Access control system, access control device, and access control method

Abstract

To detect that an access destination site indicated by an access request is an illegal site.SOLUTION: A data storage device stores white list information including address information collected from each of a plurality of access control devices. A receiving unit of each of the access control devices receives an access request from a terminal device. A first acquisition unit acquires first image information from an access destination site indicated by first address information included in the access request. A second acquisition unit acquires the white list information from the data storage device. A determination unit determines that the access destination site is an illegal site when the first address information is not included in the white list information, and the first image information is similar to second image information corresponding to second address information included in the white list information.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an access control technology. [Background technology]

[0002] Phishing is a fraudulent activity aimed at stealing personal information such as user names, passwords, and credit card numbers from Internet users. For example, a phishing site is a fake website that is luring users to enter personal information on the phishing site's web screen by sending an email masquerading as a trusted entity, and the personal information is then stolen. A phishing site is an example of a malicious and fraudulent site.

[0003] Conventionally, in order to prevent phishing, for example, a blacklist including the URLs (Uniform Resource Locators) of phishing sites is used to detect phishing sites from among the destinations accessed by a user. The blacklist is periodically updated by a security vendor or the like.

[0004] A method has also been proposed to restrict the destinations that users can access by using a whitelist that contains the URLs of websites that are determined to be trustworthy and legitimate. By installing antivirus software or antivirus applications on users' PCs (Personal Computers), it is also possible to detect viruses or programs that steal user data.

[0005] In relation to phishing countermeasures, a system relating to phishing and brand protection through imitation detection is known (see, for example, Patent Document 1). A communication device is also known that allows the transmission of important information to a legitimate site and blocks the transmission of important information to a phishing site without imposing a burden on the end user (see, for example, Patent Document 2). A program for warning against access to phishing sites other than legitimate sites is also known (see, for example, Patent Document 3). [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Special Publication No. 2018-526721 [Patent Document 2] JP 2015-11659 A [Patent Document 3] JP 2016-45754 A Summary of the Invention [Problem to be solved by the invention]

[0007] Conventional methods of detecting phishing sites using blacklists, whitelists, etc. and blocking access to phishing sites from user terminal devices have limitations.

[0008] This problem is not limited to cases where access to phishing sites is blocked, but occurs when access to various malicious and fraudulent sites is blocked.

[0009] In one aspect, the present invention has an object to detect whether an access destination site indicated by an access request is an unauthorized site. [Means for solving the problem]

[0010] In one proposal, the access control system includes a data storage device and a plurality of access control devices. The data storage device stores whitelist information including address information collected from each of the plurality of access control devices. Each access control device includes a receiving unit, a first acquiring unit, a second acquiring unit, and a determining unit.

[0011] The receiving unit receives an access request from the terminal device. The first acquiring unit acquires first image information from an access destination site indicated by first address information included in the access request. The second acquiring unit acquires whitelist information from the data storage device.

[0012] The judgment unit judges that the accessed site is an unauthorized site when the whitelist information does not include the first address information and the first image information is similar to second image information corresponding to the second address information included in the whitelist information. Effect of the Invention

[0013] According to one aspect, it is possible to detect whether the access destination site indicated by the access request is an unauthorized site. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a configuration diagram of an information processing system according to a comparative example. [Diagram 2] 13 is a flowchart of an access control process of a comparative example. [Diagram 3] FIG. 1 is a functional configuration diagram of an access control system according to an embodiment. [Figure 4] 11 is a flowchart of an access control process performed by an access control device. [Diagram 5] FIG. 1 is a configuration diagram of an information processing system including an access control system. [Figure 6] FIG. 2 is a functional configuration diagram of a UTM device. [Figure 7] 3A to 3C are diagrams showing blacklist information, whitelist information, and image list information. [Figure 8A] 1 is a flowchart (part 1) of an access control process in an information processing system. [Figure 8B] 13 is a flowchart (part 2) of an access control process in the information processing system. [Figure 9] FIG. 2 is a hardware configuration diagram of an information processing device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, the embodiments will be described in detail with reference to the drawings.

[0016] 1 shows an example of the configuration of an information processing system according to a comparative example. The information processing system in FIG.

[0017] The terminal device 101 is an information processing device (computer) of an Internet user, and the Web server 103 is an information processing device that provides information or services to users via the Internet. The UTM device 102 is, for example, an information processing device of a business that provides a firewall (FW) service, and the data server 104 is, for example, an information processing device of a security vendor.

[0018] The UTM device 102 communicates with the terminal device 101 via a private network such as an intranet, and communicates with the Web server 103 and the data server 104 via a public network such as the Internet.

[0019] The UTM device 102 includes a FW unit 111, an analysis unit 112, a checking unit 113, and a management unit 114. The Web server 103 stores the contents of a legitimate site 131 and a phishing site 132. The data server 104 stores blacklist information 141 in which the URL of the phishing site 132 is registered. In the information processing system of FIG. 1, access control processing is performed in the following procedure.

[0020] (P1) The terminal device 101 transmits an access request to the UTM device 102, and the FW unit 111 of the UTM device 102 transmits the received access request to the Web server 103.

