Access control device, access control method and access control program

Abstract

To provide an access control device, an access control method, and an access control program that can suppress aggressive access at an early stage. [Solution] The server 1 comprises a database 21 that stores the weighted number of accesses to a site for each access source address, a program sending unit 11 that sends a browser fingerprint collection program to the browser of the access source when access to the site is detected, a risk level acquisition unit 12 that acquires a predetermined risk level for the value of each item of the browser fingerprint when the browser fingerprint collected by the collection program is received from the access source, an access number update unit 13 that adds a larger value to the weighted access number as the risk level increases and updates it, and an access restriction unit 14 that restricts access from the same access source if the updated weighted access number exceeds a predetermined threshold.

Description

[Technical Field]

[0001] The present invention relates to a technique for detecting offensive access. [Background technology]

[0002] In the past, attacks that involve large amounts of access to specific sites through the automatic manipulation of browsers by bots, etc., have been a problem. In order to suppress such aggressive access, it is common to use an access counter to limit accesses that exceed a threshold, or to mitigate attacks through mechanisms such as standby authentication (see, for example, Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Cloudflare Waiting Room, Cloudflare, Inc., Internet, [Retrieved July 31, 2024]<https: / / www.cloudflare.com / ja-jp / application-services / products / waiting-room / > Summary of the Invention [Problem to be solved by the invention]

[0004] However, conventional methods for detecting large amounts of access do not impose restrictions such as blocking the source of access until a large amount of access occurs, which means that a considerable amount of aggressive access is allowed to pass through.

[0005] An object of the present invention is to provide an access control device, an access control method, and an access control program that can suppress aggressive accesses at an early stage. [Means for solving the problem]

[0006] The access control device of the present invention comprises a memory unit that stores a weighted number of accesses to a site for each access source address; a program transmission unit that, when it detects access to the site, transmits a browser fingerprint collection program to the browser of the access source; a risk level acquisition unit that, when it receives the browser fingerprint collected by the collection program from the access source, acquires a predetermined risk level for the value of each item of the browser fingerprint; an access number update unit that updates the weighted access number by adding a larger value the higher the risk level; and an access restriction unit that restricts accesses from the same access source if the weighted access number after update by the access number update unit exceeds a predetermined threshold.

[0007] The risk level may be set higher when there is automatic operation than when there is no automatic operation, depending on a value indicating the presence or absence of automatic operation in the browser fingerprint.

[0008] The collection program acquires additional information indicating whether a specific value in the browser fingerprint has been overwritten, and the risk acquisition unit may increase the risk based on the additional information if the specific value has been overwritten.

[0009] The collection program detects that a second standard function required to reproduce a first standard function for obtaining the additional information has been called by overwriting the second standard function, and the risk level acquisition unit may increase the risk level when the second standard function is called.

[0010] When the browser fingerprint is not transmitted from the access source, the risk level acquisition unit may acquire a risk level for the browser fingerprint not being transmitted.

[0011] In the access control method of the present invention, a computer stores a weighted number of accesses to a site for each access source address, and when access to the site is detected, a program sending unit sends a browser fingerprint collection program to the browser from which the access is made, and when the browser fingerprint collected by the collection program is received from the access source, a risk level acquisition unit acquires a predetermined risk level for the value of each item in the browser fingerprint, and an access number update unit updates the weighted access number by adding a larger value the higher the risk level, and if the weighted access number after update by the access number update unit exceeds a predetermined threshold, an access restriction unit restricts access from the same access source.

[0012] An access control program according to the present invention causes a computer to function as the access control device. [Effects of the Invention]

[0013] According to the present invention, aggressive access can be suppressed early. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 2 is a block diagram showing the functional configuration of a server according to the embodiment. [Figure 2] FIG. 10 is a sequence diagram illustrating an example of an implementation procedure of an access control method according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0015] An example of an embodiment of the present invention will be described below. Conventional mass access detection does not restrict communication until a large number of accesses are made from the same address, allowing a considerable amount of aggressive access to pass through. However, the access control device of this embodiment improves on the conventional access counter to significantly reduce the amount of access that passes through, thereby suppressing damage caused by attacks.

[0016] FIG. 1 is a block diagram showing the functional configuration of a server 1 (access control device) in this embodiment. The server 1 is an information processing device equipped with a control unit 10 and a memory unit 20, and when a user's terminal 2 accesses a website to be controlled via a network (Internet), it performs access control based on the weighted access count for each IP address, which will be described later.

[0017] The control unit 10 is a part that controls the entire server 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU. Specifically, the control unit 10 executes an access control program stored in the storage unit 20, thereby functioning as a program transmission unit 11, a risk level acquisition unit 12, an access count update unit 13, and an access restriction unit .

[0018] The storage unit 20 is a storage area for various programs for causing the hardware group to function as the server 1, various data, etc., and may be a ROM, RAM, flash memory, hard disk drive (HDD), or the like. In this embodiment, the memory unit 20 includes an access control program as well as a database (DB) 21 that stores the weighted number of accesses to a site for each access source IP address, and further, the risk level is preset and stored for each value of each item in the browser fingerprint (for example, for each item or for each combination).

