Illicit access detecting device, personal data-cooperating board, illicit access detecting method and program

Abstract

To provide an illicit access detecting device, a personal data-cooperating board, an illicit access detecting method and a program, capable of detecting an illicit access to a personal data-cooperating board with greater accuracy.SOLUTION: An illicit access detecting device for detecting an illicit access in a personal data-cooperating board to perform cooperation of personal data between a plurality of service servers, comprises: a request collecting section that collects API requests sent from the service server; a request pattern recording section that records a request pattern in which request parameters as parameters included in the API request are gathered on a session-by-session basis; and a normal request pattern generating section that generates a normal request pattern that is a request pattern in a normal range in units of service servers, sessions and users based on the request pattern.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an unauthorized access detection device, a personal data linkage platform, an unauthorized access detection method, and a program. [Background technology]

[0002] In urban planning called smart cities and super cities, the construction of a personal data integration platform that will link personal data between multiple services is underway. As the number of services connected to the personal data integration platform increases, it is expected that unauthorized access to personal data via the platform will also increase.

[0003] Patent Document 1 describes a technology for detecting unauthorized access to a server, and describes using an identifier of an object to be identified, including a user ID, and a state of a past request history (access history) linked to the identifier of the object to be identified, as judgment conditions. In Patent Document 1, a higher FP score is set for a judgment condition that, when satisfied, indicates a stronger suspicion of unauthorized access, and the risk of access to the server is determined based on the FP score. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2018-041316 Summary of the Invention [Problem to be solved by the invention]

[0005] However, the technology described in Patent Document 1 targets unauthorized access to a specified server. A personal data sharing platform to which multiple services are connected has a characteristic that the same user has a different user ID in each service. Therefore, even if the technology in Patent Document 1 is used as is, it is difficult to accurately detect unauthorized access by bots or the like using legitimate access routes in the personal data sharing platform.

[0006] An object of the present disclosure is to provide an unauthorized access detection device, a personal data linkage platform, an unauthorized access detection method, and a program that can detect unauthorized access to a personal data linkage platform with higher accuracy. [Means for solving the problem]

[0007] The unauthorized access detection device according to the present disclosure is an unauthorized access detection device that detects unauthorized access in a personal data integration platform that integrates personal data between multiple service servers, and includes a request collection unit that collects API requests sent from the service servers, a request pattern recording unit that records request patterns in which request parameters included in the API requests are compiled for each session, and a normal request pattern generation unit that generates a normal request pattern, which is a request pattern within a normal range, for each service server, session, and user based on the request pattern.

[0008] The personal data integration platform of the present disclosure is a personal data integration platform that integrates personal data between multiple service servers, and includes a request collection unit that collects API requests sent from the service servers, a request pattern recording unit that records request patterns in which request parameters included in the API requests are summarized for each session, and a normal request pattern generation unit that generates a normal request pattern, which is a request pattern within a normal range, for each service server, session, and user based on the request pattern.

[0009] The unauthorized access detection method of the present disclosure is a method for detecting unauthorized access in a personal data integration platform that integrates personal data between multiple service servers, in which a computer collects API requests sent from the service servers, records request patterns in which request parameters included in the API requests are summarized for each session, and generates normal request patterns that are request patterns within a normal range for each service server, session, and user based on the request patterns.

[0010] The program according to the present disclosure is a program that causes a computer to execute a process for detecting unauthorized access in a personal data integration platform that integrates personal data between multiple service servers, and causes the computer to execute the following processes: collecting API requests sent from the service servers; recording request patterns in which request parameters, which are parameters included in the API requests, are compiled for each session; and generating normal request patterns, which are request patterns within a normal range, for each service server, session, and user based on the request patterns. [Effects of the Invention]

[0011] According to the present disclosure, it is possible to provide an unauthorized access detection device, a personal data linkage platform, an unauthorized access detection method, and a program that can detect unauthorized access to a personal data linkage platform with higher accuracy. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a schematic block diagram illustrating an example of the configuration of an unauthorized access detection device according to the present disclosure. [Figure 2] 1 is a flowchart illustrating an example of an unauthorized access detection method according to the present disclosure. [Figure 3] 1 is a schematic block diagram showing an example of a connection relationship between a personal data link platform and a service server according to the present disclosure. [Figure 4] 1 is a schematic block diagram illustrating an example of the configuration of a personal data linkage platform according to the present disclosure. [Figure 5] FIG. 10 is a diagram illustrating an example of ID federation data according to the present disclosure. [Figure 6] FIG. 10 is a diagram illustrating an example of a request to the personal data linkage platform in the test phase according to the present disclosure. [Figure 7] FIG. 10 is a diagram illustrating an example of a request pattern according to the present disclosure. [Figure 8] FIG. 10 is a diagram illustrating an example of a response pattern according to the present disclosure. [Figure 9] FIG. 10 is a diagram illustrating an example of a normal request pattern according to the present disclosure. [Figure 10] FIG. 10 is a diagram illustrating an example of a parameter set according to the present disclosure. [Figure 11] 10 is a flowchart illustrating an example of processing in a test phase and a release phase in the unauthorized access detection method according to the present disclosure. [Figure 12] 10 is a flowchart illustrating another example of processing in a test phase and a release phase in the unauthorized access detection method according to the present disclosure. [Figure 13]FIG. 10 is a diagram illustrating an example of an unauthorized request to the personal data linkage platform in the operation phase according to the present disclosure. [Figure 14] 10 is a flowchart illustrating an example of a process in an operation phase in the unauthorized access detection method according to the present disclosure. [Figure 15] 10 is a flowchart illustrating another example of the operation phase process in the unauthorized access detection method according to the present disclosure. [Figure 16] FIG. 1 is a block diagram illustrating an example of a configuration of a computer according to the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0013] Embodiment 1 An example of the configuration of an unauthorized access detection device 10 according to the present disclosure will be described below with reference to FIG. 1. The unauthorized access detection device 10 detects unauthorized access in a personal data linkage platform (not shown) that links personal data between multiple service servers (not shown). The multiple service servers and the personal data linkage platform are capable of communicating with each other. The multiple service servers and the personal data linkage platform are also capable of linking with each other, for example, through an API (Application Programming Interface). Each service server stores personal data of users registered with the service server. The personal data includes not only personal information such as the user's name and contact information, but also a wide range of information related to the user, such as location information and medical and health information. The unauthorized access detection device 10 includes a request collection unit 11, a request pattern recording unit 12, and a normal request pattern generation unit 13.

