Information processing device, information processing method, and information processing program

Abstract

To implement a fraud detection system that is easy to use and highly accurate. [Solution] The information processing device 1 comprises a determination unit 30, a modification unit 31, an acquisition unit 32, a specification unit 33, and a judgment unit 34. The determination unit 30 determines the lifetime value of the authentication information issued by the domain controller. The modification unit 31 causes the domain controller to perform a process to change the lifetime of the authentication information to the value determined by the determination unit 30. The acquisition unit 32 acquires a packet containing the authentication information. The specification unit 33 identifies the lifetime value of the authentication information contained in the packet acquired by the acquisition unit 32. The judgment unit 34 determines that the authentication information contained in the packet acquired by the acquisition unit 32 is invalid authentication information if the lifetime value identified by the specification unit 33 and the lifetime value modified by the modification unit 31 are different.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, an information processing method, and an information processing program.

Background Art

[0002] Active Directory is a service provided by Microsoft (registered trademark) and can centrally manage Windows (registered trademark) computers.

[0003] In Active Directory, mainly Kerberos authentication is used. In Kerberos authentication, authentication is performed by exchanging authentication information called a ticket with a domain controller.

[0004] Tickets used in Kerberos authentication include a TGT (Ticket Granting Ticket) and an ST (Service Ticket). The TGT is a ticket that proves the user is correct and is used to issue an ST. The ST is a ticket for using the services of an Active Directory domain.

[0005] The JPCERT (Japan Computer Emergency Response Team) Coordination Center has confirmed many cases where the Active Directory environment has been invaded. In particular, the JPCERT Coordination Center has reported that the administrator authority of Active Directory has been abused. According to the report of the JPCERT Coordination Center, attackers who have stolen the administrator authority of Active Directory often create illegal authentication information called a Golden Ticket or a Silver Ticket.

[0006] A golden ticket is a TGT (Token Guarantee) with a legitimate signature that has been fraudulently created by an attacker. A golden ticket can be created by exploiting the password of a krbtgt account obtained by attacking a domain controller. The attacker can then use the golden ticket to impersonate any account.

[0007] A silver ticket is a security threat (ST) that has been fraudulently created by an attacker. An attacker can create a silver ticket by gaining access to any resource within the domain and obtaining the necessary information to generate one. A silver ticket allows an attacker to impersonate any account. By becoming any account, the attacker can then access specific services within the Active Directory environment.

[0008] When attackers use golden tickets or silver tickets to impersonate legitimate accounts, it becomes difficult to distinguish between the use of TGTs and STs in a fraudulent attempt and their use in legitimate operations, making detection of the impersonation extremely challenging. Research is being conducted on countermeasures against such impersonation (see, for example, Patent Document 1 and Non-Patent Documents 1-3). [Prior art documents] [Patent Documents]

[0009] [Patent Document 1] U.S. Patent Application Publication No. 2016 / 0330233 [Non-patent literature]

[0010] [Non-Patent Document 1] Mariko Fuimoto, Watatu Matusda, Takuho MItsunaga, “Detecting Abuse of Domain Administrator privilege using Windows Event Log”, IEEE AINS 2018 [Non-Patent Document 2] Microsoft Corporation, Administrator Account Security Planning Guide, “Chapter 3 - Guidelines for Strengthening Administrator Account Security, Creating a Decoy Administrator Account,” [online], [Accessed December 3, 2024], Internet <https: / / learn.microsoft.com / ja-jp / security-updates / planningandimplementationguide / 19869239> [Non-Patent Document 3] JPCERT Coordination Center, “Detection and countermeasures against attacks on Active Directory using logs, 5.2.1. Changing the password of the krbtgt account, 5.2.3. Changing the password of the account running the service,” [online], [Accessed December 3, 2024], Internet<https: / / www.jpcert.or.jp / research / AD.html> [Overview of the project] [Problems that the invention aims to solve]

[0011] However, the aforementioned prior art may not always provide a solution that is easy to use and highly accurate in detecting fraud.

[0012] For example, attackers may attempt to exploit fraudulent authentication. One such example is the use of golden tickets or silver tickets in fraudulent authentication events. However, attacks using golden or silver tickets exploit legitimate accounts. Therefore, detecting golden or silver tickets is not easy. For instance, even the aforementioned prior art has operational and detection accuracy challenges.

[0013] For example, the technology described in Patent Document 1 requires a change in the network configuration. Non-Patent Document 1 discusses the possibility of false positives occurring depending on the operation.

[0014] The method described in Non-Patent Document 2 involves creating a decoy administrator account that an attacker is likely to focus on, and monitoring access using this decoy administrator account. However, when an attacker uses a golden ticket or silver ticket, they have already stolen legitimate domain administrator or server administrator accounts. In this situation, the likelihood of the attacker attempting access using a decoy account is low.

