Information processing device, information processing method, and information processing program

Abstract

The present invention provides an information processing device, an information processing method, and an information processing program that suppress the use of fraudulent websites through messages that direct users to such websites. [Solution] A system for suppressing access to malicious websites, in which a server device is connected to a smartphone via a network and the server device works in cooperation with the smartphone to suppress access to malicious websites from the smartphone, wherein the smartphone, which is a portable information processing device, includes an acquisition means for acquiring received messages and a suppression means for suppressing the use of a website via a link if the received message includes a link to a website, and suppresses the use of the website even if the received message is a fraudulent message such as a scam.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, an information processing method, and an information processing program.

Background Art

[0002] In recent years, techniques for warning of access to malicious sites have been proposed. For example, Patent Document 1 describes detecting a malicious site based on a comparison result between personal information to be transmitted to a connection destination site and verification information. Patent Documents 2 to 4 propose detecting a malicious site using a website address.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Patent Document 2

Patent Document 3

Patent Document 4

Summary of the Invention

Problems to be Solved by the Invention

[0004] Phishing scams that use messages such as emails to redirect users to malicious websites have become prevalent. Such messages often contain sophisticated text designed to guide users to malicious websites. Recipients of the messages may be deceived by the sophisticated text, mistake the message for one from a legitimate website, and end up using the malicious website.

[0005] One aspect of the disclosure technology aims to provide information processing devices, information processing methods, and information processing programs that can deter the use of fraudulent websites through messages that lead users to such websites. [Means for solving the problem]

[0006] One aspect of the disclosed technology is exemplified by the following information processing device: This information processing device comprises an acquisition means for acquiring an incoming message, and a suppression means for suppressing the use of a website via a link in the incoming message.

[0007] According to this information processing device, even if the received message is a fraudulent message such as a scam, the use of the website will be suppressed. Therefore, according to this information processing device, the use of fraudulent websites that are directed to such websites will be suppressed.

[0008] This information processing device may further have the following features: The website has an input form, and the suppression means may suppress the use of the website when it detects input into the input form after the website has been accessed via the link. Alternatively, the information processing device may prohibit input into the input form on the website accessed via the link. In the case of fraudulent websites, personal information may be stolen by inputting into the input form provided on the fraudulent website. According to an information processing device with such features, the use of the website is suppressed or prohibited upon detection of input into the input form, thereby preventing the theft of personal information. .

[0009] The information processing device may further have the following features. The suppression means determines whether or not to allow access to the website via the link based on a first phrase stored in the memory and a second phrase included in the received message, and suppresses the use of the website if the determination is negative. The first phrase is, for example, a phrase included in a message from a legitimate website. According to an information processing device having such features, it is possible to determine whether or not the received message is a message that leads to a fraudulent website by comparing the phrases, and if it is determined to be a message that leads to a fraudulent website, the use of the website can be suppressed.

[0010] The information processing device may further have the following features: The website has an input form, and the suppression means does not suppress the use of the website until input is detected into the input form, even in the case of a negative determination. With an information processing device having such features, the display of the website is permitted until input is detected into the input form, making it possible to prompt the user of the information processing device to visually confirm the website.

[0011] The information processing device may further have the following features. The first statement above includes a predetermined word and a predetermined phrase, and the suppression means suppresses the use of the website when the received message includes the predetermined word and does not include the predetermined phrase. The predetermined word is, for example, a word included in a message from a legitimate website. The predetermined word may also be, for example, a word used in a fraudulent message that imitates a message from a legitimate website. The predetermined phrase is a phrase (for example, a standard phrase) included in a message from a legitimate website. If the received message includes the predetermined word and does not include the predetermined phrase, it is considered to be a message from a fraudulent site that cleverly imitates a message from a legitimate website by using the predetermined word. An information processing device having such features can suppress damage from fraud and other scams caused by fraudulent messages that cleverly imitate messages from legitimate websites.

[0012] The information processing device may further have the following features: The website has an input form, and the suppression means does not suppress the use of the website until it detects input into the input form, even if the received message contains the predetermined words and does not contain the predetermined text. With an information processing device having such features, even if a website is accessed via a link in a fraudulent message that cleverly imitates a message from a legitimate website, it is possible to prompt the user of the information processing device to visually check the website until the process of inputting into the input form, which may lead to fraud or other harm, is performed.

