Information processing system and information processing method

Abstract

To provide an effective countermeasure against online skimming.SOLUTION: A security management server 22 acquires information of one or more communication destinations related to communication occurring when displaying a page of a prescribed website (in Fig. 1, a website of an affiliated store) with a web browser. The security management server 22 generates a white list containing a communication destination to which the communication is permitted by a user controlling the page of the website from among the one or more communication destinations. When displaying the page of the website with the browser, if communication occurs, a user terminal 12 detects the communication destination. When the detected communication destination is not contained in the white list, the user terminal 12 executes a prescribed alert process.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to data processing technology, and more particularly to an information processing system and an information processing method. [Background technology]

[0002] Online skimming (also known as web skimming) is an attacking technique that involves tampering with web applications used on e-commerce (electronic commerce) sites and the like to fraudulently obtain payment information (e.g., credit card numbers) entered by users (see, for example, Non-Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Non-Patent Document 1] “What is Web Skimming? Meaning and Definition - IT Trending Terms”, [online], NTT Communications, [Retrieved November 2, 2021], Internet<URL:https: / / www.ntt.com / bizon / glossary / e-w / web-skimming.html> Summary of the Invention [Problem to be solved by the invention]

[0004] Online skimming can sometimes be caused by tampering with external JavaScript programs ("JavaScript" is a registered trademark) called by a company's web applications, and until now it has been difficult to take effective measures against such tampering that is beyond a company's control.

[0005] The present disclosure has been made in view of such problems, and one of its objectives is to provide an effective countermeasure against online skimming. [Means for solving the problem]

[0006] In order to solve the above problems, an information processing system of one embodiment of the present disclosure includes a communication destination information acquisition unit that acquires information on one or more communication destinations related to communication that occurs when a page of a specified website is displayed in a web browser; a whitelist generation unit that generates a whitelist indicating communication destinations from among the one or more communication destinations that are permitted for communication by a first user who manages the website page; a communication destination detection unit that detects the communication destination when communication occurs when a page of the website is displayed in the web browser; and an alert processing unit that executes a specified alert process if the communication destination detected by the communication destination detection unit is not included in the whitelist.

[0007] Another aspect of the present disclosure is an information processing method, which includes the steps of: acquiring information about one or more communication destinations related to communication that occurs when a page of a predetermined website is displayed on a web browser; generating a whitelist indicating, from the one or more communication destinations, communication destinations that are permitted by a first user who manages the website page; detecting a communication destination when communication occurs when the website page is displayed on the web browser; and executing a predetermined alert process if the communication destination detected in the detecting step is not included in the whitelist.

[0008] Any combination of the above components, or any expression of the present disclosure converted between an apparatus, a computer program, a recording medium storing a computer program, etc., is also valid as an aspect of the present disclosure. [Effects of the Invention]

[0009] The technology disclosed herein can provide an effective countermeasure against online skimming. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating a configuration of an information processing system according to an embodiment. [Figure 2] FIG. 2 is a block diagram showing functional blocks of the security management server of FIG. 1. [Figure 3] FIG. 10 is a diagram illustrating an example of scenario data. [Figure 4] FIG. 2 is a block diagram showing functional blocks of the user terminal of FIG. 1. [Figure 5] 10 is a flowchart showing the operation of the security management server. [Figure 6] FIG. 10 is a diagram illustrating an example of a whitelist setting screen. [Figure 7] 10 is a flowchart showing the operation of a user terminal. [Figure 8] 10 is a flowchart showing the operation of the security management server. [Figure 9] FIG. 10 is a diagram illustrating an example of an alert information screen. DETAILED DESCRIPTION OF THE INVENTION

[0011] The subject of the device or method of the present disclosure includes a computer. The computer executes a computer program to realize the functions of the subject of the device or method of the present disclosure. The computer includes, as its main hardware configuration, a processor that operates according to the computer program. The type of processor is not important as long as it can realize the functions by executing the computer program. The processor is composed of one or more electronic circuits including semiconductor integrated circuits (IC, LSI, etc.). The computer program is recorded on a non-transitory recording medium such as a computer-readable ROM, optical disk, or hard disk drive. The computer program may be pre-stored on the recording medium or may be supplied to the recording medium via a wide area communication network including the Internet.

[0012] In the embodiment, an information processing system that realizes effective countermeasures against online skimming is proposed. Online skimming is an attack in which, for example, a JavaScript program calls a communication API (Application Programming Interface) in the background while a web page is displayed, and the user's confidential information entered on the web page is transmitted to an external device illegally. In online skimming, the illegal communication is performed, for example, when a button on the web page is pressed, or, in the case of a keylogger, when data is entered into a text field or the like.