[0015] The countermeasures described in Non-Patent Literature 3 can invalidate the created golden tickets and silver tickets. However, if an attack is attempted after the countermeasures described in Non-Patent Literature 3 have been implemented, no trace of the attack will be left behind. Therefore, the countermeasures described in Non-Patent Literature 3 leave a risk that golden tickets and silver tickets could be recreated, for example, by a potentially infected terminal.

[0016] Servers in an Active Directory environment, including domain controllers, are often always-on servers essential for organizational operations. Therefore, a technology that can accurately detect authentication information such as golden tickets and silver tickets while minimizing the impact on operations is desirable.

[0017] The present invention has been made in view of the above, and aims to provide a method for easily operating and highly accurate fraud detection. [Means for solving the problem]

[0018] To solve the above problems, the information processing apparatus of the present invention includes a determination unit, a change unit, an acquisition unit, a specification unit, and a determination unit. The determination unit determines the value of the lifetime of the authentication information issued by the domain controller. The change unit causes the domain controller to execute a process of changing the lifetime of the authentication information to the value determined by the determination unit. The acquisition unit acquires a packet including the authentication information. The specification unit specifies the value of the lifetime of the authentication information included in the packet acquired by the acquisition unit. The determination unit determines that the authentication information included in the packet acquired by the acquisition unit is unauthorized authentication information when the value of the lifetime specified by the specification unit is different from the value of the lifetime changed by the change unit.

Effect of the Invention

[0019] According to the present invention, it is possible to perform unauthorized detection that is easy to operate and highly accurate.

Brief Description of the Drawings

[0020] [Figure 1] FIG. 1 is a diagram for explaining an overview of information processing executed by an information processing apparatus according to an embodiment. [Figure 2] FIG. 2 is a diagram showing an example of the configuration of an information processing system according to an embodiment. [[ID=第十九]] [Figure 3] FIG. 3 is a diagram showing an example of the configuration of an information processing apparatus according to an embodiment. [Figure 4] FIG. 4 is a diagram showing an example of a lifetime setting information table stored in a lifetime setting information storage unit according to an embodiment. [Figure 5] FIG. 5 is a diagram showing an example of an unauthorized detection history table stored in an unauthorized detection history storage unit according to an embodiment. [Figure 6] FIG. 6 is a diagram showing an example of the value of the start time and the value of the end time included in a packet acquired by an acquisition unit according to an embodiment. [Figure 7] FIG. 7 is a diagram showing an example of unauthorized detection information notified by a notification unit according to an embodiment. [Figure 8]Figure 8 is a flowchart showing an example of information processing by the processing unit of the information processing device according to the embodiment. [Figure 9] Figure 9 is a flowchart showing an example of fraud detection processing by the processing unit of the information processing device according to the embodiment. [Figure 10] Figure 10 shows an example of a computer that executes an information processing program. [Modes for carrying out the invention]

[0021] The following describes embodiments for carrying out the present invention with reference to the drawings. The present invention is not limited to these embodiments.

[0022] [overview] First, an overview of the information processing performed by the information processing device according to the embodiment will be explained with reference to Figure 1. Figure 1 is a diagram illustrating an overview of the information processing performed by the information processing device according to the embodiment.

[0023] As shown in Figure 1, the information processing system 100, which includes the information processing device 1, also includes a domain controller 2, a server 3, a terminal device 4, and an L2 switch 5.

[0024] Domain Controller 2 is a server that centrally manages user accounts, computer access rights, and other access privileges within a specific domain on the network, and performs user authentication. Server 3 is a server that provides services to users and belongs to the domain managed by Domain Controller 2.

[0025] Terminal device 4 is a terminal device operated by a user and belongs to a domain managed by domain controller 2. L2 switch 5 is a Layer 2 switch and is a network device that forwards packets between multiple devices, such as information processing device 1, domain controller 2, server 3, and terminal device 4.

[0026] As shown in Figure 1, the information processing device 1 obtains the decryption key from the domain controller 2 (step S1).

[0027] Next, the information processing device 1 determines the lifetime value of the authentication information issued by the domain controller 2 (step S2). Authentication information is, for example, a ticket that proves that the user is legitimate (e.g., TGT) or a ticket that allows the user to use services provided by the server 3 (e.g., ST). In the following, the lifetime value of the authentication information determined by the information processing device 1 may be referred to as the changed value.

[0028] For example, the information processing device 1 randomly determines a value within a predetermined range as a change value that is different from the value set as the default value for the lifetime of authentication information in the domain controller 2, but is not limited to such an example.

