Communication system and computer program

Abstract

This communication system includes: a detection means for monitoring communication from a terminal within a management target area to outside the management target area and detecting a data transmission request; a determination means for determining whether monitoring target data is included in data to be transmitted by the communication in which the detection means detects the transmission request; an encryption means for encrypting the data determined to include the monitoring target data by the determination means; and a transmission means for transmitting the data encrypted by the encryption means.

Description

Communication System and Computer Program

[0001] The present invention relates to a communication system and a computer program for improving the security of important data.

[0002] In recent years, not only external attacks but also leakage incidents of important data such as customer information due to internal crimes have become social problems.

[0003] In order to prevent the leakage of important data, there are measures such as access restrictions on important data according to the user's authority (for example, Patent Document 1).

[0004] Japanese Patent Application Laid-Open No. 9-204330

[0005] However, simply imposing access restrictions on important data according to authority cannot prevent cases where an authorized user maliciously takes out important data. Furthermore, if the authority to impose access restrictions is usurped by a malicious attacker, the important data will leak out. Therefore, simply imposing access restrictions on important data according to authority is insufficient.

[0006] An object of the present invention is to reduce the possibility of leakage of important data and improve the security of important data.

[0007] In order to solve the above problems, a communication system according to the present invention includes: a detection unit that monitors communication from a terminal within a management target area to outside the management target area and detects a data transmission request; a determination unit that determines whether monitored target data is included in the data to be transmitted by the communication for which the detection unit has detected a transmission request; an encryption unit that encrypts the data determined by the determination unit to include the monitored target data; and a transmission unit that transmits the data encrypted by the encryption unit.

[0008] Further, the communication system according to the present invention is characterized in that the determination unit determines whether monitored target data is included in the data to be transmitted by performing determination using a pattern of a predetermined character string.

[0009] Furthermore, the communication system according to the present invention includes a holding means for holding decryption data for decrypting data encrypted by the encryption means, and a key transmission means for transmitting the decryption data when permission has been obtained from a user other than the user of the terminal.

[0010] In the communication system of the present invention, communication from a terminal within a managed area to outside the managed area is monitored, a data transmission request is detected, it is determined whether the data to be transmitted by the detected communication includes monitored data, the data determined to include monitored data is encrypted, and the encrypted data is transmitted. This allows for automatic encryption according to the data that the terminal intends to transmit, thereby reducing the possibility of leakage of important data and improving the security of important data.

[0011] A block diagram showing an example configuration of the communication system of Embodiment 1. A block diagram showing an example configuration of the monitoring server. A diagram showing an example of a judgment pattern. A diagram showing an example of a whitelist (WL). A diagram showing an example of a blacklist (BL). A flowchart showing an example of the monitoring server's processing. A flowchart showing an example of the monitoring client's processing. A diagram showing an example of a correspondence table stored in the key storage unit. A diagram showing an example of a login screen displayed on the management terminal. A diagram showing an example of a transmission management screen displayed on the management terminal.

[0012] Current encryption relies on the operator's discretion, meaning that data will not be encrypted if there is malicious intent or if the operator forgets to perform the operation. Furthermore, encrypting all data would encrypt data that does not need to be encrypted, resulting in an enormous processing burden. The following describes embodiments of the present invention, but the present invention is not limited thereto and can be modified as appropriate within the scope of the technical idea of ​​the present invention. (Embodiment 1) <Communication System Configuration> Figure 1 is a block diagram showing an example of the configuration of the communication system of Embodiment 1. This communication system monitors communication from user terminals 20 and 70 within the managed area A to outside the managed area A, and automatically encrypts and transmits the data if the data that user terminals 20 and 70 intend to send outside the managed area A includes monitored data.