[0013] The information processing device may further have the following features: It further comprises a storage unit for storing the address of a legitimate site, and the suppression means further suppresses the use of the website when the address of the website indicated by the link is different from the address stored in the storage unit, and the website indicated by the link and the legitimate site have a predetermined similarity relationship. If the legitimate site and the website are similar despite having different addresses, the website is considered to be a site that imitates the legitimate site for fraudulent purposes, etc. By suppressing the use of such a website that imitates the legitimate site, it is possible to suppress damage to the user of the information processing device caused by the website that imitates the legitimate site.

[0014] Disclosure technology can also be understood from the perspective of information processing methods and information processing programs. [Effects of the Invention]

[0015] According to the disclosure technology, it is possible to suppress access to malicious websites through messages that direct users to those websites. [Brief explanation of the drawing]

[0016] [Figure 1] Figure 1 shows an example of a system for suppressing access to fraudulent websites according to an embodiment of this system. [Figure 2] Figure 2 shows an example of a processing block for a server device according to this embodiment. [Figure 3] Figure 3 shows an example of a specific word management table stored in the management database. [Figure 4] Figure 4 shows an example of a specific document management table stored in the management database. [Figure 5] Figure 5 shows an example of a URL management table stored in the management database. [Figure 6]Figure 6 is a diagram illustrating an example of processing blocks of the smartphone according to the embodiment. [Figure 7] Figure 7 is a diagram illustrating an example of a received message acquired by an acquisition unit in the embodiment. [Figure 8] Figure 8 is a diagram illustrating an example of an error screen output by a suppression unit in the embodiment. [Figure 9] Figure 9 is a diagram illustrating an example of a warning screen output by the suppression unit in the embodiment. [Figure 10] Figure 10 is the first diagram illustrating an example of a processing flow of the server apparatus according to the embodiment. [Figure 11] Figure 11 is the second diagram illustrating an example of the processing flow of the server apparatus according to the embodiment. [Figure 12] Figure 12 is the first diagram illustrating an example of a processing flow of the smartphone according to the embodiment. [Figure 13] Figure 13 is the second diagram illustrating an example of the processing flow of the smartphone according to the embodiment. [Figure 14] Figure 14 is the third diagram illustrating an example of the processing flow of the smartphone according to the embodiment. [Modes for Carrying Out the Invention]

[0017] <Embodiment> Embodiments will be described below with reference to the drawings. Figure 1 is a diagram showing an example of a fraudulent website access suppression system 1 according to an embodiment. The fraudulent website access suppression system 1 comprises a smartphone 2 and a server device 3. The fraudulent website access suppression system 1 is a system that suppresses access from the smartphone 2 to fraudulent websites (hereinafter referred to as "fraudulent sites") exemplified by phishing sites. Examples of fraudulent sites include websites accessed via links contained in messages that impersonate real companies, organizations, services, etc. Some fraudulent sites are websites that impersonate the appearance of legitimate websites (hereinafter referred to as "legitimate sites") published by companies, financial institutions, etc.

[0018] Smartphone 2 is a portable information processing device. Smartphone 2 can, for example, send email, use short messaging services (SMS), and use social networking services. This service enables sending and receiving messages using services (such as social networking services), accessing websites, and more.

[0019] Server device 3 is a stationary information processing device. Server device 3 is connected to smartphone 2 via network N1 in a communicable manner. Server device 3 works in cooperation with smartphone 2 to suppress access to malicious websites from smartphone 2.

[0020] Network N1 is a computer network that connects information processing devices in a communicative manner. Network N1 may be wired or wireless. Network N1 is, for example, the Internet.

[0021] <Hardware Configuration> Referring to Figure 1, an example of the hardware configuration of smartphone 2 and server device 3 will be described. First, the hardware configuration of smartphone 2 will be described. Smartphone 2 includes a CPU 21, main memory 22, auxiliary memory 23, communication unit 24, display 25, and connection bus B2. The CPU 21, main memory 22, auxiliary memory 23, communication unit 24, and display 25 are interconnected by connection bus B2.