[0029] Next, the information processing device 1 transmits the changed value, which is the value determined in step S2, to the domain controller 2 (step S3). The domain controller 2 receives the changed value transmitted from the information processing device 1 and changes the lifetime value of the authentication information issued in response to a request from a terminal device 4 or the like to the acquired changed value (step S4).

[0030] In this way, the information processing device 1 sends the changed value to the domain controller 2, causing the domain controller 2 to perform a process to change the lifetime of the authentication information to the value determined in step S2. As a result, the domain controller 2 can issue authentication information with the lifetime value changed.

[0031] Next, the information processing device 1 captures packets destined for the domain controller 2 and packets destined for the server 3 (step S5). Then, the information processing device 1 obtains packets from the packets captured in step S5 that contain authentication information as the destination device (step S6). Packets containing authentication information as the destination device are, for example, packets that present authentication information to a server (for example, the TGS (Ticket Granting Server) in the domain controller 2 or server 3).

[0032] Next, the information processing device 1 decrypts the packet obtained in step S6 using the decryption key obtained in step S1 (step S7). Then, the information processing device 1 identifies the lifetime value of the authentication information contained in the decrypted packet (step S8).

[0033] Next, the information processing device 1 compares the change value determined in step S2 with the lifetime value of the authentication information identified in step 8. If these values ​​are different, it determines that the authentication information is fraudulent (step S9).

[0034] Thus, the information processing device 1 can determine whether or not authentication information is fraudulent by changing the lifetime value of the authentication information in the domain controller 2, enabling easy operation and highly accurate fraud detection. The information processing system 100, including the information processing device 1, will be described in more detail below.

[0035] [Configuration of Information Processing System 100] Figure 2 shows an example of the configuration of an information processing system 100 according to an embodiment. As shown in Figure 2, the information processing system 100 includes a domain controller 2, a plurality of servers 3, and a plurality of terminal devices 4.

[0036] Domain Controller 2 is a server that centrally manages user accounts and access rights to computers within the domain, and performs user authentication. Domain Controller 2 has functions such as AS (Authentication Server) and the TGS mentioned above. The AS is a server that accepts authentication from users, and the TGS is a server that issues tickets for using Server 3. The domain managed by Domain Controller 2 is an Active Directory domain, but is not limited to this example.

[0037] Active Directory uses Kerberos authentication. Kerberos authentication is performed by exchanging authentication information with domain controller 2. This authentication information includes, for example, a TGT (Ticket Granting Ticket) and an ST (Service Ticket). A TGT is a ticket that proves the user is legitimate and is used, for example, to issue an ST. An ST is a ticket for using services provided by server 3.

[0038] Each of the multiple servers 3 may be, for example, a file server, a web server, a database server, a print server, or an LDAP (Lightweight Directory Access Protocol) server, but is not limited to these examples.

[0039] Terminal device 4 is a terminal device operated by a user and belongs to a domain managed by domain controller 2. Terminal device 4 is, for example, a workstation, but is not limited to this example; it may also be, for example, a desktop PC (personal computer), a laptop PC, or a tablet.

[0040] Network N is, for example, a LAN (Local Area Network) or a WAN (Wide Area Network), but is not limited to such examples. Network N includes, for example, the L2 switch 5 described above. The domain controller 2, multiple servers 3, and multiple terminal devices 4 are connected to each other via Network N so that they can communicate with one another.

[0041] [Configuration of Information Processing Device 1] Next, an example of the configuration of the information processing device 1 will be described. Figure 3 is a diagram showing an example of the configuration of the information processing device 1 according to the embodiment.

[0042] As shown in Figure 3, the information processing device 1 comprises a communication unit 10, a storage unit 11, and a processing unit 12. The communication unit 10 is connected to a network N and can communicate with the domain controller 2, the server 3, and the terminal device 4.

[0043] The storage unit 11 stores various types of information. The storage unit 11 includes a lifetime setting information storage unit 20, a fraud detection history storage unit 21, and a mode information storage unit 22. The lifetime setting information storage unit 20 stores the change value of the authentication information lifetime, which is determined by the processing unit 12 at predetermined intervals.

[0044] Figure 4 shows an example of a lifetime setting information table stored in the lifetime setting information storage unit 20 according to the embodiment. As shown in Figure 4, the lifetime setting information table stored in the lifetime setting information storage unit 20 includes information relating "modification date and time," "authentication information type," and "modified value" for each "modification date and time."

[0045] "Date and Time of Change" indicates the date and time when the lifetime value of the authentication information in the domain controller 2 was changed by the processing unit 12. "Authentication Information Type" indicates the type of authentication information whose lifetime value was changed by the processing unit 12 in the domain controller 2. Examples of authentication information types include TGT and ST. "Changed Value" is the lifetime value of the authentication information in the domain controller 2 that was changed by the processing unit 12.

