Information processing device and program

Abstract

To suppress a fraudulent access to an information processing device.SOLUTION: An information processing device 10 includes a processor 12. When it is determined that an access from an external side is a fraudulent access, the processor 12 obtains an area 56 where an access originator is present on the basis of the IP address of the access originator, obtains a warning message 60 corresponding to the obtained area 56 of the access originator, and transmits, to the access originator, the obtained warning message 60 as a response to the access.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an information processing device connected to a network and a program therefor. [Background technology]

[0002] An information processing device such as a server is connected to the Internet and provides a specific service to multiple users. However, the information processing device may be subject to unauthorized access that interferes with the provision of the service. There are various types of unauthorized access, such as a DoS attack (Denial of Service Attack) and cracking.

[0003] In recent years, in order to combat such unauthorized access, systems such as an intrusion detection system called an IDS (Intrusion Detection System) and an intrusion prevention system called an IPS (Intrusion Prevention System) have been increasingly introduced.

[0004] Patent document 1 discloses that dummy packets containing IP addresses (dummy information) are sent to make devices (nodes) that do not exist within the network appear to be present within the network, and terminals connected to the network include information about the dummy packets in their communication logs, thereby increasing the load on an intruder who has invaded a terminal from outside when analyzing the communication logs within the terminal, making it more difficult for the intruder to attack the network. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2016-58805 A Summary of the Invention [Problem to be solved by the invention]

[0006] The means of unauthorized access are becoming more sophisticated day by day, and even now, there are frequent cases where unauthorized access has disrupted the provision of services by information processing devices. In order to deal with unauthorized access, continuous system updates are necessary. Therefore, a mechanism that can prevent unauthorized access to information processing devices is desired.

[0007] An object of the present invention is to prevent an information processing device from being subjected to unauthorized access. [Means for solving the problem]

[0008] The information processing device of the present invention includes a processor, which, when it is determined that access received from outside is unauthorized access, obtains the region in which the access source is located based on the IP address of the access source, obtains a warning message corresponding to the region of the obtained access source, and sends the obtained warning message to the access source as a response to the access.

[0009] According to this configuration, the warning message corresponding to the region of the access source can prevent the access source that has performed unauthorized access to the information processing device from performing unauthorized access to the same device again.

[0010] In the information processing device of the present invention, the warning message may include a word or phrase that is restricted by an information management system in the area from which the access originates.

[0011] With this configuration, it is expected that the information management system will recognize that the source of unauthorized access has accessed a website related to restricted words, and will restrict further access to the information processing device by the same source of access.

[0012] In the information processing device of the present invention, the warning message may include a redirection message to a website whose viewing is restricted by an information management system in the region from which the access originates.

[0013] With this configuration, it is expected that the information management system will recognize that the source of unauthorized access is accessing a website whose viewing is restricted, and will restrict the source of access from again to the information processing device.

[0014] In the information processing device of the present invention, when the processor determines that access received from outside is unauthorized access, it may send the IP address or a domain corresponding to the IP address to an information management system in the region from which the access originated.

[0015] According to this configuration, it is expected that the information management system will recognize the source of unauthorized access and restrict access to the network from that source.

[0016] The program of the present invention is characterized in that, when access received from outside is determined to be unauthorized access, it causes a computer to function in the following manner: obtain the region in which the access source is located based on the IP address of the access source, obtain a warning message corresponding to the obtained region of the access source, and send the obtained warning message to the access source as a response to the access. Effect of the Invention

[0017] According to the present invention, it is possible to prevent unauthorized access to an information processing device. [Brief description of the drawings]

[0018] [Figure 1] FIG. 1 is a diagram illustrating a flow of data over the Internet. [Diagram 2] FIG. 2 is a functional block diagram of an information processing device. [Diagram 3] 10 is a flowchart showing a process for preventing unauthorized access to an information processing device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings. The configuration described below is an example for the purpose of explanation, and can be appropriately changed according to the specifications of the system and device. Furthermore, when multiple embodiments and modifications are included below, it is assumed from the beginning that the characteristic parts of these will be used in appropriate combination. The same elements in all drawings are given the same reference numerals, and duplicated explanations will be omitted.

