JP2004348202A - Data relaying system with method control function of http request and method for controlling same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data relaying system which can prevent illegal writing only for information resources of a specific web system or leakage of information. <P>SOLUTION: The data relaying system relays communication data between a client and a WWW server. The data relaying system includes a URL database for storing URL information group of each WWW server, a means for registering identification information showing whether method specified by HTTP is allowed to be used or not as method control information corresponding to the URL stored in the URL database, and a means for controlling the use of the method of the HTTP request at each URL at an access destination by inhibiting the HTTP request if the method is to be controlled and the URL is to be regulated by deciding whether the URL of the access destination is the URL to be regulated or not base on the URL database and the method control information at receiving the HTTP request to the WWW server. In the case of the method to be controlled and the URL to be specified, the HTTP request is not permitted. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a data relay system having a function of controlling a method used in an HTTP (Hyper Text Transfer Protocol) request passing through a data relay device such as a proxy server, and a method of controlling the method.
[0002]
[Prior art]
A Web (Web) system that provides various services using the Internet has the convenience that an unspecified number of people can use it. However, malicious information may be written by a malicious person and cause inconvenience. There is a problem that a security problem is more likely to occur as compared with a closed type system that is not connected to an external system, such as confidential information being leaked and suffering damage. In order to solve such security problems, in recent years, it has been difficult to decipher communication contents by using encryption technology and personal authentication technology standardized by the Internet Engineering Task Force (IETF), which is an Internet standardization organization. In addition, a system incorporating a function of detecting that the data has not been tampered with has been developed, and is provided by some ASPs (Application Service Providers) and the like. Many other proposals have been made to enhance security using unique algorithms.
[0003]
As a system for ensuring the security of electronic mail, for example, a proxy provided with a means for checking whether electronic mail has been tampered between a mail server on a LAN (local area network) and the Internet. There is a device in which a device is provided to prevent the falsified e-mail from entering the LAN by rejecting the reception of the e-mail if the device has been tampered with (for example, see Patent Document 1). Further, as a system for preventing an annoying remark from being written on an electronic bulletin board, for example, a means for determining whether or not there is an annoying remark (phrase) based on a list of prohibited words registered in advance. In some cases, when it is determined that there is an annoying utterance, the utterance is hidden. In addition, in consideration of the case where the message is judged to be annoying erroneously, the administrator of the electronic bulletin board looks at the list of saved hidden and displayed utterance documents, and if necessary, hides or displays the message. There is a method that can change the handling (see, for example, Patent Document 2).
[0004]
[Patent Document 1]
JP-A-2002-24147
[Patent Document 2]
JP-A-2002-82869
[0005]
[Problems to be solved by the invention]
The above-described electronic mail security system can prevent a falsified e-mail from entering the LAN, but cannot prevent the falsification itself, resulting in damage. Further, in the above-described electronic bulletin board security system, it is possible to avoid displaying information determined to be an annoying utterance, but it is considered that it is often difficult to judge whether an utterance is an annoying utterance only by a word or phrase.
[0006]
By the way, in a Web system such as an electronic mail system and an electronic bulletin board system (hereinafter, referred to as a Web mail system and a Web bulletin board system, respectively), a method (POST method or PUT method) specified by HTTP is used. It is conceivable to control writing of information by controlling a specific method. However, in this case, all the writing on the Internet and the intranet cannot be performed, and the Web system service becomes unavailable.
[0007]
The present invention has been made in view of the circumstances described above, and an object of the present invention is to control a method of an HTTP request so that information resources of a specific Web system can be controlled without hindering the convenience of the Internet. It is an object of the present invention to provide a data relay system having an HTTP request method control function and a method control method thereof, which can prevent unauthorized writing and information leakage.