[0013] Area A of the managed data includes, for example, areas within a company, each department within a company, or an organization such as a related company, where terminals capable of accessing the monitored data provided by the DB server 40 are installed. Area A of the managed data also includes areas that include, for example, the internal network 1 within an organization such as a company, and user terminals 70 connected via network 2 such as the Internet through a VPN (Virtual Private Network) or hosting service. Depending on the configuration of the internal network 1 and the use of hosting services, other servers or communication devices may be interposed between the user terminal 20 and the monitoring server 10. Area A of the managed data may also be set for each designated department within the organization (for example, each department or branch office). Monitored data refers to important data that would cause a serious incident if leaked externally, such as highly marketable personal information or customer data. Personal information is expressed in the form of a string of characters such as numbers with a regular pattern that can be judged by a human. Monitored data may also be defined for each area of ​​the managed data A. Details of the monitored data will be described later.

[0014] The internal network 1 is connected to, for example, a monitoring server 10 that monitors (determines and encrypts) communications from user terminals 20 to outside the internal network 1, a management terminal 30 used by administrators other than the users of user terminals 20, and a database (DB) server 40 that provides monitored data, etc. This communication system also includes, for example, a third-party terminal 50 outside the managed area A, and an external server 60 that provides services such as email services and cloud storage services.

[0015] The monitoring server 10 monitors communication from user terminals 20 within managed area A to areas outside managed area A. When it detects a data transmission request, if the data to be transmitted contains monitored data, it encrypts the data to be transmitted. Data can be transmitted via email, uploaded to a web server, etc., but the monitoring server 10 is configured to detect transmission requests regardless of the method. The monitoring server 10 also confirms with the administrator whether it is permissible to send the decryption key (decryption data) for the encrypted data. If permission is granted, it sends the decryption key (decryption data) and the information necessary for decryption to the third-party terminal 50 or external server 60 outside managed area A that sent the data.

[0016] User terminals 20 and 70 are composed of information processing devices such as personal computers and mobile information terminals, and can access monitored data provided by DB server 40 via, for example, business applications and web applications. User terminals 20 and 70 are also equipped with web browsers, email clients, etc., and can send data outside of managed area A. User terminal 70 is equipped with a monitoring client 71 that monitors communications. The monitoring client 71 monitors communications from managed area A to outside managed area A, and when it detects a data transmission request, it temporarily suspends the communication and requests the monitoring server 10 to confirm the data to be sent (determine whether the data to be sent contains predetermined monitored data). The monitoring client 71 also terminates the communication if it is not possible to communicate with the monitoring server 10. Note that user terminals 20 belonging to the internal network 1 may also be equipped with a monitoring client 71 similar to that of user terminal 70.

[0017] Figure 2 is a block diagram showing an example configuration of the monitoring server 10. This monitoring server 10 includes a communication monitoring unit 11 that detects communication requests from user terminals 20 etc. within a predetermined managed area A connected to the internal network 1 to outside the managed area A; a communication determination unit 12 that determines whether or not the data to be transmitted by the communication detected by the communication monitoring unit 11 contains data to be monitored; a key generation unit 13 that generates an encryption key (decryption data); a data encryption unit 14 that encrypts the communication data (data that has been determined to contain data to be monitored); a transmission unit 15 that transmits the data encrypted by the data encryption unit 14; a key storage unit 16 that stores decryption data etc.; a transmission management unit 17 that determines whether or not to transmit a key (decryption data) for decryption; and a Web server 18 that serves as an interface between the transmission management unit 17 and the management terminal 30.

[0018] The communication determination unit 12 determines whether or not the data to be transmitted contains monitored data, etc., according to predetermined determination criteria. When making a determination, it is possible that the data may be transmitted in an encoded form depending on the communication method. For example, in the case of email transmission, when the encoded data is decoded, numbers are also stored as strings. Therefore, the determination is made after decoding according to each encoding method. The determination criteria include, for example, patterns of strings such as regular numbers, such as highly marketable information such as personal information, contained in the communication data as shown in Figure 3 (determination patterns), and, for example, a correspondence table between the characteristics of the communication destination and whether or not communication is possible, as shown in Figures 4 and 5. In addition, each organization may add determination criteria that match the monitored data that it deems important.