[0020] FIG. 1 is a diagram showing a schematic diagram of a data flow via the Internet 90. The information processing device 10 is a Web server connected to the Internet 90, and provides a specific service to a plurality of terminal devices via the Internet 90. Here, the specific service may be a service that provides only a Web site (homepage) to the user, and the content is not limited. The information processing device 10 may be a server on a cloud, or may be composed of a plurality of computers. In this specification, another information processing device (computer) that accesses the information processing device 10 is called a terminal device in order to distinguish it from the information processing device 10.

[0021] The information processing device 10 may be subject to unauthorized access from a terminal device (unauthorized device 16 in FIG. 1). There are various types of unauthorized access, such as DoS attacks, cracking, information theft, unauthorized use of another person's account, and unauthorized use of a credit card. However, the information processing device 10 has a means for preventing unauthorized access, as described below.

[0022] Incidentally, in certain countries, when using the Internet 90 on a PC (personal computer), Internet searches including specific words and browsing of specific websites may be restricted. The content of such restrictions may vary depending on the region of the country. For example, in one region, browsing of websites related to pornography or a specific religion may be restricted, while in another region, browsing of websites including sensitive content may be restricted. Such restrictions are realized by an information management system 20 operated in each region. The information management system 20 includes a computer 21 operated by an administrative agency or the like, and a firewall 22 constructed by the computer 21. The firewall 22 monitors communications of terminal devices in the jurisdiction, and when it detects communications subject to the restrictions, it blocks the communications.

[0023] 1 illustrates an information management system 20 that monitors communications of terminal devices in a certain area, and an unauthorized device 16 (a terminal device making unauthorized access) in the same area. Note that the information processing device 10 is in an area different from the area monitored by the information management system 20, and does not provide content restricted by the information management system 20 as a service.

[0024] Next, the configuration of the information processing device 10 will be described. The information processing device 10 is a computer, and includes a processor 12 and a storage unit 14. The processor 12 can also be defined as a computer in the narrow sense. The processor 12 includes one or more CPUs, and executes information processing according to a program 50 (see FIG. 2) installed in the information processing device 10. The multiple CPUs included in the processor 12 may be located physically apart from each other. The processor 12 may include a dedicated processor such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). The storage unit 14 is a ROM, a RAM, a flash memory, a hard disk, or the like.

[0025] 2 is a functional block diagram of the information processing device 10. The processor 12 operates according to a program 50 in the storage unit 14 to function as an acquisition unit 40, a generation unit 42, and a transmission unit 46. The storage unit 14 stores the program 50, an access log 52, a blacklist 54, a region 56, and a warning message 60.

[0026] The access log 52 records the date and time when the information processing device 10 was accessed from a terminal device, in association with the IP address of the terminal device. The IP address is a number for identifying each computer that transmits and receives packets on the Internet Protocol (IP). The processor 12 updates the access log 52 using the IP address of the terminal device received when an access is accepted from the terminal device.

[0027] The blacklist 54 is a list of IP addresses of terminal devices that the information processing device 10 does not want to be accessed by. The blacklist 54 records, for example, IP addresses of terminal devices that have previously performed unauthorized access to the information processing device 10. The processor 12, for example, identifies, from the access log 52, the IP addresses of terminal devices that have maliciously performed a large amount of access to the information processing device 10 in a short period of time (terminal devices that have performed a DoS attack), and records them in the blacklist 54.

[0028] When the information processing device 10 is accessed by a terminal device having an IP address on the blacklist 54, the area 56 is estimated to be the area in which the terminal device is located, and the estimated area is recorded.

[0029] The warning message 60 is sent as a response to an access made to the information processing device 10 by a terminal device having an IP address on the blacklist 54.