[0014] The request collection unit 11 collects API requests sent from service servers to the personal data linkage platform. Here, the API request includes parameters (hereinafter referred to as "request parameters") such as the user ID registered in the service server and the type of data requested from the service server (hereinafter referred to as "data type"). Furthermore, the pattern of request parameters (hereinafter referred to as "request pattern") included in the API request tends to differ from service server to service server. Here, the request pattern of an API request includes the API call order, the combination of specified data types, etc. Furthermore, the request pattern of an API request may also differ depending on the version of the service server.

[0015] The request pattern recording unit 12 records a request pattern in which request parameters included in an API request are grouped for each session. Specifically, the request pattern recording unit 12 records the request pattern for each service server, each version of the service server, and each session. More specifically, the request pattern recording unit 12 records the request pattern of API requests sent from a certain service server of a certain version for each session in chronological order.

[0016] The normal request pattern generating unit 13 generates a normal request pattern, which is a request pattern within a normal range, for each service server, session, and user, based on the request patterns recorded in the request pattern recording unit 12 .

[0017] 2 is a flowchart showing an example of an unauthorized access detection method according to the present disclosure. First, the request collection unit 11 collects API requests sent from the service server to the personal data link platform (step S11). Next, the request pattern recording unit 12 records the request patterns of the API requests in chronological order for each session (step S12). Next, the normal request pattern generation unit 13 generates normal request patterns for each service server, session, and user based on the request patterns (step S13), and then ends this process.

[0018] In the unauthorized access detection device 10 according to the present disclosure, a normal request pattern is generated based on the request pattern of an API request sent from a service server. The request pattern of the API request differs for each service server and also differs depending on the version of the service server. Therefore, the normal request pattern generated based on the request pattern of the API request also differs depending on the service server and the version of the service server. This makes it possible to accurately detect unauthorized access by comparing the request pattern of an API request sent by an attacker who has stolen credential information for a certain service server with the normal request pattern. Therefore, it is possible to provide an unauthorized access detection device 10 that can more accurately detect unauthorized access to a personal data link platform.

[0019] Embodiment 2 Next, an example of the connection relationship between the personal data linkage platform 100 according to the present disclosure and the service servers 200_1, 200_2, and 200_3 will be described with reference to Fig. 3. Hereinafter, when there is no particular distinction between the service servers 200_1, 200_2, and 200_3, they will be simply referred to as the service servers 200. Note that Fig. 3 shows an example in which three service servers 200 are connected to the personal data linkage platform 100, but the number of service servers 200 connected to the personal data linkage platform 100 is not limited.

[0020] 3, the plurality of service servers 200 and the personal data linkage platform 100 are capable of communicating with each other. The plurality of service servers 200 and the personal data linkage platform 100 are capable of linking with each other, for example, through an API. Each service server 200 stores personal data of users registered in that service server 200.

[0021] Next, an example of the configuration of the personal data linkage infrastructure 100 according to the present disclosure will be described with reference to Fig. 4. As shown in Fig. 4, the personal data linkage infrastructure 100 includes a proxy device 110, a normal request pattern generation device 120, a parameter set generation device 130, a dummy response generation device 140, a request determination device 150, a user ID determination device 160, a communication control device 170, and a recording device 180.

[0022] The proxy device 110 functions as a request collection unit, a response collection unit, a response delay unit, and a dummy response transmission unit.

[0023] Specifically, the proxy device 110 collects API requests sent from the service server 200 to the personal data exchange infrastructure 100. More specifically, the proxy device 110 collects API requests by wrapping APIs provided in the personal data exchange infrastructure 100. Here, the API requests include request parameters such as a user ID registered in the service server and the type of data requested from the service server. Furthermore, the request patterns of API requests tend to differ for each service server and each version of the service server. Here, the request patterns of API requests include the API call order, combinations of specified data types, and the like. In this way, the proxy device 110 functions as a request collection unit. Furthermore, the recording device 180 records request patterns 182 in which the request parameters included in the API requests are grouped for each session. An example of the request pattern 182 is shown in FIG. 7.

[0024] The proxy device 110 also collects API responses sent from the service server 200 to the personal data exchange platform 100. More specifically, the proxy device 110 collects API responses by wrapping APIs provided in the personal data exchange platform 100. Here, the API responses include parameters (hereinafter referred to as "response parameters") such as a user ID registered in the personal data exchange platform 100 and the type of data sent from the service server. The response parameter patterns (hereinafter referred to as "response patterns") included in API responses tend to differ for each service server and each version of the service server. This allows the proxy device 110 to function as a response collection unit. The recording device 180 also records response patterns 183, in which the response parameters included in the API responses are grouped for each session. An example of the response pattern 183 is shown in FIG. 8.

