CN103080961A

CN103080961A - Method for detecting and preventing illegal transactions in electronic commerce and system therefor

Info

Publication number: CN103080961A
Application number: CN2011800012817A
Authority: CN
Inventors: 郑澈宇
Original assignee: Interez Inc
Current assignee: Hi Tek Polymers Inc
Priority date: 2011-07-29
Filing date: 2011-07-29
Publication date: 2013-05-01
Also published as: WO2013018940A1; KR20130013877A; KR101288103B1

Abstract

A method for preventing illegal transactions in an illegal electronic commerce system for preventing illegal transactions in electronic commerce comprising an electronic commerce web server and an illegal transactions prevention server, includes the steps of: driving an information collection agent when a user terminal executes a dedicated application using a service provided from the electronic commerce web server; connecting the information collection agent with an illegal transaction prevention server through a first communication channel to acquire licensed connection information and/or policy information, and transferring a blocking event to the dedicated application according to the corresponding policy information to determine whether the service is blocked using the electronic commerce web server; and transmitting the collected information and the dedicated connection information for the user terminal through a second communication channel to the electronic commerce web server so as to transmit the collected information and the dedicated connection information for the user terminal.

Description

The black detection of ecommerce and blocking method and system

Technical field

The present invention relates to a kind ofly survey in real time and interdict black method and system in ecommerce.

Background technology

Along with the development of the Internet and Internet user's increase, a lot of enterprises, public institution and financing corporation utilize other server for website service or service-specific, give client various and easily service.

Along with the black increase of in the E-business service of using the Internet, disliking with the anonymity of the Internet, need anti-here thing, therefore prior art is just used merely and is collected, storage and analyze link information or the statistical information of user terminal (PC etc.) information is so that survey in the mode of afterwards batch processing and interdict illegal transaction.

But illegal transaction person dislikes and uses this time difference, perhaps attempt circuitous the connection or the more intelligent ecommerce illegal transaction of the adulterium of user terminal information etc., so being injured of industry increases gradually.

Summary of the invention

The user that the present invention utilizes ecommerce for the E-business service with safety offers or the enterprise that E-business service is provided survey in real time and interdict black method and system and provide.

Simultaneously, the present invention is for the circuitous connection impact of the acting server of not giving user terminal or VPN etc., utilizes the NAT IP address of user terminal and determines whether interdict, so will the stand-by period be down to minimum.

And user terminal is accepted before the specific service by actual e-commerce website server, and the present invention can determine whether to interdict and whether being injured of user be taken precautions against in possible trouble.

It is a kind of based on comprising that e-business network site server and illegal transaction prevent the black method of blocking of the ecommerce illegal transaction interrupting system of server that one aspect of the present invention can provide.

One embodiment of the present of invention can provide based on comprising that e-business network site server and illegal transaction prevent the black method of blocking of the ecommerce illegal transaction interrupting system of server, comprise that (a) user terminal is connected in this e-business network site server, and the Information gather agent that is provided is installed; (b) this user terminal is for the service that utilizes this e-business network site server and provide and carry out vertical application so that drive this Information gather agent, is connected in by this Information gather agent and by the first communication port then that this illegal transaction prevents server so that at least one in access authentication link information and the policy information; (c) this user terminal will be communicated to this vertical application according to the blocking event of this policy information that obtains so that whether decision serves by the blocking of this e-business network site server; (d) this Information gather agent that drives in this user terminal will be sent to this e-business network site server for collection information and this authentication link information of this user terminal by the second communication passage; And (e) this e-business network site server login resume of connecting of user terminal according to this, this collection information and this authentication link information are sent to this illegal transaction and prevent server, wherein, this illegal transaction prevents this authentication link information of server by utilizing and will be sent to user terminal according to the policy information whether blocking serves.

This first communication port is socket safety traffic passage, and this second communication passage is the parcel communication port, and this authentication link information is NAT IP address.

This Information gather agent can comprise the user of this user terminal install under agreeing the signature mode of rear drive and not this user agree process and the non-signature mode that drives.

This signature mode is in order to drive the ActiveX mode, NPAPI mode, any one the signature mode operational code plug-in unit in the Java Applet mode and the script command of programming.

Should (b) step further comprise, before access authentication link information and policy information, this Information gather agent exhalation socket connect and confirm that by this first communication port this illegal transaction prevents the communications status of server, and if the state that can communicate by letter can obtain this authentication link information and policy information.

This Information gather agent will be passed on the H DATA of parcel or V DATA to be sent to this illegal transaction with server by this first communication port and prevent server, and prevent server access authentication link information with response to this from this illegal transaction.

Utilize VPN if this user terminal is set to, this Information gather agent is by the VPN virtual ethernet, and by actual Ethernet, should transmit parcel and be sent to illegal transaction and prevent server.

Another aspect of the present invention provides a kind of and has comprised the e-business network site server and prevent the illegal transaction server, and the black ecommerce illegal transaction interrupting system of blocking user terminal.