[0030] Next, the operation of the information processing device 10 will be described. Fig. 3 is a flowchart showing a process flow for unauthorized access of the information processing device 10. In S100, the processor 12 of the information processing device 10 waits for access from a terminal device. Then, when there is access from a terminal device (S100: Yes), in S102, the processor 12 acquires the IP address of the terminal device contained in a packet transmitted from the terminal device.

[0031] Next, in S104, the processor 12 checks whether the access from the terminal device is unauthorized access. Specifically, if the IP address acquired in S102 does not exist in the blacklist 54, the processor 12 determines that the access from the terminal device is not unauthorized access (S104: No), and provides normal services to the terminal device. On the other hand, if the IP address acquired in S102 exists in the blacklist 54, the processor 12 determines that the access from the terminal device is unauthorized access (S104: Yes), and performs processing for unauthorized access (S106 to S114) described below.

[0032] From here on, we will explain an example in which an unauthorized device 16 (see Figure 1) accesses the information processing device 10 (symbol 30), and because the IP address of the unauthorized device 16 exists in the blacklist 54, the access 30 from the unauthorized device 16 is determined to be unauthorized access, and processing for the unauthorized access (S106 to S114) is carried out.

[0033] In S106, the processor 12 functions as the acquisition unit 40 to acquire a domain corresponding to the IP address of the unauthorized device 16 (hereinafter also referred to as the access source 16). Here, IPv4 IP addresses assigned to each country in the world are managed by Regional Internet Registries (RIRs). RIRs include APNIC (Asia Pacific Network Information Centre), ARIN (American Registry for Internet Numbers), RIPE NCC (Reseaux IP Europeens Network Coordination Centre), LACNIC (Latin American and Caribbean IP address Registry), and AFRINIC (African Network Information Centre). The processor 12 acquires a domain corresponding to the IP address of the unauthorized device 16, for example, by making a reverse lookup inquiry to these RIRs via the Internet.

[0034] Next, in S108, the processor 12 functions as the acquisition unit 40 and estimates the region where the unauthorized device 16 exists. The domain acquired in S106 includes a region code such as "jp", "us", or "cn". For example, if the domain acquired in S106 is "~△△△.□□.jp", the region code is "jp", and it can be estimated that the region where the unauthorized device 16 exists is "Japan". Also, for example, if the domain acquired in S106 is "~△△△.□□.us", the region code is "us", and it can be estimated that the region where the unauthorized device 16 exists is "United States". In this way, the acquisition unit 40 of the processor 12 acquires (estimates) the region where the unauthorized device 16 exists based on the domain. Then, the processor 12 stores the acquired region 56 in the storage unit 14.

[0035] In addition, when the acquired domain is, for example, "~△△△.com", the domain does not include a regional code, and therefore the region in which the unauthorized device 16 is located cannot be obtained directly from the domain. However, domains often include proper nouns such as organization names, and by searching the Internet for the proper noun, it is often possible to determine in which region the owner of the domain is located (where the unauthorized device 16 is located). Therefore, when the processor 12 cannot directly obtain the region in which the unauthorized device 16 is located from the domain, the processor 12 may estimate the region in which the unauthorized device 16 is located by searching the Internet for a character string included in the domain.

[0036] Note that whether the region to be acquired (estimated) is a country, province, prefecture, state, ward, city, or other unit depends on the region unit under the jurisdiction of each information management system 20 (see FIG. 1). For example, if the unauthorized device 16 is regulated by an information management system 20 operated by a country, the region unit to be acquired may be a "country", and if the unauthorized device 16 is regulated by an information management system 20 operated by a ward, the region unit to be acquired may be a "ward".