[0021] If the URL of the destination site included in the access request indicates the legitimate site 131, the Web server 103 transmits a response including a Web screen of the legitimate site 131 to the UTM device 102. If the URL of the destination site included in the access request indicates the phishing site 132, the Web server 103 transmits a response including a Web screen of the phishing site 132 to the UTM device 102.

[0022] (P2) The FW unit 111 outputs the access request received from the terminal device 101 to the analysis unit 112.

[0023] (P3) The management unit 114 acquires the blacklist information 141 from the data server 104 and stores the acquired blacklist information 141 as the blacklist information 121 in the UTM device 102.

[0024] (P4) The analysis unit 112 extracts the URL of the access destination site included in the access request, and outputs it to the checking unit 113.

[0025] (P5) Check unit 113 accesses blacklist information 121 via management unit 114 and compares the URL of the accessed site with each URL in blacklist information 121.

[0026] (P6) If the URL of the accessed site does not match any URL in the blacklist information 121, the check unit 113 notifies the FW unit 111 of access permission, and the FW unit 111 transmits the response received from the Web server 103 to the terminal device 101. For example, if the URL of the accessed site indicates the legitimate site 131, access is permitted.

[0027] (P7) If the URL of the accessed site matches any URL in blacklist information 121, checking unit 113 notifies FW unit 111 that access is not permitted. Then, FW unit 111 transmits a response including a warning screen indicating that the accessed site is an illegal site to terminal device 101. For example, if the URL of the accessed site indicates phishing site 132, access is blocked.

[0028] (P8) The management unit 114 may change the blacklist information 121 by adding a newly detected phishing site to the blacklist information 121. Therefore, the management unit 114 periodically transmits the blacklist information 121 to the data server 104. The data server 104 updates the blacklist information 141 based on the received blacklist information 121, thereby implementing a synchronization process between the blacklist information 121 and the blacklist information 141.

[0029] Fig. 2 is a flowchart showing an example of access control processing of a comparative example in the information processing system of Fig. 1. First, a user starts up the terminal device 101 (step 211), a provider providing a FW service starts up the UTM device 102 (step 221), and an administrator of the Web server 103 starts up the Web server 103 (step 231).

[0030] Next, the terminal device 101 transmits an access request for browsing the legitimate site 131 or the phishing site 132 to the UTM device 102 (step 212). The FW unit 111 of the UTM device 102 receives the access request from the terminal device 101 (step 222) and transmits the received access request to the Web server 103.

[0031] The Web server 103 receives the access request from the UTM device 102 (step 232) and transmits a response including a Web screen of the destination site indicated by the URL included in the access request to the UTM device 102 (step 233). The Web server 103 then waits until it receives the next access request (step 234). The Web screen of the destination site is a top page, a password entry screen, etc.

[0032] The check unit 113 of the UTM device 102 checks whether the URL of the access destination site included in the access request exists in the blacklist information 121 (step 223).

[0033] If the URL of the accessed site is present in the blacklist information 121 (step 223, YES), the FW unit 111 transmits a response including a warning screen indicating that the accessed site is an unauthorized site to the terminal device 101. The terminal device 101 receives the response including the warning screen and displays the warning screen (step 213).

[0034] If the URL of the accessed site does not exist in the blacklist information 121 (step 223, NO), the FW unit 111 transmits the response including the Web screen received from the Web server 103 to the terminal device 101 (step 224). Then, the UTM device 102 waits until it receives the next access request (step 225). The terminal device 101 receives the response including the Web screen and displays the Web screen (step 214).

[0035] 2, it is possible to permit access to the legitimate site 131 and block access to the phishing site 132 indicated by the blacklist information 121. This protects the user of the terminal device 101 from phishing.

[0036] However, unknown phishing sites corresponding to URLs not included in the blacklist information 121 are permitted to be accessed in the same way as the legitimate site 131. The blacklist information 141 is updated periodically, but is not updated in real time, so it is difficult for the data server 104 to update the blacklist information 141 in real time every time a new phishing site is added. For this reason, there is a limit to the method of protecting users from phishing using only the blacklist information 141.

[0037] On the other hand, there is also a method of controlling access using whitelist information in which the URLs of legitimate sites are registered. With this method, access is permitted only to legitimate sites indicated by URLs in the whitelist information. However, this places a heavy burden on the user, as the user must determine in advance whether the site to be accessed is a legitimate site or not and then register the URL of the legitimate site in the whitelist information.

[0038] Furthermore, even if antivirus software or the like is installed in the user's terminal device 101, it is difficult for the antivirus software or the like to detect a phishing site.

[0039] Fig. 3 shows an example of a functional configuration of an access control system according to an embodiment. The access control system in Fig. 3 includes a data storage device 311 and access control devices 312-1 to 312-N (N is an integer equal to or greater than 2). The data storage device 311 stores whitelist information 321 including address information collected from each access control device 312-i (i = 1 to N). Each access control device 312-i includes a receiving unit 331, a first acquiring unit 332, a second acquiring unit 333, and a determining unit 334.