[0025] Furthermore, when the proxy device 110 determines that an API request to the personal data exchange platform 100 is unauthorized access, it delays the API response sent from the service server 200 to the personal data exchange platform 100 and sends it to the server that originated the request (attacker). In this way, the proxy device 110 functions as a response delay unit.

[0026] Furthermore, if the proxy device 110 determines that the user ID included in the API request to the personal data link infrastructure 100 does not exist, it delays a dummy response (described later) and transmits it to the server (attacker) that is the request source. In this way, the proxy device 110 functions as a dummy response transmission unit.

[0027] The normal request pattern generation device 120 generates a normal request pattern 184, which is a request pattern within a normal range, for each service server 200, session, and user, based on the request pattern 182 recorded in the recording device 180. Specifically, the normal request pattern generation device 120 groups the request patterns for each session recorded in the recording device 180 and further performs statistical processing to generate the normal request pattern 184 for each service server 200, session, and user. In this way, the normal request pattern generation device 120 functions as a normal request generation unit. Furthermore, the recording device 180 records the normal request pattern 184. An example of the normal request pattern 184 is shown in FIG. 9.

[0028] Parameter set generation device 130 generates parameter sets 185 for generating dummy responses 186 for each service server 200, session, and user, based on response patterns 183 recorded in recording device 180. Specifically, parameter set generation device 130 groups response patterns 183 recorded in recording device 180 and performs statistical processing to generate parameter sets 185 for each service server 200, session, and user. In this way, parameter set generation device 130 functions as a parameter set generation unit. Furthermore, recording device 180 records the parameter sets 185. An example of parameter set 185 is shown in FIG. 10.

[0029] The dummy response generation device 140 generates a dummy response 186 based on a parameter set 185 recorded in the recording device 180. Specifically, the dummy response generation device 140 generates the dummy response 186 by randomly combining data structures included in the parameter set 185. More specifically, if a JSON schema is used as an example of the data structure, the dummy response generation device 140 can generate a response template in the JSON schema from the parameter set 185, set random values ​​for its values ​​(text, numeric values, boolean values), and generate the dummy response 186. In this way, the dummy response generation device 140 functions as a dummy response generation unit. The recording device 180 records the dummy response 186.

[0030] The request determination device 150 determines whether an API request sent to the personal data link platform 100 is an unauthorized request based on the normal request pattern 184 recorded in the recording device 180. Specifically, the request determination device 150 compares the normal request pattern 184 with the API request and calculates the probability of unauthorized access. If the probability of unauthorized access is higher than a predetermined threshold, the request determination device 150 determines that the API request is an unauthorized access. 9 shows the following characteristics: "In a session of session type "01", a request to the shared API is sent first, and then a request to the stored API is sent", "The parameters of the request to the shared API always (100% occurrence rate) include a specification to share the data type "DA01" from the server ID "0001", and with a 75% probability, a specification to share the data type "DB01" from the server ID "0002", "The parameters of the request to the stored API always (100% occurrence rate) include one instance of the data type "DC01", and "One session is completed in 300 msec to 500 msec". The request determination device 150 then calculates the probability of unauthorized access based on a score table such as that shown in Table 1 below and equation (1) shown below. That is, the request determination device 150 compares the normal request pattern 184 with the API request, and substitutes the score value of the medium item in the score table that corresponds to the comparison result into formula (1) to calculate the probability of unauthorized access. Note that the accuracy of the probability of unauthorized access can be improved by performing machine learning to determine the coefficients k1, k2,..., k7 in formula (1) and the values ​​of α and β in the score table. In this way, the request determination device 150 functions as a request determination unit. (Probability of unauthorized access) = (Score value of N1) × k1 + (Score value of N2) × k2 +(N3 score value)×k3+(N4 score value)×k4 +(N5 score)×k5+(N6 score)×k6 + (N7 score) × k7 (1) In equation (1), k1, k2,..., k7 are coefficients by which the score values ​​of item numbers N1, N2,..., N7 are multiplied, respectively. Also, the score table is not limited to the contents shown in Table 1. [Table 1]

[0031] The user ID determination device 160 determines whether or not a user ID included in an API request sent to the personal data federation platform 100 actually exists, based on ID federation data 181 recorded in the recording device 180. The ID federation data 181 is user ID federation information in which different user IDs are managed for each user on a per-service server 200 basis. As a result, the user ID determination device 160 functions as a user ID determination unit.

[0032] When the request determination device 150 determines that the API request is an unauthorized request, the communication control device 170 notifies a predetermined alert to the stakeholder. Here, the stakeholder is the service server 200 and the user whose credentials have been stolen by an attacker. Furthermore, when the user ID determination device 160 determines that the user ID included in the API request does not exist, the communication control device 170 notifies a predetermined alert to the stakeholder. Here, the stakeholder is the service server 200 whose credentials have been stolen by an attacker. As a result, the communication control device 170 functions as an alert notification unit.

[0033] 4, the recording device 180 records ID federation data 181, a request pattern 182, a response pattern 183, a normal request pattern 184, a parameter set 185, a dummy response 186, etc. The ID federation data 181 is input to the recording device 180 in advance by a user. The request pattern 182 and the response pattern 183 are generated in a test phase, which will be described later. The normal request pattern 184 and the parameter set 185 are generated in a release phase, which will be described later. The dummy response is generated in an operation phase, which will be described later.