[0022] The CPU 21 is also called a microprocessor unit (MPU) or processor. The CPU 21 is not limited to a single processor and may be in a multiprocessor configuration. Furthermore, a single CPU 21 connected via a single socket may have a multicore configuration. At least a portion of the processing performed by the CPU 21 may be performed by other processors, such as dedicated processors like a Digital Signal Processor (DSP), Graphics Processing Unit (GPU), numerical processor, vector processor, or image processing processor. Also, at least a portion of the processing performed by the CPU 21 may be performed by integrated circuits (ICs) or other digital circuits. Furthermore, at least a portion of the CPU 21 may include analog circuits. Integrated circuits include Large Scale Integrated Circuits (LSIs), Application Specific Integrated Circuits (ASICs), and Programmable Logic Devices (PLDs). PLDs include, for example, Field-Programmable Gate Arrays (FPGAs). The CPU 21 may be a combination of a processor and integrated circuits. The combination is called, for example, a microcontroller unit (MCU), system-on-a-chip (SoC), system LSI, or chipset. In smartphone 2, the CPU 21 loads the program stored in the auxiliary storage unit 23 into the work area of ​​the main memory unit 22 and controls peripheral devices through program execution. This allows smartphone 2 to perform processing that matches a predetermined purpose. The main memory unit 22 and the auxiliary storage unit 23 are recording media that can be read by the CPU 21.

[0023] The main memory unit 22 is exemplified as a memory unit that is directly accessed by the CPU 21. The main memory unit 22 includes Random Access Memory (RAM) and Read Only Memory (ROM).

[0024] The auxiliary storage unit 23 stores various programs and data on a recording medium in a read / write manner. The auxiliary storage unit 23 is also called an external storage device. The auxiliary storage unit 23 stores the operating system (OS), various programs, various tables, etc. The OS includes a communication interface program that exchanges data with external devices connected via the communication unit 24. External devices include, for example, other information processing devices and external storage devices connected by a computer network. The auxiliary storage unit 23 also stores data on a cloud system, which is a group of computers on a network. It may be part of the system.

[0025] The auxiliary storage unit 23 may be, for example, an Erasable Programmable ROM (EPROM), a Solid State Drive (SSD), or a Hard Disk Drive (HDD). Alternatively, the auxiliary storage unit 23 may be a Compact Disc (CD) drive, a Digital Versatile Disc (DVD) drive, or a Blu-ray® Disc (BD) drive. Furthermore, the auxiliary storage unit 23 may be provided by a Network Attached Storage (NAS) or Storage Area Network (SAN).

[0026] The communication unit 24 is, for example, an interface with network N1. The communication unit 24 communicates with external devices, exemplified by the server device 3, via network N1.

[0027] The display 25 displays data processed by the CPU 21 and data stored in the main memory 22. The display 25 is, for example, a Liquid Crystal Display (LCD), a Plasma Display Panel (PDP), an inorganic Electroluminescence (EL) panel, or an organic EL panel. The display 25 may also have a touch panel superimposed on it, for example, to detect touch operations by the user's finger. By superimposing a touch panel on the display 25, the smartphone 2 can provide the user with an intuitive operating environment.

[0028] Next, the hardware configuration of server device 3 will be described. Server device 3 comprises a CPU 31, a main memory unit 32, an auxiliary memory unit 33, a communication unit 34, and a connection bus B3. The CPU 31, main memory unit 32, auxiliary memory unit 33, communication unit 34, and connection bus B3 are the same as those of smartphone 2 (CPU 21, main memory unit 22, auxiliary memory unit 23, communication unit 24, and connection bus B2), so their description will be omitted.

[0029] <Processing block of server device 3> Figure 2 shows an example of a processing block of a server device 3 according to an embodiment. The server device 3 includes a response means 301 and a management database 302. The server device 3 performs processing as each part of the server device 3, such as the response means 301 and the management database 302, by having the CPU 31 execute a computer program that has been loaded into the main memory unit 32 in an executable format.

[0030] The management database 302 stores various information related to the detection of malicious websites. The management database 302 is constructed, for example, in the auxiliary storage unit 33.