[0040] Fig. 4 is a flowchart showing an example of an access control process performed by the access control device 312-i in Fig. 3. First, the receiving unit 331 receives an access request from a terminal device (step 401). The first acquiring unit acquires first image information from an access destination site indicated by first address information included in the access request (step 402), and the second acquiring unit acquires whitelist information from a data storage device (step 403).

[0041] If the whitelist information does not include the first address information and the first image information is similar to the second image information corresponding to the second address information included in the whitelist information, the judgment unit judges that the accessed site is an illegal site (step 404).

[0042] According to the access control system of FIG. 3, it is possible to detect that the access destination site indicated by the access request is an unauthorized site.

[0043] Fig. 5 shows an example of the configuration of an information processing system including the access control system of Fig. 3. The information processing system of Fig. 5 includes terminal devices 501-1 to 501-N, UTM devices 502-1 to 502-N, Web servers 503-1 to 503-M, a data server 504, and a data server 505.

[0044] The terminal devices 501-i (i=1 to N) are information processing devices of Internet users, and the Web servers 503-j (j=1 to M) are information processing devices that provide information or services to users via the Internet. The UTM devices 502-i (i=1 to N) and the data server 505 are, for example, information processing devices of a business that provides a FW service, and the data server 504 is, for example, an information processing device of a security vendor.

[0045] The users of the terminal device 501-i are, for example, employees of various business types or business formats, and the UTM device 502-i is provided for each business. The number of terminal devices 501-i that use each UTM device 502-i is not limited to one, and each of the terminal devices 501-i of a plurality of users can use the UTM device 502-i.

[0046] The UTM device 502-i and the data server 505 correspond to the access control device 312-i and the data storage device 311 in FIG. 3, respectively.

[0047] The UTM device 502-i communicates with a terminal device 501-i via a communication network 511-i, and communicates with a Web server 503-j, a data server 504, and a data server 505 via a communication network 512. The communication network 511-i is, for example, a private network such as an intranet, and the communication network 512 is, for example, a public network such as the Internet.

[0048] The Web server 503-j stores the contents of legitimate sites or phishing sites. The data server 504 stores blacklist information 521 in which the URLs of phishing sites are registered. The data server 505 stores whitelist information 531 and image list information 532.

[0049] The URLs of legitimate sites are registered in the whitelist information 531. The whitelist information 531 includes the URLs of general legitimate sites distributed by security vendors, etc., and the URLs of legitimate sites collected from each UTM device 502-i. The URLs are an example of address information.

[0050] Image list information 532 registers image data acquired from legitimate sites indicated by each of the multiple URLs included in whitelist information 531. Each image data represents, for example, a Web screen returned from Web server 503-j as a response to an access request including the URL of the legitimate site. A URL in whitelist information 531 is associated with image data in image list information 532 acquired from the legitimate site indicated by that URL. Image data is an example of image information.

[0051] By preparing image list information 532 associated with whitelist information 531, it becomes possible to compare image data obtained from an unknown website with image data obtained from a known legitimate site.

[0052] Fig. 6 shows an example of a functional configuration of the UTM device 502-i in Fig. 5. The UTM device 502-i in Fig. 6 includes a FW unit 611, an analysis unit 612, a first check unit 613, a first management unit 614, a second check unit 615, a second management unit 616, and a storage unit 617.

[0053] The FW unit 611 corresponds to the receiving unit 331 and the first obtaining unit 332 in Fig. 3. The second management unit 616 and the second check unit 615 correspond to the second obtaining unit 333 and the determining unit 334 in Fig. 3, respectively.

[0054] The terminal device 501-i transmits an access request including a URL of a destination site to the UTM device 502-i. The destination site is, for example, a legitimate site or a phishing site. The URL of the destination site corresponds to the first address information.

[0055] The FW unit 611 of the UTM device 502-i transmits the received access request to a Web server 503-j that stores the content of the accessed site, and receives a response from the Web server 503-j. The received response includes image data of the Web screen of the accessed site. The image data of the Web screen of the accessed site corresponds to the first image information.

[0056] The FW unit 611 outputs the access request received from the terminal device 501-i to the analysis unit 612. The analysis unit 612 extracts the URL of the access destination site included in the access request and outputs it to the first check unit 613 and the second check unit 615.

[0057] The first management unit 614 acquires the blacklist information 521 from the data server 504 , and stores the acquired blacklist information 521 in the storage unit 617 as blacklist information 621 .

[0058] The second management unit 616 acquires whitelist information 531 and image list information 532 from the data server 505. Then, the second management unit 616 stores the acquired whitelist information 531 in the memory unit 617 as whitelist information 622, and stores the acquired image list information 532 in the memory unit 617 as image list information 623.

[0059] Fig. 7 shows examples of blacklist information 621, whitelist information 622, and image list information 623. The blacklist information 621 in Fig. 7 includes URL1 to URL7.

[0060] 7 includes URL11 to URL22. Among these, URL11 to URL16 are URLs of known legitimate sites included in general whitelist information distributed over communication network 512. The general whitelist information may be distributed from data server 504 to data server 505.

