. However, the hardware configuration example shown in Fig. 7 is an example of a hardware configuration that realizes each function of the packet security system 102, and is not intended to limit the hardware configuration of the packet security system 102. The packet security system 102 may include hardware not shown in Fig. 7.

[0039] As shown in FIG. 7, the hardware configuration that can be adopted by the packet security system 102 includes a CPU (Central Processing Unit) 31, a main memory device 32, an auxiliary memory device 33, and an IF (Interface) unit 34, which are interconnected by an internal bus, for example.

[0040] The CPU 31 executes each command included in the distributed re-encryption program executed by the information processing device (computer) 30. The main storage device 32 is, for example, a RAM (Random Access Memory), and temporarily stores various programs such as the distributed re-encryption program executed by the information processing device (computer) 30 for processing by the CPU 31.

[0041] The auxiliary storage device 33 is, for example, a hard disk drive (HDD), and is capable of storing various programs, such as a packet security program, executed by the information processing device (computer) 30, for a medium to long term. The various programs, such as the packet security program, can be provided as a program product recorded on a non-transitory computer-readable storage medium.

[0042] The IF unit 34 provides an interface related to input and output of the packet security system 102, for example.

[0043] The information processing device (computer) 30 employing the above-mentioned hardware configuration realizes each function of the packet security system 102 by executing the above-mentioned packet security method as a program.

[0044] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. [Appendix 1] A packet security system having a content rewriting function that acquires content from an HTTP server in response to a request from a client, inspects the safety of the content, and rewrites safe link information contained in the content into character string information. [Appendix 2] The packet security system according to claim 1, wherein the content rewriting function assigns an identifying domain name when rewriting the secure link information into character string information. [Appendix 3] 3. A packet security system as described in claim 1 or 2, comprising a database of link information whose safety has been confirmed, and determining the safety of the link information by referring to the database. [Appendix 4] a packet security system having a content rewriting function for acquiring content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information included in the content into character string information; a DNS server that responds to an inquiry about an IP address related to the link information rewritten by the packet security system so that the HTTP server can be accessed without going through the packet security system; a proxy that reversely converts the link information rewritten by the packet security system to restore the original link information, and then makes a request for content based on the original link information; A network system comprising: [Appendix 5] The network system of claim 4, wherein the DNS server and the proxy identify the link information rewritten by the packet security system using an identification domain name that is assigned when the packet security system rewrites the link information. [Appendix 6] 6. The network system of claim 4 or 5, wherein the proxy is incorporated in the client device. [Appendix 7] 6. The network system according to claim 4 or 5, wherein the proxy is incorporated in an external server of the client device. [Appendix 8] A packet security method for obtaining content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information contained in the content into character string information. [Appendix 9] 9. The packet security method according to claim 8, wherein a domain name for identification is added when the secure link information is rewritten into character string information. [Appendix 10] A packet security program that causes a computer to execute a process of acquiring content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information contained in the content into character string information.

[0045] The disclosures of the above cited patent documents are incorporated herein by reference. Within the scope of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the scope of the entire disclosure of the present invention, various combinations or selections (including partial deletions) of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure including the scope of claims and the technical ideas. In particular, with regard to the numerical ranges described in this specification, any numerical value or small range included in the range should be construed as being specifically described even if not otherwise specified. Furthermore, the disclosures of the above cited documents, if necessary, in accordance with the spirit of the present invention, may be used in part or in whole in combination with the disclosures of this specification as part of the disclosure of the present invention, and are deemed to be included in the disclosures of this application. [Explanation of symbols]

[0046] 100 Network Systems 101 Client 111 Web Browser 112 Proxy 113 Inverse conversion unit 102 Packet Security System 121 Content rewriting function 103 DNS Server A 131 Address Response Part 132 Domain Threat Level DB 104 HTTP Server 141 HTML Content A 142 Content B 143 Content C 105 Gateway 106 DNS Server B 107 Route A 108 Route B 306 Database 30 Information processing device 31 CPU 32 Main storage 33 Auxiliary storage device 33 IF Section

Claims

1. A packet security system having a content rewriting function that acquires content from an HTTP server in response to a request from a client, inspects the safety of the content, and rewrites safe link information contained in the content into character string information.

2. 2. The packet security system according to claim 1, wherein the content rewriting function adds a domain name for identification when rewriting the secure link information into character string information.

3. 2. A packet security system according to claim 1, further comprising a database of link information whose safety has been confirmed, and the safety of the link information is judged by referring to the database.

4. a packet security system having a content rewriting function for acquiring content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information included in the content into character string information; a DNS server that responds to an inquiry about an IP address related to link information rewritten by the packet security system so that the HTTP server can be accessed without going through the packet security system; a proxy that reversely converts the link information rewritten by the packet security system to restore the original link information, and then makes a request for content based on the original link information; A network system comprising:

5. 5. The network system according to claim 4, wherein the DNS server and the proxy identify the link information rewritten by the packet security system by using an identification domain name that is assigned when the packet security system rewrites the link information.

6. 5. The network system according to claim 4, wherein the proxy is incorporated in the client device.

7. 5. The network system according to claim 4, wherein the proxy is incorporated in an external server of the client device.

8. A packet security method for obtaining content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information contained in the content into character string information.

9. 9. The packet security method according to claim 8, further comprising the step of adding a domain name for identification when the secure link information is rewritten into character string information.

10. A packet security program that causes a computer to execute a process of acquiring content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information contained in the content into character string information.

Images