JP2010134832A - Information processor and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processor capable of detecting presence of a malicious third party. <P>SOLUTION: The information processor includes a decoy data generating part (103) for generating a decoy data for inviting the third party of intercepting a data, to access specific equipment, and a scanner part (101) for transmitting the data including the decoy data. The decoy data generating part (103) generates the decoy data including at least decoy information attractive for the third party, and access information for inviting an access to the specific equipment allowing reference of the decoy information. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a technique for intercepting data and detecting the presence of a malicious third party who attempts unauthorized access using information included in the intercepted data.

  Currently, the number of users of the Internet is increasing, and the number of users who use electronic mail or the like as a means of communication is increasing.

  However, the present situation is that there is a malicious third party who intercepts data such as electronic mail and attempts unauthorized access using information contained in the intercepted data.

For this reason, as a technical document filed prior to the present invention, there is a document that discloses a technique for performing secret communication so that data cannot be intercepted by a third party (see, for example, Patent Document 1). Patent Document 1 discloses a technique for performing secret communication using the quantum correlation of a light beam pair with good quantum correlation.
Japanese Patent No. 3564489

  However, since it is unclear whether or not the quantum communication technology as in Patent Document 1 will spread to the market, the presence of a malicious third party is detected using the existing communication technology, and the third party's fraud The current situation is to prevent unwanted access.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide an information processing apparatus and program capable of detecting the presence of a malicious third party.

  In order to achieve this object, the present invention has the following features.

<Information processing device>
An information processing apparatus according to the present invention is an information processing apparatus that transmits data, and a heel data generation unit that generates heel data for directing a third party who intercepted the data to access a specific device; Transmission means for transmitting data including the bag data, and the bag data generating unit is provided with bag information that attracts interest to the third party and a specific device that can reference the bag information. The bag data including at least access information for access is generated.

<Program>
The program according to the present invention is a program to be executed by an information processing apparatus that transmits data, and generates spear data for directing a third party who intercepted the data to access a specific device. A data generation step and a transmission step for transmitting data including the bag data are executed by the information processing apparatus, and the bag data generation step includes the bag information that attracts the third party, The bag data including at least access information for accessing a specific device to which information can be referred to is generated.

  According to the present invention, it is possible to detect the presence of a malicious third party.

<Outline of communication system>
First, an outline of a communication system according to the present embodiment will be described with reference to FIG.

  The communication system of the present embodiment is configured by connecting the information processing apparatus 100, the mail server 200, the client PC 300, and the communication apparatus 400 via a network NW.

  The information processing apparatus 100 transmits mail to the mail server 200 and stores the mail in the mail server 200. A legitimate user uses the client PC 300 to access the mail server 200 and browse the mail stored in the mail server 200. As a result, a legitimate user can view the mail stored in the mail server 200.

  In the above-described communication system of the present embodiment, a malicious third party uses the communication device 400 to intercept a mail existing on the network NW and use the information included in the intercepted mail to illegally use it. May be accessed. For this reason, development of a system capable of detecting the presence of a malicious third party and preventing unauthorized access by the third party is considered necessary.

  In the communication system of the present embodiment, in order to solve the above-described problem, the information processing apparatus 100 creates trap data for directing a malicious third party to access the information processing apparatus 100, and the created dataメ ー ル Send mail including data to network NW. The wrinkle data is created including at least wrinkle information that is of interest to a malicious third party and access information for accessing the information processing apparatus 100 that can refer to the wrinkle information.

  As a result, when a malicious third party intercepts a mail containing trap data, he / she is interested in the trap information included in the trapped trap data, and the information processing device is based on the access information included in the trap data. It is possible to direct access to 100. As a result, it is possible to detect the presence of a malicious third party and prevent unauthorized access by the third party. Hereinafter, the communication system of the present embodiment will be described in detail with reference to the accompanying drawings.

<System configuration example of communication system>
First, a system configuration example of a communication system according to the present embodiment will be described with reference to FIG. FIG. 1 is a diagram illustrating a system configuration example of a communication system according to the present embodiment.

  The communication system of the present embodiment is configured by connecting the information processing apparatus 100, the mail server 200, the client PC 300, and the communication apparatus 400 via a network NW. Note that the communication mode of the network NW is not particularly limited, and any communication mode regardless of wired or wireless is applicable.

  The information processing apparatus 100 transmits mail to the mail server 200. The information processing apparatus 100 according to the present embodiment transmits a mail including bag data to the mail server 200. As a mail transmission method, for example, e-mail distribution can be mentioned. The trap data is information for allowing a third party (such as an eavesdropper or an attacker) who intercepts the mail to access the information processing apparatus 100 based on the trap data included in the email. An eavesdropper is a person who intercepts mail, and an attacker is a person who attacks an arbitrary device based on information included in the intercepted mail.