[0061] On the other hand, URL17 to URL22 are URLs of legitimate sites collected from the UTM devices 502-1 to 502-N. Each UTM device 502-i transmits to the data server 505 the URL of the unknown legitimate site accessed by the terminal device 501-i and image data acquired from the legitimate site indicated by the URL.

[0062] The data server 505 performs a statistical analysis on the URLs received from the UTM devices 502-1 to 502-N. Then, based on the result of the statistical analysis, the data server 505 adds any of the URLs received from the UTM devices 502-1 to 502-N to the whitelist information 531 as the URL of a reliable legitimate site.

[0063] In the statistical analysis, for example, the data server 505 extracts URLs of legitimate sites accessed by a certain number of users or more from among URLs of unknown legitimate sites accessed by a plurality of users within a predetermined period. Then, the data server 505 adds the extracted URLs to the whitelist information 531 as URLs of reliable legitimate sites. In addition, the data server 505 adds image data received together with the added URL to the image list information 532 as image data corresponding to the URL.

[0064] 7 includes image data D15 and image data D17 to D22. In the initial state, the image data corresponding to URL11 to URL16 are not registered in the image list information 532.

[0065] Thereafter, when any of the terminal devices 501-i accesses a legitimate site indicated by any of URL11 to URL16, the UTM device 502-i transmits the URL of the legitimate site and image data acquired from the legitimate site to the data server 505. The data server 505 registers the image data received together with the URL from the UTM device 502-i in the image list information 532 as image data corresponding to the URL.

[0066] Image data D15 is image data registered in association with URL 15 when any of terminal devices 501-i accesses the legitimate site indicated by URL 15. On the other hand, image data D17 to image data D22 are image data added in association with URL 17 to URL 22, respectively, when URL 17 to URL 22 are added to whitelist information 531 based on the results of statistical analysis.

[0067] The first check unit 613 compares the URL of the accessed site with each URL in the blacklist information 621. If the URL of the accessed site matches any URL in the blacklist information 621, the first check unit 613 determines that the accessed site is a phishing site, and notifies the FW unit 611 that access is not permitted.

[0068] In this case, the FW unit 611 discards the image data of the Web screen of the destination site, thereby preventing the image data of the Web screen of the destination site from being transmitted to the terminal device 501-i. Then, the FW unit 611 transmits a response including a warning screen indicating that the destination site is an unauthorized site to the terminal device 501-i. Therefore, if the destination site is a phishing site, access is blocked. The warning screen indicating that the destination site is an unauthorized site is an example of warning information regarding the destination site.

[0069] If the URL of the accessed site does not match any of the URLs in the blacklist information 621 , the second check unit 615 compares the URL of the accessed site with each URL in the whitelist information 622 .

[0070] If the URL of the accessed site matches any of the URLs in the whitelist information 622, the second check unit 615 determines that the accessed site is a legitimate site, and notifies the FW unit 611 of access permission. In this case, the FW unit 611 transmits image data of the Web screen of the accessed site to the terminal device 501-i.

[0071] The second management unit 616 updates the image list information 623 by adding the image data of the Web screen of the accessed site to the image list information 623. Then, the second management unit 616 transmits the URL of the accessed site and the image list information 623 to the data server 505.

[0072] If the image data corresponding to the URL of the accessed site is not registered in the image list information 532, the data server 505 registers the image data added to the image list information 623 in the image list information 532 as image data corresponding to that URL.

[0073] If the URL of the accessed site does not match any of the URLs in the whitelist information 622 , the second check unit 615 compares the image data of the web screen of the accessed site with each image data in the image list information 623 .

[0074] The second check unit 615 calculates, for example, the degree of dissimilarity between the image data of the web screen of the accessed site and the image data in the image list information 623. If the degree of dissimilarity is smaller than a threshold, the second check unit 615 determines that the two image data are similar, and if the degree of dissimilarity is equal to or greater than the threshold, the second check unit 615 determines that the two image data are dissimilar. As the degree of dissimilarity between the two image data, the sum of squared differences of pixel values, the sum of absolute differences of pixel values, etc. can be used.

[0075] The second check unit 615 may calculate the similarity between the image data of the web screen of the accessed site and the image data in the image list information 623. If the similarity is greater than a threshold, the second check unit 615 determines that the two image data are similar, and if the similarity is equal to or less than the threshold, the second check unit 615 determines that the two image data are dissimilar. As the similarity between the two image data, normalized cross-correlation of pixel values ​​or the like can be used.

[0076] If the image data of the web screen of the accessed site is similar to any image data D in the image list information 623, there is a high possibility that the image data of the web screen of the accessed site is a copy of the image data D. Therefore, the second check unit 615 determines that the accessed site is a phishing site disguised as the legitimate site S having the web screen represented by the image data D, and notifies the FW unit 611 that access is not permitted.