[0013] In the embodiment, the information processing system generates a whitelist containing communication destinations permitted by a first user who manages a web page of a website to be protected (hereinafter also referred to as a "protected site") when the web page is displayed. Then, when communication occurs when a web page of the protected site is displayed in a web browser, the information processing system detects the communication destination, and if the detected communication destination is not included in the whitelist, executes an alert process. This enables accurate detection of situations where online skimming is highly likely and supports countermeasures against online skimming.

[0014] In the embodiment, a first user who manages a web page of a protected site is referred to as a "site administrator," and a second user who inputs confidential information into the web page is referred to as a "site user." The web page of the protected site is, for example, a web page of an e-commerce site. The site user is, for example, a customer who intends to purchase a product on an e-commerce site. The confidential information of the site user can be considered attribute information about the site user that should be kept secret from third parties, and may include at least one of the site user's personal information, sensitive information, and information necessary for payment. For example, the confidential information may include at least one of the site user's name, gender, date of birth, address, telephone number, email address, account number, credit card number, debit card number, card expiration date, security code, and PIN.

[0015] FIG. 1 shows the configuration of an information processing system 10 according to an embodiment. The information processing system 10 includes a user terminal 12, an affiliated store server 14, an affiliated store terminal 16, a payment agent server 18, and a security management server 22. FIG. 1 also shows an attacker's information processing device (attacker device 20) that attempts to steal users' confidential information through online skimming. The devices in FIG. 1 are connected via a communication network that may include a LAN, a WAN, and the Internet.

[0016] The affiliated store server 14 is an information processing device that includes the functionality of a web server. The affiliated store server 14 stores web applications for websites (e.g., e-commerce sites) of affiliated stores (hereinafter simply referred to as "affiliated stores") such as credit card companies. The web applications include, for example, HTML files and JavaScript programs. The affiliated store server 14 provides the web applications for the affiliated store's website to the user terminal 12, thereby causing the user terminal 12 to display the web pages of the website.

[0017] The affiliated store terminal 16 is an information terminal operated by a site administrator of the affiliated store. The user terminal 12 is an information terminal operated by a site user. The affiliated store terminal 16 and the user terminal 12 may be a PC, a smartphone, or a tablet terminal.

[0018] The payment agent server 18 is an information processing device of a payment agent company that acts as an intermediary between credit card companies (which can also be called payment institutions) and affiliated stores. The payment agent server 18 works in conjunction with a device (not shown) of the credit card company to execute payment processing based on the confidential information (credit card number, etc.) of the site user transmitted from the user terminal 12.

[0019] The attacker device 20 is an information processing device to which the site user's confidential information stolen by online skimming is sent. In online skimming, for example, malicious code that communicates with the attacker device 20 is embedded in an external JavaScript program that is directly or indirectly called by a member store's web application, and the site user's confidential information entered on the member store's web page is fraudulently sent from the user terminal 12 to the attacker device 20.

[0020] The security management server 22 is an information processing device that executes processing to protect sites to be protected (in this embodiment, websites of affiliated stores) from online skimming. The configuration of the security management server 22 will be described in detail below.

[0021] Figure 2 is a block diagram showing the functional blocks of the security management server 22 in Figure 1. Each block shown in the block diagram in this specification can be realized in hardware terms using elements such as a computer processor (e.g., CPU) and memory, electronic circuits, and mechanical devices, and in software terms using computer programs, etc., but the functional blocks shown here are realized by the cooperation of these elements. Therefore, those skilled in the art will understand that these functional blocks can be realized in various ways by combining hardware and software. Furthermore, the functions of the multiple functional blocks shown in Figure 2 may be implemented in a single computer, or may be distributed across multiple computers.

[0022] The security management server 22 comprises a control unit 30, a storage unit 32, and a communication unit 34. The control unit 30 executes various data processing operations. The storage unit 32 stores data referenced or updated by the control unit 30. The communication unit 34 communicates with external devices in accordance with a predetermined communication protocol. For example, the control unit 30 transmits and receives data to and from the user terminal 12, the affiliated store server 14, and the affiliated store terminal 16 via the communication unit 34.

[0023] The storage unit 32 includes a scenario storage unit 36, a communication destination information storage unit 38, a whitelist storage unit 40, a test script storage unit 42, and an alert information storage unit 44.

[0024] The scenario storage unit 36 ​​stores scenario data for automating operations and data input on web pages of a site to be protected. The scenario data is determined taking into consideration screen transitions on the site to be protected (for example, transitions from (1) login page → (2) product selection page → (3) credit card information input page → (4) final confirmation page). In addition, multiple pieces of scenario data can be determined depending on the patterns of screen transitions, operations, and data input on the site to be protected.