[0008]
[Means for Solving the Problems]
The present invention relates to a data relay system having a method control function for an HTTP request and a method control method therefor. The object of the present invention is to provide a data relay device for relaying communication data between a client and a WWW server. In a data relay system, a URL database in which URL information groups of each WWW server are classified and stored in a predetermined category, and a method specified as a control target among methods specified by HTTP is used as a control target, and use of the control target method is permitted. A method restriction information registration unit for registering identification information indicating whether or not to execute the method as the method restriction information in association with the URL stored in the URL database, and when receiving the HTTP request from the client to the WWW server, Before the header information of the request It is determined whether or not the method to be controlled is set, and whether or not the access destination URL is the URL to be controlled is determined based on the URL database and the method restriction information. And a method control means for restricting the use of the method of the HTTP request for each URL of the access destination by disallowing the HTTP request to the WWW server when it is determined that the URL is a URL to be restricted. Achieved by
[0009]
Further, the method regulation information registration means has a function of registering the identification information as the method regulation information in association with a URL stored in the URL database and a user of the client or a group to which the user belongs. If the method control means determines that the method is the control target method and the URL is a control target URL, the method set in the HTTP request is further permitted to be used by the user of the client. Is determined based on the method restriction information, and when the use is not permitted, the HTTP request to the WWW server is rejected, so that the use of the method of the HTTP request is performed for each user of the client. Or, restrict for each group to which the user belongs. ; By be more effectively achieved.
[0010]
Further, the HTTP request is a connection request to the WWW server; if the HTTP request to the WWW server is rejected, the HTTP request data is discarded, and the HTTP request rejection is indicated. Further comprising a non-permission notification transmitting unit that transmits response data to the client to notify the user; the data relay device is a proxy server; and the control target method changes the resource environment of the access destination. The method to be controlled is a method of a type referring to the resource of the access destination; each method to be controlled is individually set for each URL stored in the URL database. Can be set to the above; the method regulation information Recording means for registering the identification information in association with a category which is a classification element of the URL database, and when the category is set in the method regulation information, the method control means includes The method control means and the URL database are provided in the data relay device; the method regulation information registration means is provided in the client; The control information can be registered from the client; and the method to be controlled includes the methods used in the Web mail system and the Web bulletin board system.
[0011]
Further, with regard to a method control method of an HTTP request, the object of the present invention is a method control method of an HTTP request in a data relay system having a data relay device that relays communication data between a client and a WWW server, A URL database in which URL information groups of each WWW server are classified and stored in a predetermined category is provided, and whether a method specified as a control target among the methods specified by HTTP is used as a control target is permitted or not. Is stored in advance in the storage unit as method restriction information in association with the URL stored in the URL database, and the control unit of the data relay device transmits an HTTP request from the client to the WWW server. When receiving, the header of the HTTP request It is determined whether or not the method to be controlled is set in the information, and whether or not the URL of the access destination is a URL to be controlled is determined based on the URL database and the method restriction information. Is achieved by restricting the use of the method of the HTTP request for each URL of the access destination by disallowing the HTTP request to the WWW server when it is determined that the URL is the URL to be restricted and the method is a URL to be restricted. Is done.
[0012]
Further, the identification information is associated with a URL stored in the URL database, and is associated with a user of the client or a group to which the client belongs. If the control unit of the apparatus determines that the method is the control target method and the URL is a control target URL, the control unit further determines whether the method set in the HTTP request is permitted to be used by the user of the client. Is determined based on the method regulation information, and when the use is not permitted, the HTTP request to the WWW server is not permitted, so that the use of the method of the HTTP request is performed for each user of the client or to which the user belongs. Regulation by group; more effective by To be achieved.
[0013]
BEST MODE FOR CARRYING OUT THE INVENTION
According to the present invention, in a data relay system for relaying communication data between a client and a WWW (World Wide Web) server, when relaying an HTTP request, permission / inhibition of use of a method set in the HTTP request is provided. A method control function for controlling permission for each URL (Uniform Resource Locators) is provided. If use of a method is not permitted for an access destination URL, data is discarded without, for example, connecting to a WWW server. Like that. By providing such a function in the data relay device, it is possible to prevent unauthorized information writing and rewriting to a specific Web system for a specific URL, and leakage of information due to writing by an internal person such as in a company. Can be prevented.
[0014]
Furthermore, in addition to the function of controlling permission / non-permission of method use for each URL as described above, the data relay system according to the present invention provides permission / non-permission of method use for each user or a group to which the user belongs. It has a function to control each time, and it is possible to regulate the use of the method for a specific user or group. The method to be regulated is a method of a type that changes the resource environment of the access destination. For example, when a method standardized as RFC2068 or RFC2069 is taken as an example, a method of a server specified by a URI (Uniform Resource Identifiers) is used. For example, a “POST method” for transferring data and a “PUT method” for replacing a resource designated by a URI with data to be transferred correspond to the “POST method”. In order to prevent leakage of confidential information, a type that refers to a resource to be accessed, such as a “GET method” for obtaining a resource specified by a URI or a “HEAD method” for obtaining a response header of a resource specified by a URI. May be subject to regulation.