  The mail server 200 stores mail and has a function of a known mail server.

  The client PC 300 is a device used by a legitimate user who browses mail stored in the mail server 200, and has a known function.

  The communication device 400 is a device used by a third party (such as an eavesdropper or an attacker) who intercepts mail, and has a known communication function.

<Hardware configuration example of information processing apparatus 100>
Next, a hardware configuration example of the information processing apparatus 100 according to the present embodiment will be described with reference to FIG. FIG. 2 is a diagram illustrating a hardware configuration example of the information processing apparatus 100 according to the present embodiment.

  As shown in FIG. 2, the information processing apparatus 100 according to the present embodiment includes a system controller 110, a scanner 120, an image processing unit 130, a communication interface 140, an operation display unit 150, and an HDD 160. is doing.

  The system controller 110 controls the information processing apparatus 100, and includes a CPU 111, a ROM 112, and a RAM 113. For example, the CPU 111 reads a program from the ROM 112, the HDD 160, and the like, expands the read program on the RAM 113, and executes the program. In addition, the CPU 111 develops the image data input from the communication interface 140 on the RAM 113 and executes it.

  The scanner 120 performs image reading processing. The image processing unit 130 performs image processing. The communication interface 140 communicates with an external communication device. Note that the communication interface 140 is preferably composed of a wireless network adapter so that a third party can easily intercept mail. However, the communication interface 140 does not necessarily need to be wireless, and can be configured with a normal Ethernet (registered trademark) adapter. The operation display unit 150 displays information notified from the system controller 110 or notifies the system controller 110 of information input from the user. The HDD 160 stores various data and programs.

<Functional configuration of information processing apparatus 100>
Next, a functional configuration example of the information processing apparatus 100 according to the present embodiment will be described with reference to FIG. FIG. 3 is a diagram illustrating a functional configuration example of the information processing apparatus 100 according to the present embodiment.

  The information processing apparatus 100 of this embodiment includes a scanner unit 101, a storage unit 102, a bag data generation unit 103, a bag server unit 104, and a clock unit 105.

  The scanner unit 101 realizes a function of a known network scanner.

  The storage unit 102 stores various information.

  The eyelid data generation unit 103 implements a function for generating eyelid data.

  囮 Server unit 104 realizes a function of accepting access from a third party and recording third party information.

  The clock unit 105 realizes a function of measuring the current time.

<Processing operation of the scanner unit 101>
Next, the processing operation of the scanner unit 101 will be described with reference to FIG. The processing operation of a general network scanner will be omitted, and the processing operation when generating mail will be described.

  First, the scanner unit 101 generates a mail header for transmission to the mail server 200 (step S1).

  Next, the scanner unit 101 generates message part 1 (plain text) including bag data, and adds the generated message part 1 to the body part of the mail (step S2). A specific method for generating bag data will be described later. Next, the scanner unit 101 generates a message part 2 including scan data, and adds the generated message part 2 to the body part of the mail (step S3). The scan data is data obtained by performing a known image reading process.

  The scanner unit 101 encrypts the message part 1 including the trap data by an encryption method (plain text, scramble such as Base64, DES or the like) that can be easily decrypted by a third party. Further, the message part 2 including the scan data is encrypted by an encryption method (S / MIME or the like) that is difficult for a third party to decipher. As a result, the scanner unit 101 can create a mail in a format that allows a third party to decode only the part of the eyelid data, and can send the created mail to the mail server 200. As a result, only the information that can be leaked to the third party (the cocoon data) can be disclosed to the third party.

  Note that the encryption method is not limited to the encryption method described above, and can be partially encrypted even in an XML-based format such as SOAP. It is also possible to create.

<Processing operation of bag data generation unit 103>
Next, the processing operation of the eyelid data generation unit 103 will be described with reference to FIG. Based on the time information measured by the clock unit 105, the bag data generation unit 103 performs the following processing operation at midnight on the first day of each month to generate bag data.

  First, the eyelid data generation unit 103 reads the following template character string from the storage unit 102 (step A1).

<Template string>
http: / device IP address or host name: 18888 / administrator / confidencial / scandatafile / image.html? ID = admin? PASS = password string

  However, the “device IP address or host name” part and the “password character string” part are variable parts, and the other parts are fixed parts. The template character string is stored in the storage unit 102 in advance.

  Next, the heel data generation unit 103 generates a password character string (step A2). The method for generating the password character string is not particularly limited, and can be generated by applying a known method. In this embodiment, eight characters selected at random are used as a password character string.