[0034] FIG. 5 shows an example of ID federation data 181. As shown in FIG. 5, ID federation data 181 is user ID federation information that manages, for each user, a different user ID for each of multiple service servers 200 (hereinafter referred to as "server-specific user ID"). As described above, a system that uses the personal data federation platform 100 is characterized in that the same user has a different user ID for each of multiple service servers 200. Therefore, the personal data federation platform 100 uses ID federation data 181 to federate different user IDs for the same user for each of the service servers 200. The ID federation data 181 also manages personal information 181B of the user for each user. In other words, the ID federation data 181 is information in which the user ID 181A of a user registered in the personal data federation platform 100 is associated with the user's personal information 181B and the server-specific user ID 181C. In the example shown in FIG. 5, the name and contact information are recorded as personal information 181B. In addition, as the server-specific user ID 181C, for each server ID of the service server 200 ("0001", "0002", "0003" shown in Figure 5), the user ID 181A registered in the personal data integration platform 100 is recorded, for example, the user ID of the user who is "P00001" shown in Figure 5 (for example, "PA001", "PA002", "PA003" shown in Figure 5). 5 indicates user ID federation information used in the release phase (described later) and the operation phase (described later). In the test phase (described later), temporary ID federation data (not shown) is used as user ID federation information. Specifically, in the temporary ID federation data, the server-specific user ID is a temporary user ID that is different for each service server 200. More specifically, in the temporary ID federation data, for example, the user IDs "PA001," "PA002," and "PA003" of a user whose user ID is "P00001" in the ID federation data 181 are temporary user IDs "XA001," "XA002," and "XA003."

[0035] An example of the request pattern 182 recorded in the recording device 180 will be described with reference to FIGS. 6 and 7. FIG. 6 shows an example of a request to the personal data linkage infrastructure 100 in the test phase, and FIG. 7 shows an example of the request pattern 182. In the example shown in FIG. 6, in the test phase, a service server 200_1 having a server ID of "0001" transmits "Request 1" and "Request 2" as API requests to the personal data linkage infrastructure 100. Here, "Request 1" is an API request that specifies "XA001" as the user ID and "DA01" as the data type. Furthermore, "Request 2" is an API request that specifies "XA001" as the user ID and "DA02" as the data type. Furthermore, in the temporary ID linkage data, "XA001," "XA002," and "XA003" are associated with each other as different temporary user IDs for the same user for the multiple service servers 200_1 to 200_3. Furthermore, the data type "DA01" is registered in the service server 200_2 whose server ID is "0002", and the data type "DA02" is registered in the service server 200_3 whose server ID is "0003".

[0036] 7 shows a request pattern 182 recorded in the recording device 180 in the example shown in FIG. 6 above. The recording device 180 records the request pattern 182 in which request parameters (user ID, data type, etc.) of API requests are grouped for each session. This allows the recording device 180 to function as a request pattern storage unit. For example, as shown in FIG. 7, the request pattern 182 is data in which request parameters of API requests from the service server 200_1 with version "1.0" and server ID "0001" are grouped in chronological order for each session. Also, as shown in FIG. 7, the recording device 180 records multiple request patterns 182 for each service server 200, version, and session. As shown in FIG. 7, the request parameters include, for example, "time," "path," "user ID," "data type," and "sharer." Here, the "sharer" refers to the service server 200 that provides the data type, and the server ID of the service server 200 is recorded as the request parameter "sharer." Furthermore, since the request pattern 182 is data generated in a test phase (described later), a temporary user ID is used as the user ID.

[0037] FIG. 8 shows an example of a response pattern 183 recorded in the recording device 180. The recording device 180 records the response pattern 183 in which response parameters (user ID, data type, etc.) of API responses are grouped for each session. This allows the recording device 180 to function as a response pattern recording unit. For example, as shown in FIG. 8, the response pattern 183 is data in which response parameters of API responses sent to the service server 200_1 with version "1.0" and server ID "0001" are grouped for each session. Also, as shown in FIG. 8, the recording device 180 records multiple response patterns 183 for each service server 200, version, and session. As shown in FIG. 8, the response parameters include, for example, a "user ID," a "data type," a "number of data items," and a "data structure." Also, since the response pattern 183 is data generated in a test phase (described later), a temporary user ID is used as the user ID.

[0038] FIG. 9 shows an example of a normal request pattern 184 recorded in the recording device 180. For example, as shown in FIG. 9, the normal request pattern 184 is a request pattern statistically generated based on the request pattern 182 of the service server 200_1 having the version "1.0" and the server ID "0001." Here, the "request pattern within the normal range" refers to a request pattern within a range that can be determined as a legitimate request pattern among the request patterns of API requests received by the personal data link platform 100. Also, as shown in FIG. 9, the recording device 180 records multiple normal request patterns 184 for each service server 200, version, session, and user ID. As shown in FIG. 9, the request parameters include, for example, "path," "data type," "shared source," "execution rate," and "occurrence rate." The "execution rate" and "occurrence rate" are probabilities calculated by statistical processing by the normal request pattern generation device 120. Specifically, the normal request pattern generation device 120 groups the request patterns for each session recorded in the recording device 180 so that request patterns having the same server ID, the same version, and the same user ID are grouped together. As a result, sessions in the same group are of the same type. Furthermore, the normal request pattern generation device 120 performs statistical processing to calculate the execution rate and occurrence rate of each request in all sessions included in the same type. Here, the statistical processing is, for example, processing to calculate basic statistics.

[0039] 10 shows an example of a parameter set 185 recorded in the recording device 180. For example, as shown in FIG. 10, the parameter set 185 is a set of response parameters that is statistically generated based on the response parameters of the service server 200_1 having the version "1.0" and the server ID "0001." Also, as shown in FIG. 10, the recording device 180 records a plurality of parameter sets 185 for each service server 200, version, session, and user ID. As shown in FIG. 10, the response parameters include, for example, "data type," "number of data items," and "data structure." Note that the "number of data items" is a value calculated by statistical processing by the parameter set generation device 130. Specifically, the parameter set generation device 130 groups the response patterns recorded in the recording device 180 so that response patterns having the same server ID, the same version, and the same user ID are grouped together. As a result, response patterns in the same group become response patterns of the same type. Furthermore, the parameter set generation device 130 performs statistical processing to calculate the number of occurrences of each data type in all response patterns included in the same type. Here, the statistical processing is, for example, processing to calculate basic statistics.