[0019] Browser fingerprinting is the collection of various browser information (IP address, user agent, window size, type of installed fonts, type of plugins, GPU performance, whether automatic operation is enabled, etc.). The risk level may be set for these browser information items based on, for example, statistically calculated anomalies, but in particular, the risk level is set higher when automatic operation is present than when there is no automatic operation, depending on the value indicating whether or not automatic operation is present.

[0020] When program transmission unit 11 detects an access to a site to be controlled, it transmits a browser fingerprint collection program to the browser that has made the access.

[0021] When risk level acquisition unit 12 receives a browser fingerprint collected by the collection program from the access source, it acquires a risk level set in advance for the value of each item of the browser fingerprint.

[0022] When the access count update unit 13 extracts the weighted access count from the access source from the database 21, the access count update unit 13 updates the weighted access count by adding a larger value to the weighted access count as the risk level acquired by the risk level acquisition unit 12 increases.

[0023] When the weighted access count updated by the access count update unit 13 exceeds a predetermined threshold, the access limiting unit 14 limits access from the same access source.

[0024] [First embodiment] Using each of the aforementioned functional units, the server 1 pre-sets a risk level corresponding to the browser fingerprint of the terminal 2 of the user who accessed the site, and counts the access count as a number corresponding to the risk level (≧1) instead of 1.

[0025] FIG. 2 is a sequence diagram illustrating an example of the procedure for implementing the access control method according to this embodiment. In this access control method, first, in the server 1, a risk level corresponding to the browser information (browser fingerprint) is set in advance for each item value or for each combination of values.

[0026] In step S1, the user's terminal 2 accesses the server 1 via a browser. In step S2, program transmission unit 11 of server 1 transmits a collection program for collecting browser fingerprints to the browser of terminal 2 that has made the access.

[0027] In step S3, terminal 2 executes the program received from server 1 on the browser, generates a browser fingerprint, and transmits it to server 1.

[0028] In step S4, the risk level acquisition unit 12 of the server 1 acquires from the database 21 the weighted number of accesses from the IP address of the access source. In step S5, access count update unit 13 of server 1 adds a number according to the risk level that is set in advance in correspondence with the received browser fingerprint to the acquired weighted access count.

[0029] In step S6, the access restriction unit 14 of the server 1 determines whether the weighted access count updated in step S5 exceeds a threshold value. If the determination is YES, the process proceeds to step S7, and if the determination is NO, the process proceeds to step S8.

[0030] In step S7, the access restriction unit 14 of the server 1 restricts access by, for example, refusing access from the IP address in question or requesting specific authentication from the user. In step S8, the access count update unit 13 of the server 1 stores the updated weighted access count in the database 21.

[0031] [Second embodiment] In the first embodiment, server 1 acquires a risk level for a browser fingerprint received from terminal 2, but in the second embodiment, a case where this browser fingerprint is not sent from terminal 2 is taken into consideration.

[0032] When the browser fingerprint is not transmitted from the access source, risk level acquisition section 12 of server 1 acquires the risk level for the fact that the browser fingerprint has not been transmitted. That is, in addition to the risk level for the value of each item of the browser fingerprint, storage unit 20 stores the risk level for the case where the browser fingerprint itself cannot be obtained. It should be noted that risk level obtaining section 12 may determine that terminal 2 has not transmitted a browser fingerprint if, for example, a predetermined time has passed without receiving a browser fingerprint after transmitting a collection program.

[0033] [Third embodiment] The various browser information collected as browser fingerprints can be disguised due to the specifications of JavaScript (registered trademark) that runs on browsers.

[0034] Therefore, the risk acquisition unit 12 of the server 1 calculates the risk depending on whether or not the information has been overwritten, thereby being able to calculate the risk more appropriately than when using other methods, such as those based on statistically calculated anomalies. In other words, the collection program acquires additional information indicating whether a specific value in the browser fingerprint has been overwritten, and the risk acquisition unit 12 increases the risk based on this additional information if the specific value has been overwritten.

[0035] Specifically, risk level acquisition unit 12 collects whether browser information has been overwritten (for example, spoofing the presence or absence of automatic operation from "yes" to "no") as additional information to the browser fingerprint, for example, using function hasOwnProperties, and if the browser information has been overwritten, determines that the browser has been spoofed and increases the risk level. For example, a predetermined value may be added to the risk level, or a risk level in the case of spoofing may be set separately for each item of the browser fingerprint.

[0036] Furthermore, the risk level acquisition unit 12 may be equipped with the following function, taking into consideration the possibility that the function used to check whether the browser information has been overwritten may itself be overwritten. In other words, the collection program detects that the second standard function has been called by overwriting the second standard function required to reproduce the first standard function for obtaining additional information, and the risk level acquisition unit 12 increases the risk level when the second standard function is called.

[0037] Specifically, the risk level acquisition unit 12 may take into consideration the possibility that the standard JavaScript function hasOwnProperties has been overwritten, making it appear as if no automatic operation has occurred, and may monitor whether other specific standard functions (such as indexOf, which is often used in programs) have been called unintentionally, and if they have been called, may determine that there is a high possibility that information has been overwritten.