One embodiment of the present of invention provide based on comprising that e-business network site server and illegal transaction prevent the ecommerce illegal transaction interrupting system of server, service in order to utilize this e-business network site server to provide is provided, when the vertical application that is mounted or browser are driven by the user, this ecommerce illegal transaction interrupting system activation bit is collected the agency, then will transmit that parcel is sent to that this illegal transaction prevents server so that access authentication link information and policy information by this Information gather agent and by the first communication port, and in order to be communicated to the user terminal that this vertical application is controlled according to this policy information blocking event; And according to the collection of letters of this transmission parcel of this Information gather agent that is driven by this user terminal, respond the authentication link information of extracting this user terminal out with this, then analyze this authentication link information and with the policy data that are stored in database relatively, then will generate according to the policy information whether blocking of this user terminal serves, and prevent server by the illegal transaction that this first communication port is communicated to this collection agency, wherein, determine whether to interdict the service use that provides in this e-business network site server according to this vertical application of this blocking event.

This Information gather agent will be sent to this e-business network site server by the second communication passage by the authentication link information of this first communication port acquisition and the information of collecting for this user terminal.

Other aspects and advantages of the present invention will partly be set forth in the following description, and partly will be apparent by this description, perhaps can know by implementing the present invention.

Describe the present invention below in conjunction with the drawings and specific embodiments, but not as a limitation of the invention.

Description of drawings

Fig. 1 is the block scheme according to the detection of the first embodiment of the present invention and the black system of blocking ecommerce.

Fig. 2 illustrates the information category to classify for kind and the collection mode of the information of collection according to an embodiment of the invention.

Fig. 3 illustrates when using VPN in the collection information according to an embodiment of the invention, obtains the scheme of original authentication IP.

Fig. 4 be illustrate according to an embodiment of the invention real-time detection and blocking technology for black Policy Model and usability methods and disposal route.

Fig. 5 illustrates because application method and the screen of each one security service " the special-purpose PC specified services of ecommerce " of the additional client who provides of the present invention and " overseas IP blocking service ".

Fig. 6 is the process flow diagram that illustrates for application process and the actual system that realizes of Fig. 5.

Fig. 7 is the example that illustrates for the system architecture of service that Fig. 5 is provided.

Fig. 8 is according to the detection of second embodiment of the present invention and the black block scheme of blocking ecommerce.

Embodiment

Because the present invention allows multiple change and a large amount of embodiments, therefore with shown in the drawings and in written description, describe specific embodiment in detail.Yet this also is not used in the enforcement that the present invention is limited to AD HOC, and can expect, the institute that does not deviate from spirit of the present invention and technical scope changes, equivalent and replacement include in the present invention.In description of the invention, when the specific details of correlation technique is considered to and may unnecessarily blurs in the situation of essence of the present invention, it will be left in the basket.

Although the term as " first " and " second " etc. can be used for describing Various Components, such element is not necessarily limited to above-mentioned term.Above-mentioned term only is used for element of difference and another element.

The term that uses in the present invention only is used for describing specific embodiment, and is not used in restriction the present invention.The expression of odd number comprises plural number (a plurality ofs') expression, unless it has clear and definite different implication in context.In this application, should be appreciated that, be used for being illustrated in the existence of feature, quantity, step, action, element, parts or its combination that instructions discloses such as the term of " comprising " or " having " etc., get rid of one or more other features, quantity, step, action, element, parts or it is in conjunction with the possibility that may exist or increase and be not used in.

Below, with reference to the accompanying drawings to describing in detail according to certain embodiments of the invention.Fig. 1 is the block scheme according to the detection of the first embodiment of the present invention and the black system of blocking ecommerce; Fig. 2 illustrates the information category to classify for kind and the collection mode of the information of collection according to an embodiment of the invention; Fig. 3 illustrates when using VPN in the collection information according to an embodiment of the invention, obtains the scheme of original authentication IP; Fig. 4 be illustrate according to an embodiment of the invention real-time detection and blocking technology for black Policy Model and usability methods and disposal route; Fig. 5 illustrates because application method and the screen of each one security service " the special-purpose PC specified services of ecommerce " of the additional client who provides of the present invention and " overseas IP blocking service "; Fig. 6 is the process flow diagram that illustrates for application process and the actual system that realizes of Fig. 5; Fig. 7 is the example that illustrates for the system architecture of service that Fig. 5 is provided.

With reference to Fig. 1, survey and the black system of blocking ecommerce (for the facility understanding and illustrate hereinafter referred to as " ecommerce illegal transaction detection and interrupting system ") can comprise user terminal 100, e-business network site server 200 and illegal trade preventing system 300.

User terminal 100 is in order to accept to be connected in by communication network the device of various service that e-business network site server 200 provides.Wherein, the service that provides in order to accept this e-business network site server 200, user terminal 100 can be downloaded from this e-business network site server 200 and at least one is installed is the application program installation file of a plurality of information.

For the facility of understanding and illustrating, claiming this user terminal 100 to download the application program for a plurality of informations of installing by this e-business network site server 200 in instructions is Information gather agent.

And the various service of user terminal 100 in order to utilize this e-business network site server 200 to provide can download at least one other vertical application and be installed on this user terminal 100.For example, vertical application can be the HTS (Home Trading System) for security exchange.No doubt, in addition, vertical application can be applicable to the other application program in order to utilize specific service that this e-business network site server 200 provides to install samely.

Simultaneously, Information gather agent can be installed on the user terminal 100 by signature mode or non-signature mode.No doubt, a plurality of Information gather agents can side by side be installed on the user terminal 100 by signature mode and non-signature mode.In this instructions, suppose and be mounted by each signature mode and a plurality of Information gather agents of non-signature mode.Therefore, in this instructions, do not have other explanation, be construed as Information gather agent and all comprise signature mode and non-signature mode.