[0025] Figure 3 shows an example of scenario data. The scenario data 60 in the figure contains code written in YAML (YAML Ain't Markup Language) that indicates the operation of entering the password "password1" on the screen and the operation of clicking the login button. In this way, the scenario data includes code that simulates the site user's operation on the web page of the protected site displayed in the web browser.

[0026] Returning to FIG. 2, the communication destination information storage unit 38 stores information on one or more communication destinations regarding communications that occur when a web page of a protected site is displayed in a web browser, the information being acquired by the crawler unit 46 described below.

[0027] The whitelist storage unit 40 stores whitelist data generated by the whitelist generation unit 50 (described later). The whitelist is a list that indicates communication destinations that are permitted by the site administrator of the protected site among communication destinations that occur when a web page of the protected site is displayed in a web browser. In other words, the whitelist is a list that excludes communication destinations that are not permitted by the site administrator among communication destinations that occur when a web page of the protected site is displayed in a web browser.

[0028] The inspection script storage unit 42 stores a JavaScript program (hereinafter also referred to as an "inspection script") for preventing online skimming, which is generated by the inspection script generation unit 52 described below. The inspection script is executed by the web browser of the user terminal 12 that displays the web page of the protected site. The inspection script monitors the communication that occurs when the web page of the protected site is displayed in the web browser, and detects the risk of online skimming. In the embodiment, the inspection script includes whitelist data. The function of the inspection script will be described later with reference to FIG. 4.

[0029] The alert information storage unit 44 stores alert information sent from the user terminal 12 as an alert process by the inspection script. The alert information includes, for example, the URL of the protected site (in other words, identification information of the affiliated store site), data sent in the fraudulent communication, destination information (location data, IP address, country name, data size, etc.), call stack data (IP address, country name, line position, etc. for each called destination), and attack code.

[0030] The control unit 30 includes a crawler unit 46, a setting screen providing unit 48, a whitelist generating unit 50, an inspection script generating unit 52, an inspection script providing unit 54, an alert information generating unit 56, and an alert information providing unit 58. A computer program implementing the functions of these multiple functional blocks may be installed in storage (such as the memory unit 32) of the security management server 22. The control unit 30 may be realized by a processor (such as a CPU) of the security management server 22. The processor of the security management server 22 may fulfill the functions of the multiple functional blocks by reading the computer program into main memory and executing it.

[0031] The crawler unit 46, which can also be called a communication destination information acquisition unit, detects communications that occur when a web page of a protected site is displayed in a web browser, and acquires information on one or more communication destinations related to the detected communications. The crawler unit 46 stores the information on one or more communication destinations in the communication destination information storage unit 38.

[0032] The setting screen providing unit 48 transmits data of a whitelist setting screen including information of one or more communication destinations stored in the communication destination information storage unit 38 to the affiliated store terminal 16, and displays the whitelist setting screen on the affiliated store terminal 16.

[0033] The whitelist generation unit 50 generates a whitelist including communication destinations permitted by the site administrator on the whitelist setting screen from among one or more communication destinations whose information is stored in the communication destination information storage unit 38. The whitelist generation unit 50 stores the data of the generated whitelist in the whitelist storage unit 40.

[0034] The inspection script generation unit 52 generates an inspection script (JavaScript program) including data of the whitelist stored in the whitelist storage unit 40. The inspection script generation unit 52 stores the generated inspection script in the inspection script storage unit 42.

[0035] The inspection script providing unit 54 executes processing to provide the inspection script stored in the inspection script storage unit 42 to the user terminal 12 that displays the web page of the protected site. For example, the inspection script providing unit 54 may directly transmit the inspection script to the user terminal 12 that displays the web page of the protected site. Alternatively, the inspection script providing unit 54 may transmit the inspection script to the affiliated store server 14 in advance, and the affiliated store server 14 may further provide the inspection script to the user terminal 12 that provides the web application of the protected site.

[0036] The alert information generation unit 56 receives unauthorized communication information transmitted from the user terminal 12 and generates alert information based on the unauthorized communication information. The alert information generation unit 56 stores the generated alert information in the alert information storage unit 44.

[0037] The alert information providing unit 58 transmits data of an alert information screen including the alert information stored in the alert information storage unit 44 to the member store terminal 16, and causes the member store terminal 16 to display the alert information screen.

[0038] Figure 4 is a block diagram showing functional blocks of the user terminal 12 in Figure 1. The user terminal 12 includes a control unit 70 and a communication unit 72. The control unit 70 executes various data processing operations. The communication unit 72 communicates with external devices according to a predetermined communication protocol. For example, the control unit 70 communicates with the affiliated store server 14, the attacker device 20, and the security management server 22 via the communication unit 72.

[0039] The control unit 70 includes a web browser unit 74. The control unit 70 may be realized by a processor (such as a CPU) of the user terminal 12. The web browser unit 74 may be realized by the processor of the user terminal 12 executing known web browser software including a JavaScript engine.

