JP2004120574A - Apparatus and method of filtering uniform resource locator - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an apparatus and a method of filtering uniform resource locators (URL) which realizes a filtering function as to whether a URL to connect by request from a client device is to be relayed or denied by effecting a filtering operation by a user name in a remote access without giving a trouble to a user for the client device using the Internet at an institution without a system manager in an enterprise or the like or in general homes. <P>SOLUTION: A user name U and an IP address P of the client device 1 are acquired by an authentication server 4 from a start event log and a stop event log included in an authentication log of a response record issued from the client device 1 in response to a user authentication request from the server 4, and transmitted to a data base server 5. The server 5 collates the received user name U against a user name U in a table prepared in advance according to a policy for authorizing connection or not defined for each of the user names U. Then it is determined whether the connection to the URL requested from the client device 1 is permitted. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a URL filtering device and a method for determining whether to relay or reject access from a client device to a URL database.
[0002]
[Prior art]
This type of conventional URL filtering system installs a database of URLs examined in advance inside or outside a proxy server capable of transmitting and receiving to and from a client device, and determines whether to relay or deny access of the client device. I have.
[0003]
In other words, the proxy server having a database in which data on whether or not to prohibit the connection for each URL is checked against the URL requested to be connected by the client device with the database, and the connection is not prohibited. Only in this case, the client device has a function of connecting to a desired URL.
[0004]
As a method for changing and managing filtering rules for each client device at this time, a method of setting a rule for each group using a user authentication function of a proxy server or the like, or a method of setting a host computer of the client device. A method of forming a group for each IP address has been adopted. In these cases, it is necessary to set a proxy on the client side (for example, see Non-Patent Document 1).
[0005]
[Non-patent document 1]
Published by Fujitsu Limited, "Firewall Dedicated Device, GeoStreamNetSheller / FW, Product Report," April 2001, page 5.
[0006]
[Problems to be solved by the invention]
However, in the above-described conventional URL filtering system, in order to enable filtering for a client device connected to a broadband such as a telephone line or ADSL, the client device needs to have a proxy server setting. Setting up the server was complicated. Then, if the setting of the proxy server is canceled while avoiding the complexity, the filtering operation does not function.
[0007]
There is also a method of using user-authenticated data, but this is actually impossible because there is no system that cooperates with a commonly used remote authentication (Remote Authentication Dial User Service) server. .
[0008]
Therefore, the present invention has been conceived in order to solve the problems of the above-mentioned conventional URL filtering system, and has been applied to a client device using the Internet in a corporation or a general home without a system administrator in a company or the like. By enabling a filtering operation with a user name at the time of remote access without making a user troublesome, a filtering function of relaying or rejecting a URL requested to be connected by a client device can be realized. It is an object to provide a URL filtering device and method.
[0009]
[Means for solving the problem]
In order to achieve this object, the invention according to claim 1 includes at least a gateway server capable of transmitting and receiving to and from a client device, a database server capable of transmitting and receiving to and from the gateway server, and an authentication server capable of transmitting and receiving to and from the client device. The URL filtering device, wherein the authentication server, based on the request of the gateway server, includes a start record included in an auth log of a response record issued from the client device in response to a user authentication request from the authentication server. A user name and an IP address of the client device are obtained from an event log and an end event log, and transmitted to the database server. The database server determines the user name received from the authentication server and a predetermined user name for each user name. Connection approval policy The client device checks the user name in the table created as described above and transmits a result of the connection to the URL requested to be connected by the client device to the gateway server, and the gateway server receives the result from the gateway server. It is characterized by executing a process based on the result of the connection being made.
[0010]
Here, the client device is a computer of a terminal that uses a URL service. The URL (Uniform Resource Locator) means a notation specified to use a service on a computer connected to the Internet, such as an access method to a computer that provides the service, a domain name, and the like. The disk path, file name, and the like are recorded.