In this instructions, the Information gather agent of signature mode refers to for information about collects the agency when being installed in user terminal 100, is mounted and the agency that drives at relevant user terminal 100 under user's agreement.For example, the Information gather agent of signature mode can be implemented by JAVA/FLEX and JAVA Applet etc.

Simultaneously, the Information gather agent of non-signature mode refers to the agreement that do not have the user or other installation process and can drivenly act on behalf of, and for example, can pass through Flash, MMS, and RTSP, simple JAVA Applet, white-night, Ajax etc. are implemented.

Although explanation supposition Information gather agent is provided and is installed on this user terminal 100 by the e-business network site server in this instructions, in addition, can be prevented from illegal transaction server 300 and control and be installed on this user terminal 100.

For example, when user terminal 100 is connected to e-business network site server 200 at first, can be mounted by this e-business network site server 200.

Each of the information that Information gather agent will be collected by a plurality of collection channels (channel) (below, be called " terminal collection information " in order to understand with facility) is sent to e-business network site server 200 and illegal transaction prevents server 300.

Information gather agent can be connected in e-business network site server 200 by first passage so that the information of collecting is sent to this e-business network site server 200, and the various service that provides from this e-business network site server 200 perhaps is provided.Wherein, first passage can be the parcel communication port.

On the contrary, Information gather agent forms safety traffic by second channel with preventing illegal transaction server 300, and transmits by the link information of this second channel with this user terminal 100.Wherein, second channel is the socket communication passage.

With reference to Fig. 1, Information gather agent can comprise end message collection module 131, encrypting module 135, transfer control module 137.

End message collection module 131 is carried out the function of collecting for the various information of this user terminal 100.Fig. 2 shows the information of collecting by end message collection module 131.Namely, end message collection module 131 can be the various information that whether needs for the illegal connection of judging this user terminal 100 or illegal transaction (for example, (e-commerce website connects the date to link information, the e-business network site server connects the IP address, VPN client IP address, VPN gateway IP address, acting server IP address, authentication IP address etc.), Ethernet information, MAC information, hardware information, end message are (for example, telephone number, IMSI, IMEI, USIM information etc.).No doubt, the information by end message collection module 131 is collected except the information shown in Fig. 2, may further include other information.

Encrypting module 135 is carried out the function that will be encrypted according to fixed in advance method by the collection information that end message collection module 131 is collected.For example, encrypting module 135 can be carried out RSA (Rivest Shamir Adleman), Seed, 3DES (Data Encryption Standard).

Transfer control module 137 is carried out control so that the collection information that will encrypt by first passage and second channel is sent to the function that illegal transaction prevents server 300.

For example, transfer control module 137 may be controlled to confirm that by the first communication path of first passage illegal transaction prevents the communications status of server 300, if communications status be the state that can communicate by letter (namely, " alive "), the collection information exchange of by the gross encryption is crossed the first communication path be sent to illegal transaction and prevent server 300.

Simultaneously, if transfer control module 137 may be controlled to communications status be the state that cannot communicate by letter (namely, whether communication unconfirmed to be) words, the collection information that to encrypt by second channel is sent to after the e-business network site server 200, is sent to illegal transaction by this e-business network site server 200 and prevents server 300.

Second channel is the parcel communication port for the connection between the browser that is mounted at user terminal 100 or specific application program (App) and the e-business network site server 200, although often can communicate by letter, yet first passage is that the network environment (for example, setting fire wall etc.) that belongs to may cannot be communicated by letter according to user terminal 100.

Although so reason is arranged, the reason that must transmit by the collection information that first passage will preferentially be encrypted is as follows.

The first, by the browser of user terminal 100, connect although use the also circuitous access path of acting server, because can wiping, the feature of socket communication sees original authentication IP address.

The second, the data volume that is sent to e-business network site server 200 by second channel reduces, and the result can reduce the load of e-business network site server 200.

The website service section 210 that the information page that e-business network site server 200 according to an embodiment of the invention comprises will provide and revise login and the main information such as transfer accounts provides, execution provides the server framework 220 of the function of the infrastructure such as Website server/WAS/DBMS, and links in real time and the collection and treatment processed and blocking information receiving part 250 for the information of will collecting in e-commerce server special use or Website server 200 (hereinafter referred to as the e-business network site server) of security policy according to an embodiment of the invention.

This collection and treatment and blocking information receiving part 250 can comprise the collection and treatment instruction part 251 that consists of the order Set file at the interior control Information gather agent of user terminal 100, execution by the information of collection be sent to real-time multichannel collection information send receiving part 340 and from real-time collecting information analysis and policy survey/blocking section 350 accepts the collection of the function of blocking information/blocking information and send receiving part 252, and carry out will be surveyed by real-time collecting information analysis and policy/policy is interdicted in the detection of the function that the policy data of blocking section 500 management are saved with own policy DB synchronization and Key saves section 253.

Illegal transaction prevents that server 300 from can comprise that real-time hyperchannel collection information send receiving part 340 and real-time collecting information analysis and policy to survey/blocking section (collect information analysis and blocking section) 350 according to an embodiment of the invention.

Collect information analysis and blocking section 350 and comprise the information of collecting is saved in login and policy-database, and relatively judge the method for whether interdicting with the policy data of database.