[0040] The web browser unit 74 includes a communication destination detection unit 76 and an alert processing unit 78. The communication destination detection unit 76 and the alert processing unit 78 are realized by the web browser unit 74 executing an inspection script provided by the member store server 14 or the security management server 22. In other words, the processing of the communication destination detection unit 76 and the alert processing unit 78 is executed by the web browser of a site user who inputs confidential information into the web page of a protected site.

[0041] The communication destination detection unit 76 monitors the occurrence of communication when the web browser unit 74 displays a web page of a site to be protected, and detects the communication destination when communication occurs.

[0042] The alert processing unit 78 executes a predetermined alert process when the communication destination detected by the communication destination detection unit 76 is not included in the whitelist in the inspection script.

[0043] As part of its alert processing, the alert processing unit 78 stores information about communications with destinations not included in the whitelist in a predetermined storage unit. In this embodiment, the alert processing unit 78 transmits unauthorized communication information to the security management server 22, thereby storing alert information based on the unauthorized communication information in the alert information storage unit 44 of the security management server 22.

[0044] Furthermore, as part of its alert processing, the alert processing unit 78 generates a JavaScript error object and stores, in a predetermined storage unit, information on the call history of one or more JavaScript programs (so-called stack traces) that is automatically recorded in the error object. In the embodiment, the alert processing unit 78 transmits unauthorized communication information including the above-mentioned call history information to the security management server 22, thereby storing alert information including the above-mentioned call history information in the alert information storage unit 44 of the security management server 22.

[0045] The operation of the information processing system 10 configured as above will now be described. 5 is a flowchart showing the operation of the security management server 22. Scenario data created in advance for each site to be protected is stored in the scenario storage unit 36 ​​of the security management server 22. Here, the operation relating to one site to be protected (hereinafter also referred to as the "affiliated store site") will be explained, but the operation relating to other sites to be protected is similar.

[0046] When the predetermined whitelist update condition is met (Y in S10), the crawler unit 46 of the security management server 22 automatically executes a process to display the web page of the affiliated store site in the web browser and inputs operations and data into the web page in accordance with the scenario data stored in the scenario storage unit 36. The whitelist update condition may be that a predetermined amount of time has passed since the last whitelist was created or updated, or that an explicit update request has been received from the administrator of the security management server 22 or the affiliated store site administrator.

[0047] The crawler unit 46 uses a known API hooking technique to monitor communications that occur when a web page of a member store site is displayed in a web browser. In this embodiment, the crawler unit 46 monitors calls to communication APIs by JavaScript programs (first-party scripts) loaded from the member store server 14 and JavaScript programs (third-party scripts) called directly or indirectly from the first-party scripts. The communication APIs include APIs related to WebSocket and APIs related to XMLHttpRequest.

[0048] The crawler unit 46 detects the occurrence of communication (in the embodiment, a call to a communication API) when one or more web pages of the affiliated store site are displayed in a web browser, and acquires information on one or more communication destinations related to the communication (hereinafter also referred to as "communication destination information"). The crawler unit 46 stores the communication destination information in the communication destination information storage unit 38 (S11). The communication destination information may include information passed as an argument to the communication API, or may include information transmitted to an external device via the communication API. For example, the communication destination information may include the domain name of the communication destination, the number of accesses (number of communications), the IP address, the country name, the time zone, coordinates, and the crawling date and time (the date and time when the communication destination information was collected). Part of the communication destination information (e.g., the IP address, the country name, the time zone, the coordinates, etc.) may be data acquired from an external database using the domain name of the communication destination as a key.

[0049] The setting screen providing unit 48 of the security management server 22 transmits data for a whitelist setting screen including one or more pieces of communication destination information stored in the communication destination information storage unit 38 to the affiliated store terminal 16, causing the affiliated store terminal 16 to display the whitelist setting screen (S12). Figure 6 shows an example of a whitelist setting screen. The whitelist setting screen 80 includes a communication destination information area 82 and a check area 84. The site administrator refers to the communication destination information set in the communication destination information area 82 and selects communication destinations with which communication is permitted in the check area 84.

[0050] 5, the whitelist generation unit 50 of the security management server 22 receives communication destination information selected by the site administrator on the whitelist setting screen, transmitted from the affiliated store terminal 16; in other words, communication destination information permitted by the site administrator. The whitelist generation unit 50 generates whitelist data including one or more pieces of communication destination information (domain names in this embodiment) permitted by the site administrator (S13). As a variation, the whitelist may include a host name (and port number) in addition to a domain name as communication destination information, or may include the FQDN (Fully Qualified Domain Name) of the communication destination.