[0077] In this case, the FW unit 611 discards the image data of the Web screen of the accessed site, thereby preventing the image data of the Web screen of the accessed site from being transmitted to the terminal device 501-i. Then, the FW unit 611 transmits a response including a warning screen indicating that the accessed site is an unauthorized site to the terminal device 501-i.

[0078] The whitelist information 622 includes a URL of a legitimate site S having a Web screen represented by the image data D. The URL of the legitimate site S included in the whitelist information 622 corresponds to the second address information.

[0079] In this way, by combining the URL and image data of the accessed site and making a judgment on the accessed site, it is possible to detect unknown phishing sites that are not registered in the blacklist information 521. Then, when a phishing site is detected, the transmission of the Web screen of the phishing site is prevented, and instead a warning screen is sent to the terminal device 501-i, thereby protecting the user from phishing.

[0080] If the image data of the Web screen of the accessed site is not similar to any image data in the image list information 623, the accessed site is likely to be an unknown legitimate site. Therefore, the second check unit 615 determines that the accessed site is a reliable legitimate site, and notifies the FW unit 611 of access permission. In this case, the FW unit 611 transmits image data of the Web screen of the accessed site to the terminal device 501-i.

[0081] The second management unit 616 adds the URL of the accessed site to the whitelist information 622 and adds image data of the web screen of the accessed site to the image list information 623, thereby updating the whitelist information 622 and the image list information 623. As a result, information on a new website determined to be a legitimate site is added to the whitelist information 622 and the image list information 623.

[0082] Then, the second management unit 616 transmits the whitelist information 622 and the image list information 623 to the data server 505. The data server 505 performs the above-mentioned statistical analysis based on the received whitelist information 622, and adds the URLs added to the whitelist information 622 to the whitelist information 531 based on the results of the statistical analysis. As a result, synchronization processing between the whitelist information 622 and the whitelist information 531 is performed.

[0083] Furthermore, the data server 505 adds the image data added to the image list information 623 to the image list information 532 , thereby carrying out a synchronization process between the image list information 623 and the image list information 532 .

[0084] By carrying out these synchronization processes, it is possible to automatically and efficiently generate whitelist information 531 and image list information 532 that reflect the access histories of users in various industries or business formats. This allows other UTM devices 502-i to use the information on legitimate sites added to whitelist information 531 and image list information 532, thereby preventing erroneous determination that the legitimate site is a phishing site.

[0085] Furthermore, by performing a synchronization process when a URL is added to the whitelist information 622, it is possible to update the whitelist information 531 and the image list information 532 in real time. Therefore, it becomes possible to use the information of the added legitimate site more quickly than with general whitelist information.

[0086] Figures 8A and 8B are flowcharts showing an example of an access control process in the information processing system of Figure 5. In this example, N=4, and the information processing system includes UTM devices 502-1 to 502-4.

[0087] First, the user starts the terminal device 501-1 (step 811), the provider providing the FW service starts the UTM device 502-1 (step 821), and the administrator of the Web server 503-j starts the Web server 503-j (step 841). When the UTM device 502-1 starts up, the first management unit 614 acquires the blacklist information 521 from the data server 504, and stores the acquired blacklist information 521 in the storage unit 617 as blacklist information 621.

[0088] Next, the terminal device 501-1 transmits an access request for browsing the website to the UTM device 502-1 (step 812). The FW unit 611 of the UTM device 502-1 receives the access request from the terminal device 501-1 (step 822) and transmits the received access request to the Web server 503-j.

[0089] The Web server 503-j receives the access request from the UTM device 502-1 (step 842) and transmits a response including the Web screen of the access destination site indicated by the URL included in the access request to the UTM device 502-1 (step 843).Then, the Web server 503-j waits until it receives the next access request (step 844).

[0090] The first check unit 613 of the UTM device 502-1 checks whether the URL of the access destination site included in the access request exists in the blacklist information 621 (step 823).

[0091] If the URL of the accessed site is present in the blacklist information 621 (step 823, YES), FW unit 611 transmits a response including a warning screen indicating that the accessed site is an unauthorized site to terminal device 501-1. Terminal device 501-1 receives the response including the warning screen and displays the warning screen (step 813).

[0092] If the URL of the accessed site does not exist in the blacklist information 121 (step 823, NO), the second management unit 616 requests the whitelist information 531 and the image list information 532 from the data server 505 (step 824).

[0093] The data server 505 transmits the whitelist information 531 and the image list information 532 to the UTM device 502-1 (step 851). The second management unit 616 stores the received whitelist information 531 in the memory unit 617 as whitelist information 622, and stores the received image list information 532 in the memory unit 617 as image list information 623.

[0094] Next, the second check unit 615 checks whether the URL of the accessed site is present in the whitelist information 622 (step 825). If the URL of the accessed site is not present in the whitelist information 622 (step 825, NO), the second check unit 615 compares the image data of the web screen of the accessed site with each image data in the image list information 623 (step 826).

[0095] If the image data of the Web screen of the accessed site is similar to any of the image data in the image list information 623 (step 826 , YES), the FW section 611 performs the process of step 827 .