[0019] In the example in Figure 3, the string matching pattern is defined by the following rules: - The string that indicates a match with any number is called a special character, "\d". A "matching string" that matches a specific pattern is constructed by combining a regular character such as "-" with a special character. - The matching string is constructed according to the regular expression as follows: - "3-digit number" → "\d\d\d" or "[\d]{3}" - "5-character string consisting of a number or a hyphen" → "[\d-]{5}" Here, for example, - [\d-] indicates a pattern that matches a number or a hyphen. - {5} indicates that the previous pattern is repeated 5 times. Specifically, in the example in Figure 3, it is defined as follows.・Postal code: A 3-digit number and a 4-digit number joined by a hyphen, or a 7-digit number: "\d{3}-\d{4}" "\d{7}" ・(Landline) telephone number: A string consisting only of numbers or numbers and hyphens, with 10 digits: "[\d-]{10}" ・Mobile phone number: A string consisting only of numbers or numbers and hyphens, with 11 digits: "[\d-]{11}" ・Bank account number: A string consisting only of numbers, hyphens, and spaces, with 4, 3, or 7 digits: "[\d]{4}-[\d]{3}-[\d]{7}" "[\d]{4} [\d]{3} [\d]{7}" ・Credit card number: A string consisting only of numbers or numbers and hyphens, or numbers and spaces, with 16 digits: "[\d]{16}" ``[\d]{4}-[\d]{4}-[\d]{4}-[\d]{4}'' ``[\d]{4} [\d]{4} [\d]{4}'' ・12 digits of My Number only, or three 4-digit numbers connected by a space symbol ``[\d]{12}'' ``[\d-\]{15}''

[0020] The communication determination unit 12 determines whether or not the data to be monitored is included based on whether or not the string contained in the data to be transmitted matches the determination pattern in Figure 3. That is, the communication determination unit 12 checks whether or not the string contained in the data to be transmitted matches all of the determination patterns in the list of determination patterns in Figure 3, starting from the top. If the communication determination unit 12 finds that multiple determination patterns are matched, for example, both "\d\d\d" and "\d\d\d\d", it determines that the longer determination string has been matched. Furthermore, various determination criteria can be used to determine the data to be monitored, and these criteria may be changed for each target string, but for example, it is possible to determine that the data to be monitored is included if two or more types of target strings are detected and two or more occurrences are found. Other possible criteria include "consider if two or more dates are detected as a date of birth" and "consider if two or more email addresses are found using regular expressions as personal information." Additionally, a determination criterion can be considered in which the data is determined to be monitored even if it is detected alone, for example, if it contains an 11-digit number including the unique numbers 090, 080, and 070. The rules used in the judgment criteria are examples of rules applicable to Japan as of March 2024, and will be modified as appropriate when applied outside of Japan or when string rules related to personal information change. The judgment criteria are not limited to the above examples. In other words, although important information differs from organization to organization, it is also possible to define the format of the data to be monitored, as described above, and make a judgment based on whether the strings in the data match the defined format. By determining whether the data to be sent contains data to be monitored according to such judgment criteria, it is not necessary to register information such as tags indicating that the data is important in advance for the purpose of judgment.

[0021] <Operation Overview> In this embodiment, the communication system combines the following six main processes to reduce the possibility of leakage of important data and improve the security of important data. The difficulty in deterring and preventing information leakage by members of an organization lies in the fact that communication operations themselves are extremely easy, and that operations cannot be immediately undone if an incorrect operation is performed. It also lies in the fact that it depends on the operations of the member performing the communication and the specific member who has the authority to approve the communication. 1. Detection of communication requests to areas outside of managed area A 2. Determination of the need for data encryption 3. Determination of whether communication is possible 4. Data encryption 5. Transmission of encrypted data 6. Transmission of information necessary for decryption (decryption data, etc.) In this embodiment, an example in which all six of the above processes are implemented will be described, but some may be omitted. These processes can reduce the possibility of leakage of important data and improve the security of important data.