Real-time hyperchannel collection information according to an embodiment of the invention send receiving part 340 can comprise that execution is collected mail for a plurality of information of not losing A Channel 190 and collection and treatment and blocking information receiving part 250 and the hyperchannel of processing capacity is collected information in conjunction with sending receiving part 341, collection information encryption/the decryption part 342 that information is encrypted and the information of collecting mail is decrypted, and the keeper can monitor and manage the keeper User I/F 343 of collection information.

Simultaneously, collect information analysis and policy survey/blocking section 350 comprises that execution will send from a plurality of real-time hyperchannel collection information the combining information real time aggregation section 351 of the information fusion function that receiving part 340 collects mail, execution is surveyed the information analysis of collecting or determine whether to interdict the user terminal policy of function and judges and enforcement division 352, real-time login and policy-database 353 that collection information and relevant policies information are saved, and the keeper can monitor message collects and the keeper User I/F 354 of analysis result.

To immediately be sent to the real-time collecting information analysis from the information that real-time hyperchannel collection information send receiving part 340 to collect and policy survey/blocking section 350 is so that save complete collection information, simultaneously, carry out after the applicable processing of the policy that needs, to be sent to according to the content that policy is judged e-business network site server 200, when attempting to conclude the business with convenient user terminal, process in real time surveying/the blocking processing.

" ecommerce illegal transaction blocking method and system " according to an embodiment of the invention can be constituted as except existing e-business network site server, other has independently system, all load major parts that occur when therefore real-time information is saved and processed with policy do not affect to existing e-business network site server, no doubt, so that the user of existing service or ISP obtain satisfied.

Explain the operation of each composed component according to an embodiment of the invention and the each other words of effect between each element, user terminal 100 uses the website to connect the browser 110 of usefulness for the purpose of ecommerce or (for example concludes the business special-purpose terminal installation procedure 120, security HTS, Home Trading System) or use two modes and be connected in e-business network site server 200.At this moment, the response of e-business network site server 200 can comprise Java Script file and the order that is equivalent to collection and treatment instruction part 251 with webpage, and browser 110 is carried out this order and Agent can be installed, collection information, transmission collection information.

Simultaneously, this command script comprises more important information, for example censure the intrinsic number Class ID of Agent assembly, the path of Agent installation file, the version of Agent, the address of the server that collection information is transmitted is exactly first to collect the address, and the server address that again transmits when a communication failure is exactly the second collected address information etc.

At first, Agent uses the warning order browser to confirm at 100 li Agent that are mounted of user terminal according to this, although this version is not lower than the version of order appointment if Agent installs or installed, download new Agent and install, so that Information gather agent is become operating readiness.(whether basis requires user's agreement can be divided into signature mode and non-signature mode Agent during installation.) when the use of Information gather agent like this prepares to finish, browser is carried out follow-up script command and is driven order to this Agent, so that collect the information of user terminal 100 and after 135 li of end message encrypting modules are encrypted, begin the transmission of the information of collecting by end message transfer control section 137.At this moment, the information category of collection is as shown in Figure 2.

On the e-business network site server 200 of one embodiment of the present of invention, when user terminal 100 connects for ecommerce (for example, login, buy checkout, transfer accounts, message board, the authentication notarization is reissued screen etc.), if e-business network site server 200 is website service server forms, website service section 210 provides screen, simultaneously collection and treatment instruction part 251 provides command script, and at user terminal 100 interior implementation information concerning order languages, so that install and activation bit collection agency.

Collection and treatment instruction part 251 is to be made of the script file of the 110 li implementations of connection browser in user terminal 100 and order language.

Collection according to an embodiment of the invention/blocking information send receiving part 252 to cross B channel 191 and be sent at once real-time hyperchannel collection information and send receiving part 340 by collecting the collection information exchange that transmits in path 193,194.

At this moment, if comprise the e-business network site server 200 of collection and treatment and blocking information receiving part 250 and in real time hyperchannel collection information send and need to be encrypted that (this interval is the in-house network of all enterprises between the network between the receiving part 340, although therefore usually be not encrypted, but the policy of enterprise can be encrypted according to this), operation and process aforesaid encrypting and decrypting and process.

Detection according to an embodiment of the invention blocking policy and KEY save section 253 in order to watch out for to comprising that real-time Policy Model registration DB and terminal combining information save real-time collecting information analysis and the policy of section 353 and survey/network of blocking section 350 devices or obstacle occurs or situation (for clog-free E-business service is provided swimmingly) that can not operation sequence on this HW server, and real-time Policy Model registration DB and terminal combining information are saved to more than one Policy Model change in the important policies database (with reference to Fig. 4) that section 353 provides and side by side synchronization.

Therefore, can provide with real-time collecting information analysis and policy survey/the irrelevant illegal transaction of the obstacle of blocking section 350 interdicts service in real time.

For example, if overseas IP blocking service, the application user ID of this service and domestic IP band domain information etc. saved in real time Policy Model registration DB and terminal combining information are saved 353 li in section and upgraded at any time, and with this information usually with survey blocking policy and KEY and save section's 253 synchronizations, although so that survey in real-time collecting information analysis and policy/obstacle occurs 350 li in blocking section, collect/blocking information send receiving part 252 whether to judge blocking individually.

Real-time hyperchannel collection information according to an embodiment of the invention is sent receiving part 340 to be constituted as all collection information that transmitted by user terminal 100 by two channel and three communication paths are carried out the high speed deciphering in real time, and with the deciphering information be sent to the real-time collecting information analysis and policy survey/blocking section 350 after, be combined into a collection information (Record) in this.