[0040] Next, the processing in the test phase and release phase in the unauthorized access detection method according to the present disclosure will be described with reference to Figures 11 and 12. Figure 11 shows the processing for generating a normal request pattern 184, and Figure 12 shows the processing for generating a parameter set 185. The test phase and release phase are preparatory stages carried out before the operation phase is implemented.

[0041] 11, first, the proxy device 110 collects API requests sent from the service server 200 to the personal data link infrastructure 100 (step S101). Next, the recording device 180 records request patterns 182 of the API requests in chronological order for each session (step S102). Next, the normal request pattern generation device 120 generates normal request patterns 184 for each service server, version, session, and user ID based on the request patterns 182 (step S103), and then ends this processing. Note that steps S101 and S102 are performed in the test phase, and step S103 is performed in the release phase.

[0042] 12, first, the proxy device 110 collects API responses sent from the service server 200 to the personal data link platform 100 (step S201). Next, the recording device 180 records the response pattern 183 of the API response for each session (step S202). Next, the parameter set generation device 130 generates parameter sets 185 for each service server, version, session, and user ID based on the response pattern 183 (step S203), and ends this processing. Note that steps S201 and S202 are performed in the test phase, and step S203 is performed in the release phase.

[0043] Next, processing in the operation phase of the unauthorized access detection method according to the present disclosure will be described with reference to Figures 13 to 15. Figure 13 shows an example of an unauthorized request to the personal data linkage infrastructure in the operation phase, Figure 14 shows an example of unauthorized access detection processing in the unauthorized access detection method, and Figure 15 shows another example of unauthorized access detection processing in the unauthorized access detection method.

[0044] In the example shown in FIG. 13, in the operation phase, an attacker's server 300 that has stolen the credentials of the service server 200_1 having the server ID "0001" transmits API requests "Request 1," "Request 2," and "Request 3" to the personal data federation platform 100. Here, "Request 1" is an API request that specifies "LA001" as the user ID and "DA01" as the data type. Furthermore, "Request 2" is an API request that specifies "LA001" as the user ID and "DQ01" as the data type. Furthermore, "Request 3" is an API request that specifies "LA001" as the user ID and "DB01" as the data type. Furthermore, in the ID federation data 181, "PA001," "PA002," and "PA003" are associated with each other as different temporary user IDs for the same user for each of the multiple service servers 200_1 to 200_3. Furthermore, the data type "DA01" is registered in the service server 200_2 whose server ID is "0002", and the data type "DB01" is registered in the service server 200_3 whose server ID is "0003". It is assumed that there is no server that records the data type "DQ01". The unauthorized access detection processing shown in FIGS. 14 and 15 will be described below with reference to the example shown in FIG. 13.

[0045] 14, first, the proxy device 110 collects API requests sent to the personal data link infrastructure 100 from one service server 200 or from an attacker's server 300 that has stolen the credentials of the one service server 200 (step S301). Next, the request determination device 150 compares the API requests collected in step S301 with the normal request pattern 184 recorded in the recording device 180 to calculate the probability of unauthorized access (step S302). Next, the request determination device 150 determines whether the API request is unauthorized access based on whether the probability of unauthorized access calculated in step S302 is higher than a predetermined threshold (step S303). If the probability of unauthorized access is equal to or lower than the predetermined threshold in step S303 and the request determination device 150 determines that the API request is not unauthorized access (step S303; No), this process ends. In step S303, if the probability of unauthorized access is higher than a predetermined threshold and the request judgment device 150 judges that the API request is unauthorized access (step S303; Yes), the proxy device 110 delays the API response from the other service server 200 and sends it to the attacker's server 300 (step S304), and the communication control device 170 notifies the one service server 200 and the user whose credentials have been stolen of a predetermined alert (step S305), and this processing ends.

[0046] 15, first, the proxy device 110 collects API requests sent to the personal data link infrastructure 100 from one service server 200 or from an attacker's server 300 that has stolen the credentials of the one service server 200 (step S401). Next, the user ID determination device 160 determines whether or not the user ID included in the API request sent to the personal data link infrastructure 100 actually exists, based on the ID federation data 181 recorded in the recording device 180 (step S402). Next, based on the determination result in step S402, the request determination device 150 determines whether or not the API request is unauthorized access (step S403). In step S403, if the user ID included in the API request actually exists and the request determination device 150 determines that the API request is not unauthorized access (step S403; No), this process ends. In step S403, if the user ID included in the API request does not exist and the request judgment device 150 judges that the API request is an unauthorized access (step S403; Yes), the proxy device 110 delays a dummy response and sends it to the attacker's server 300 (step S404), and the communication control device 170 notifies one of the service servers 200 of a predetermined alert (step S405), and this processing ends.

[0047] In the personal data linkage infrastructure 100 according to the present disclosure, a normal request pattern 184 is generated based on a request pattern 182 of an API request sent from a service server 200. The request pattern 182 of the API request varies for each service server 200 and tends to vary depending on the version of the service server 200. Therefore, the normal request pattern 184 generated based on the request pattern 182 of the API request also varies depending on the service server 200 and the version of the service server 200. This makes it possible to accurately detect unauthorized access by comparing the request pattern of an API request sent from an attacker who has stolen credential information of a certain service server 200 with the normal request pattern. Therefore, it is possible to provide an unauthorized access detection device 10 that can detect unauthorized access to the personal data linkage infrastructure 100 with high accuracy.