[0031] Figure 3 shows an example of a specific word management table 3021 stored in the management database 302. The specific word management table 3021 has the following items: "Item No." and "Specific Word". The "Item No." stores a number that uniquely identifies each specific word stored in the specific word management table 3021. The "Specific Word" stores, for example, a word or phrase included in a legitimate message sent from a legitimate site. The "Specific Word" may also store, for example, a word or phrase commonly used in fraudulent messages that mimic legitimate messages. A legitimate message sent from a legitimate site could be, for example, a message sent by a financial institution to customers who hold an account with that financial institution. Fraudulent messages may also mimic legitimate messages by using words or phrases used in legitimate messages. The specific words stored in the "Specific Word" of the specific word management table 3021 may be written using operators, as exemplified in item No. 3 of the specific word management table 3021. In item No. 3, "urgent" and "confirmation" are The operator "+" indicates that both "urgent" and "confirmation" are included, and that other words or sentences may be interposed between "urgent" and "confirmation." The specific words are examples of "the first sentence" and "the designated word."

[0032] Figure 4 shows an example of a specific text management table 3022 stored in the management database 302. The specific text management table 3022 has the following items: "Item No." and "Specific Text". The "Item No." stores a number that uniquely identifies each specific text stored in the specific text management table 3022. The "Specific Text" stores the text (standard text) included in the regular message sent from the regular site. The specific text is an example of "First Text" and "Predetermined Text".

[0033] Figure 5 shows an example of a URL management table 3023 stored in the management database 302. The URL management table 3023 has the following items: "Item No.", "URL", and "Page Data". The "Item No." stores a number that uniquely identifies each URL stored in the URL management table 3023. The "URL" stores the URL of the canonical website's webpage. In other words, the URL management table 3023 is a whitelist. The "Page Data" stores data (page data) that describes the visual characteristics of the canonical website's webpage indicated by the "URL". The page data may be, for example, image data that is an image of the entire screen rendered by a web browser based on the Hyper Text Markup Language (HTML) data of the canonical website's webpage indicated by the "URL". Alternatively, the page data may be, for example, the HTML data (HTML source file) of the canonical website's webpage indicated by the "URL". "URL" is an example of an "address".

[0034] Returning to Figure 2, the response means 301 receives a site verification request from smartphone 2 inquiring whether the website is a legitimate site. The site verification request includes, for example, a link contained in a message received by smartphone 2. Hereinafter, the website accessed via the link will also be referred to as the "linked site". The response means 301 determines whether the URL indicated by the link is included in the URL management table 3023. If the URL indicated by the link is included in the URL management table 3023, the response means 301 sends a permission response to smartphone 2, allowing it to use the linked site. If the URL indicated by the link is not included in the URL management table 3023, the response means 301 sends a pending response to smartphone 2.

[0035] The response means 301 also receives a similarity confirmation request from the smartphone 2, inquiring whether the linked site is similar to the canonical site. The similarity confirmation request includes, for example, a link contained in the received message. The response means 301 performs a similarity determination between the linked website and the canonical site's page data in the URL management table 3023. When the page data is image data, the response means 301 generates an image of the linked site of the link included in the inquiry using a web browser. The response means 301 then compares the generated image of the linked site with the canonical site's page data stored in the URL management table 3023 to determine whether there is page data similar to the image of the linked site. Here, various publicly known image comparison techniques can be used to determine the similarity between the image data of the linked site and the page data. When the page data is HTML data, for example, the HTML data of the linked site of the link included in the inquiry can be obtained, and the obtained HTML data can be compared with the canonical site's page data stored in the URL management table 3023. Here, in determining the similarity between the HTML data and page data of the linked site, techniques for comparing various publicly known texts can be employed. The answering means 301 is either the linked site or the canonical site stored in the URL management table 3023. If it is determined that the two sites are similar, a prohibition response is sent to smartphone 2, instructing it to stop using the linked site. If the response means 301 determines that the linked site is not similar to either the linked site or any of the legitimate sites stored in the URL management table 3023, a confirmation response is sent to smartphone 2, instructing it to check the received message.