[0037] Next, in S110 of FIG. 3, the processor 12 functions as the generating unit 42 to generate a warning message 60 corresponding to the region 56 in the storage unit 14. The warning message 60 includes a message for activating the firewall 22 of the information management system 20 (see FIG. 1) that has jurisdiction over the region 56 in which the unauthorized device 16 exists. Specifically, the warning message 60 includes, for example, as shown in FIG. 2, a phrase 62 (word, sentence, etc.) that is restricted by the information management system 20 that has jurisdiction over the region 56 in which the unauthorized device 16 exists, and a forwarding message 64 to a restricted website. Note that the warning message 60 may include only one of the restricted phrase 62 and the forwarding message 64 to a restricted website. As described above, the content of the restriction of the access of the terminal device (restricted phrase, restricted website, etc.) differs for each region in which the terminal device exists, i.e., for each information management system 20 that has jurisdiction over the region in which the terminal device exists, so the region 56 is acquired in S108, and then the warning message 60 corresponding to the region 56 is generated.

[0038] For example, a table associating regions with restriction contents is stored in advance in the storage unit 14, and the processor 12 determines the restriction contents corresponding to the region 56 acquired in S108 from the table, and generates the warning message 60 based on the restriction contents. For example, if restricted words and URLs of restricted websites are stored as the restriction contents, the processor 12 may include the restriction contents in the warning message 60. In addition, for example, the processor 12 may perform an Internet search using the restriction contents or keywords corresponding to the restriction contents, collect the restricted words and URLs of restricted websites, and include them in the warning message 60. The processor 12 stores the generated warning message 60 in the storage unit 14.

[0039] Next, in S112 of Fig. 3, the processor 12 functions as the acquisition unit 40 and acquires the warning message 60 from the storage unit 14. Note that in this embodiment, the warning message 60 is generated in S110, but the warning message 60 corresponding to each region may be created in advance by the information processing device 10 or another information processing device and stored in the storage unit 14. In this case, S110 in the flow of Fig. 3 may be omitted, and in S112, the processor 12 may read out and acquire the warning message 60 corresponding to the region acquired in S108 from the storage unit 14.

[0040] Next, in S114, the processor 12 functions as the transmitting unit 46 and transmits the warning message 60 acquired in S112 to the unauthorized device 16. This is transmitted as a response 32 to the access 30 (see FIG. 1) from the unauthorized device 16. At this time, the processor 12 intentionally transmits the warning message 60 in plain text so that the firewall 22 will be activated by the warning message 60. This completes the process for unauthorized access by the information processing device 10.

[0041] Next, the effects of the information processing device 10 of the embodiment described above will be described.

[0042] The warning message 60 sent by the information processing device 10 is detected by the firewall 22 that monitors the area in which the unauthorized device 16 is located, before it is received by the unauthorized device 16. At this time, the warning message 60 includes a word or phrase restricted by the information management system 20, and thus the firewall 22 is activated. In other words, the information management system 20 recognizes that the unauthorized device 16 has accessed a website related to a restricted word or phrase. This is expected to cause the information management system 20 to restrict the unauthorized device 16 from accessing the information processing device 10 again. Therefore, it is possible to prevent the information processing device 10 from being illegally accessed again by the unauthorized device 16.

[0043] Moreover, the warning message 60 includes a transfer message 64 to a website restricted by the information management system 20. This transfer message 64 is specified so that when the unauthorized device 16 receives the transfer message 64, the unauthorized device 16 automatically accesses the transfer destination indicated in the transfer message 64. When the unauthorized device 16 accesses the website restricted by the information management system 20 by the transfer message (see reference numeral 34 in FIG. 1), the firewall 22 is activated. This is due to the unauthorized device 16 having accessed the information processing device 10, so that when the firewall 22 is activated, it is expected that the information management system 20 will restrict the unauthorized device 16 from accessing the information processing device 10 again. Therefore, it is possible to prevent the information processing device 10 from being illegally accessed again by the unauthorized device 16.

[0044] The warning message 60 may include a sentence that warns the user of the unauthorized device 16. On the other hand, the warning message 60 may be composed of only the restricted phrase 62, only the redirection message 64 to the restricted website, or only both of them.