[0046] The fraud detection history storage unit 21 contains information on authentication information that has been determined to be fraudulent by the processing unit 12. Figure 5 shows an example of a fraud detection history table stored in the fraud detection history storage unit 21 according to this embodiment.

[0047] As shown in Figure 5, the fraud detection history table stored in the fraud detection history storage unit 21 contains information that correlates the "detection date and time," "authentication information type," "specific value of lifetime," and "correct value of lifetime" for each authentication information determined to be fraudulent.

[0048] The "Detection Date and Time" includes information indicating the detection date and time, which is the date and time when the processing unit 12 determined that the authentication information was invalid. The "Authentication Information Type" is information indicating the type of authentication information that the processing unit 12 determined to be invalid.

[0049] The "specific lifetime value" is the lifetime value identified from the information contained in the authentication information that the processing unit 12 has determined to be invalid. The "correct lifetime value" is the correct lifetime value compared with the lifetime value of the authentication information that the processing unit 12 has determined to be invalid, and is the modified value described above.

[0050] The mode information storage unit 22 stores information indicating the operating mode set by the administrator of the information processing system 100 or the like. The operating modes that can be set by the administrator of the information processing system 100 or the like include, for example, a first mode, a second mode, and a third mode.

[0051] The first mode is a mode in which the type of authentication information subject to fraud detection is TGT. The second mode is a mode in which the type of authentication information subject to fraud detection is TGT and ST. The third mode is a mode in which the type of authentication information subject to fraud detection is ST. In the following, the operating mode set by the administrator of the information processing system 100 or the like may be referred to as the set operating mode.

[0052] Returning to Figure 3, we will now describe the processing unit 12 of the information processing device 1. The processing unit 12 includes a determination unit 30, a modification unit 31, an acquisition unit 32, a specific unit 33, a judgment unit 34, and a notification unit 35.

[0053] The determination unit 30 determines the lifetime value of the authentication information issued by the domain controller 2. The authentication information issued by the domain controller 2 is, as described above, TGT, ST, etc.

[0054] When the setting operation mode is the first mode, the determination unit 30 determines the lifetime value of the TGT among the multiple types of authentication information issued by the domain controller 2. For example, the determination unit 30 determines the lifetime value of the TGT to a value other than the default value for the lifetime of the TGT in the domain controller 2.

[0055] The default value for the TGT lifetime in the domain controller 2 is, for example, 10 hours. The determination unit 30 determines the TGT lifetime value to a value within a predetermined range that is different from the default value for the TGT lifetime.

[0056] The predetermined range is, for example, from 5 hours to 15 hours, and the determination unit 30 determines the value in one-hour increments within the range of 5 hours to 15 hours as the lifetime value of the TGT. However, the predetermined range is not limited to the range of 5 hours to 15 hours.

[0057] The determination unit 30 determines a random value as the lifetime value of the TGT at predetermined intervals. The predetermined interval is, for example, one day, but may also be several hours (for example, 6 hours or 12 hours), or any other period.

[0058] Since an attacker may actively use the default value for the TGT's lifetime, the determination unit 30 determines a value other than the default value for the TGT's lifetime as the value for the TGT's lifetime.

[0059] Furthermore, setting a shorter lifetime value increases the number of authentication requests to domain controller 2, thus placing a load on domain controller 2. Therefore, it is desirable to set the lower limit of the lifetime value while considering the load on domain controller 2.

[0060] Furthermore, setting a long lifetime value can allow attackers to continue using tickets for an extended period in the event of an attack other than a golden or silver ticket, such as stealing a ticket from a legitimate account. Therefore, it is sometimes desirable not to set the lifetime limit to an excessively long value.

[0061] In addition, the determination unit 30 can determine the lifetime value of the TGT by determining a value according to a predetermined rule, instead of determining a random value.

[0062] When the setting operation mode is the second mode, the determination unit 30 determines the lifetime values ​​of the TGT and ST from among the multiple types of authentication information issued by the domain controller 2. The method for determining the lifetime value of the TGT is the same as, for example, the method for determining it when the setting operation mode is the first mode.

[0063] The determination unit 30 determines the lifetime value of TGT to a value other than the default value for TGT lifetime in the domain controller 2, and determines the lifetime value of ST to a value other than the default value for ST lifetime in the domain controller 2.

[0064] The default lifetime for TGT in Domain Controller 2 is, for example, 10 hours, and the default lifetime for ST in Domain Controller 2 is, for example, 8 hours.

[0065] The determination unit 30 determines the lifetime value of TGT to a value within a predetermined first range, but different from the default value for TGT's lifetime. The determination unit 30 also determines the lifetime value of ST to a value within a predetermined second range, but different from the default value for ST's lifetime.