[0036] Furthermore, the response means 301 receives a message confirmation request from the smartphone 2 inquiring whether the received message is from a legitimate site. The response means 301 determines whether a specific word pre-stored in the specific word management table 3021 is included in the body of the received message. The response means 301 also determines whether a specific phrase pre-stored in the specific phrase management table 3022 is included in the body of the received message. For example, if the body of the received message does not contain the specific word and the received message does not contain the specific phrase, the response means 301 determines it to be a suspicious message and sends a warning response to the smartphone 2. Also, for example, if the body of the received message contains the specific word but the received message does not contain the specific phrase, the response means 301 determines it to be a fraudulent message and sends a prohibition response to the smartphone 2. The body of the received message is an example of the "second phrase".

[0037] <Processing block for Smartphone 2> Figure 6 shows an example of a processing block of a smartphone 2 according to an embodiment. The smartphone 2 includes an acquisition means 201 and a suppression means 202. The smartphone 2 performs processing as each part of the smartphone 2, such as the acquisition means 201 and the suppression means 202, by having the CPU 21 execute a computer program that has been loaded into the main memory 22 in an executable manner.

[0038] The acquisition means 201 acquires received messages, for example, via email, short messaging service (SMS), and social networking service (SNS). The received messages acquired by the acquisition means 201 include, for example, text data.

[0039] Figure 7 shows an example of a received message 201 acquired by the acquisition means 201 in an embodiment. The received message 2011 illustrated in Figure 7 includes a message body 2012. The message body 2012 contains a URL 2013. The message body 2012 is, for example, a message prompting access to a linked site via the URL 2013. If the received message 2011 is not a message from a legitimate site, and the user accesses the linked site via the URL 2013, the user of smartphone 2 may be at risk of becoming a victim of fraud or other harm.

[0040] Returning to Figure 6, the suppression means 202 suppresses the use of the linked site indicated by the link if the received message acquired by the acquisition means 201 contains a link to a website. The suppression of the use of the linked site by the suppression means 202 may be performed, for example, by sending a query to the server device 3 and based on the response to that query. Here, "suppress use" may include prohibiting access to the linked site via the link. "Suppress use" may also include outputting a warning message when it detects text input into the input form of the linked site after the linked site has been displayed via the link. Furthermore, "suppress use" may also include prohibiting text input into the input form of the linked site after the linked site has been displayed via the link.

[0041] The suppression means 202, for example, sends a site verification request to the server device 3 that includes a link contained in the received message acquired by the acquisition means 201. When system 2 receives a permission response to a site verification request, it does not need to restrict access to the linked site. On the other hand, when the restriction means 202 receives a pending response to a site verification request from the server device 3, it displays the linked site in the web browser. If the linked site includes an input form, the restriction means 202 further monitors input into that input form.

[0042] When the suppression means 202 detects input into the input form, it sends an analogy confirmation request to the server device 3. Here, the suppression means 202 may detect input into the input form, for example, when the input form is selected (the cursor is moved into the input form). Alternatively, the suppression means 202 may detect input into the input form when any characters are entered into the input form. When the suppression means 202 receives a prohibited response to the analogy confirmation request from the server device 3, it displays an error screen. The suppression means 202 may output the error screen to the display 25 and terminate the display of the linked site.

[0043] Figure 8 shows an example of an error screen 2021 output by the suppression means 202 in an embodiment. The error screen 2021 includes an error dialog 2022. The error dialog 2022 displays a message indicating an error and includes an OK button 2023. When the OK button 2023 is pressed, the suppression means 202 executes a prohibition process that prohibits the use of the linked site. In the prohibition process, for example, the web browser is closed. Alternatively, the prohibition process may close the web browser tab displaying the linked site. Alternatively, the prohibition process may maintain the display of the linked site while prohibiting input into the input form of the linked site.

[0044] When the suppression means 202 receives an acknowledgment response from the server device 3 in response to an analogy confirmation request, it sends a message confirmation request to the server device 3. When the suppression means 202 receives a prohibition response from the server device 3 in response to the message confirmation request, it displays an error screen 2021. When the suppression means 202 receives a warning response from the server device 3 in response to the message confirmation request, it outputs a warning screen to the display 25.