[0048] Furthermore, a parameter set 185 is generated based on a response pattern 183 of an API response sent from the service server 200, and a dummy response 186 is generated based on the parameter set 185. The response pattern 183 of the API response varies for each service server 200 and tends to vary depending on the version of the service server 200. Therefore, the dummy response 186 generated based on the parameter set 185 based on the response pattern 183 of the API response reflects the characteristics of the service server 200 targeted by the attacker. By sending the dummy response to the attacker, it is possible to delay the attacker from realizing that his or her API request has been detected as unauthorized access. This allows time to be spent dealing with the unauthorized access. Furthermore, by sending a dummy response to the attacker instead of a legitimate API response, damage can be minimized.

[0049] Furthermore, the user ID determination device 160 determines whether the user ID included in the API request sent to the personal data linkage platform 100 actually exists, and if the user ID does not actually exist, the request determination device 150 determines that the API request is an unauthorized access. Therefore, unauthorized access can be detected by using the ID linkage data 181 that is unique to the personal data linkage platform 100.

[0050] Furthermore, if the request determination device 150 determines that an API request sent to the personal data link platform 100 is unauthorized access, a predetermined alert is sent to the stakeholder by the communication control device 170. This allows the stakeholder to take action against the unauthorized access and minimize damage.

[0051] In the above embodiment, the present invention has been described as a hardware configuration, but the present invention is not limited to this. The above-described functions (processing) of the proxy device 110, normal request pattern generation device 120, parameter set generation device 130, dummy response generation device 140, request determination device 150, user ID determination device 160, and communication control device 170 may be realized by a computer 600 having the following configuration, for example.

[0052] 16 is a block diagram showing the configuration of a computer 600 that realizes the processing of the unauthorized access detection device 10, the proxy device 110, the normal request pattern generation device 120, the parameter set generation device 130, the dummy response generation device 140, the request determination device 150, the user ID determination device 160, and the communication control device 170. As shown in FIG. 16, the computer 600 includes a memory 601 and a processor 602.

[0053] The memory 601 is configured, for example, by a combination of a volatile memory and a non-volatile memory. The memory 601 is used to store programs executed by the processor 602, data used for various processes, and the like. A storage unit (not shown) of the unauthorized access detection device 10, a storage unit (not shown) of the proxy device 110, a storage unit (not shown) of the normal request pattern generation device 120, a storage unit (not shown) of the parameter set generation device 130, a storage unit (not shown) of the dummy response generation device 140, a storage unit (not shown) of the request determination device 150, a storage unit (not shown) of the user ID determination device 160, and a storage unit (not shown) of the communication control device 170 may be realized by the memory 601. However, these may also be realized by any other storage device.

[0054] The processor 602 reads and executes programs from the memory 601 to perform processing of each device. The processor 602 may be, for example, a microprocessor, an MPU (Micro Processor Unit), or a CPU (Central Processing Unit). The processor 602 may include multiple processors.

[0055] In the above example, the program can be stored and supplied to a computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of tangible storage media. Non-transitory computer-readable media include, for example, magnetic recording media, magneto-optical recording media, CD-ROMs (Read Only Memory), CD-Rs, CD-R / Ws, and semiconductor memories. Semiconductor memories include, for example, mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs (Random Access Memory). The program may also be supplied to a computer by various types of transient computer-readable media. Examples of transient computer-readable media include electrical signals, optical signals, and electromagnetic waves. The transient computer-readable media can be supplied to a computer via wired communication paths such as electrical wires and optical fibers, or wireless communication paths.