Gradually the situation that increases or explode in order to watch out for quantity of information that per minute collects, real-time hyperchannel collection information according to an embodiment of the invention send receiving part 340 and real-time collecting information analysis and policy survey/each module of blocking section 350 can separated operation in other H/W server, also comprises having the combining information real time aggregation section 351 of module of formation (Queue) function so that send receiving part 340 to become two-fold or triple real-time hyperchannel collection information.

Combining information real time aggregation section 351 uses formation (Queue) with FIFO (First-In-First-Out) data structure so that the information of sending receiving part 340 side by side to transmit without a plurality of real-time hyperchannel collection information of the collection of letters with obscuring, and order ground subsequent treatment.Use FIFO Queue so that send receiving part 340 side by side to transmit under the situation that information or overall information conveying capacity explode in a plurality of real-time hyperchannel collection information, the collection of letters/handling part can out of service or lost part information.

The user terminal policy is judged and enforcement division 352 can be divided into real-time policy decision section and real-time detection/detection policy implementation section, and as shown in Figure 4, consist of real-time policy decision section's module so that the information that will collect is at first judged according in real time Policy Model registration DB 353 comparative analysiss.

Relatively crossing real-time detection/blocking policy implementation section with the data communication device of judging in real-time policy decision section module saves relevant Event log at DB, if and policy is set to automatic blocking, send the immediately in real time blocking of receiving part 252 website service sections 210 by collection/blocking information, if and policy is set to automatic detection, by system manager User Interface 343,354 give the keeper with SMS, Email, the circulars such as management system screen.

For real-time blocking, from must within the several seconds, finishing processing (for example: 1-3 second) till user terminal 100 plays the time that website service section 210 can interdict during for the important screen of the purpose connecting electronic business web site server 200 of ecommerce.Therefore, the technology that the common processing time need to be reduced significantly.

Be constituted as according to one embodiment of present invention the three kinds of following methods of using.

The first, be constituted as the investigation that does not have to add and can distinguish the situation that can detect original authentication IP in order to promptly process.

The possibility because the IP of existing user terminal makes a circulation, in order to know that authentication IP will wait for Achannel 190 information, yet user terminal is that the transfer rate of the network state A channel 190 that belongs to is unstable according to this, therefore needs time or communication also cannot.

Yet, in the present invention, if confirm in advance that by Information gather agent user terminal 100 does not use the circuitous skill of IP of Proxy or VPN etc., (in order to confirm whether use Proxy, will to confirm OS Registry, and whether to use VPN in order confirming, will confirm whether PC communication comprises TAP with the Description of Adapter device, VPN, LZIP, the specific character row of SOCKv5 etc.) will collect path 193 for the No.2 of the information of judging the preecedence requirement whether interdict (for example, authentication IP, user ID, MAC Address etc.) by B channel 191 and be sent to collection and treatment and the information of blocking receiving part 250.

Then, send receiving part 340 through real-time hyperchannel collection information, real-time collecting information analysis and policy survey/wait of unpromising with remaining information (No.1 192 or the No.3 194) combination of blocking section 350, and analyze individually at once so that promptly carry out and judge and whether interdict.

Proxy, the circuitous connection ratio such as VPN are average 0.5%, so the present invention 99.5% transaction can not be subject to the impact of unsettled A channel 190, so that immediately can interdict in real time.

Second, end message transfer control section 137 is constituted as, the No.2 that collects path 192 and B channel 191 as the No.1 that will collect information exchange and cross A channel190 collects path 193 when being sent to server, use asynchronous communication (Asynchronous I/O, perhaps Non-Blocking I/O) mode in order to there is not communication latency.

Synchronous communication mode is the mode of waiting for to not doing any operation till the execution of communication request finishes, therefore realizes at an easy rate, but when multiple communication is parallel, because the operation of order wears down a lot of times.

Yet asynchronous communication is the mode of carrying out subsequent operation before this execution after the communication request finishes, thereby, simultaneously, carry out rapidly a plurality of operations, but be difficult to realize.

The 3rd, for judging that the information that needs of whether interdict (for example: the policy of setting, national IP band territory is shown according to this, whether interdicts Flag etc.) is stored in main memory and holds in the device and be used, so that can process at high speed during connection.

For inquiry so at a high speed and generate/deletion, save device and use Hash table (Hash Table) so that make than the mode along with Disc I/O of database or file etc. and responding faster.

Simultaneously, in order to prevent that saving the device use amount increases excessively, (execution in per 40 seconds checks) deletes unwanted information periodically.

According to one embodiment of present invention, effectively use and save device, although use inexpensive intel server, can process 200-300 spare by per second.

Even promptly carry out real-time detection/blocking by exquisite policy, attack if can not watch out for the circuitous of user terminal 100 or alter, all be useless.At first, obtain user terminal 100 original authentication IP addresses and use when policy is judged, so that all round about manners (Proxy, VPN, long-range connection etc.) that defence is used in order to alter authentication IP address.

Simultaneously, because the MAC Address of user terminal 100 of easily altering, when collecting mac address information, collect and whether alters and the information of original MAC Address and use when policy is judged.

Therefore, can prevent at all that illegal transaction person from hiding oneself information or avoidance and be connected in the mode of e-business network site server 200.