[0038] For example, the function hasOwnProperties: Object.hasOwnProperties = function() { ... A ...} When the function is overwritten as above, various standard functions such as indexOf are required to accurately reproduce the behavior of the original function hasOwnProperties in part A. Here, the server 1 sets indexOf in the program sent to the terminal 2 as follows: String.indexOf = function() { ... B ...} Then, when hasOwnProperties is called, B is executed because A uses indexOf. Since the original Object.hawnProperties is a standard function, B is not called due to the nature of JavaScript. Therefore, when the risk level acquisition unit 12 detects the execution of B, it determines that the browser information has been forged and increases the risk level.

[0039] According to the above-described embodiment, the server 1 increases the weighted access count for each IP address based on the value of the browser fingerprint of the access source from a value greater than the normal value of 1 per access. This allows the weighted access count for aggressive access to reach the threshold value more quickly than before, making it possible to block aggressive access more quickly. In particular, by setting a high risk level for access from an automatically operated browser, the server 1 can effectively restrict aggressive access. Furthermore, for normal accesses, no additional charges are added based on the browser fingerprint, so the threshold value obtained from conventional knowledge can be used as is.

[0040] Typically, blocking of large amounts of access is often done based on the number of accesses or sessions per IP address, but attackers may use techniques such as using multiple IP addresses in rotation, changing the IP address just before the threshold is reached, and then reusing the IP address again when the access count is reset. In contrast, with the method of this embodiment, attackers must significantly increase the number of IP addresses they use, and because the threshold does not appear fixed to attackers, they must change IP addresses with a modest number of accesses. This increases the cost of attacks, and as a result, the motivation to attack the target website decreases, which is expected to reduce attacks.

[0041] Furthermore, when server 1 detects that the browser fingerprint value has been overwritten, it determines that the browser has been spoofed by an attacker, and greatly increases the weighted access count. Furthermore, the server 1 may detect that the standard function of the browser for determining whether or not the overwrite has been performed has been overwritten and the information has been falsified. Specifically, by taking advantage of the property that standard functions do not call other standard functions, when the server 1 detects that another standard function has been called, it determines that the information has been falsified by an attacker and greatly increases the weighted access count. This allows the server 1 to restrict aggressive access more efficiently.

[0042] Furthermore, when a server does not receive a normal value that should have been sent from a terminal, it often denies access from that terminal, notifies the user that the value is invalid, or displays an error. In contrast, the server 1 of this embodiment deliberately passes the connection request, greatly increasing the weighted access count. This makes it difficult for an attacker to determine which part of the attack program is being determined to be an attack, and prevents circumvention of access restrictions.

[0043] Furthermore, this embodiment makes it possible to restrict offensive access at an early stage, for example, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0044] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0045] The access control method by the server 1 is realized by software. When realized by software, the programs constituting this software are installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed, or may be distributed by being downloaded to computers via a network. [Explanation of symbols]

[0046] 1 Server (access control device) 10 Control Unit 11 Program Transmission Unit 12 Risk Acquisition Department 13 Access count update section 14 Access Restriction Section 20 Memory section 21 Databases

Claims

1. a storage unit that stores a weighted number of accesses to a site for each access source address; a program transmission unit that, upon detecting an access to the site, transmits a browser fingerprint collection program to the browser that is the access source; a risk level acquisition unit that, when receiving the browser fingerprint collected by the collection program from the access source, acquires a predetermined risk level for each value of the browser fingerprint; an access count update unit that updates the weighted access count by adding a larger value to the weighted access count as the risk level increases; an access restriction unit that restricts access from the same access source when the weighted access count updated by the access count update unit exceeds a predetermined threshold.

2. The access control device according to claim 1 , wherein the risk level is set higher when there is automatic operation than when there is no automatic operation, depending on a value indicating the presence or absence of automatic operation in the browser fingerprint.

3. the collection program acquires, as additional information, whether a specific value in the browser fingerprint has been overwritten; The access control device according to claim 1 , wherein the risk level acquisition unit increases the risk level when the specific value has been overwritten based on the additional information.

4. the collection program detects that a second standard function necessary to reproduce the first standard function for acquiring the additional information has been called by overwriting the second standard function; The access control device according to claim 3 , wherein the risk level acquisition unit increases the risk level when the second standard function is called.

5. The access control device according to claim 1 , wherein the risk level acquisition unit acquires a risk level for the browser fingerprint not being transmitted when the browser fingerprint is not transmitted from the access source.

6. The computer For each access source address, the weighted number of accesses to the site is stored. When an access to the site is detected, a program transmission unit transmits a browser fingerprint collection program to the browser from which the access is made, When the browser fingerprint collected by the collection program is received from the access source, a risk level acquisition unit acquires a predetermined risk level for each value of the browser fingerprint, an access count update unit updates the weighted access count by adding a larger value to the weighted access count as the risk level increases; an access control method in which, when the weighted access count updated by the access count update unit exceeds a predetermined threshold, an access restriction unit restricts access from the same access source;

7. An access control program for causing a computer to function as the access control device according to any one of claims 1 to 4.

Images