[0066] For example, the determination unit 30 may set a predetermined first range to a range of 5 hours to 15 hours and a predetermined second range to, for example, a range of 3 hours to 13 hours, but is not limited to this example.

[0067] The determination unit 30 determines random values ​​as lifetime values ​​for TGT and ST at predetermined intervals, but it can also determine lifetime values ​​for TGT and ST according to predetermined rules at predetermined intervals. The predetermined interval is, for example, one day, but may also be several hours (for example, 6 hours or 12 hours), or any other period.

[0068] Furthermore, when the setting operation mode is the third mode, the determination unit 30 determines the lifetime value of the ST among the multiple types of authentication information issued by the domain controller 2. The method for determining the lifetime value of the ST is the same as, for example, the method for determining it when the setting operation mode is the second mode.

[0069] The modification unit 31 causes the domain controller 2 to perform a process to change the lifetime of the authentication information issued by the domain controller 2 to a value determined by the determination unit 30. For example, the modification unit 31 sends a modified value, which is the value determined by the determination unit 30, to the domain controller 2, thereby causing the domain controller 2 to perform a process to change the lifetime of the authentication information issued by the domain controller 2 to a value determined by the determination unit 30. The domain controller 2 receives the modified value sent from the information processing device 1 and changes the lifetime value of the authentication information to the acquired modified value.

[0070] When the setting operation mode is the first mode, the modification unit 31 causes the domain controller 2 to perform a process to change the lifetime of the TGT issued by the domain controller 2 to the value determined by the determination unit 30.

[0071] Furthermore, when the setting operation mode is the second mode, the modification unit 31 causes the domain controller 2 to perform a process to change the respective lifetimes of the TGT and ST issued by the domain controller 2 to the values ​​determined by the determination unit 30.

[0072] Furthermore, if the setting operation mode is the third mode, the modification unit 31 causes the domain controller 2 to execute a process to change the lifetime of each ST issued by the domain controller 2 to a value determined by the determination unit 30.

[0073] Furthermore, the modification unit 31 can also access the domain controller 2 and change the signing key of the TGT on the domain controller 2.

[0074] The acquisition unit 32 acquires various types of information. For example, the acquisition unit 32 acquires a decryption key from the domain controller 2. For example, the acquisition unit 32 acquires a Keytab file containing the decryption key from the domain controller 2. The authentication information is encrypted, and the encrypted portion of the authentication information can be decrypted using the decryption key contained in the Keytab file.

[0075] Furthermore, if the signature key of the TGT is changed by the modification unit 31, the acquisition unit 32 performs the process of acquiring the Keytab file each time the signature key of the TGT is changed.

[0076] Furthermore, the acquisition unit 32 acquires packets containing authentication information. For example, the acquisition unit 32 captures packets output from a mirror port of a network device (e.g., an L2 switch 5) included in network N. The capture of packets output from a mirror port may be performed, for example, by known capture software.

[0077] The acquisition unit 32 acquires packets containing authentication information from packets captured from the mirror port or the like by the acquisition unit 32 or capture software. For example, when the setting operation mode is the first mode, the acquisition unit 32 acquires packets containing TGT.

[0078] A packet containing a TGT is, for example, a TGS-REQ (Ticket Granting Service Request) packet. A TGS-REQ is a packet containing a message requesting a service ticket to access a specific service, but is not limited to such examples.

[0079] Furthermore, when the configuration operation mode is the second mode, the acquisition unit 32 acquires packets containing TGTs and packets containing STs. Packets containing STs are, for example, SMB (Server Message Block) packets (for example, SMB2 session setup request message packets), but are not limited to such examples. Also, when the configuration operation mode is the third mode, the acquisition unit 32 acquires packets containing STs.

[0080] The identification unit 33 identifies the lifetime value of the authentication information contained in the packet acquired by the acquisition unit 32. The identification unit 33, for example, decrypts the encrypted portion of the packet acquired by the acquisition unit 32 using the decryption key acquired by the acquisition unit 32.

[0081] The identification unit 33 obtains the StartTime value and EndTime value from the authentication information (TGT or ST) contained in a portion of the area included in the packet acquired by the acquisition unit 32, which has been decrypted using the decryption key.

[0082] The identification unit 33 then calculates the lifetime value from the acquired start time and end time values ​​to identify the lifetime value set in the authentication information contained in the packet. For example, the identification unit 33 identifies the lifetime value set in the authentication information contained in the packet by performing a calculation using the following formula (1). Lifetime value = End time value - Start time value ... (1)

[0083] Figure 6 shows an example of start time and end time values ​​included in a packet acquired by the acquisition unit 32 according to the embodiment. In the example shown in Figure 6, the start time value is December 16, 2024, 21:23:45, and the end time value is December 17, 2024, 7:23:45. In this case, the identification unit 33 identifies 10 hours as the lifetime value of the authentication information.