[0011]
In the invention according to claim 2, in the database server, a primary table including a user name and an IP address corresponding to the user name, and a policy indicating a user name and a connection authentication permission / prohibition policy corresponding to the user name are provided. A user list table consisting of a policy name, a policy table consisting of the policy name and a plurality of prohibition categories corresponding to the policy name, and a request rejection URL database list that collects request rejection URLs corresponding to the prohibition category. It is characterized by having.
[0012]
According to a third aspect of the present invention, there is provided a URL filtering method including at least a gateway server capable of transmitting / receiving to / from a client device, a database server capable of transmitting / receiving to / from the gateway server, and an authentication server capable of transmitting / receiving to / from the client device. The database server stores, in a primary table capable of storing a set of a user name received from the authentication server and an IP address corresponding to the user name, an IP address of a client device newly requesting connection to a URL. If the same IP address already exists, the set of the existing IP address and the user name is deleted from the primary table, and the set of the IP address and the user name of the client device is changed to the primary address. The same IP address in the primary table. There If not, is characterized by directly adding a set of the IP address and the user name of the client device.
[0013]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, the configuration and operation of a filtering device according to an embodiment of the present invention will be described in detail with reference to the drawings.
[0014]
FIG. 1 is a conceptual diagram showing the configuration and operation of a filtering device according to an embodiment of the present invention. FIG. 2 is a functional block diagram of a database server which is one of the configurations of the filtering device according to the embodiment of the present invention.
[0015]
First, when a user accesses a desired URL from the client device 1 via the gateway server 3 on which the filtering module 2 is mounted, a user authentication request for requesting a user name U and a password from the authentication server 4 is made. Is made. Here, the gateway server 3 and the authentication server 4 receive the connection request to the URL from the client device 1 via the Internet via the modem M on the line receiving side.
[0016]
When the client device 1 responds to the user authentication request from the authentication server 4, a start event log and an end event log are recorded in the auth log of the authentication server 4. Next, a user name U and an IP address A are acquired as a set from the start event log and the end event log, and registered in the primary table 6 of the database server 5.
[0017]
The database server 5 has a primary table 6, a request rejection URL database table 7, a policy table 8, and a user list table 9.
[0018]
The user name U in the user list table 9 has a one-to-one correspondence with the user name U registered in the authentication server 4. Here, in the user list table 9, only a user name U for which filtering is to be effective exists.
[0019]
The policy table 8 has a plurality of prohibition categories C, C, C,... Corresponding to one policy name P, so that a policy of connection approval / disapproval can be set for each prohibition category C. I have. With this, when a plurality of users have the same connection approval / disapproval policy, only one type of setting may be performed, so that it is not necessary to set a connection approval / disapproval policy for each user.
[0020]
By associating the IP address A of the primary table 6 with the policy name P of the user list table 9 based on the same user name, the client device 1 that has passed the authentication of the authentication server 4 acquires the IP address A, and , The database server 5 determines whether or not the URL requested by the IP address A of the client device 1 is to be filtered, and the gateway server 3 receives the result. Then, the gateway server 3 returns a comment regarding the prohibition or permission of the connection to the client device 1.
[0021]
In this case, the setting of the policy name P, which means the connection approval / disapproval policy, can be changed for each user name U.
[0022]
When the user authentication of the authentication server 4 is completed, a start event occurs, and the user name U and the IP address A are added to the primary table from the start event log. Further, the end event does not occur unless the user performs a line disconnection process on the client device 1.
[0023]
Accordingly, when an accident such as a line failure used for connection of the client device 1 occurs, there may be a case where the end event does not exist. In this case, the user name U and the IP address A based on the end event log are generated. Cannot be deleted.
[0024]
Further, since the IP address assigned by the authentication server 4 to the connected client device 1 is randomly set each time, it can be said that there is almost no possibility that the same user is assigned the same IP address.
[0025]
Therefore, it is checked whether or not the user name U acquiring the same IP address A as when the start event occurred exists in the primary table 6, and if so, the user name U and the IP address A Is deleted, and the newly acquired user name U and IP address A are added to the primary table 6.