[0051] The inspection script generation unit 52 of the security management server 22 generates inspection script data including the whitelist generated by the whitelist generation unit 50, and stores the inspection script data in the inspection script storage unit 42 (S14). If the whitelist update conditions are not met (N in S10), the processes of S11 to S14 are skipped.

[0052] Note that the processes of S11 to S14 are repeatedly executed each time the whitelist update condition is satisfied. For example, if the whitelist update condition is satisfied again after creating a whitelist (or inspection script) for the affiliated store site, the crawler unit 46 again acquires one or more pieces of communication destination information for the webpage of the affiliated store site. In other words, the crawler unit 46 acquires one or more pieces of communication destination information for the webpage of the affiliated store site multiple times.

[0053] The setting screen providing unit 48 presents a whitelist setting screen showing one or more pieces of communication destination information for the web pages of the affiliated store site acquired by the crawler unit 46 to the site administrator of the affiliated store terminal 16 multiple times. If there is a change in the communication destinations permitted by the site administrator, the whitelist generating unit 50 updates the whitelist to reflect the change. The inspection script generating unit 52 updates the inspection script to include the updated whitelist.

[0054] 7 is a flowchart showing the operation of the user terminal 12. In response to an operation by a site user, the web browser unit 74 of the user terminal 12 requests the affiliated store server 14 to provide a web application of the affiliated store site. The web browser unit 74 of the user terminal 12 receives the web application sent from the affiliated store server 14, and displays the web page of the affiliated store site on a display unit (not shown) based on the web application (S20).

[0055] Furthermore, the web browser unit 74 of the user terminal 12 reads the inspection script from the security management server 22 in accordance with the description of the web application sent from the affiliated store server 14. The web browser unit 74 of the user terminal 12 performs the functions of a communication destination detection unit 76 and an alert processing unit 78 by executing the inspection script.

[0056] The communication destination detection unit 76 of the user terminal 12 uses a known API hooking method to monitor communications that occur when a web page of the affiliated store site is displayed on the web browser unit 74. Specifically, the communication destination detection unit 76 monitors calls to communication APIs by JavaScript programs (first-party scripts) loaded from the affiliated store server 14 and JavaScript programs (third-party scripts) called directly or indirectly from the first-party scripts. The communication APIs include APIs related to WebSocket and APIs related to XMLHttpRequest.

[0057] When communication occurs when one or more web pages of the affiliated store site (e.g., a login page, a product selection page, a credit card information input page, or a final confirmation page) are displayed on the web browser unit 74 (Y in S21), the communication destination detection unit 76 of the user terminal 12 acquires the communication destination information (S22). The communication destination information may include data passed as an argument to the above-mentioned communication API, or may include data (transmission data) transmitted to an external device via the above-mentioned communication API. The transmission data may include the destination domain name, host name, and port number, and may further include confidential information of the site user (e.g., a credit card number required for payment, etc.).

[0058] The alert processing unit 78 of the user terminal 12, as a process executed by the API hook when a communication API is called, determines whether the communication destination information (in this embodiment, a domain name) acquired by the communication destination detection unit 76 matches any entry (in this embodiment, a domain name) in the whitelist (S23). If the two do not match, that is, if the detected communication destination is not an authorized communication destination (N in S24), the alert processing unit 78 transmits unauthorized communication information including the communication destination information acquired by the communication destination detection unit 76 to the security management server 22 (S25).

[0059] Furthermore, if the detected communication destination is not an authorized communication destination, the alert processing unit 78 generates a JavaScript error object as further processing executed by the API hook when the communication API is called. This error object records call stack information indicating the function call history. The call stack information includes, for example, information about the first JavaScript program that called the communication API (including the line position where it was executed, i.e., the position of the attack code), information about the second JavaScript program that called the first JavaScript program, information about the third JavaScript program that called the second JavaScript program, and so on.

[0060] If the communication destination information acquired by the communication destination detection unit 76 matches an entry in the whitelist, i.e., if the detected communication destination is an authorized communication destination (Y in S24), the process of S25 is skipped. In this embodiment, communication with the outside using the communication API is permitted regardless of whether the communication destination information acquired by the communication destination detection unit 76 matches an entry in the whitelist. A configuration for prohibiting communication with the outside will be described in a modified example below. If no communication occurs when the webpage of the affiliated store site is displayed, in other words, if a call to the communication API has not been detected (N in S21), the processes of S22 to S25 are skipped.

[0061] If the processing of the web page of the affiliated store site is completed (for example, the procedure for purchasing a product is completed) (Y in S26), the processing in this figure ends. If the processing of the web page of the affiliated store site is not completed (for example, the procedure for purchasing a product is not completed) (N in S26), the processing returns to S21, that is, the monitoring of the call of the communication API continues.