[0015]
The data relay device, which is a component of the data relay system according to the present invention, is preferably a proxy server, but is not limited to a proxy server, but may be a router having a relay route control function or a gateway device having a protocol conversion function or the like. Can also be applied. Hereinafter, a device that relays data communication between a WWW server and a client on the Internet, including these devices, is referred to as a “data relay device,” and an ASP (Application Service Provider) associated with the data relay device is referred to as a “data relay device”. A preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.
[0016]
FIG. 1 is a schematic diagram illustrating an example of the entire configuration of a data relay system according to the present invention. In an organization such as a company, when the personal computer can access the Internet, for example, as shown in FIG. 1, a data relay device (proxy server in this example) 20 having a security function and a cache function is connected to the LAN 1 and the Internet. And a WWW server such as a Web mail system 40a or a Web bulletin board system 40b on the Internet or an intranet from each client terminal 10 (hereinafter, referred to as "client") via the proxy server 20. The mode of accessing the forty is widely used.
[0017]
In general, the proxy server controls a cache and a log (elapsed record) for all relay data of the client 10 connected to an internal network such as a private network or an intranet. In the proxy server 20, each client 10 connected to an internal network such as the LAN 1 is assigned to a specific group (G1-1, G1-2, G2-1, G2-2,. ), And the cache or log of the data is controlled for each group. In addition, permission / non-permission of use of the method for the WWW server 40 is controlled for each URL of an access destination, and control is performed for each user or each group to which the user belongs, so that writing of information to the WWW system 40 is restricted. I have to.
[0018]
The URL database 30 shown in FIG. 1 classifies a group of URL information of websites existing in the world into predetermined categories such as information types, utilization technologies, browsing systems, settlement systems, and database utilization types. This is a database that stores a URL information group that can be indexed with various keys, and the URL of the website and the classification code indicating the category are registered in association with each other. The URL database 30 is provided by, for example, an ASP that operates and manages a data relay system. The ASP computer automatically updates the URL database 30 by, for example, automatically collecting and categorizing the latest URL information of the site using a predetermined algorithm, and distributing the relevant update information daily through a communication network. Means. In addition, a URL information registration unit that registers URL information classified by a user in a predetermined category in the URL database 30 is provided, so that the user can register desired URL information.
[0019]
In the embodiment of the present invention, the permission / non-permission of the use of the method of the HTTP request is controlled for each URL of the access destination for the URL registered in the URL database 30 so that the URL on the Internet or the intranet can be controlled. It is possible to restrict access by this method only for a specific URL, not for all websites.
[0020]
FIG. 2 is a block diagram showing a configuration example of a main part of a proxy server having a method control function according to the present invention. In this example, the URL database 30 is provided in the proxy server 20 (or another device), and the URL information updating means 31 is provided in an ALP computer (not shown).
[0021]
The method regulation information registration unit 21 stores, in the URL database 30, identification information indicating whether a specific method among the methods specified by HTTP is to be controlled and the use of the controlled method is permitted. This is means for registering as "method restriction information" in association with the URL. In this example, the method restriction information is provided in a specific terminal on the client side so that the client can register the method restriction information.
[0022]
The main components of the proxy server 20 include a URL database 30 storing a URL information group of each WWW server including a URL information group to be restricted, and a method for storing the method restriction information registered by the method restriction information registration unit 21. A regulation information storage unit 22, a method control unit 23 that regulates the use of a method to be controlled for each URL of an access destination, and an HTTP request to the WWW server when the method control unit denies an HTTP request to the WWW server. A non-permission notification transmission unit 24 for discarding the data and transmitting response data indicating non-permission of the HTTP request to the client to notify the user is provided.
[0023]
The method control means 23 of the proxy server 20, for example, upon receiving an HTTP request from the client to the WWW server, determines whether or not the method to be controlled is set in the header information of the HTTP request, 30 to determine whether the URL of the access destination is a URL to be restricted, based on the method restriction information. If it is determined that the URL is a method to be controlled and is also a URL to be restricted, the WWW server HTTP requests to the WWW server are rejected, and data transfer to the WWW server is rejected.