[0096] In step 827, the FW unit 611 transmits a response including a warning screen indicating that the accessed site is an unauthorized site to the terminal device 501-1. The UTM device 502-1 then waits until it receives the next access request (step 832). The terminal device 501-1 receives the response including the warning screen and displays the warning screen (step 814).

[0097] If the image data of the web screen of the accessed site is not similar to any image data in the image list information 623 (step 826, NO), the second management unit 616 adds the URL of the accessed site to the whitelist information 622 (step 828).Then, the second management unit 616 adds the image data of the web screen of the accessed site to the image list information 623 (step 829), and transmits the whitelist information 622 and the image list information 623 to the data server 505 (step 830).

[0098] Next, the FW unit 611 transmits a response including a Web screen of the accessed site to the terminal device 501-1 (step 831). The UTM device 502-1 then waits until it receives the next access request (step 832). The terminal device 501-1 receives the response including the Web screen and displays the Web screen (step 815).

[0099] If the URL of the accessed site is present in the whitelist information 622 (step 825, YES), the second management unit 616 adds the image data of the web screen of the accessed site to the image list information 623 (step 829).Then, the second management unit 616 transmits the URL of the accessed site and the image list information 623 to the data server 505 (step 830).

[0100] Next, the FW unit 611 transmits a response including a Web screen of the accessed site to the terminal device 501-1 (step 831). The UTM device 502-1 then waits until it receives the next access request (step 832). The terminal device 501-1 receives the response including the Web screen and displays the Web screen (step 815).

[0101] The other UTM devices 502-i (i=2 to 4) also perform the same process as the UTM device 502-1, and if the accessed site is an unknown legitimate site, transmits whitelist information 622 and image list information 623 to the data server 505. In addition, if the accessed site is a known legitimate site, the other UTM devices 502-i transmit the URL of the accessed site and image list information 623 to the data server 505.

[0102] The data server 505 performs a statistical analysis based on the whitelist information 622 received from the UTM devices 502-1 to 502-4, and updates the whitelist information 531 and the image list information 532 based on the results of the statistical analysis (step 852). In this case, the data server 505 adds the URL added to the whitelist information 622 to the whitelist information 531, and adds the image data added to the image list information 623 to the image list information 532.

[0103] Furthermore, if the image data corresponding to the URL of the accessed site received from any of the UTM devices 502-i is not registered in the image list information 532, the data server 505 updates the image list information 532 (step 852). In this case, the data server 505 registers the image data added to the image list information 623 in the image list information 532 as image data corresponding to the URL of the accessed site.

[0104] The configuration of the access control system in FIG. 3 is merely an example, and some of the components may be omitted or changed depending on the purpose or conditions of the access control system.

[0105] 1 and 5 are merely examples, and some of the components may be omitted or changed depending on the purpose or conditions of the information processing system. For example, if the blacklist information 521 is not used, the data server 504 can be omitted.

[0106] 6 is merely an example, and some of the components may be omitted or changed depending on the purpose or conditions of the information processing system. For example, if the blacklist information 521 is not used, the first check unit 613 and the first management unit 614 can be omitted.

[0107] The flowchart in Fig. 4 is merely an example, and some of the processes may be omitted or changed depending on the configuration or conditions of the access control system. The flowcharts in Fig. 2, Fig. 8A, and Fig. 8B are merely an example, and some of the processes may be omitted or changed depending on the configuration or conditions of the information processing system. For example, if blacklist information 521 is not used, the processes of steps 813 and 823 in Fig. 8A can be omitted.

[0108] The blacklist information 621, the whitelist information 622, and the image list information 623 shown in FIG. 7 are merely examples, and these pieces of information change depending on the purpose or conditions of the information processing system.

[0109] Fig. 9 shows an example of the hardware configuration of an information processing device used as the access control device 312-i in Fig. 3 and the UTM device 502-i in Fig. 6. The information processing device in Fig. 9 includes a CPU (Central Processing Unit) 901, a memory 902, an input device 903, an output device 904, an auxiliary storage device 905, a media drive device 906, and a network connection device 907. These components are hardware, and are connected to each other via a bus 908.

[0110] The memory 902 is, for example, a semiconductor memory such as a Read Only Memory (ROM) or a Random Access Memory (RAM), and stores programs and data used in processing. The memory 902 may operate as the storage unit 617 in FIG.

[0111] 3 by executing a program using the memory 902. The CPU 901 (processor) also operates as the FW unit 611, analysis unit 612, first check unit 613, first management unit 614, second check unit 615, and second management unit 616 in FIG. 6 by executing a control program using the memory 902.

[0112] The input device 903 is, for example, a keyboard, a pointing device, etc., and is used for inputting instructions or information from an operator. The output device 904 is, for example, a display device, a printer, etc., and is used for outputting inquiries or instructions to an operator and processing results.

[0113] The auxiliary storage device 905 is, for example, a magnetic disk device, an optical disk device, a magneto-optical disk device, a tape device, or the like. The auxiliary storage device 905 may be a hard disk drive. The information processing device can store programs and data in the auxiliary storage device 905 and use them by loading them into the memory 902. The auxiliary storage device 905 may operate as the storage unit 617 in FIG. 6.