  Next, the eyelid data generation unit 103 reads the device IP address or host name from the storage unit 102 (step A3). The device IP address or host name is the IP address or host name of the information processing apparatus 100 and is stored in the storage unit 102 in advance.

  Next, the bag data generation unit 103 combines the template character string, the password character string, and the device IP address or host name to generate bag data (step A4).

  Next, the eyelid data generation unit 103 stores the generated eyelid data in the storage unit 102 (step A5).

  In this way, the heel data generation unit 103 reads the template character string from the storage unit 102, and the part of “device IP address or host name”, which is the variation part of the template character string, and the part of “password character string” Then, the new character string acquired by the processing of steps A2 and A3 is synthesized, and new font data is generated and stored in the storage unit 102.

  Note that the above-described method of generating the eyelid data is merely an example, and the above-described eyelid data can be configured to be generated manually by the user. In addition, a plurality of patterns of wrinkle data are stored in advance in the storage unit 102, and the user arbitrarily selects the plurality of patterns of wrinkle data stored in the storage unit 102 manually, and the above-described wrinkle data is stored. It can also be constructed to generate.

  In the above embodiment, the generation of the cocoon data is performed once a month. However, the generation of the cocoon data does not have to be performed once, and the actual password policy is often updated once every six months. Therefore, it is also possible to construct so that the soot data is generated once every six months.

<Processing operation of 囮 server unit 104>
Next, the processing operation of the bag server unit 104 will be described with reference to FIGS.

  First, a processing operation for setting image data to be referred to by a third party will be described with reference to FIG.

  First, the bag server unit 104 determines the number of image data for disclosure using a random number (step B1). In the present embodiment, it is assumed that 3 is determined as the number of image data for disclosure.

  Next, 囮 server unit 104 searches for the image data of the search target month based on the public month parameter given to each image data (step B2), and the public month parameter given to the searched image data Is updated to 0 (step B3). For example, when searching for image data for March as image data for the search target month, the image data for March, which is the search target month, is searched based on the public month parameter 3. Then, the public month parameter assigned to the March image data obtained by the search is updated to 0.

  Next, the eaves server unit 104 selects image data at random for the number of image data for disclosure from among the image data for which the disclosure month parameter is 0 (step B4). In this embodiment, three pieces of image data for publication are selected at random.

  Next, the disclosure month parameter assigned to the selected selected image data is updated to the value of the corresponding month (for example, 3) (step B5).

  Next, the eaves server unit 104 sets the access right for the selected selected image data to be disclosed, and sets the access rights for the other remaining image data to be unlisted (step B6).

  Next, the eaves server unit 104 sets so that link information for linking to image data set for publication is included in image_list.html (step B7).

  The URL “image.html” included in the bag data of this embodiment is information that transitions to the login screen. When logging in from the login screen, the image data corresponding to image_list.html can be selected. It is constructed to transition to the selection screen. Therefore, by setting the image_list.html to include link information for linking to the image data set for publishing, the image data set for publishing can be selected from the image selection screen by a third party. It becomes possible to.

  In the present embodiment, image data simulating a scanned image of a confidential document is used as bag information. For this reason, for example, 36 patterns of image data are stored in the storage unit 102, and a maximum of 3 image data are set to be accessible from an external communication device at random for each month. Is set in an inaccessible state from an external communication device. Further, the three image data selected in step B4 are selected so that they are not accessible during the past 12 months.

  The reason why the image data is used as the wrinkle information is that the URL “scandatafile” is included in the URL. For this reason, when a template character string different from the template character string described above is applied, it is not necessary to use image data as the bag information, and arbitrary information can be used as the bag information.

  In this embodiment, 36 patterns of image data are stored in the storage unit 102. However, the image data need not be 36 patterns, and image data of an arbitrary pattern may be stored in the storage unit 102. Is possible. However, if the image data corresponding to the bag information is always the same, the image data may be perceived by the bag information and a third party. For this reason, it is preferable that the image data of a plurality of patterns is stored in the storage unit 102 and is constructed so as to dynamically change the image data used as the wrinkle information.

  The bag information preferably includes business performance information, new product information, confidential information, new technology information, personal information, and the like. As a result, it is possible to improve the probability of directing a third party who intercepted the mail to access the information processing apparatus 100.

  Next, a processing operation when a third party accesses the bag server unit 104 using the communication device 300 will be described with reference to FIG.

  First, a third party intercepts a mail that exists on the network NW using the communication device 300, and the trap data (URL: http: // device IP address or host name: 18888 / administrator / confidencial / The information processing apparatus 100 is accessed based on scandatafile / image.html).囮 server 104 displays a login screen on the display unit of communication device 300 when the URL of 2 data is accessed (step C1 / Yes) (step C2).