[0045] Furthermore, if unauthorized access from the unauthorized device 16 continues even after the processor 12 of the information processing device 10 has sent the warning message 60 to the unauthorized device 16, the processor 12 of the information processing device 10 may send to the unauthorized device 16 another warning message 60 in which the restricted phrase 62 or the forwarding message 64 to the restricted website has been changed. The processor 12 of the information processing device 10 may also repeatedly send the warning message 60 with the above-mentioned changed content, thereby acquiring, by machine learning, appropriate content for the warning message 60 that will prevent unauthorized access for each region. In this way, a warning message 60 that can appropriately activate the firewall 22 of each information management system 20 can be obtained.

[0046] Furthermore, when the processor 12 of the information processing device 10 determines that the access received from the terminal device is unauthorized access (S104: Yes in FIG. 3), the processor 12 may transmit the IP address of the terminal device or the domain corresponding thereto to the information management system 20 that has jurisdiction over the area in which the terminal device exists (the area acquired in S108 in FIG. 3) or the administrative agency that has jurisdiction over the area in which the terminal device exists. In addition, at this time, the processor 12 of the information processing device 10 may also transmit a message indicating that unauthorized access has been received from the terminal device. In this way, it is expected that the information management system 20 or the administrative agency will recognize the terminal device (unauthorized device 16) that has performed the unauthorized access and restrict access to the Internet by the unauthorized device 16. This makes it possible to prevent the information processing device 10 from being unauthorizedly accessed again by the unauthorized device 16.

[0047] In the above-described embodiment, the warning message 60 includes the restricted phrase 62 or the forwarding message 64 to the restricted website, but the warning message 60 may include only a message that warns the user without including these. Although such a warning message 60 does not activate the firewall 22, it is expected that the user of the unauthorized device 16 who receives the warning message 60 will voluntarily stop unauthorized access. As described above, in order to obtain the region in which the unauthorized device 16 is located (S108 in FIG. 3), the warning message 60 can be created in the language used in that region and according to the characteristics of that region and sent to the unauthorized device 16.

[0048] In the embodiment described above, whether or not an access from a terminal device is an unauthorized access is determined by using the blacklist 54. However, this is merely one example, and whether or not an access from a terminal device is an unauthorized access can be determined by using various means such as an existing IDS. [Explanation of symbols]

[0049] 10 information processing device, 12 processor, 14 memory unit, 16 unauthorized device (access source), 20 information management system, 21 computer, 22 firewall, 30 access, 32 response, 34 access, 40 acquisition unit, 42 generation unit, 46 transmission unit, 50 program, 52 access log, 54 blacklist, 56 region, 60 warning message, 62 restricted words, 64 transfer message, 90 Internet (network).

Claims

1. A processor is included. The processor, When it is determined that the access received from the outside is an unauthorized access, the region in which the access source exists is obtained based on the IP address of the access source; Obtain a warning message corresponding to the region of the obtained access source; Transmitting the acquired warning message to the access source as a response to the access; The warning message includes a redirect message to a website whose browsing is restricted by an information management system in the region from which the access originates.

23. An information processing apparatus comprising:

2. 2. The information processing device according to claim 1, The warning message includes a phrase restricted by the information management system in the region from which the access originates.

23. An information processing apparatus comprising:

3. 2. The information processing device according to claim 1, The processor, when the access received from the outside is determined to be an unauthorized access, the IP address or the domain corresponding to the IP address is transmitted to the information management system in the area from which the access originates.

23. An information processing apparatus comprising:

4. When it is determined that the access received from the outside is an unauthorized access, the region in which the access source exists is obtained based on the IP address of the access source; Obtain a warning message corresponding to the region of the obtained access source; sending the acquired warning message to the access source as a response to the access; A program for causing a computer to function as described above, The warning message includes a redirect message to a website whose browsing is restricted by an information management system in the region from which the access originates. program.

Images