(the Virtual Private Network of VPN in the round about manner as implied above, virtual private network) is in the circuitous technology of the IP that threatens most of all ecommerce one, the tunnelling function that uses VPN Gateway server (Fig. 3) to provide for the original IP that hides user terminal 100 exactly, thereby often be used mala fide (200 IP that recognize VPN Gateway of e-business network site server).So the VPN implementation is a variety of and uses PPTP, GRE, L2TP, SSL, the agreement of VPN etc.

As shown in Figure 3, when user terminal connects by VPN Driver 410, plug-in unit drives that information exchange that order collects is crossed VPN Driver circuitous 430 and transmission information to illegal transaction prevents server 300 according to this in Information gather agent.

According to one embodiment of present invention, carry out after A channel 190 communications, if the communication of user terminal 100 interior active connections (Active Connection) comprises agreement (PPTP as implied above with the Description of Adapter device, GRE, L2TP, SSL, VPN) in one, but can be judged as the circuitous able one of connection of VPN.

As shown in Figure 3, when the information of collecting through the VPN driver and circuitous when being sent to illegal transaction and preventing server 300 420, exchange following communication pathway for, be exactly as shown in Figure 3, again carry out A channel 190 communications 430 in order to can obtain original authentication IP with original Ethernet driver.

Namely, this user terminal 100 with used (namely, be connected in outside VPN Gateway's) used beyond the network drive after the original network drive that uses was found out from Information gather agent before the VPN and (to use the GetAdapterInfo function and the information of the Adapter that obtains to be consisted of by the IP_ADAPTER_INFO structure, and find out in this have the Adapter that sets up IP and Gateway IP illegally) select it, again carry out A channel 190 communication 420 so that after hyperchannel collection information send receiving part 400 to carry out all to collect VPN circuitous in real time and the flow process (with reference to Fig. 3) of the authentication IP address before circuitous with this driver interface

At this moment, communicate by letter in order to use except using the original network drive the VPN driver in the communication between browser and the website, Agent uses the skill of the Routing Table (catalogue of define grid communication path) of temporary transient change user terminal 100, thereby pass through before the external the Internet communication change path of VPN driver output so that export 430 with the socket communication of Fig. 3 by original network drive, just sending the authentication IP of receiving part 340 collections by this path from real-time hyperchannel collection information is circuitous original authentication IP before.

When using other IP round about manner Proxy, also can obtain original authentication IP by following flow process.

At first, the Information gather agent inquiry comprises the Registry of the OS set information of user terminal 100, thereby judges whether that first Proxy is installed in the browser.At this moment, if Proxy is mounted, then use A channel 190 communications to send receiving part 400 to obtain original authentication IP from real-time hyperchannel collection information.

Make a circulation in order to judge whether Agent to utilize long-range connection, the specific Registry of user terminal 100 (HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Termi nalServer Wds rdpwd Tds tcp) after the inner affirmation portal number, use the GetTcpTable function and obtain the status information of this port, if and this port is opened, can know that this moment is in long-range connection.Whether MAC alters and original MAC Address in order to obtain, with reference to relevant NIC (the Network Interface Card) part in Registry.

Support can additionally be mounted on any structure of existing network station service structure or client-server etc. according to the system of the ecommerce illegal transaction real-time detection of aforesaid one embodiment of the present of invention and blocking and be implemented.

Namely, illegal transaction prevents that server 200 from obtaining and analyze each terminal intrinsic information and user's much information from user terminal 100 and e-business network site server 200, so that the blocking policy of setting according to this e-business network site server is taked to survey step by step and the blocking measure.

With reference to Fig. 4, the real-time detection of the applicable according to this register information of E-business service enterprise and blocking policy and the ecommerce security service is provided for each client are so that can improve the image of the enterprise that can do Secure Transaction.

The form of applicable one embodiment of the present of invention so that the service that additionally provides to client is as follows.

First, " the special-purpose PC specified services of ecommerce ", be exactly according to this will the be in computing machine of interior computing machine or office or the more than one computing machine of oneself trusting that carries computing machine etc. of the application screen (Fig. 5) that provides of e-commerce venture and flow process (Fig. 6) client oneself register in advance, thereby computing machine in addition can not concluded the business, and steals important information so that obviate is usurped the personal information of oneself or to hacker's behavior of money and property.At this moment, the computing machine of registration is identified with MAC Address, and therefore, obtaining aforesaid adulterium original MAC Address before is necessary condition.

The second, be " service of IP blocking abroad ", be exactly only use computing machine at home of client's application, can not connect in overseas, thus the service that is protected.Utilize it, client can block overseas hacker's connection at all.

For the authentication IP that judges the connectionist domestic IP whether, and the domestic IP assignment information of using KRNIC (Korea S the Internet development institute) to announce, at this moment, the connectionist uses the IP skill of making a circulation, and will know aforesaid original authentication IP so that judicious country.By this additional security service, client receives the defencive function that existing protective device or server can not provide, and not with the additional effect of the ecommerce of the safety of hacker's behavior.But no doubt e-commerce venture contacts and off-line working, so that this service can be watched out for client's access application.

Fig. 7 is the example that illustrates for the system architecture of service that Fig. 5 is provided.Register exactly at first step/cancel in the procedure to apply, e-commerce venture provides and registers/cancel screen, and then client oneself is with service request or cancel, and the result of and this application/cancel is stored in the DB of enterprise.