[0022] <Detailed Operation of Monitoring Server 10> Figure 6 is a flowchart showing an example of the processing of the monitoring server 10. The communication monitoring unit 11 constantly monitors communications from user terminals 20 within the managed area A. In S11, when it detects a transmission request from the user terminal 20 to an area outside the managed area A, the communication determination unit 12 temporarily suspends the detected communication in the following S12. Then, in S13, the communication determination unit 12 determines whether or not the communication content contains data to be monitored based on the determination criteria. If the data to be monitored is not included, the communication determination unit 12 resumes communication in S16 and terminates the processing shown in Figure 6. If the data to be monitored is included, the communication determination unit 12 checks in S14 whether or not the communication destination (the destination to which the message is to be sent) is registered in the organization's communication destination list (for example, the whitelist (WL) that shows destinations to which transmission is permitted, as shown in Figure 4).

[0023] If the communication destination is registered in the whitelist (WL), the communication determination unit 12 instructs the key generation unit 13 to generate an encryption key in S18 and the data encryption unit 14 to encrypt the data using the encryption key. In the following S19, the communication determination unit 12 instructs the data encryption unit 14 to send the encrypted data from S18 to the transmission unit 15, and the process in Figure 6 ends. On the other hand, if the communication destination is not registered in the whitelist, the communication determination unit 12 instructs in S15 whether the communication destination is registered in the organization's communication blacklist (for example, the blacklist (BL) that shows destinations to which transmission is prohibited, as shown in Figure 5). If the communication destination is registered in the blacklist (BL), the communication determination unit 12 cancels the communication in S17, and the process in Figure 6 ends. If the communication destination is not registered in the blacklist, the communication determination unit 12 instructs the key generation unit 12 to generate an encryption key in S18 and the data encryption unit 14 to encrypt the data, and in S19, it sends the encrypted data, and the process in Figure 6 ends. Furthermore, the processing of S14 and S15 may be performed with S15 being checked first. Additionally, the processing of S15 may be executed before the processing of S13, so that if the communication destination is registered in the blacklist, the communication is canceled, and if the communication destination is not registered in the blacklist, the processing from S13 onwards is executed. This reduces the number of times the processing from S13 onwards is executed, thereby reducing the processing load.

[0024] <Operation in the case of user terminal 70> The process shown in Figure 6 may be started when the monitoring client 71 of the user terminal 70 detects a transmission request to an area outside of managed area A. When the monitoring client 71 detects a transmission request to an area outside of managed area A from the user terminal 70, it starts the process shown in Figure 7. In S21, when the monitoring client 71 detects a transmission request to an area outside of managed area A, it attempts to establish communication with the monitoring server 10 in the following S22. If it fails to establish communication (connection) with the monitoring server 10, the monitoring client 71 cancels the communication and terminates the process shown in Figure 7. At that time, the monitoring client 71 may notify the user of the user terminal 70 that it has canceled the communication. If the connection with the monitoring server 10 is successful, in S23, the monitoring client 71 temporarily suspends the detected communication, sends the data to be sent to the monitoring server 10, and requests confirmation of whether or not it contains data to be monitored. After this, the monitoring server 10 executes the processes from S13 onwards in Figure 6.

[0025] In the key generation and encryption process shown in S18 of Figure 6 above, the key generation unit 13 generates an encryption key, and the data encryption unit 14 encrypts the data. The key generation unit 13 generates a key for each piece of data to be transmitted, and generates a separate encryption key for each piece of data. The key storage unit 16 stores, for example, the "sender," "recipient," "subject," "body," and "decryption data" for each piece of data to be transmitted, as shown in Figure 8.

