Packet security system, network system, packet security method, and packet security program

Abstract

To provide a packet security system, a network system, a method, and a program that reduce the costs of security scan processing and communication traffic.SOLUTION: In a network system 100, a packet security system 102 has a content rewriting function 121 that acquires content from an HTTP server 104 according to a request from a client 101, inspects safety of the content, and rewrites safe link information contained in the content to character string information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a packet security system, a network system, a packet security method, and a packet security program. [Background technology]

[0002] Methods for inspecting packets on a network can be broadly divided into SPI (Stateful Packet Inspection) and DPI (Deep Packet Inspection). Traditionally, SPI was the mainstream, inspecting the destination and source IP addresses contained in the header, but there have been cases where the header of a packet appears normal but a virus is embedded in the body, so DPI, which inspects the contents of the packet data itself (body), has also been implemented (see Patent Document 1, for example). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-107935 Summary of the Invention [Problem to be solved by the invention]

[0004] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0005] However, in a security system that performs DPI scanning of packet communications on a network route, when scanning communications that provide multiple contents via HTTP (HTTPS) on a single domain, even if some of the communications contain content that has been confirmed to be safe, security scanning of all of the communications becomes redundant. This increases the costs of security scanning processing and communication volume for the security system, and increases service costs.

[0006] In view of the above-mentioned problems, an object of the present invention is to provide a packet security system, a network system, a packet security method, and a packet security program that contribute to reducing the costs of security scan processing and communication traffic. [Means for solving the problem]

[0007] In a first aspect of the present invention, there is provided a packet security system having a content rewriting function that, in response to a request from a client, obtains content from an HTTP server, inspects the safety of the content, and rewrites safe link information contained in the content into character string information.

[0008] In a second aspect of the present invention, there is provided a network system comprising: a packet security system having a content rewriting function that acquires content from an HTTP server in accordance with a request from a client, inspects the safety of the content, and rewrites safe link information contained in the content into character string information; a DNS server that responds to an inquiry about an IP address related to the link information rewritten by the packet security system in a manner that allows access to the HTTP server without going through the packet security system; and a proxy that reverse-converts the link information rewritten by the packet security system to restore the original link information, and then requests content based on the original link information.

[0009] In a third aspect of the present invention, there is provided a packet security method for obtaining content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information included in the content into character string information.

[0010] In a fourth aspect of the present invention, there is provided a packet security program that causes a computer to execute a process of acquiring content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information included in the content into character string information. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product. [Effects of the Invention]

[0011] According to each aspect of the present invention, it is possible to provide a packet security system, a network system, a packet security method, and a packet security program that contribute to reducing costs for security scan processing and communication traffic. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of a network system. [Figure 2] FIG. 2 is a system diagram showing an example of the operation of the network system. [Figure 3] FIG. 3 is a flowchart illustrating an example of processing in the packet security system. [Figure 4] FIG. 4 is a flowchart showing an example of the process of the DNS server A. [Figure 5] FIG. 5 is a flowchart showing an example of a proxy process. [Figure 6] FIG. 6 is a diagram showing a modified configuration example of a network system. [Figure 7] FIG. 7 is a diagram illustrating an example of the hardware configuration of a packet security system. DETAILED DESCRIPTION OF THE INVENTION

[0013] An embodiment of the present invention will be described below with reference to the drawings. However, the present invention is not limited to the embodiment described below. In addition, the same or corresponding elements in each drawing are appropriately designated by the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationships and ratios of each element may differ from those in reality. There may also be parts in which the dimensional relationships and ratios differ between the drawings.

[0014] 1 is a diagram showing an example of the configuration of a network system. As shown in Fig. 1, a network system 100 includes a client 101, a packet security system 102, a DNS server A 103, an HTTP server 104, a gateway 105, and a DNS server B 106.

[0015] The client 101 has a proxy 112 including a web browser 111 and an inverse conversion unit 113. The web browser 111 is an interface that enables a user to obtain information via a network. As will be explained later, the inverse conversion unit 113 has a function of inversely converting the content of HTML content rewritten by the packet security system 102 and rewriting it to the original content. The proxy 112 has a role of executing communications received from the web browser 111.

[0016] The packet security system 102 has a content rewriting function 121. In response to a request from the client 101, the packet security system 102 acquires content from the HTTP server 104, inspects the safety of the content, and rewrites safe link information included in the content into character string information, as will be described later.