[0045] Figure 9 shows an example of a warning screen 2024 output by the suppression means 202 in an embodiment. The warning screen 2024 includes a warning dialog 2025. The warning dialog 2025 displays a warning message and includes an allow button 2026 and a deny button 2027. When the allow button 2026 is pressed, the suppression means 202 allows the web browser to continue using the linked site. For example, when allowing continued use, the suppression means 202 allows input into the input form and submission of the entered information. Also, when the deny button 2027 is pressed, the suppression means 202 prohibits the web browser from continuing to use the linked site. For example, when prohibiting continued use, the suppression means 202 may close the web browser or close the web browser tab displaying the linked site.

[0046] <Processing Flow> Figures 10 and 11 show an example of the processing flow of the server device 3 according to the embodiment. The following description of the example of the processing flow of the server device 3 will refer to Figures 10 and 11.

[0047] In step S1, the response means 301 receives a site verification request from smartphone 2. In step S2, the response means 301 refers to the URL management table 3023 and determines whether the linked site included in the site verification request received in step S1 is a legitimate site. If it is confirmed to be a legitimate site (step S If the answer is YES in step 2, the process proceeds to step S11, and the response means 301 sends an permission response to smartphone 2 (step S11). If it is not confirmed to be a legitimate site (NO in step S2), the process proceeds to step S3, and the response means 301 sends a pending response to smartphone 2 (step S3).

[0048] In step S4, the response means 301 receives an analogy confirmation request from smartphone 2. In step S5, the response means 301 refers to the URL management table 3023 to determine whether the linked site is similar to the canonical site. If it is similar (YES in step S5), the process proceeds to step S12, and the response means 301 sends a rejection response to smartphone 2 (step S12). If it is not similar (NO in step S5), the process proceeds to step S6, and the response means 301 sends a confirmation response to smartphone 2 (step S5).

[0049] In step S7, the response means 301 receives a message confirmation request from smartphone 2. In step S8, the response means 301 refers to the specific word management table 3021 and the specific text management table 3022 to determine whether the received message is a suspected inappropriate message or an inappropriate message. If the received message is determined to be a suspected inappropriate message ("suspected inappropriate message" in step S8), the process proceeds to step S9, and the response means 301 sends a warning response to smartphone 2. If the received message is determined to be an inappropriate message ("inappropriate message" in step S8), the process proceeds to step S10, and the response means 301 sends a prohibition response to smartphone 2.

[0050] Figures 12 to 14 show an example of the processing flow of a smartphone 2 according to an embodiment. The following description of the example of the processing flow of a smartphone 2 will refer to Figures 12 to 14.

[0051] In step S21, the acquisition means 201 acquires the received message. In step S22, it is determined whether the received message contains a link. If a link is included (YES in step S22), the process proceeds to step S23. If a link is not included (NO in step S22), the process ends. In other words, the use of the linked website is not restricted.

[0052] In step S23, the suppression means 202 sends a site verification request to the server device 3 regarding the destination site of the link contained in the received message.

[0053] In step S24, the suppression means 202 determines whether the response received from the server device 3 is a pending response or an authorized response. If it is a pending response ("pending response" in step S24), the process proceeds to step S25. If it is an authorized response ("authorized response" in step S24), the process proceeds to step S36.

[0054] In step S25, the suppression means 202 causes the web browser to output the linked site. If the suppression means 202 detects input to the input form on the linked site (YES in step S26), it sends an analogy confirmation request (step S27). If no input is detected to the input form on the linked site (NO in step S26), the process in step S26 is repeated.

[0055] In step S28, the suppression means 202 determines whether the response received from the server device 3 is a confirmation response or a prohibited response. If it is a confirmation response (indicated as "confirmation response" in step S28), the process proceeds to step S29. If it is a prohibited response (indicated as "prohibited response" in step S28), the process proceeds to step S34.

[0056] In step S29, the suppression means 202 sends a message confirmation request to the server device 3. In step S30, the suppression means 202 determines whether the response received from the server device 3 is a warning response or a prohibition response. If it is a warning response (indicated as "warning response" in step S30), the process proceeds to step S31. If it is a prohibition response (indicated as "prohibition response" in step S30), the process proceeds to step S34.