Carry out exactly in the transaction at second step, Bchannel 191 information that user terminal 100 is sent to e-commerce server are transferred to the collection background program through JSP module (accepting and the Java Server Page module of processing HTML Form shape information) and the handling procedure of enterprise.The collection background program all is sent to the analysis background program with A channel 190 information of this information and the direct collection of letters from user terminal 100, and whether the generation of analysis background program interdicts Flag.

The MAC Address of the original MAC Address that analysis background program according to an embodiment of the invention is relatively collected and in advance registration (situation of " the special-purpose PC specified services of ecommerce "), whether the original authentication IP that perhaps judge to collect the IP (situation of " overseas IP blocking service ") of domestic distribution, thereby judge and whether to interdict, and Flag is installed saving in the device.The blocking Flag that so generates copies to e-business network site server 200 in real time by the synchronization background program in the e-business network site server, thereby the blocking Flag information saved in the device in the e-business network site server is maintained, so that the important transaction of enterprise (login is transferred accounts etc.) obtains the blocking measure at once when handling procedure can and need with reference to this Flag information.

Fig. 8 is detection and the black block scheme of blocking ecommerce according to a second embodiment of the present invention.

With reference to Fig. 8, ecommerce illegal transaction interrupting system can comprise user terminal 100, e-business network site server 200, and illegal transaction prevents server 300.

Below, will omit for the explanation of the structural detail that in Fig. 1, illustrates and function, and different parts only will be described.

Providing of the specific service that user terminal 100 provides for this e-business network site server 200, when carrying out the vertical application of installing at this user terminal 100, Information gather agent is driven and be connected to illegal transaction control server 300 and collect authentication IP address by the first communication port.Wherein, the authentication link information is the authentication IP address of this user terminal 100, also with by the circuitous of acting server and VPN is connected irrespectively, prevents that by this illegal transaction server 300 can be obtained.At this moment, Information gather agent prevents from also can obtaining the server 300 policy information except authentication IP from illegal transaction.Therefore, Information gather agent is analyzed this policy information and the blocking event is communicated to vertical application (perhaps special software) so that prevent from being connected in e-business network site server 200 in advance.

The words that describe in detail, the Information gather agent of user terminal 100 will be sent to illegal transaction with the H data of passing on parcel or V data by the first communication port and prevent server 300, and illegal transaction prevents that server will be sent to Information gather agent with the authentication link information (NAT IP address) of passing on parcel (H data or V data) to respond.

For example, when user terminal 100 is set to VPN, Information gather agent is not will pass on parcel to be sent to illegal transaction by the VPN virtual ethernet to prevent server 300, prevents server 300 but will pass on parcel to be sent to illegal transaction by actual Ethernet.Therefore, illegal transaction prevents that server 300 from can obtain the authentication link information of actual user's terminal 100, although this user terminal 100 uses VPN.

For this reason, as shown in Figure 8, illegal transaction control server 300 further is included as the IP module 360 that transmits the authentication link information.Information gather agent collection of letters H data or the V data of IP module 360 from being driven by user terminal 100 are then responded the function of just carrying out the authentication link information (NAT IP address) that transmits user terminal 100 with this.

In this instructions, authenticate link information (NAT IP address) and censure the IP address that obtains by socket communication.That is the IP address that, generally obtains by website communication can be different from the IP address of actual user's terminal 100 of setting according to acting server or VPN etc.Therefore, when by e-business network site server 200 when using the specific service vertical application to be driven by the user, Information gather agent according to an embodiment of the invention can be driven, prevents server 300 and in advance access authentication link information and policy information so that can be connected to illegal transaction by the first communication port before active service is provided.Therefore, Information gather agent according to this relevant policies information is communicated to vertical application with the blocking event, and the input that vertical application interdicts event according to this can determine whether to interdict.Thereby the user is accepting can determine whether interdict before the actual critical services from actual e-commerce website server 200, and the stand-by period reduce significantly so that watch out for being injured owing to black user in advance.

The Information gather agent of user terminal 100 obtains the according to this authentication link information that transmits of H data or V data of the first communication port according to this, and the collection information for this user terminal 100 of then following is sent to e-business network site server 200 together.Wherein, collection information can be information (CPU, network interface, the MAC of for example user terminal 100, IP, Hard Disk, Keyboard, OS information, browser information, security personnel's software is installed and whether operate etc.) and the accounts information (login ID) by 200 acquisitions of e-business network site server, whether login successfully at least more than one among the URL of connection.

At this moment, the Information gather agent of user terminal 100 will can be sent to e-business network site server 200 by authentication link information and the collection information that the second communication passage obtains.As mentioned above, the first communication port can be the socket communication passage, and the second communication passage can be the parcel communication port.Simultaneously, the first communication port and the according to this non-synchronous data communication of second communication passage and communicate by letter.

Therefore, e-business network site server 200 will be sent to illegal transaction with the authentication link information from the collection information that user terminal 100 is collected and prevent server 300, and after this they are used in the policy judgement of this user terminal 100.

Simultaneously, according to an embodiment of the inventionly comprise that e-business network site server and illegal transaction prevent that the black method of blocking of the ecommerce illegal transaction interrupting system of server is embodied as the software command form that can carry out by the means with the process information of multiple electronic type, and be recorded saving in the media.Save media and can comprise software command, data file, the alone or in combination form of data structure etc.