[0062] 8 is a flowchart showing the operation of the security management server 22. When unauthorized communication information transmitted from the user terminal 12 is received (Y in S30), the alert information generation unit 56 of the security management server 22 generates alert information based on the unauthorized communication information and stores the alert information in the alert information storage unit 44 (S31). The alert information provision unit 58 of the security management server 22 transmits data of an alert information screen in which the alert information stored in the alert information storage unit 44 is set to the affiliated store terminal 16 (S32). The affiliated store terminal 16 displays the alert information screen on the display unit. If unauthorized communication information is not received (N in S30), the processes of S31 and S32 are skipped.

[0063] 9 shows an example of an alert information screen. The alert information screen 90 includes, as alert information, the URL of the site to be protected (target site URL), data sent to the unauthorized communication destination, information about the unauthorized communication destination (destination information), call stack data, and attack code. The destination information includes location data (host name + domain name + port number) extracted from the sent data, the IP address searched based on the domain name, the country name, and the data size. The call stack information includes, for each called function, the IP address searched based on the domain name and the country name, as well as the line position of the executed code.

[0064] The attack code information is the JavaScript program that called the communication API, in other words, it indicates the attack code in the JavaScript program that performed the unauthorized communication. This JavaScript program is the JavaScript program that was last called in the call history indicated by the call stack data. The alert information screen 90 highlights the third line of the attack code location "attack.js" recorded in the error object. In FIG. 9, the third line is underlined as an example of highlighting. As a variation, the attack code line may be highlighted, displayed in a different color than the other lines, or displayed in larger font than the other lines.

[0065] The site administrator can check the alert information screen 90 to identify unauthorized communication destinations and the JavaScript programs that accessed those destinations, and take measures against tampering with first-party scripts or third-party scripts. Furthermore, if a communication destination displayed on the alert information screen 90 is one that should be permitted, the site administrator can request the security management server 22 to update the whitelist, and have the whitelist (inspection script) updated to permit communication with the communication destination displayed on the alert information screen 90.

[0066] According to the information processing system 10 of the embodiment, by detecting fraudulent communications that occur when displaying a webpage of a protected site and executing an alert process, online skimming can be accurately detected and countermeasures against online skimming can be supported. Furthermore, the information processing system 10 can support the site administrator of the protected site in taking appropriate measures against online skimming by presenting information (e.g., call stack information) regarding communications with communication destinations not included in the whitelist to the site administrator. Furthermore, by updating the whitelist of communication destinations in response to an explicit request or periodically, online skimming detection and countermeasure support can be continuously provided in response to environmental changes (e.g., changes in script call relationships) at the protected site.

[0067] The present disclosure has been described above based on examples. The contents described in the examples are merely examples, and it will be understood by those skilled in the art that various modifications are possible in the combination of the components and processing steps of the examples, and that such modifications are also within the scope of the present disclosure.

[0068] A first modified example will be described. Although not mentioned in the above embodiment, if the communication destination information acquired by the communication destination detection unit 76 of the user terminal 12 does not match an entry in the whitelist, the alert processing unit 78 of the user terminal 12 may temporarily suspend communication with the outside world as a process executed by the API hook when the communication API is called, and may ask the site user whether or not to continue communication with the unauthorized communication destination. For example, the alert processing unit 78 may display information about a communication destination not on the whitelist and pop up a screen (referred to here as a "selection receiving screen") that accepts a selection of whether or not to continue communication with this communication destination. The alert processing unit 78 may continue communication with the communication destination not on the whitelist or discontinue communication with the communication destination, according to the user's selection on the selection receiving screen.

[0069] As another example, if the communication destination information acquired by the communication destination detection unit 76 does not match an entry in the whitelist, the alert processing unit 78 may forcibly stop communication with a communication destination not on the whitelist without displaying the selection acceptance screen, in other words, without confirming with the site user, as a process executed by the API hook when the communication API is called. Alternatively, the alert processing unit 78 may be configured to continue communication with a communication destination not on the whitelist while providing alert information to the affiliated store terminal 16. Whether or not to present the selection acceptance screen to the site user, in other words, whether or not to allow the site user to decide whether or not to communicate with a communication destination not on the whitelist, may be determined by the affiliated store's site administrator, and may be switchable by the affiliated store's site administrator. For example, the inspection script generation unit 52 of the security management server 22 may include or exclude code for displaying the selection acceptance screen from the inspection script according to the setting made by the affiliated store's site administrator.