[0026] <Authorization Operation on the Sending Management Screen> On the monitoring server 10, as shown in Figure 2 above, the Web server 18 is in operation. When the management terminal 30 accesses the monitoring server 10 using a Web browser, the sending management unit 17 displays a login screen on the management terminal 30, for example, as shown in Figure 9. When the user (authorizer) of the management terminal 30 logs in using a pre-registered username (user ID, etc.) and password, the sending management unit 17 displays a list of emails awaiting sending permission on the management terminal 30, for example, as shown in Figure 10. The authorizer presses the "Send" button for the emails in the displayed list for which they authorize the sending of decryption data. This instruction to press the button is supplied to the sending management unit 17 via the Web server 18. In response, the sending management unit 17 instructs the sending unit 15 to send the decryption data to the recipient shown in Figure 8. Furthermore, to prevent the user who sent the data from granting permission, the transmission management unit 17 identifies the user according to the username entered on the login screen (Figure 9), and does not display emails awaiting permission from that user on the transmission management screen of the management terminal 30. This prevents the user who sent the data from granting permission.

[0027] <Sending the Key> As described above, for data for which permission has been obtained from the licensor, the transmission management unit 17 causes the transmission unit 15 to send the "decryption data". The following methods are possible for sending the decryption data. <In the case of HTTP communication> The data recipient registers authentication information in advance with the key (decryption data) provision site. The provision site verifies through authentication that the user who accesses the site is a legitimate data recipient and downloads the key after authentication. Alternatively, if the data recipient has registered an email address in advance, the provision site may send an email to the registered email address containing a URL for providing the key that includes a random token string, and provide the key when the user accesses the URL.

[0028] <For email> One possible method is to send an email with the key attached to the recipient. Another method is to send an email containing a URL for receiving the key that includes a random token string, and the user receives the key by accessing the URL.

[0029] As explained above, in this embodiment, by determining whether the data to be transmitted contains predetermined monitored data and encrypting it if it contains monitored data, the possibility of leakage of important data can be reduced and the security of important data can be improved. Furthermore, in this embodiment, the security of important data can be further improved by transmitting decryption data only when permission has been obtained from a user (administrator) different from the user who sent the data.

[0030] A...Managed area, 1...Internal network, 10...Monitoring server, 11...Communication monitoring unit, 12...Communication determination unit, 13...Key generation unit, 14...Data encryption unit, 15...Transmission unit, 16...Key storage unit, 17...Transmission management unit, 20, 70...User terminals, 30...Management terminal. 40...DB server, 50...Third-party terminal, 60...External server, 71...Monitoring client

Claims

1. A communication system comprising: detection means for monitoring communications from a terminal within a managed area to an area outside the managed area and detecting data transmission requests; determination means for determining whether the data to be transmitted by the communication for which the detection means detected a transmission request includes monitored data; encryption means for encrypting the data that the determination means has determined to include the monitored data; and transmission means for transmitting the data encrypted by the encryption means.

2. The communication system according to claim 1, characterized in that the determination means determines whether or not the data to be transmitted contains the monitored data by determining whether or not the data to be transmitted contains the monitored data by determining whether or not the determination means uses a predetermined pattern of strings.

3. The communication system according to claim 1 or 2, further comprising: a holding means for holding decryption data for decrypting the encrypted data; and a key transmission means for transmitting the decryption data when permission has been obtained from a user other than the user of the terminal.

4. The communication system according to claim 1 or 2, characterized in that the determination means blocks the communication when the destination of the transmission request is registered in a blacklist indicating destinations from which transmission is prohibited.

5. The communication system according to claim 1 or 2, characterized in that the determination means causes the encryption means to transmit the encrypted data to the transmission means when the destination of the transmission request is registered in a whitelist indicating destinations that are permitted to transmit.

6. The communication system according to claim 1 or 2, characterized in that a terminal within the managed area is provided with the detection means and a confirmation means that requests the determination means to confirm the data to be transmitted by the communication in which the detection means has detected a transmission request.

7. A computer program characterized by causing a computer to monitor communications from terminals within a managed area to those outside the managed area, to detect data transmission requests, to determine whether the data to be transmitted by the detected communication contains monitored data, to encrypt the data that has been determined to contain monitored data, and to transmit the encrypted data.

Images