[0084] The determination unit 34 determines that the authentication information contained in the packet acquired by the acquisition unit 32 is invalid authentication information if the lifetime value of the TGT identified by the identification unit 33 is different from the lifetime value of the TGT changed by the modification unit 31.

[0085] For example, suppose the lifetime value stored in the lifetime setting information storage unit 20 is in the state shown in Figure 4, the authentication information included in the packet acquired by the acquisition unit 32 is TGT, and the start time value and end time value of this TGT are the values ​​shown in Figure 6.

[0086] In this case, the lifetime value of the TGT included in the packet acquired by the acquisition unit 32 is determined to be 10 hours by the identification unit 33. On the other hand, the start time value of the TGT included in the packet acquired by the acquisition unit 32 is 21:23:45 on December 16, 2024, and the lifetime value of the TGT issued by the domain controller 2 at this time is 14 hours (see Figure 4).

[0087] Therefore, the lifetime value of the TGT contained in the packet acquired by the acquisition unit 32 is different from the lifetime value of the TGT that would have been issued by the domain controller 2 (the lifetime value modified by the modification unit 31). In this case, the determination unit 34 determines that the authentication information contained in the packet acquired by the acquisition unit 32 is invalid authentication information.

[0088] Furthermore, the determination unit 34 determines that the authentication information contained in the packet acquired by the acquisition unit 32 is invalid authentication information if the predetermined conditions are met and the value of the ST lifetime identified by the identification unit 33 is greater than the value of the ST lifetime changed by the modification unit 31.

[0089] The predetermined condition is that the lifetime value of the ST identified by the identification unit 33 is a value in hours. In other words, this condition means that the lifetime value of the ST is not limited by the expiration date (end time) of the TGT. The lifetime value of the ST may be limited by the expiration date (end time) of the TGT, and the lifetime value limited by the expiration date of the TGT is not effectively a value in hours.

[0090] The notification unit 35 notifies fraud detection information, which includes information about authentication information that has been determined by the determination unit 34 to be fraudulent. The notification unit 35 notifies fraud detection information by displaying the fraud detection information, which includes information about authentication information that has been determined by the determination unit 34 to be fraudulent, on an unillustrated display unit in the information processing device 1.

[0091] Furthermore, the notification unit 35 can also notify the administrator of the information processing system 100 of fraud detection information by, for example, sending fraud detection information, which includes information on authentication information that has been determined to be fraudulent by the determination unit 34, to the administrator's terminal device 4.

[0092] Fraudulent authentication information includes, for example, information indicating the detection time (the time the fraud was detected), information indicating the source IP address, information indicating the destination IP address, information indicating the impersonated account, and information indicating the lifetime value of the detection.

[0093] Figure 7 shows an example of fraud detection information notified by the notification unit 35 according to the embodiment. The fraud detection information shown in Figure 7 includes information indicating that a malicious TGT (Golden Ticket) has been detected, information indicating the source IP address of the Golden Ticket, information indicating the destination IP address of the Golden Ticket, information indicating the impersonated account, information indicating the time of fraud detection, and information indicating the lifetime value.

[0094] [Information Processing] Next, the procedure for information processing by the processing unit 12 of the information processing device 1 according to the embodiment will be described. Figure 8 is a flowchart showing an example of information processing by the processing unit 12 of the information processing device 1 according to the embodiment.

[0095] As shown in Figure 8, the processing unit 12 of the information processing device 1 obtains a decryption key from the domain controller 2 (step S10). The processing unit 12 determines whether or not it is time for a lifetime change (step S11). A lifetime change timing is, for example, a timing that occurs every predetermined period (e.g., every 12 hours, every day), but is not limited to such an example.

[0096] If the processing unit 12 determines that it is time to change the life timing (step S11: Yes), it randomly determines the value of the life time (step S12). The processing unit 12 stores the determined value of the life time in the storage unit 11.

[0097] Next, the processing unit 12 instructs the domain controller 2 to perform a process to change the lifetime of the authentication information to the lifetime value determined in step S12 (step S13).

[0098] If the processing in step S13 is completed, or if it is determined that it is not a life timing change timing (step S11: No), the processing unit 12 determines whether or not it is a fraud detection timing (step S14). A fraud detection timing is, for example, a timing that occurs at predetermined intervals (for example, every minute, every five minutes, etc.), but is not limited to such an example.

[0099] If the processing unit 12 determines that it is time for fraud detection (step S14: Yes), it performs fraud detection processing (step S15). Fraud detection processing is the process shown in steps S20 to S26 in Figure 9, which will be described in detail later.