[0017] The DNS server A103 has an address response unit 131 and a domain threat level DB 132. In response to a request from the client 101, the DNS server A103 refers to the domain threat level DB 132 and selects an IP address to respond to the request from the client 101.

[0018] The HTTP server 104 responds to the request and provides the HTML content. In the example shown in Fig. 1, the HTTP server 104 is assumed to provide HTML content A141, which includes link information Link(B) and Link(C) relating to content B142 and content C143.

[0019] The gateway 105 is a device that enables the client 101 to communicate with the network, and the DNS server B 106 is an arbitrary DNS server different from the DNS server A 103. As shown in Fig. 1, the client 101 can access the HTTP server 104 via either a route A 107 or a route B 108. Note that the route A 107 provides direct access, while the route B 108 provides access via the packet security system 102.

[0020] 2 is a system diagram showing an example of the operation of the network system. As shown in Fig. 2, the network system includes a web browser 111, a proxy 112, a packet security system 102, a DNS server A 103, an HTTP server 104, and a DNS server B 106.

[0021] The Web browser 111 queries the DNS server A 103 for IP address information as a domain resolution (S221) for the HTTP server 104. In response, the DNS server A 103 replies with the IP address of the packet security system 102, not the IP address of the HTTP server 104 (S222).

[0022] The Web browser 111 requests HTML content A141 from the packet security system 102 (S223), and the packet security system 102 transfers the request to the HTTP server 104 (S224), and receives a response of HTML content A141 from there (S225).The packet security system 102 then inspects this content and converts link information Link(B) to content B142 into Link(B)' (S201).

[0023] FIG. 3 is a flowchart showing an example of processing by the packet security system. After acquiring HTML content (S301), the packet security system 102 checks whether link information or an src file provided by the same server is included (S302). If included, it checks whether this information is registered in the database 306 as secure link or src file information (S303). If registered, the link information is converted into Base64 string information and replaced with the HTML content's identifying TLD (Top Level Domain) and SLD (Second Level Domain) (S304), such as <string information>.cloffload.exsecurity. Note that if src file information is included instead of link information, the src file information is restored as URL information and replaced in the same way. For example, if the src information is / videos / contentB, the URL is restored to the abbreviated host information, such as httpserverdomain / videos / contentB. The content is then sent as HTML content (S305).

[0024] In the example of HTML content A141 shown in FIG. 1, there are links to content B142 and content C143, but if only content B142 is registered in database 306, only Link (B) 144 will be rewritten by packet security system 102.

[0025] Now, returning to the explanation of the processing in Figure 2, the replaced HTML content is returned to the Web browser as HTML content A' (S226). The Web browser 111 first performs DNS resolution with the DNS server A 103 to obtain content B as the src file required for rendering from HTML content A' (S227). The DNS server A 103 determines that this query is for the converted domain (S202), and returns the address of the proxy 112 as the IP address (S228).

[0026] 4 is a flowchart showing an example of processing by DNS server A. After receiving a DNS resolution request (S401), address response unit 131 determines whether or not an identification TLD and SLD have been assigned (S402), and if an identification TLD and SLD have been assigned, it determines that the address of proxy 112 is the domain resolution result (S403), and if not, it performs normal domain resolution (S404). DNS server A transmits a response based on the result of the domain resolution (S405). In this example, which is a query about content B, an identification TLD and SLD have been assigned, so it determines that the query is for a converted domain.

[0027] Now, returning to the explanation of the processing in Fig. 2, the Web browser 111 then requests the content B and accesses the proxy 112 (S229). In the proxy 112, the inverse conversion unit 113 converts Link(B)' to Link(B) 144 (S203).

[0028] 5 is a flowchart showing an example of proxy processing. After receiving an HTTP request (S501), the inverse conversion unit 113 checks the URL information (S502). If an identifying TLD and SLD have been added, the Base64 character string information is inversely converted to restore the original URL information and replace it (S503). If not, no particular processing is performed. Then, the HTTP request is sent based on the original URL information (S504). In this case regarding content B, an identifying TLD and SLD have been added to Link(B)', so replacement is performed.