[0070] A second modified example will now be described. In the above embodiment, the alert processing unit 78 of the user terminal 12 compared the communication destination information acquired by the communication destination detection unit 76 with entries in a whitelist incorporated into the inspection script. As a modified example, the alert processing unit 78 may compare the communication destination information acquired by the communication destination detection unit 76 with entries in a whitelist stored in the whitelist storage unit 40 of the security management server 22. In other words, the alert processing unit 78 may communicate with the security management server 22 to confirm whether the communication destination detected by the communication destination detection unit 76 is authorized by the site administrator.

[0071] A third modified example will now be described. In the above embodiment, the processing of the communication destination detection unit 76 and the alert processing unit 78 was executed by the user terminal 12 (web browser unit 74). As a modified example, the processing of the communication destination detection unit 76 and the alert processing unit 78 may be executed by the security management server 22; in other words, the functions of the communication destination detection unit 76 and the alert processing unit 78 may be implemented in the security management server 22. The security management server 22 may periodically access protected sites and execute the processing shown in the flowchart of Figure 7. If the security management server 22 detects communication with a communication destination not included in the whitelist entries, it may provide alert information to the affiliated store terminal 16.

[0072] A fourth modification related to the third modification will now be described. The crawler unit 46 of the security management server 22 may further execute a check script to fulfill the functions of the communication destination detection unit 76 and the alert processing unit 78 when it automatically executes the process of displaying the web page of the affiliated store site in a web browser and inputting operations and data into that web page in accordance with the scenario data stored in the scenario storage unit 36. This makes it possible to detect communication with unauthorized communication destinations, making it easier to prevent online skimming, even if the web page of the affiliated store site is tampered with so that the check script is not called from the web page of the affiliated store site.

[0073] The crawler unit 46 of the security management server 22 may also include a check unit that checks the data on the webpage of the member store site. The check unit may search for code that calls an inspection script within the code on the webpage of the member store site, and may detect this if the code that calls an inspection script is not present in the code on the webpage of the member store site (for example, if the code has been deleted by an attacker). If the code on the webpage of the member store site does not contain code that reads an inspection script, the alert information providing unit 58 of the security management server 22 may send and display alert information to the member store terminal 16 indicating that the webpage of the member store site may have been tampered with. This can help quickly detect that the webpage of the member store site has been tampered with and quickly repair the webpage of the member store site.

[0074] A fifth modified example will now be described. As mentioned above, the alert information stored in the alert information storage unit 44 of the security management server 22 includes skimming information indicating data sent to an unauthorized destination not included in the whitelist, or data that was attempted to be sent to an unauthorized destination (for example, when the transmission was blocked). The skimming information includes information about the site user and information about the credit card used by the site user. For example, the skimming information may include the site user's name, gender, date of birth, credit card number, card expiration date, security code, etc.

[0075] The security management server 22 of this modified example may further include a skimming information providing unit. The skimming information providing unit may transmit skimming information associated with each affiliated store (e.g., a list of site user names and credit card numbers) stored in the alert information storage unit 44 to the affiliated store terminal 16 of each affiliated store for display. The skimming information providing unit may anonymize part of the skimming information provided to the affiliated store terminal 16. For example, the skimming information providing unit may provide to the affiliated store terminal 16 skimming information including a credit card number with some digits masked (e.g., values ​​other than the last four digits)

[0076] According to the fifth modification, it becomes easier to identify the information of site users or credit cards that have fallen victim to online skimming, and it becomes easier to limit the liability of affiliated stores for online skimming.

[0077] Any combination of the above-described examples and modifications is also useful as an embodiment of the present disclosure. A new embodiment resulting from a combination will have the combined effects of the combined examples and modifications. It will also be understood by those skilled in the art that the functions to be performed by each constituent element described in the claims can be realized by each component shown in the examples and modifications alone or in combination. [Explanation of symbols]

[0078] 10 Information processing system, 12 User terminal, 14 Member store server, 16 Member store terminal, 22 Security management server, 46 Crawler unit, 50 Whitelist generation unit, 76 Communication destination detection unit, 78 Alert processing unit.

Claims

1. a communication destination information acquisition unit that acquires information on one or more communication destinations regarding communications that occur when a page of a predetermined website is displayed on a web browser; a whitelist generation unit that generates a whitelist indicating communication destinations that are permitted to communicate by a first user who manages pages of the website, from among the one or more communication destinations; a communication destination detection unit that detects a communication destination when communication occurs when the page of the website is displayed on a web browser; an alert processing unit that executes a predetermined alert process when a communication destination detected by the communication destination detection unit is not included in the whitelist; A skimming information provider; Equipped with The alert processing unit stores, as the alert processing, information regarding communications with communication destinations not included in the whitelist in a predetermined storage unit, The information about the communication stored in the storage unit includes information about a credit card that was sent to a communication destination not included in the whitelist or that was about to be sent to a communication destination not included in the whitelist, the skimming information providing unit provides the first user with information regarding credit cards that have been sent to a communication destination not included in the whitelist or that have been attempted to be sent to a communication destination not included in the whitelist. Information processing system.