[0026]
As a result, even if an end event does not exist in the authentication server 4 due to a line failure or the like, the user name U and the IP address A used last time are used from the primary table 6 as in the case where the line is normally disconnected. Is deleted, so that even if the client device 1 (another user) having the same IP address and a different user name accesses the client device 1, the subsequent filtering operation is executed.
[0027]
Hereinafter, a more specific operation of the filtering device according to the embodiment of the present invention will be described in detail with reference to the drawings.
[0028]
FIG. 3 is a flowchart showing the processing between the authentication server and the database server after the remote user is authenticated.
[0029]
When the authentication processing of the client device 1 is performed by the authentication server 4, the authentication server 4 transmits the user name U and the IP address A to the database server 5, and the database server 5 transmits the user name U and the IP address A to the database server 5. Is acquired (step S1), it is determined whether or not the acquired IP address A is in the primary table 6 (step S2). If the result of the determination is that the IP address A exists in the primary table 6, the user name U paired with the IP address A is deleted from the primary table 6 (step S3). As a result of the determination, when the acquired IP address A does not exist in the primary table 6, the user name U and the IP address A are added to the primary table 6 as they are (step S4).
[0030]
When the line is disconnected abnormally, the authentication server 4 does not record the disconnection log, so that the user name U on the primary table 6 cannot be deleted from the disconnection log. Therefore, by the processing of steps S3 and S4, when a new user connects to the database server 5 via the gateway server 3, whether or not a user name U (another user) corresponding to the same IP address A exists. The user name U (another user) is deleted if it exists.
[0031]
Next, the database server 5 associates the newly added user name U with the policy name P meaning a policy of connection approval / disapproval (step S5).
[0032]
Therefore, a case where the client device 1 as a remote user has actually made a connection request to a desired URL will be described below.
[0033]
FIG. 4 is a flowchart showing the processing of the gateway server and the database server when accessing the URL from the client device.
[0034]
When the gateway server 3 receives the request from the client device 1 as a remote user and transmits the URL for which the connection was requested to the database server 5, the database server 5 requests the client device 1 specified by the IP address A to connect. The requested URL is obtained (step S11). Next, the database server 5 collates the primary table 6 to obtain a user name U corresponding to the IP address A (step S12), and stores the user name U in the user list table 9 of the database server 5. It is determined whether or not it exists (step S13). If the user name U is found in the user list table 9 as a result of the determination, whether or not the request URL is subject to the restriction based on the connection approval / disapproval policy is identified (step S14). As a result of the determination, if the user name U does not exist in the user list table 9, the gateway server 3 approves the request, relays the request to the request URL, and transmits the request URL to the browser of the client device 1 (step S15).
[0035]
Further, following the identification processing in step S14, it is determined whether the request URL is included in the restriction target (step S16). As a result of the determination, when the requested URL is included in the restriction target, the gateway server 3 notifies the client device 1 that the request URL is the restriction target, and denies access to the request URL (step S17). As a result of the determination, when the request URL is not included in the restriction target, the gateway server 3 approves the request, relays the request to the request URL, and transmits the request URL to the browser of the client device 1 (step S15).
[0036]
When the client device 1 completes the transmission / reception work with the request URL and the client device 1 terminates the transmission / reception with the request URL and executes the line disconnection processing, the database server 5 stores the user name of the client device 1 U and IP address A are acquired (step S6), and the acquired user name U and IP address A are deleted from primary table 6 (step S7).
[0037]
【The invention's effect】
As described above, according to the first aspect of the present invention, the authentication server, based on the request of the gateway server, stores the auth of the response record issued from the client device in response to the user authentication request from the authentication server. The user name and the IP address of the client device are acquired from the start event log and the end event log included in the log, and transmitted to the database server. The database server receives the user name received from the authentication server, The user name is collated with the user name in the table created in accordance with the determined connection approval / disapproval policy, and the result of whether or not the client device can connect to the requested URL is transmitted to the gateway server. Since processing is performed based on the connection availability result received from the server, Because of not using the user authentication function of the proxy server to not require the setting of the proxy server on the client device side. Therefore, the filtering operation is enabled by the user name at the time of remote access without making the user troublesome for a client device using the Internet in a corporation or a general home without a system administrator in a company or the like. Accordingly, a filtering function of relaying or rejecting a URL requested to be connected by the client device can be realized.