[0029] Now, let us return to the explanation of the processing in Fig. 2. The proxy 112 executes domain resolution to the DNS server B 106 (S230), and the DNS server B 106 responds with the address of the HTTP server 104 (S231). The proxy 112 acquires the content B 142 from the HTTP server 104 (S232), and the HTTP server 104 responds by sending the content B (S233). The proxy 112 transfers the content B 142 to the web browser (S234), and the content B 142 is acquired.

[0030] Meanwhile, the Web browser 111 requests content C143 in the same way as content B142 (S235). However, because this is provided in the domain of the HTTP server 104, the request is sent to the packet security system 102, whose address has already been resolved. The packet security system 102 transfers the request to the HTTP server 104 (S236) and acquires content C143 (S237). After the safety of content C143 is confirmed by the packet security system 102, it is transferred to the Web browser 111 (S238).

[0031] As described above, in the network system 100, the packet security system 102 obtains content from the HTTP server in response to a request from a client, checks the security of the content, and rewrites the secure link information contained in the content into character string information. This allows a request to be made to the HTTP server 104 without having to check the security of the secure link information again, thereby contributing to reducing the costs of security scan processing and communication volume.

[0032] (Application embodiment 1) 6 is a diagram showing a modified configuration example of a network system. As shown in Fig. 6, a network system 100 includes a client 101, a packet security system 102, a DNS server A 103, an HTTP server 104, a gateway 105, and a DNS server B 106.

[0033] In the configuration example of the network system shown in Fig. 1, the proxy 112 is incorporated into the device of the client 101, but in the configuration example of the network system shown in Fig. 6, the proxy 112 is incorporated into an external server (gateway 105) of the device of the client 101. However, the configuration example of the network system shown in Fig. 6 can also execute the processes shown in Fig. 2 to Fig. 5 in the same way as the configuration example of the network system shown in Fig. 1, and can enjoy the same effects as the configuration example of the network system shown in Fig. 1.

[0034] (Application embodiment 2) When the packet security system 102 converts link information, if the link information is large and the character string exceeds the domain length, the length of the character string to be rewritten can be kept short by treating the link information as URL path information.

[0035] (Application embodiment 3) In this disclosure, a method of converting to a domain part using BASE64 has been shown as a reversible conversion method, but any conversion method can be used as long as it is reversible. For example, if you want to keep the access destination secret, you can encrypt it using the content rewriting function 121 and decrypt it using the inverse conversion unit 113.

[0036] (Application embodiment 4) By adding information before converting link information, it becomes possible to acquire this information during decoding by the inverse conversion unit 113. For example, adding client user information or session ID information makes it possible to trace traffic.

[0037] (Application embodiment 5) The IP address of the resolution destination can be controlled by associating a unique TLD and SLD for each user or group, which are assigned by the packet security system 102. This makes it possible to select the destination IP address of the proxy to be used.

[0038] (Example of hardware configuration) Fig. 7 is a diagram showing an example of the hardware configuration of a packet security system. That is, the packet security system 102 makes it possible to realize each function of the packet security system 102 by executing the above-described packet security method as a program on an information processing device (computer) 30 employing the hardware configuration shown in Fig. 7. However, the example of the hardware configuration shown in Fig. 7 is an example of a hardware configuration that realizes each function of the packet security system 102, and is not intended to limit the hardware configuration of the packet security system 102. The packet security system 102 may include hardware not shown in Fig. 7.

[0039] As shown in FIG. 7, the hardware configuration that can be adopted by the packet security system 102 includes a CPU (Central Processing Unit) 31, a main memory device 32, an auxiliary memory device 33, and an IF (Interface) unit 34, which are interconnected by, for example, an internal bus.

[0040] The CPU 31 executes each command included in the distributed re-encryption program executed by the information processing device (computer) 30. The main storage device 32 is, for example, a RAM (Random Access Memory), and temporarily stores various programs, such as the distributed re-encryption program executed by the information processing device (computer) 30, for processing by the CPU 31.

[0041] The auxiliary storage device 33 is, for example, an HDD (Hard Disk Drive), and is capable of storing, for the medium to long term, various programs such as a packet security program executed by the information processing device (computer) 30. Various programs such as a packet security program can be provided as a program product recorded on a non-transitory computer-readable storage medium.

[0042] The IF unit 34 provides an interface for input and output of the packet security system 102, for example.

[0043] The information processing device (computer) 30 employing the above hardware configuration implements the functions of the packet security system 102 by executing the packet security method described above as a program.