[0114] The medium drive device 906 drives a portable recording medium 909 and accesses the recorded contents. The portable recording medium 909 is a memory device, a flexible disk, an optical disk, a magneto-optical disk, etc. The portable recording medium 909 may be a CD-ROM (Compact Disk Read Only Memory), a DVD (Digital Versatile Disk), a USB (Universal Serial Bus) memory, etc. An operator can store programs and data in the portable recording medium 909 and load them into the memory 902 for use.

[0115] Thus, the computer-readable recording medium that stores the program and data used in the processing is a physical (non-transitory) recording medium such as the memory 902, the auxiliary storage device 905, or the portable recording medium 909.

[0116] The network connection device 907 is a communication interface circuit that is connected to the communication networks 511-i and 512 and performs data conversion associated with communication. The information processing device can receive programs and data from an external device via the network connection device 907 and load them into the memory 902 for use.

[0117] It is not necessary for the information processing device to include all of the components in Fig. 9, and some of the components may be omitted depending on the purpose or conditions of the information processing device. For example, if an interface with an operator is not required, the input device 903 and the output device 904 may be omitted. If the portable recording medium 909 is not used, the medium drive device 906 may be omitted.

[0118] As the terminal device 501-i, the Web server 503-j, the data server 504, and the data server 505 in FIG. 5, information processing devices similar to those in FIG. 9 can be used.

[0119] Although the disclosed embodiments and their advantages have been described in detail, it will be appreciated that those skilled in the art may make various modifications, additions and omissions therein without departing from the scope of the invention as clearly set forth in the claims.

[0120] The following notes are further disclosed regarding the embodiment described with reference to FIGS. (Appendix 1) An access control system comprising a data storage device and a plurality of access control devices, The data storage device stores whitelist information including address information collected from each of the plurality of access control devices; Each of the plurality of access control devices A receiving unit that receives an access request from a terminal device; a first acquisition unit that acquires first image information from an access destination site indicated by first address information included in the access request; A second acquisition unit that acquires the whitelist information from the data storage device; a determination unit that determines that the destination site is an unauthorized site when the first address information is not included in the whitelist information and the first image information is similar to second image information corresponding to the second address information included in the whitelist information; and 1. An access control system comprising: (Appendix 2) The access control system described in Appendix 1, characterized in that when the destination site is determined to be an unauthorized site, the judgment unit prevents the first image information from being sent to the terminal device and sends warning information regarding the destination site to the terminal device. (Appendix 3) the data storage device further stores image list information including image information acquired from a site indicated by the second address information included in the whitelist information; The second acquisition unit further acquires the image list information from the data storage device, The access control system according to claim 1 or 2, characterized in that the determination unit uses, as the second image information, image information included in the image list information, which is obtained from the site indicated by the second address information. (Appendix 4) the image list information includes image information acquired from sites indicated by each of a plurality of pieces of address information included in the whitelist information, when the first image information is not similar to any of the image information included in the image list information, the determination unit transmits the first address information and the first image information to the data storage device, and transmits the first image information to the terminal device; The access control system described in Appendix 3, characterized in that the data storage device adds the first address information to the whitelist information and adds the first image information to the image list information based on the results of statistical analysis using the first address information and address information received from other access control devices. (Appendix 5) A receiving unit that receives an access request from a terminal device; a first acquisition unit that acquires first image information from an access destination site indicated by first address information included in the access request; a second acquisition unit that acquires whitelist information from a data storage device that stores whitelist information including address information collected from each of a plurality of access control devices; a determination unit that determines the destination site to be an unauthorized site when the first address information is not included in the whitelist information and the first image information is similar to second image information corresponding to the second address information included in the whitelist information; An access control device comprising: (Appendix 6) The access control device described in Appendix 5, characterized in that when the judgment unit judges that the accessed site is the fraudulent site, it prevents the first image information from being sent to the terminal device and sends warning information regarding the accessed site to the terminal device. (Appendix 7) the data storage device further stores image list information including image information acquired from a site indicated by the second address information included in the whitelist information; The second acquisition unit further acquires the image list information from the data storage device, The access control device according to claim 5 or 6, characterized in that the determination unit uses, from among the image information included in the image list information, image information obtained from the site indicated by the second address information as the second image information. (Appendix 8) the image list information includes image information acquired from sites indicated by each of a plurality of pieces of address information included in the whitelist information, when the first image information is not similar to any of the image information included in the image list information, the determination unit transmits the first address information and the first image information to the data storage device, and transmits the first image information to the terminal device; The access control device described in Appendix 7, characterized in that the data storage device adds the first address information to the whitelist information and adds the first image information to the image list information based on the results of statistical analysis using the first address information and address information received from other access control devices. (Appendix 9) receiving an access request from a terminal device; acquiring first image information from an access destination site indicated by first address information included in the access request; Obtaining whitelist information from a data storage device that stores whitelist information including address information collected from each of a plurality of access control devices; If the first address information is not included in the whitelist information and the first image information is similar to second image information corresponding to the second address information included in the whitelist information, the accessed site is determined to be an unauthorized site. 2. An access control method, comprising the steps of: (Appendix 10) The access control method described in Appendix 9, characterized in that the computer further executes a process of preventing the first image information from being sent to the terminal device and sending warning information regarding the accessed site to the terminal device if the accessed site is determined to be an unauthorized site. (Appendix 11) the data storage device further stores image list information including image information acquired from a site indicated by the second address information included in the whitelist information; The computer further performs a process of obtaining the image list information from the data storage device; The access control method according to claim 9 or 10, characterized in that the process of determining that the accessed site is an fraudulent site includes a process of using, as the second image information, image information obtained from the site indicated by the second address information among the image information included in the image list information. (Appendix 12) the image list information includes image information acquired from sites indicated by each of a plurality of pieces of address information included in the whitelist information, the computer further executes a process of transmitting the first address information and the first image information to the data storage device and transmitting the first image information to the terminal device when the first image information is not similar to any image information included in the image list information; The access control method described in Appendix 11, characterized in that the data storage device adds the first address information to the whitelist information and adds the first image information to the image list information based on the results of a statistical analysis using the first address information and address information received from other access control devices. [Explanation of symbols]