Can design especially and form for the present invention at the software command of saving media recording, be used perhaps for software pursuer bulletin.The example of saving media can comprise hardware, floppy disk and such as the magnetic medium of tape, CD-ROM, optical media (optical media) such as DVD, such as magnetic-optical media (magneto-optical media) of floppy disk (floptical disk) and such as ROM, RAM, flash save the hardware unit of the special formation of carrying out in order to save program command of device etc.Simultaneously, aforesaid media can be to comprise transmitting designated program order, the light of the carrier wave of the signal of data configuration etc., or metal wire, the transfer medium of waveguide etc.The example of program command can not only comprise the machine-language coding that forms by compiler, and uses interpreter and the higher level lanquage coding of for example carrying out by computing machine of process information device electronically.

Aforesaid hardware unit can be configured in order to carry out operation of the present invention and be operated by more than one software module, and vice versa.

Although with reference to specific embodiment spirit of the present invention is described in detail, these embodiment only are used for the example purpose, rather than are used for limiting the present invention.Can understand that without departing from the scope and spirit of the present invention, those skilled in the art can change or improve embodiment.

Claims

1. one kind based on comprising that e-business network site server and illegal transaction prevent the black method of blocking of the ecommerce illegal transaction interrupting system of server, comprising:

(a) user terminal is connected in this e-business network site server, and installs the Information gather agent that is provided;

(b) this user terminal is for the service that utilizes this e-business network site server and provide and carry out vertical application in order to drive this Information gather agent, is connected in by this Information gather agent and by the first communication port then that this illegal transaction prevents server so that at least one in access authentication link information and the policy information;

(c) this user terminal will be communicated to this vertical application according to the blocking event of this policy information that obtains so that whether decision serves by the blocking of this e-business network site server;

(d) this Information gather agent that drives in this user terminal will be sent to this e-business network site server for collection information and this authentication link information of this user terminal by the second communication passage; And

(e) this e-business network site server login resume that will connect according to user terminal, this collection information and this authentication link information are sent to this illegal transaction and prevent server,

Wherein, this illegal transaction prevents this authentication link information of server by utilizing so that will be sent to user terminal according to the policy information whether blocking serves.

2. prevention method is interdicted in illegal transaction according to claim 1, and wherein, described the first communication port is socket safety traffic passage, and described second communication passage is the parcel communication port.

3. prevention method is interdicted in illegal transaction according to claim 1, and wherein, described authentication link information is NAT IP address.

4. illegal transaction according to claim 1 blocking prevention method wherein, is installed the signature mode of rear drive and not this user's agreement process and the non-signature mode that drives under the user that described Information gather agent is included in this user terminal agrees.

5. illegal transaction according to claim 4 blocking prevention method, wherein, described signature mode is in order to drive the ActiveX mode, NPAPI mode, any one the signature mode plug-in unit in the Java Applet mode and the script command of programming.

6. prevention method is interdicted in illegal transaction according to claim 1, wherein, (b) step further comprises, before access authentication link information and policy information, this Information gather agent exhalation socket connect and confirm the communications status that this prevents the illegal transaction server by this first communication port, if then this communications status is the state that can communicate by letter, obtain this authentication link information and policy information.

7. prevention method is interdicted in illegal transaction according to claim 6, wherein, this Information gather agent will be pass on the H DATA of parcel or V DATA with server by this first communication port and be sent to this illegal transaction and prevent server, and prevent server access authentication link information with response to this from this illegal transaction.

8. prevention method is interdicted in illegal transaction according to claim 7, wherein, utilize VPN if this user terminal is set to, this Information gather agent is not by the VPN virtual ethernet but by actual Ethernet, should transmit parcel and be sent to illegal transaction and prevent server.

9. one kind based on the ecommerce illegal transaction interrupting system that comprises e-business network site server and illegal transaction and prevent server, comprising:

For the service that utilizes this e-business network site server to provide, when the vertical application that is mounted or browser are driven by the user, this ecommerce illegal transaction interrupting system activation bit is collected the agency, then will transmit that parcel is sent to that this illegal transaction prevents server so that access authentication link information and policy information by this Information gather agent and by the first communication port, and in order to be communicated to the user terminal that this vertical application is controlled according to this policy information blocking event; And

The collection of letters according to this transmission parcel of this Information gather agent that is driven by this user terminal, to respond the authentication link information of extracting this user terminal out, then analyze this authentication link information and with the policy data that are stored in database relatively, then will generate according to the policy information whether blocking of this user terminal serves, and prevent server by the illegal transaction that this first communication port is communicated to this collection agency

Wherein, this vertical application determines whether to interdict the service use that this e-business network site server provides according to this blocking event.

10. ecommerce illegal transaction interrupting system according to claim 9, wherein, the described Information gather agent authentication link information that will obtain by this first communication port and cross the second communication passage for the collection information exchange that this user terminal is collected and be sent to the e-business network site server.

11. ecommerce illegal transaction interrupting system according to claim 9, wherein, described the first communication port is the socket communication passage, and described second communication passage is the parcel communication port.

12. illegal transaction interrupting system according to claim 9, wherein, this Information gather agent is sent to this illegal transaction by the first communication port with socket connect and prevents server and confirm communications status, and if the state that can communicate by letter should pass on parcel to be sent to this illegal transaction and prevent server.

13. illegal transaction interrupting system according to claim 9, wherein, utilize VPN if this user terminal is set to, this Information gather agent is not by the VPN virtual ethernet, and by actual Ethernet, should transmit parcel and be sent to illegal transaction and prevent server.

14. illegal transaction interrupting system according to claim 13, wherein, this reception and registration parcel is V data or H data.