[0057] In step S31, the suppression means 202 causes the warning screen 2024 to be displayed on the display 25. If the allow button 2026 is pressed on the warning screen 2024 (the "allow button" in step S32), the process proceeds to step S33. If the reject button 2027 is pressed on the warning screen 2024 (the "reject button" in step S32), the process proceeds to step S35.

[0058] In step S33, the suppression means 202 allows continued use of the linked site. In step S34, the suppression means 202 displays the error screen 2021 on the display 25. The error screen 2021 remains displayed on the display 25 until the OK button 2023 is pressed on the error screen 2021. Once the OK button 2023 is pressed, the process proceeds to step S35.

[0059] In step S35, the suppression means 202 performs a prohibition process to prohibit the use of the linked site. Examples of prohibition processes include closing the web browser that displayed the linked site, closing the tab of the web browser that displayed the linked site, or prohibiting input into the input form of the linked site.

[0060] In step S36, the suppression means 202 does not suppress the use of the linked site.

[0061] Note that the order of the processes in Figures 12 to 14 may be changed. For example, the analogy confirmation request transmission process in step S27 and the message confirmation request transmission process in step S29 may be executed before the input detection process in step S26. In this case, the output of error screen 2021 and warning screen 2024 when a prohibited response or warning response is received from the server device 3 may be executed after the input to the input form is detected by the process in step S26.

[0062] <Effects of the Embodiment> In this embodiment, when a received message contains a link, the smartphone 2 sends a request to the server device 3 regarding whether or not it is necessary to restrict access to the linked site exemplified by the analogy confirmation request and the message confirmation request. Based on the response from the server device 3, the smartphone 2 then restricts access to the linked site. Therefore, according to this embodiment, it is possible to suppress the collection of personal information and damage such as fraud caused by accessing malicious sites via links contained in received messages.

[0063] In this embodiment, the linked website is displayed on the web browser of smartphone 2 until input is detected into the input form of the linked website. Therefore, according to this embodiment, the user of smartphone 2 can visually confirm the linked website.

[0064] In this embodiment, when input is detected into the input form of the linked site, processing to suppress the use of the linked site is executed according to the results of the analogy confirmation request and the message confirmation request. Examples of processing to suppress the use of the linked site include prohibiting input into the input form of the linked site, closing the web browser displaying the linked site, and closing the tab of the web browser displaying the linked site. Therefore, According to this embodiment, it is possible to suppress the collection of personal information and damage from fraud, etc., caused by accessing malicious websites via links contained in received messages.

[0065] In this embodiment, if a received message contains a specific word but does not contain a specific phrase, the received message is determined to be a malicious message, and access to the linked site is suppressed. If a received message contains a specific word that is a word or phrase found in a legitimate message sent from a legitimate site, but does not contain a specific phrase that is found in a legitimate message sent from a legitimate site, the received message is considered to be a message that cleverly imitates a legitimate message. This embodiment, with its features, can reduce the damage caused to smartphone 2 users by cleverly crafted malicious messages.

[0066] In this embodiment, even if a received message is determined to be a fraudulent message or a suspected fraudulent message, the linked site can still be displayed by the web browser until input into the input form on the linked site is detected. Therefore, even if a message is determined to be fraudulent or a suspected fraudulent message, the user of the smartphone 2 can visually confirm the linked site.

[0067] In this embodiment, if the URL of the linked site and the URL of the legitimate site are different, and the linked site and the legitimate site are determined to be similar, the use of the linked site is suppressed. If the linked site and the legitimate site are similar despite having different URLs, the linked site is considered to be a site that imitates the legitimate site for fraudulent purposes. According to this embodiment, by suppressing the use of such fraudulent sites that imitate the legitimate site, it is possible to suppress the damage to smartphone 2 users caused by fraudulent sites that imitate the legitimate site.

[0068] <Variation> In the embodiment described above, the fraudulent website access suppression system 1 includes a smartphone 2 and a server device 3, but the server device 3 may be omitted. If the server device 3 is omitted, the response means 301 and management database 302 implemented in the server device 3 should be provided on the smartphone 2.

[0069] Here, the management database 302 may be shared among multiple companies, financial institutions, etc. By sharing the management database 302, it is possible to suppress the collection of personal information and damage such as fraud caused by accessing fraudulent sites via links contained in fraudulent messages that imitate legitimate messages sent from various companies, financial institutions, etc.