  The third party inputs admin as a user name (? ID) and inputs a password character string as a password (? PASS) from the login screen. The server 104 determines that the authentication is OK based on the user name and password input from the login screen and determines that the authentication is OK (step C3 / Yes), and displays the image selection screen on the display unit of the communication device 300. (Step C4). Whether or not the correct password has been entered is determined by whether or not the password character string entered as the password (? PASS) matches the password character string generated by the heel data generator 103 in step A2. . The image selection screen is a screen on which image data of link information destination included in image_list.html can be selected.

  In the present embodiment, since the image_list.html is set so that link information for linking to the three image data images1 to image3 set for publishing is selected, the three image data of image1 to image3 are selected. An image selection screen that can be displayed is displayed on the display unit of the communication apparatus 300.

  The third party selects image data from the image selection screen. The server 104 displays the selected image data (selected image) on the display unit of the communication device 300 when any image data is selected from the image selection screen (Step C5 / Yes) (Step S5 / Yes). C6).

  For example, when the image data corresponding to image1 is selected from the image selection screen, the bag server 104 displays the image data (selected image) corresponding to the image1 on the display unit of the communication apparatus 300.

  Note that the server 104 records information such as an HTTP request, an IP address, a MAC address, and a time when a third party accesses the information processing apparatus 100 using the communication device 300 in the storage unit 102, and the third party Records information in the storage unit 102 when the information processing apparatus 100 is accessed. As a result, the information processing apparatus 100 can identify the presence of a malicious third party who attempted unauthorized access using information obtained by intercepting e-mails, or grasp the behavior of the third party. Is possible.

  If it is determined that the authentication is OK (step C3 / Yes), the trap server 104 notifies the network administrator's device (not shown) of information indicating that a malicious third party has been detected. It is also possible to construct as follows.

  If the data (URL: http: // device IP address or host name: 18888 / administrator / confidencial / scandatafile / image.html) is sufficiently complex and the information on the URL is not disclosed, the server 104 Can be constructed to notify the network administrator's device of information indicating the detection of the presence of a malicious third party when the URL is accessed.

<Operation / Effect of Communication System of this Embodiment>
As described above, in the communication system according to the present embodiment, the information processing apparatus 100 includes the trap information (information such as image data) that is of interest to a malicious third party and the information processing device that can refer to the trap information. Generates 囮 data including at least the access information (IP address, host name, domain name, communication port number, etc.) for accessing 100, and sends the mail containing the generated 囮 data to the network NW To do. As a result, it is possible for a malicious third party to intercept the mail and to cause the information processing apparatus 100, which is a bag device, to access the mail based on the bag data included in the mail. As a result, the presence of a malicious third party can be detected and unauthorized access by the third party can be prevented.

  Further, the information processing apparatus 100 dynamically updates the wrinkle information included in the wrinkle data. As a result, it is possible to avoid a third party from perceiving that the trap data is trap.

  In addition, the information processing apparatus 100 preferably creates bag data including information suggesting that the bag information is stored in a bag device such as a database or a server. As a result, it is possible to make it seem that there is information attractive to the third party on the baggage device, and to improve the probability of directing the third party to access the baggage device. Further, it is possible to make it difficult for a third party to detect that the device storing the bag information is a bag device.

  In addition, the information processing apparatus 100 preferably creates bag data including information (information such as an access path, a URL, a user ID, and a password) that can change to a screen on which the bag information can be referred to. Thereby, after a third party accesses the information processing apparatus 100, it is possible to construct so that the third party can refer to the bag information after taking a plurality of steps. As a result, when a third party accesses the information processing apparatus 100, the third party is not immediately referred to the defect information, but the third party is referred to the defect information after taking a plurality of steps. It becomes possible to construct.

  Further, the information processing apparatus 100 records and manages information when the third party accesses the information processing apparatus 100 when the third party accesses the information processing apparatus 100 that is a saddle device. As a result, the information processing apparatus 100 can identify the presence of a malicious third party who attempted unauthorized access using information obtained by intercepting e-mails, or grasp the behavior of the third party. Is possible.

  The above-described embodiment is a preferred embodiment of the present invention, and the scope of the present invention is not limited to the above-described embodiment alone, and various modifications are made without departing from the gist of the present invention. Implementation is possible.

  For example, in the above embodiment, the mail including the bag data is transmitted. However, the transmission data is not limited to the mail, and the bag data can be included in various data. Further, the protocol for transmitting data is not particularly limited, and various protocols such as SMTP, FTP, and SOAP can be applied.