2. a communication destination information acquisition unit that acquires information on one or more communication destinations regarding communications that occur when a page of a predetermined website is displayed on a web browser; a whitelist generation unit that generates a whitelist indicating communication destinations that are permitted to communicate by a first user who manages pages of the website, from among the one or more communication destinations; a communication destination detection unit that detects a communication destination when communication occurs when the page of the website is displayed on a web browser; an alert processing unit that executes a predetermined alert process when a communication destination detected by the communication destination detection unit is not included in the whitelist; Equipped with the alert processing unit generates a JavaScript error object as the alert processing, and transmits information on call histories of one or more JavaScript programs included in the error object to a device that executes processing to protect the website from online skimming. Information processing system.

3. a communication destination information acquisition unit that acquires information on one or more communication destinations regarding communications that occur when a page of a predetermined website is displayed on a web browser; a whitelist generation unit that generates a whitelist indicating communication destinations that are permitted to communicate by a first user who manages pages of the website, from among the one or more communication destinations; a communication destination detection unit that detects a communication destination when communication occurs when the page of the website is displayed on a web browser; an alert processing unit that executes a predetermined alert process when a communication destination detected by the communication destination detection unit is not included in the whitelist; Equipped with the communication destination information acquisition unit automatically executes a process for displaying the website page on the web browser and an operation input for the website page in accordance with scenario data stored in a predetermined storage unit and including a code for simulating a user's operation on the website page displayed on the web browser, and acquires information on one or more communication destinations related to communications that occur when the website page is displayed on the web browser; Information processing system.

4. a communication destination information acquisition unit that acquires information on one or more communication destinations regarding communications that occur when a page of a predetermined website is displayed on a web browser; a whitelist generation unit that generates a whitelist indicating communication destinations that are permitted to communicate by a first user who manages pages of the website, from among the one or more communication destinations; a communication destination detection unit that detects a communication destination when communication occurs when the page of the website is displayed on a web browser; an alert processing unit that, when a communication destination detected by the communication destination detection unit is not included in the whitelist, transmits unauthorized communication information including information about the communication destination detected by the communication destination detection unit to a predetermined device, and continues communication with the communication destination not included in the whitelist; An information processing system comprising:

5. A server that performs processing to protect a predetermined website from online skimming; a user terminal that displays the page of the website in a web browser; Equipped with The server a communication destination information acquisition unit that acquires information on one or more communication destinations related to communications that occur when the page of the website is displayed on a web browser; a whitelist generation unit that generates a whitelist indicating communication destinations that are permitted to communicate by a first user who manages pages of the website, from among the one or more communication destinations; an inspection script generation unit that generates an inspection script including the whitelist; the user terminal includes a web browser; the web browser of the user terminal loads the inspection script from the server in accordance with the description on the page of the website, and executes the inspection script to perform the functions of a communication destination detection unit and an alert processing unit; the communication destination detection unit detects a communication destination when communication occurs when a page of the website is displayed on a web browser; the alert processing unit executes a predetermined alert process when the communication destination detected by the communication destination detection unit is not included in the whitelist, the server checks the code of the page of the website, and if the code of the page of the website does not contain a code for loading the inspection script from the server, sends alert information indicating that the page of the website may have been tampered with to a terminal of an administrator of the website; Information processing system.

6. the processes of the communication destination detection unit and the alert processing unit are executed by a web browser of a second user who inputs confidential information into the page of the website.

5. The information processing system according to claim 1.

7. the communication destination information acquisition unit acquires information on the one or more communication destinations for the page of the website a plurality of times; the whitelist generation unit presents information about the one or more communication destinations for the page of the website to the first user a plurality of times, and when the communication destinations permitted for communication by the first user are changed, reflects the change in the whitelist; 7. The information processing system according to claim 1.

8. acquiring information about one or more communication destinations regarding communications that occur when a page of a predetermined website is displayed on a web browser; generating a whitelist indicating destinations that are permitted to communicate with the one or more destinations by a first user who manages pages of the website; detecting a communication destination when communication occurs when displaying a page of the website on a web browser; a step of executing a predetermined alert process when the communication destination detected in the detecting step is not included in the whitelist; is executed by one computer or distributed across multiple computers, The step of executing the alert process includes storing, as the alert process, information regarding communications with communication destinations not included in the whitelist in a predetermined storage unit; The information about the communication stored in the storage unit includes information about a credit card that was sent to a communication destination not included in the whitelist or that was about to be sent to a communication destination not included in the whitelist, The one or more computers further perform a step of providing the first user with information about credit cards sent to or attempted to be sent to a destination not included in the whitelist. Information processing methods.

Images