[0100] If the processing in step S15 is completed, or if it is determined that it is not the timing for detecting an intrusion (step S14: No), the processing unit 12 determines whether it is the timing for ending operation (step S16). The processing unit 12 determines that it is the timing for ending operation, for example, when the power to the information processing device 1 is turned off.

[0101] If the processing unit 12 determines that it is not yet time to terminate the operation (step S16: No), it proceeds to step S11. If it determines that it is time to terminate the operation (step S16: Yes), it terminates the process shown in Figure 8.

[0102] Figure 9 is a flowchart showing an example of fraud detection processing by the processing unit 12 of the information processing device 1 according to the embodiment. As shown in Figure 9, the processing unit 12 acquires a packet containing authentication information (step S20).

[0103] Next, the processing unit 12 decrypts the packet obtained in step S20 using the decryption key obtained in step S10 (step S21). Then, the processing unit 12 identifies the lifetime value of the authentication information contained in the packet decrypted in step S21 (step S22).

[0104] Next, the processing unit 12 compares the lifetime value changed in step S13 with the lifetime value identified in step S22 (step S23). The processing unit 12 determines whether the values ​​are different in the comparison in step S23 (step S24). If the processing unit 12 determines that the values ​​are different (step S24: Yes), it notifies the fraud detection information (step S25).

[0105] If the processing in step S25 is completed, or if it is determined that the values ​​are not different (step S24: No), the processing unit 12 determines whether or not there are any undetermined packets for which the processing in steps S20 to S24 has not been performed (step S26).

[0106] If the processing unit 12 determines that there are undetermined packets (step S26: Yes), it proceeds to step S20. If it determines that there are no undetermined packets (step S26: No), it terminates the process as shown in Figure 9.

[0107] [Differentiation] Furthermore, when the setting operation mode is the second mode, the determination unit 30 can also set the lower limit of a predetermined first range to a value higher than the default value of the TGT's lifetime, and set the lower limit of a predetermined second range to a value higher than the default value of the ST's lifetime. In this case, for example, the predetermined first range is from 11 hours to 15 hours, and the predetermined second range is, for example, from 9 hours to 13 hours, but is not limited to this example.

[0108] [Effects of the Embodiment] As described above, the information processing device 1 of this embodiment comprises a determination unit 30, a modification unit 31, an acquisition unit 32, a specification unit 33, and a judgment unit 34. The determination unit 30 determines the lifetime value of the authentication information issued by the domain controller 2. The modification unit 31 causes the domain controller 2 to perform a process to change the lifetime of the authentication information to the value determined by the determination unit 30. The acquisition unit 32 acquires a packet containing the authentication information. The specification unit 33 identifies the lifetime value of the authentication information contained in the packet acquired by the acquisition unit 32. The judgment unit 34 determines that the authentication information contained in the packet acquired by the acquisition unit 32 is fraudulent authentication information if the lifetime value identified by the specification unit 33 and the lifetime value modified by the modification unit 31 are different. As a result, the information processing device 1 can perform fraud detection that is easy to operate and highly accurate.

[0109] Furthermore, the acquisition unit 32 obtains a decryption key from the domain controller 2. The identification unit 33 uses the decryption key obtained by the acquisition unit 32 to decrypt the authentication information contained in the packet obtained by the acquisition unit 32, and identifies the lifetime value based on the decrypted authentication information.

[0110] Furthermore, the determination unit 30 determines the lifetime value at predetermined intervals. This allows the information processing device 1 to perform fraud detection that is easy to operate and more accurate.

[0111] Furthermore, the determination unit 30 determines a random value as the lifetime value. This allows the information processing device 1 to perform fraud detection that is easy to operate and has higher accuracy.

[0112] Furthermore, the determination unit 30 determines the lifetime value of the authentication information to a value different from the default value of the lifetime in the domain controller 2. This enables the information processing device 1 to perform fraud detection that is easy to operate and more accurate.

[0113] Furthermore, the authentication information is at least one of the TGT and ST, which are tickets used to issue service tickets (STs).

[0114] [System configuration, etc.] Furthermore, the components of each part shown in the diagram are functional concepts and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown in the diagram, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. Moreover, each processing function performed by each device can be implemented, in whole or in any part, by a CPU and the program executed on that CPU, or by hardware using wired logic.

[0115] Furthermore, among the processes described in the embodiments above, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0116] [program] It is also possible to create a program in a computer-executable language that describes the processing performed by the information processing device 1 according to the above embodiment. In one embodiment, the information processing device 1 can be implemented by installing an information processing program that performs the above information processing as packaged software or online software on a desired computer. For example, by having the information processing device execute the above information processing program, the information processing device can be made to function as the information processing device 1. The information processing device referred to here is a general-purpose computer, but is not limited to this example; it may also be a general-purpose server (for example, an on-premise server or a cloud server), or any other computer.