[0121] 101 Terminal Equipment 102, 502-1~502-N UTM device 103, 503-1 to 503-M Web Server 104, 504, 505 Data Server 111, 611 FW section 112, 612 Analysis Department 113 Check Department 114 Management Department 121, 141, 521, 621 Blacklist Information 131 Official Site 132 Phishing Site 311 Data storage device 312-1~312-N Access control device 321, 531, 622 Whitelist Information 331 Receiving unit 332 First acquisition part 333 Second Acquisition Department 334 Judgment section 501-1~501-N Terminal equipment 511-1~511-N, 512 Communication Network 532, 623 Image list information 613 First Check Section 614 1st Management Department 615 2nd Check Section 616 2nd Management Department 617 Storage section 901 CPU 902 Memory 903 Input Device 904 Output Device 905 Auxiliary storage device 906 Media Drive Unit 907 Network connection device 908 Bus 909 Portable recording media

Claims

1. An access control system comprising a data storage device and a plurality of access control devices, the data storage device stores whitelist information including address information collected from each of the plurality of access control devices, and image list information including image information acquired from sites indicated by each of the plurality of address information included in the whitelist information; Each of the plurality of access control devices A receiving unit that receives an access request from a terminal device; a first acquisition unit that acquires first image information from an access destination site indicated by first address information included in the access request; a second acquisition unit that acquires the whitelist information and the image list information from the data storage device; a determination unit that determines that the accessed site is an illegal site when the whitelist information does not include the first address information and the first image information is similar to second image information, among the image information included in the image list information, which is obtained from a site indicated by second address information included in the whitelist information, and that transmits the first address information and the first image information to the data storage device and transmits the first image information to the terminal device when the first image information is not similar to any of the image information included in the image list information; Including, The access control system is characterized in that the data storage device adds the first address information to the whitelist information and adds the first image information to the image list information based on the results of a statistical analysis using the first address information and address information received from other access control devices.

2. The access control system described in claim 1, characterized in that when the judgment unit determines that the destination site is the fraudulent site, it prevents the first image information from being sent to the terminal device and sends warning information regarding the destination site to the terminal device.

3. A receiving unit that receives an access request from a terminal device; a first acquisition unit that acquires first image information from an access destination site indicated by first address information included in the access request; a second acquisition unit that acquires whitelist information and image list information from a data storage device that stores whitelist information including address information collected from each of a plurality of access control devices and image list information including image information acquired from sites indicated by each of a plurality of address information included in the whitelist information; a determination unit which determines the accessed site to be an unauthorized site when the whitelist information does not include the first address information and the first image information is similar to second image information, among the image information included in the image list information, which is obtained from a site indicated by second address information included in the whitelist information, and which transmits the first address information and the first image information to the data storage device and transmits the first image information to the terminal device when the first image information is not similar to any of the image information included in the image list information; Equipped with The data storage device adds the first address information to the whitelist information and adds the first image information to the image list information based on the results of a statistical analysis using the first address information and address information received from other access control devices.

4. receiving an access request from a terminal device; acquiring first image information from an access destination site indicated by first address information included in the access request; Acquire whitelist information and image list information from a data storage device that stores whitelist information including address information collected from each of a plurality of access control devices and image list information including image information acquired from sites indicated by each of a plurality of address information included in the whitelist information; When the first address information is not included in the whitelist information and the first image information is similar to second image information, among the image information included in the image list information, that is obtained from a site indicated by second address information included in the whitelist information, the accessed site is determined to be an unauthorized site; if the first image information is not similar to any of the image information included in the image list information, transmitting the first address information and the first image information to the data storage device, and transmitting the first image information to the terminal device; The computer executes the process, The access control method is characterized in that the data storage device adds the first address information to the whitelist information and adds the first image information to the image list information based on the results of a statistical analysis using the first address information and address information received from other access control devices.

Images