[0044] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes. [Appendix 1] A packet security system having a content rewriting function that acquires content from an HTTP server in response to a request from a client, inspects the safety of the content, and rewrites safe link information contained in the content into character string information. [Appendix 2] 2. The packet security system according to claim 1, wherein the content rewriting function assigns an identifying domain name when rewriting the secure link information into character string information. [Appendix 3] 3. A packet security system according to claim 1, which has a database of link information whose safety has been confirmed, and determines the safety of the link information by referring to the database. [Appendix 4] a packet security system having a content rewriting function that acquires content from an HTTP server in response to a request from a client, inspects the safety of the content, and rewrites safe link information included in the content into character string information; a DNS server that responds to an inquiry about an IP address related to link information rewritten by the packet security system so that the HTTP server can be accessed without going through the packet security system; a proxy that reverse-converts the link information rewritten by the packet security system to restore the original link information, and then makes a content request based on the original link information; A network system comprising: [Appendix 5] The network system described in Appendix 4, wherein the DNS server and the proxy identify the link information rewritten by the packet security system using an identifying domain name assigned when the packet security system rewrites the link information. [Appendix 6] 6. The network system of claim 4, wherein the proxy is incorporated into the client device. [Appendix 7] 6. The network system according to claim 4 or 5, wherein the proxy is incorporated in an external server of the client device. [Appendix 8] A packet security method for acquiring content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information contained in the content into character string information. [Appendix 9] A packet security method according to claim 8, wherein a domain name for identification is added when rewriting the secure link information into character string information. [Appendix 10] A packet security program that causes a computer to execute a process of acquiring content from an HTTP server in response to a request from a client, inspecting the safety of the content, and rewriting safe link information contained in the content into character string information.

[0045] The disclosures of the above-cited patent documents and other documents are incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the claims), and further based on the basic technical concepts thereof. Furthermore, various combinations and selections (including partial deletions) of various disclosed elements (including elements of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally embraces various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure and technical concepts, including the claims. In particular, with regard to the numerical ranges set forth herein, any numerical value or subrange within that range should be construed as specifically set forth, even if not otherwise specified. Furthermore, the disclosures of the above-cited documents, when used in part or in whole in combination with the disclosures herein as part of the disclosure of the present invention, in accordance with the spirit of the present invention, are also deemed to be included in the disclosures of this application. [Explanation of symbols]

[0046] 100 Network Systems 101 Client 111 Web Browser 112 Proxy 113 Inverse conversion unit 102 Packet Security System 121 Content rewriting function 103 DNS Server A 131 Address Response Part 132 Domain Threat Level DB 104 HTTP Server 141 HTML Content A 142 Content B 143 Content C 105 Gateway 106 DNS Server B 107 Route A 108 Route B 306 Database 30 Information processing equipment 31 CPU 32 Main storage 33 Auxiliary storage device 33 IF Section

Claims

1. a packet security system having a content rewriting function that acquires content from an HTTP server in response to a request from a client, inspects the safety of the content, and rewrites safe link information included in the content into character string information; a DNS server that responds to an inquiry about an IP address related to link information rewritten by the packet security system so that the HTTP server can be accessed without going through the packet security system; a proxy that reverse-converts the link information rewritten by the packet security system to restore the original link information, and then makes a content request based on the original link information; A network system comprising:

2. 2. The network system according to claim 1, wherein the DNS server and the proxy identify the link information rewritten by the packet security system by using an identifying domain name assigned when the packet security system rewrites the link information.

3. 2. The network system according to claim 1, wherein the proxy is incorporated in the client device.

4. 2. The network system according to claim 1, wherein the proxy is incorporated in an external server of the client device.

5. A packet security method using a packet security system, a DNS server, and a proxy, comprising: The packet security system acquires content from an HTTP server in response to a request from a client, inspects the safety of the content, and rewrites safe link information included in the content into character string information; the DNS server responds to an inquiry about an IP address related to the link information rewritten by the packet security system in such a way that the HTTP server can be accessed without going through the packet security system; The packet security method in which the proxy reversely converts the link information rewritten by the packet security system to restore the original link information, and then makes a content request based on the original link information.

6. A packet security method as described in Claim 5, wherein the packet security system assigns an identifying domain name when rewriting secure link information into string information.

7. A packet security method as described in Claim 6, wherein the DNS server and the proxy use the identifying domain name to identify link information rewritten by the packet security system.

Images