[0056] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0057] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but also to one or more other embodiments. As will be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, an embodiment not explicitly shown or described. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0058] Some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes. (Appendix 1) An unauthorized access detection device that detects unauthorized access in a personal data linkage platform that links personal data between a plurality of service servers, a request collection unit that collects API requests transmitted from the service server; a request pattern recording unit that records a request pattern in which request parameters included in the API request are grouped for each session; a normal request pattern generation unit that generates a normal request pattern, which is a request pattern within a normal range, for each of the service servers, the sessions, and the users based on the request pattern; Equipped with Unauthorized access detection device. (Appendix 2) a response collection unit that collects API responses transmitted from the service server; a response pattern recording unit that records a response pattern in which response parameters included in the API response are grouped for each session; a parameter set generation unit that generates a parameter set for generating a dummy response for each of the service servers, the sessions, and the users based on the response pattern; Equipped with 2. The unauthorized access detection device according to claim 1. (Appendix 3) a request determination unit that determines whether an API request transmitted to the personal data link platform is an invalid request based on the normal request pattern; a response delay unit that, when the request determination unit determines that the API request is an invalid request, delays an API response transmitted from another service server and transmits the delayed response to a sender of the API request; Equipped with 2. The unauthorized access detection device according to claim 1. (Appendix 4) a request determination unit that determines whether an API request transmitted to the personal data link platform is an invalid request based on the normal request pattern; an alert notification unit that notifies a stakeholder of a predetermined alert when the request determination unit determines that the API request is an invalid request; Equipped with 2. The unauthorized access detection device according to claim 1. (Appendix 5) a user ID determination unit that determines whether a user ID included in an API request sent to the personal data linkage platform actually exists based on user ID linkage information in which a different user ID for each of the plurality of service servers is managed for each user; a dummy response generator that generates the dummy response based on the parameter set; a dummy response sending unit that sends the dummy response to a sender of the API request when the user ID determination unit determines that the user ID included in the API request does not exist; Equipped with 3. The unauthorized access detection device according to claim 2. (Appendix 6) the dummy response transmission unit delays the dummy response and transmits it to the sender of the API request; 6. The unauthorized access detection device according to claim 5. (Appendix 7) a user ID determination unit that determines whether a user ID included in an API request sent to the personal data linkage platform actually exists based on user ID linkage information in which a different user ID for each of the plurality of service servers is managed for each user; an alert notification unit that notifies a stakeholder of a predetermined alert when the user ID determination unit determines that the user ID included in the API request does not exist; Equipped with 2. The unauthorized access detection device according to claim 1. (Appendix 8) A personal data linkage platform that links personal data between multiple service servers, a request collection unit that collects API requests transmitted from the service server; a request pattern recording unit that records a request pattern in which request parameters included in the API request are grouped for each session; a normal request pattern generation unit that generates a normal request pattern, which is a request pattern within a normal range, for each of the service servers, the sessions, and the users based on the request pattern; Equipped with Personal data integration platform. (Appendix 9) a response collection unit that collects API responses transmitted from the service server; a response pattern recording unit that records a response pattern in which response parameters included in the API response are grouped for each session; a parameter set generation unit that generates a parameter set for generating a dummy response for each of the service servers, the sessions, and the users based on the response pattern; Equipped with The personal data integration platform described in Appendix 8. (Appendix 10) a request determination unit that determines whether an API request transmitted to the personal data link platform is an invalid request based on the normal request pattern; a response delay unit that, when the request determination unit determines that the API request is an invalid request, delays an API response transmitted from another service server and transmits the delayed response to a sender of the API request; Equipped with The personal data integration platform described in Appendix 8. (Appendix 11) a request determination unit that determines whether an API request transmitted to the personal data link platform is an invalid request based on the normal request pattern; an alert notification unit that notifies a stakeholder of a predetermined alert when the request determination unit determines that the API request is an invalid request; Equipped with The personal data integration platform described in Appendix 8. (Appendix 12) a user ID determination unit that determines whether a user ID included in an API request sent to the personal data linkage platform actually exists based on user ID linkage information in which a different user ID for each of the plurality of service servers is managed for each user; a dummy response generator that generates the dummy response based on the parameter set; a dummy response sending unit that sends the dummy response to a sender of the API request when the user ID determination unit determines that the user ID included in the API request does not exist; Equipped with The personal data integration platform described in Appendix 9. (Appendix 13) the dummy response transmission unit delays the dummy response and transmits it to the sender of the API request; The personal data integration platform described in Appendix 12. (Appendix 14) a user ID determination unit that determines whether a user ID included in an API request sent to the personal data linkage platform actually exists based on user ID linkage information in which a different user ID for each of the plurality of service servers is managed for each user; an alert notification unit that notifies a stakeholder of a predetermined alert when the user ID determination unit determines that the user ID included in the API request does not exist; Equipped with The personal data integration platform described in Appendix 8. (Appendix 15) 1. An unauthorized access detection method for detecting unauthorized access in a personal data linkage platform that links personal data between a plurality of service servers, comprising: The computer Collecting API requests sent from the service server; A request pattern in which request parameters included in the API request are grouped for each session is recorded, generating a normal request pattern, which is a request pattern within a normal range, for each of the service server, the session, and the user based on the request pattern; Unauthorized access detection methods. (Appendix 16) The computer Collecting API responses sent from the service server; Recording a response pattern in which response parameters included in the API response are organized for each session; generating a parameter set for generating a dummy response for each of the service servers, the sessions, and the users based on the response pattern; 16. The method for detecting unauthorized access according to claim 15. (Appendix 17) The computer Determine whether the API request sent from one of the service servers is an invalid request based on the normal request pattern; If it is determined that the API request is an invalid request, an API response transmitted from another service server is delayed and transmitted to the sender of the API request. 16. The method for detecting unauthorized access according to claim 15. (Appendix 18) The computer Determine whether the API request sent from one of the service servers is an invalid request based on the normal request pattern; If the API request is determined to be fraudulent, a predetermined alert is sent to the stakeholder. 16. The method for detecting unauthorized access according to claim 15. (Appendix 19) The computer Determine whether or not the user ID included in the API request sent to the personal data linkage platform actually exists based on user ID linkage information in which different user IDs for each of the plurality of service servers are managed for each of the users; generating the dummy response based on the parameter set; If it is determined that the user ID included in the API request does not exist, the dummy response is sent to the sender of the API request. 17. The method for detecting unauthorized access according to claim 16. (Appendix 20) The computer delaying the dummy response and sending it to the sender of the API request; 19. The method for detecting unauthorized access according to claim 19. (Appendix 21) The computer Determine whether or not the user ID included in the API request sent to the personal data linkage platform actually exists based on user ID linkage information in which different user IDs for each of the plurality of service servers are managed for each of the users; If it is determined that the user ID included in the API request does not exist, a predetermined alert is sent to the stakeholder. 17. The method for detecting unauthorized access according to claim 16. (Appendix 22) A program that causes a computer to execute a process for detecting unauthorized access in a personal data linkage platform that links personal data between multiple service servers, The computer, A process of collecting API requests sent from the service server; A process of recording a request pattern in which request parameters included in the API request are grouped for each session; A process of generating a normal request pattern, which is a request pattern within a normal range, for each of the service servers, the sessions, and the users based on the request pattern; Execute program. (Appendix 23) The computer, A process of collecting API responses sent from the service server; A process of recording a response pattern in which response parameters included in the API response are grouped for each session; generating a parameter set for generating a dummy response for each of the service servers, the sessions, and the users based on the response pattern; Execute 22. The program of claim 1. (Appendix 24) The computer, A process of determining whether an API request sent to the personal data link platform is an invalid request based on the normal request pattern; a process of delaying an API response transmitted from another service server and transmitting the response to the sender of the API request when the API request is determined to be an invalid request; Execute 22. The program of claim 1. (Appendix 25) The computer, A process of determining whether an API request sent to the personal data link platform is an invalid request based on the normal request pattern; a process of notifying a stakeholder of a predetermined alert when the API request is determined to be an unauthorized request; Execute 22. The program of claim 1. (Appendix 26) The computer, A process of determining whether a user ID included in an API request sent to the personal data linkage platform actually exists based on user ID linkage information in which a different user ID for each of the plurality of service servers is managed for each of the users; generating the dummy response based on the parameter set; a process of sending the dummy response to a sender of the API request when it is determined that the user ID included in the API request does not exist; Execute 23. The program described in Appendix 23. (Appendix 27) The computer delaying the dummy response and sending it to the sender of the API request; 26. The program described in Appendix 26. (Appendix 28) The computer, A process of determining whether a user ID included in an API request sent to the personal data linkage platform actually exists based on user ID linkage information in which a different user ID for each of the plurality of service servers is managed for each of the users; a process of notifying a stakeholder of a predetermined alert when it is determined that the user ID included in the API request does not exist; Execute 23. The program described in Appendix 23. [Explanation of symbols]