[0117] Figure 10 shows an example of a computer that executes an information processing program. Computer 1000 includes, for example, memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0118] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. A removable storage medium, such as a magnetic disk or optical disk, is inserted into the disk drive 1041. A serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. A video adapter 1060 is connected to, for example, a display 1061.

[0119] Here, the hard disk drive 1031 stores, for example, the OS 1091, the application program 1092, the program module 1093, and the program data 1094. The information described in the above embodiment is stored, for example, in the hard disk drive 1031 or the memory 1010.

[0120] Furthermore, the information processing program is stored in the hard disk drive 1031 as a program module 1093 containing instructions to be executed by the computer 1000, for example. Specifically, the program module 1093 containing instructions for each process executed by the information processing device 1 described in the above embodiment is stored in the hard disk drive 1031.

[0121] Furthermore, the data used for information processing by the information processing program is stored as program data 1094, for example, in the hard disk drive 1031. The CPU 1020 then reads the program module 1093 and program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as needed and executes the procedures described above.

[0122] Furthermore, the program module 1093 and program data 1094 related to the information processing program are not limited to being stored on the hard disk drive 1031; for example, they may be stored on a removable storage medium and read by the CPU 1020 via a disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 related to the information processing program may be stored on another computer connected via a network such as a LAN or WAN and read by the CPU 1020 via a network interface 1070.

[0123] Although embodiments applying the invention made by the present inventors have been described above, the present invention is not limited by the descriptions and drawings that constitute part of the disclosure of the present invention in this embodiment. That is, all other embodiments, examples, and operational techniques made by those skilled in the art based on this embodiment are included in the scope of the present invention. [Explanation of Symbols]

[0124] 1. Information Processing Device 2 Domain Controllers 3 Servers 4 Terminal devices 5 L2 switches 10 Communications Department 11 Storage section 12 Processing Units 20 Lifetime setting information storage unit 21 Fraud detection history storage unit 22 Mode Information Storage Unit 30 Decision Section 31 Changes 32 Acquisition Department 33 Specific part 34 Judgment section 35 Notification Department 100 Information Processing Systems N Network

Claims

1. A determination unit that determines the lifetime value of the authentication information issued by the domain controller, A modification unit causes the domain controller to perform a process to change the lifetime of the authentication information to a value determined by the determination unit, An acquisition unit that acquires packets containing the aforementioned authentication information, An identification unit that identifies the lifetime value of the authentication information contained in the packet acquired by the acquisition unit, The system includes a determination unit that determines that the authentication information contained in the packet acquired by the acquisition unit is invalid authentication information if the lifetime value identified by the identification unit is different from the lifetime value changed by the modification unit. An information processing device characterized by the following:

2. The acquisition unit is, Obtain the decryption key from the aforementioned domain controller, The specified part is, Using the decryption key acquired by the acquisition unit, the lifetime value of the authentication information contained in the packet acquired by the acquisition unit is identified. The information processing apparatus according to feature 1.

3. The aforementioned determination unit, The lifetime value is determined at predetermined intervals. The information processing apparatus according to claim 1 or 2.

4. The aforementioned determination unit, A random value is determined as the lifetime value. The information processing apparatus according to claim 1 or 2.

5. The aforementioned determination unit, The lifetime value of the authentication information is determined to be different from the default value of the lifetime in the domain controller. The information processing apparatus according to claim 1 or 2.

6. The aforementioned authentication information is A ticket for issuing service tickets and at least one of the aforementioned service tickets. The information processing apparatus according to claim 1 or 2.

7. A method of information processing performed by a computer, A determination process for determining the lifetime value of authentication information issued by the domain controller, A modification step in which the domain controller is instructed to perform a process to change the lifetime of the authentication information to the value determined in the determination step, A collection step of obtaining a packet containing the aforementioned authentication information, A selection step to identify the lifetime value of the authentication information contained in the packet acquired in the acquisition step, The process includes a determination step in which, if the lifetime value identified in the specified step differs from the lifetime value changed in the modification step, the authentication information contained in the packet acquired in the acquisition step is determined to be invalid authentication information. An information processing method characterized by the following:

8. A decision procedure for determining the lifetime value of authentication credentials issued by a domain controller, A modification procedure that causes the domain controller to perform a process to change the lifetime of the authentication information to the value determined in the determination procedure, A procedure for obtaining a packet containing the aforementioned authentication information, A procedure for identifying the lifetime value of the authentication information contained in the packet acquired in the acquisition procedure, If the lifetime value identified in the identification procedure differs from the lifetime value changed in the modification procedure, the computer is instructed to execute a determination procedure which determines that the authentication information contained in the packet acquired in the acquisition procedure is invalid authentication information. An information processing program characterized by the following features.

Images