  In the above embodiment, the information processing apparatus 100 is configured to include the scanner unit 101, the bag data generation unit 103, and the bag server unit 104. However, the information processing apparatus 100 transmits transmission data including bag data. It is also possible to construct the transmission function (scanner unit 101, bag data generation unit 103) and the access function (bag server unit 104) that accepts third-party access to be provided in separate information processing apparatuses. .

  However, a transmission function (scanner unit 101, 囮 data generation unit 103) that transmits transmission data including 囮 data and an access function (囮 server unit 104) that accepts third-party access are provided in separate information processing apparatuses. When constructed so as to be provided, it is necessary to construct so that information managed by each information processing apparatus can be synchronized.

  In the above embodiment, the information processing apparatus 100 includes the scanner unit 101 and has a known network scanner function. However, the information processing apparatus 100 can communicate with devices on the network. For example, it is not necessary to provide a network scanner function. However, the information processing apparatus 100 is preferably a device that regularly transmits transmission data in order to transmit transmission data including bag data.

  In order to prevent a third party from perceiving that the information processing apparatus 100 is a saddle device, it is constructed so as to have other functions (network scanner function) as in the above-described embodiment, It is desirable to be configured to transmit transmission data including 囮 data.

  In addition, the control operation in each device configuring the communication system in the present embodiment described above can be executed using hardware, software, or a composite configuration of both.

  In the case of executing processing using software, it is possible to install and execute a program in which a processing sequence is recorded in a memory in a computer incorporated in dedicated hardware. Alternatively, the program can be installed and executed on a general-purpose computer capable of executing various processes.

  For example, the program can be recorded in advance on a hard disk or ROM (Read Only Memory) as a recording medium. Alternatively, the program can be stored (recorded) temporarily or permanently in a removable recording medium. Such a removable recording medium can be provided as so-called package software. Examples of the removable recording medium include a floppy (registered trademark) disk, a CD-ROM (Compact Disc Read Only Memory), an MO (Magneto optical) disk, a DVD (Digital Versatile Disc), a magnetic disk, and a semiconductor memory.

  The program is installed in the computer from the removable recording medium as described above. In addition, it is wirelessly transferred from the download site to the computer. In addition, it is transferred to the computer via a network by wire.

  In addition, the communication system in the present embodiment is not only executed in time series according to the processing operation described in the above embodiment, but also the processing capability of the apparatus that executes the processing, or in parallel or individually as required. It is also possible to build to run on

  The present invention is applicable to services that require security.

It is a figure which shows the system configuration example of the communication system of this embodiment. It is a figure which shows the hardware structural example of the information processing apparatus 100 of this embodiment. It is a figure which shows the function structural example of the information processing apparatus 100 of this embodiment. It is a figure which shows the processing operation example of the scanner part 101 of this embodiment. It is a figure which shows the processing operation example of the eyelid data production | generation part 103 of this embodiment. It is a figure which shows the example of a processing operation of the bag server part 104 of this embodiment. It is a figure which shows the example of a processing operation of the bag server part 104 of this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Information processing apparatus 200 Mail server 300 Communication apparatus 101 Work amount acquisition part 110 Controller 111 CPU
112 ROM
113 RAM
120 Scanner 130 Image Processing Unit 140 Communication Interface 150 Operation Display Unit 160 HDD
101 Scanner unit (transmission means)
102 storage unit 103 囮 data generation unit 104 囮 server unit 105 clock unit

Claims (5)

An information processing apparatus that transmits data,
囮 data generation means for generating 囮 data for directing a third party who intercepted the data to access a specific device;
Transmission means for transmitting data including the bag data,
The bag data generating means
An information processing apparatus that generates the wrinkle data including at least wrinkle information that is of interest to the third party and access information for accessing a specific device that can be referred to by the wrinkle information . The transmission means includes
The information processing apparatus according to claim 1, wherein the data is transmitted by including the bag data in a format readable by the third party. The bag data generating means
The information processing apparatus according to claim 1, wherein the wrinkle data is generated in a format that allows transition to a screen on which the wrinkle information can be referred to. The specific device is the information processing apparatus;
The information processing apparatus according to claim 1, further comprising a storage unit that records information about the third party who has accessed the information processing apparatus. A program to be executed by an information processing apparatus that transmits data,
囮 data generation step for generating 囮 data for directing a third party who intercepted the data to access a specific device;
Transmitting the data including the bag data to the information processing apparatus,
The soot data generation step includes:
A program that generates the wrinkle data including at least wrinkle information that is of interest to the third party and access information for accessing a specific device that can be referred to by the wrinkle information.

Images