[0024]
As shown in the schematic diagram of FIG. 3, the method restriction information includes, for example, URL information and user IDs (U1, U2,..., In the USER column in FIG. 3) that specify the user or the group to which the user belongs. G1, G2,...) And identification information indicating whether or not the use of the method to be controlled is permitted (o in FIG. 3 is permitted, and x is not permitted). Then, as shown in FIG. 3, “method regulation information” indicating a correspondence relationship between each URL, each user or group, and identification information (permission or non-permission of use of a method), that is, which URL from which user or group The "method regulation information" indicating whether or not the use of the method is permitted is registered by the above-described method regulation information registration means 21 and stored in the method regulation information storage means 22 in the proxy server 20. ing. In addition, the URL to be regulated may have a function to set for each category of the classified URL database 30 in addition to a function to set for each URL. Furthermore, the method regulation information may be set such that the initial values of all URLs are not permitted (or permitted) and only the permitted URLs (or the URLs not permitted) are set as targets. The method to be controlled can be set individually for each URL or each user (or each group to which the user belongs), or for each URL and each user (or each group to which the user belongs). Is also good.
[0025]
In the example of FIG. 3, the users of U1 and U2 and the users belonging to the groups G1 and G2 permit the use of the method for the URL of A1 and for all the URLs belonging to the category C2, Each is set not to allow the use of the method. Further, for the URL of A2, the user of U2 and each user belonging to the group of G2 are set so as not to permit the use of the method. It should be noted that the object for which the use of the method is restricted can be set independently by the user, and the user can follow the guidance on the screen displayed by the method restriction information registration means 21 and set the method, URL, and user (or group) to be restricted. Is set and registered in the regulation information storage unit 22 of the proxy server 20.
[0026]
In the method control means 23 shown in FIG. 2, when the HTTP request is received, the method set in the HTTP request is the control target method and the access destination is the restriction target based on the method restriction information as described above. If it is determined that the URL is used, it is further determined whether the method is permitted to be used by the user of the client. If the method is not permitted, the HTTP request to the WWW server is not permitted. Thus, the use of the method to be controlled is restricted for each user of the client or each group to which the user belongs.
[0027]
In the present embodiment, the above-described method control function is realized by a computer program (hereinafter, referred to as a program) executed by a CPU, and the program is stored in a predetermined recording medium (flexible disk, hard disk, CD-ROM, CD-R, DVD-ROM, DVD-RAM, DVD-R, PD disk, MD disk, MO disk, etc.). It should be noted that a form in which some method control functions are implemented by hardware is also included in the present invention.
[0028]
An operation example related to the method control in the proxy server in the above configuration will be described.
[0029]
First, a schematic operation example will be described with reference to the schematic diagram of FIG. Upon receiving a connection request from the client 10 to the WWW server (1), the proxy server 10 specifies the method at the time of the request from the contents of the HTTP header information (2). If this method is a method to be controlled, it is determined whether the URL of the access destination is registered in the URL database, and if it is registered, whether to use the method is permitted based on the method regulation information. Is determined. In the present embodiment, it is determined whether the URL of the access destination is to be restricted and the connection request source user is a user to be controlled (restricted) or belongs to a group ([3]). Then, when it is determined that the use of the method is permitted, a connection is made with the WWW requested by the client 10 and the data is transferred as in the normal relay processing ((4) -1), and the connected WWW is The server response data is transferred to the client 10 ([5]). On the other hand, if it is determined that the use of the method is not permitted, the write data from the client is discarded, a notification of the restriction is transmitted to the client 1, and the process related to the method control of the HTTP request is ended ( (4) -2).
[0030]
Next, a specific operation example related to method control in the proxy server will be described with reference to the flowchart in FIG.
[0031]
When a connection request to the WWW server transmitted from the client 10 is received (steps S1 and S2), the method control means of the proxy server 10 first specifies the method at the time of the request from the contents of the HTTP header information. The method at the time of the request is set, for example, in the HTTP header as shown in FIG. 6 (the POST method in the example of FIG. 6). The method control means determines whether or not the method at the time of the request exists in a preset group of methods to be controlled, and if so, determines that the method is a method to be controlled. In this example, the method to be controlled is a method of a type that changes the resource environment of an access destination among the methods specified by HTTP. For example, the method is stored in a table in advance according to the HTTP specification. Etc. are set.