[0038]
According to the second aspect of the present invention, the database server indicates a primary table including a user name and an IP address corresponding to the user name, and a policy on whether the user name and the connection authentication corresponding to the user name are permitted. Since it has a user list table including a policy name, a policy table including a policy name and a plurality of prohibition categories corresponding to the policy name, and a request rejection URL database list collecting request rejection URLs corresponding to the prohibition category. From the relationship between the user name and the IP address in the primary table, the relationship between the user name in the user list table and the policy name, and the relationship between the policy name in the policy table and the prohibition category, a request rejection URL associated with the policy name Since the relationship between the client device and the client device that requested the connection is specified, So that Taringu function is performed.
[0039]
According to the invention described in claim 3, the database server newly connects to the URL in the primary table capable of storing a set of the user name received from the authentication server and the IP address corresponding to the user name. If the same IP address as the IP address of the client device that has made the request already exists, the set of the existing IP address and user name is deleted from the primary table, and the IP address and the user name of the client device are deleted. Is added to the primary table, and if the same IP address does not exist in the primary table, the set of the IP address and the user name of the client device is added as it is. Even if there is no event, the same as when the line was disconnected normally, Since the set of the user name U and the IP address A is deleted, even if a client device (another user) having the same set of the IP address and a different user name accesses the client device, Is performed.
[Brief description of the drawings]
FIG. 1 is a conceptual diagram showing the configuration and operation of a filtering system according to an embodiment of the present invention.
FIG. 2 is a functional block diagram of a database server which is one of the configurations of the filtering device according to the embodiment.
FIG. 3 is a flowchart showing processing of an authentication server and a database server according to the embodiment.
FIG. 4 is a flowchart showing processing of a gateway server and a database server when a URL is accessed from a client device according to the embodiment.
[Explanation of symbols]
Reference Signs List 1 client device 2 filtering module 3 gateway server 4 authentication server 5 database server 6 primary table (table)
7 Request rejection URL database table (table)
8 Policy table (table)
9 User list table (table)
A IP address C Prohibited category P Policy name U User name

Claims (3)

A URL filtering device comprising at least a gateway server capable of transmitting / receiving to / from a client device, a database server capable of transmitting / receiving to / from the gateway server, and an authentication server capable of transmitting / receiving to / from the client device,
The authentication server, based on a request of the gateway server, from a start event log and an end event log included in an auth log of a response record issued from the client device in response to a user authentication request from the authentication server. Obtain the user name and IP address of the client device and send them to the database server,
The database server compares the user name received from the authentication server with a user name in a table created in accordance with a connection approval / disapproval policy determined in advance for each user name, and issues a connection request from the client device. Transmitting the result of the connection to the existing URL to the gateway server,
The URL filtering device, wherein the gateway server executes a process based on a connection propriety result received from the gateway server. The database server includes: a primary table including a user name and an IP address corresponding to the user name; a user list table including a user name and a policy name indicating a connection authentication permission / prohibition policy corresponding to the user name; 2. A policy table comprising the policy name and a plurality of prohibition categories corresponding to the policy name, and a request rejection URL database list collecting request rejection URLs corresponding to the prohibition category. 2. The URL filtering device according to 1. A URL filtering method comprising at least a gateway server capable of transmitting / receiving to / from a client device, a database server capable of transmitting / receiving to / from the gateway server, and an authentication server capable of transmitting / receiving to / from the client device,
The database server stores, in a primary table capable of storing a set of a user name received from the authentication server and an IP address corresponding to the user name, an IP address of a client device newly requesting connection to a URL. If the same IP address already exists, the existing set of the IP address and the user name is deleted from the primary table, and the set of the IP address and the user name of the client device is replaced with the primary table. And when the same IP address does not exist in the primary table, a set of the IP address and the user name of the client device is added as it is.

Images