[0070] In the embodiments described above, the analogy confirmation request and the message confirmation request were sent separately from the smartphone 2 to the server device 3. However, the analogy confirmation request and the message confirmation request may also be sent from the smartphone 2 to the server device 3 as a single request. In such a case, for example, in step S4 of Figure 10, a request containing information for both the analogy confirmation request and the message confirmation request should be sent from the smartphone 2 to the server device 3.

[0071] The embodiments and variations disclosed above can be combined in any way.

[0072] <Computer-readable recording medium> An information processing program that enables a computer or other machine or device (hereinafter referred to as "computer, etc.") to perform any of the above functions can be recorded on a recording medium that the computer, etc. can read. Then, the computer, etc. can read this recording medium and execute the program. By doing so, that function can be provided.

[0073] Here, a recording medium that can be read by a computer refers to a recording medium that stores information such as data and programs through electrical, magnetic, optical, mechanical, or chemical means and can be read by a computer. Examples of such recording media that can be removed from a computer include flexible disks, magneto-optical disks, Compact Disc Read Only Memory (CD-ROM), Compact Disc-Recordable (CD-R), Compact Disc-ReWriterable (CD-RW), Digital Versatile Disc (DVD), Blu-ray Disc (BD), Digital Audio Tape (DAT), 8mm tape, flash memory, external hard disk drives, and Solid State Drives (SSDs). In addition, recording media that are fixed to a computer include internal hard disk drives, SSDs, and ROMs. [Explanation of Symbols]

[0074] 1. System to block access to malicious websites 2. Smartphone 3. Server equipment 21. CPU 22...Main memory 23...Auxiliary storage section 24. Communications Department 25-inch display 31. CPU 32...Main memory 33...Auxiliary storage section 34. Communications Department 201...Method of acquisition 202...Suppression means 301...Answer method 302. Management Database 2011 ·· Received Message 2012 ··Message body 2013...URL 2021 Error Screen 2022 Error Dialog 2023 ··OK button 2024 Warning Screen 2025 Warning Dialog 2026 ··Allow button 2027 ·· Reject button 3021 ··Specific Word Management Table 3022 ··Specific Text Management Table 3023 ··URL Management Table B2 connecting bus B3 connecting bus N1 Network

Claims

1. A means of obtaining received messages, The system includes, if the received message contains a link to a website, a means for restricting the use of the website via the link. Information processing device.

2. The aforementioned website has an input form, The suppression means, upon detecting input into the input form after accessing the website via the link, suppresses the use of the website. The information processing apparatus according to claim 1.

3. The aforementioned website has an input form, The suppression means prohibits input into the input form on the website accessed via the link. The information processing apparatus according to claim 1.

4. The suppression means determines whether or not to allow access to the website via the link based on a first phrase stored in the storage unit and a second phrase included in the received message, and suppresses the use of the website if the determination is negative. The information processing apparatus according to claim 1.

5. The aforementioned website has an input form, Even in the case of a negative determination, the suppression means does not suppress the use of the website until input to the input form is detected. The information processing apparatus according to claim 4.

6. The first statement described above includes a predetermined word and a predetermined sentence, The suppression means suppresses the use of the website when the received message contains the predetermined word and does not contain the predetermined text. The information processing apparatus according to claim 4.

7. The aforementioned website has an input form, The suppression means does not suppress the use of the website until input to the input form is detected, even if the received message contains the predetermined word and does not contain the predetermined text. The information processing apparatus according to claim 6.

8. It also includes a memory unit that stores the address of the official site, The suppression means further suppresses the use of the website when the address of the website indicated by the link is different from the address stored in the storage unit, and the website indicated by the link and the authorized site have a predetermined similarity relationship. The information processing apparatus according to any one of claims 1 to 7.

9. Computers The process of retrieving received messages, If the received message contains a link to a website, the system performs a suppression process to prevent the use of the website via the link. Information processing methods.

10. On the computer, The process of retrieving received messages, If the received message contains a link to a website, the system will perform a suppression process to prevent the use of the website via the link. Information processing program.

Images