[0059] 10 Unauthorized access detection device 11 Request Collection Unit 12 Request pattern recording section 13 Normal request pattern generation unit 100 Personal Data Collaboration Platform 110 Proxy device 110 (request collection unit, response collection unit, response delay unit, dummy response transmission unit) 120 Normal request pattern generation device (normal request pattern generation unit) 130 Parameter set generation device (parameter set generation unit) 140 Dummy response generator (dummy response generator) 150 Request determination device (request determination unit) 160 User ID determination device (user ID determination unit) 170 Communication control device (alert notification unit) 180 Recording device (request pattern recording unit, response pattern recording unit) 200_1, 200_2, 200_3, ... Service servers 300 Attacker's Server

Claims

1. An unauthorized access detection device that detects unauthorized access in a personal data linkage platform that links personal data between a plurality of service servers, a request collection unit that collects API requests transmitted from the service server; a request pattern recording unit that records a request pattern in which request parameters included in the API request are grouped for each session; a normal request pattern generation unit that generates a normal request pattern, which is a request pattern within a normal range, for each of the service servers, the sessions, and the users based on the request pattern; Equipped with Unauthorized access detection device.

2. a response collection unit that collects API responses transmitted from the service server; a response pattern recording unit that records a response pattern in which response parameters included in the API response are grouped for each session; a parameter set generation unit that generates a parameter set for generating a dummy response for each of the service servers, the sessions, and the users based on the response pattern; Equipped with The unauthorized access detection device according to claim 1.

3. a request determination unit that determines whether an API request transmitted to the personal data link platform is an invalid request based on the normal request pattern; a response delay unit that, when the request determination unit determines that the API request is an invalid request, delays an API response transmitted from another service server and transmits the delayed API response to a transmission source of the API request; Equipped with The unauthorized access detection device according to claim 1.

4. a request determination unit that determines whether an API request transmitted to the personal data link platform is an invalid request based on the normal request pattern; an alert notification unit that notifies a stakeholder of a predetermined alert when the request determination unit determines that the API request is an invalid request; Equipped with The unauthorized access detection device according to claim 1.

5. a user ID determination unit that determines whether a user ID included in an API request sent to the personal data linkage platform actually exists based on user ID linkage information in which a different user ID for each of the plurality of service servers is managed for each user; a dummy response generator that generates the dummy response based on the parameter set; a dummy response sending unit that sends the dummy response to a sender of the API request when the user ID determining unit determines that the user ID included in the API request does not exist; Equipped with The unauthorized access detection device according to claim 2.

6. the dummy response transmission unit delays the dummy response and transmits it to the sender of the API request; The unauthorized access detection device according to claim 5.

7. a user ID determination unit that determines whether a user ID included in an API request sent to the personal data linkage platform actually exists based on user ID linkage information in which a different user ID for each of the plurality of service servers is managed for each user; an alert notification unit that notifies a stakeholder of a predetermined alert when the user ID determination unit determines that the user ID included in the API request does not exist; Equipped with The unauthorized access detection device according to claim 1.

8. A personal data linkage platform that links personal data between multiple service servers, a request collection unit that collects API requests transmitted from the service server; a request pattern recording unit that records a request pattern in which request parameters included in the API request are grouped for each session; a normal request pattern generation unit that generates a normal request pattern, which is a request pattern within a normal range, for each of the service servers, the sessions, and the users based on the request pattern; Equipped with Personal data integration platform.

9. 1. An unauthorized access detection method for detecting unauthorized access in a personal data linkage platform that links personal data between a plurality of service servers, comprising: The computer Collecting API requests sent from the service server; Recording a request pattern in which request parameters included in the API request are grouped for each session; generating a normal request pattern, which is a request pattern within a normal range, for each of the service server, the session, and the user based on the request pattern; Unauthorized access detection methods.

10. A program that causes a computer to execute a process for detecting unauthorized access in a personal data linkage platform that links personal data between multiple service servers, The computer, A process of collecting API requests transmitted from the service server; A process of recording a request pattern in which request parameters included in the API request are grouped for each session; A process of generating a normal request pattern, which is a request pattern within a normal range, for each of the service servers, the sessions, and the users based on the request pattern; Execute program.

Images