[0032]
If it is determined that the method is a control target, it is determined whether the URL of the connection destination is included in the URL database (step S3). If it is included, it is determined that the URL is a control target URL. If it is determined that the URL is a URL to be controlled, it is determined whether the method used for the HTTP request is permitted for the URL of the access destination and is permitted for the user or the group to which the user belongs. Is determined based on the method regulation information set in advance (step S4). For example, in the example of the method regulation information in FIG. 3, when the URL of the access destination is “A2” and the user authenticated at the time of receiving the connection request is “U2”, it is determined that the use of the method is not permitted, and The request data is discarded, and response data indicating that the WWW connection is not permitted is transmitted to the client 10 to notify the user (step S5). The display unit of the client 10 displays, for example, a screen indicating that the use of the browser is not permitted (step S5).
[0033]
On the other hand, if it is determined in step S4 that the use of the method is permitted, the proxy server 10 connects to the WWW server 30 requested by the client 10 and transfers data (step S7). The WWW server 30 receiving the connection request receives the data from the client 10 and returns response data (steps S8 and S9). The proxy server 10 receiving the response data transfers the response data from the WWW server 30 to the client 10 (Step S10). Then, the client 10 receiving the response data displays the Web data (HTML, XML, etc.) of the WWW server on the display unit (step S11), and ends the processing for the HTTP request.
[0034]
In the above-described embodiment, a proxy server is described as an example of an apparatus to which the method of controlling an HTTP request according to the present invention is applied. However, the apparatus is not limited to a proxy server, and may be a gateway apparatus or a node (Node). Any device that relays communication data between the client and the request destination data server, such as a computer for communication, may be used. Further, the request destination data server is not limited to a WWW server on the Internet, and may be a data server connected to a communication network other than the Internet (LAN, intranet, extranet, etc.).
[0035]
【The invention's effect】
As described above, according to the present invention, by controlling the method of the HTTP request for each specific URL, the use of the method is regulated, so that a specific Web bulletin board or a specific Web mail It is possible to control writing of information and the like only to the system. Therefore, unauthorized writing and information leakage can be prevented without hindering the convenience of the Internet. In addition, since the use of the method is controlled for each user or each group to which the user belongs, it is possible to restrict writing of information and the like only to a specific user or a specific group. Therefore, it is possible to control the authority of writing information for each specific user or group in addition to each specific URL.
[Brief description of the drawings]
FIG. 1 is a schematic diagram showing an example of the overall configuration of a data relay system according to the present invention.
FIG. 2 is a block diagram illustrating a configuration example of a main part of a data relay device having a method control function according to the present invention.
FIG. 3 is a schematic diagram showing an example of method regulation information according to the present invention.
FIG. 4 is a schematic diagram for explaining a schematic operation example of the data relay device according to the present invention.
FIG. 5 is a flowchart illustrating a specific operation example related to method control of the data relay device according to the present invention.
FIG. 6 is a diagram illustrating an example of a method of an HTTP request to be controlled according to the present invention.
[Explanation of symbols]
1 LAN
2 Internet
10 clients
20 Data relay device (proxy server)
21 Method regulation information registration means
22 Method regulation information storage means
23 Method control means
24 Non-permission notification transmission means
30 URL database
31 URL information updating means
40 WWW server

Claims (14)

In a data relay system having a data relay device for relaying communication data between a client and a WWW server, a URL database in which URL information groups of each WWW server are classified and stored in a predetermined category, and a method defined by HTTP Method restriction information registration in which identification information indicating whether a specific method is a control target and whether or not use of the control target method is permitted is associated with a URL stored in the URL database as method restriction information. Means, when receiving an HTTP request from the client to the WWW server, determining whether or not the control target method is set in the header information of the HTTP request, and determining whether the access destination URL is a restricted URL. The URL database and It is determined based on the method restriction information, and when it is determined that the method is a control target method and the URL is a control target URL, the HTTP request to the WWW server is rejected, thereby using the method of the HTTP request. A data relay system having a method control function for an HTTP request, comprising: a method control means for restricting each URL of an access destination. The method regulation information registration unit has a function of registering the identification information as the method regulation information in association with a URL stored in the URL database and a user of the client or a group to which the user belongs. If the method control means determines that the method is the control target method and the URL is a control target URL, the method control unit further determines whether the method set in the HTTP request is permitted to be used by the user of the client. Whether the HTTP request to the WWW server is not permitted when the use is not permitted, thereby making it possible to use the method of the HTTP request for each user of the client or for each user. Is regulated for each group to which it belongs Data relay system having a method controlling function of the HTTP request according to claim 1 that. 2. The data relay system according to claim 1, wherein the HTTP request is a connection request to the WWW server. When the HTTP request to the WWW server is rejected, the data of the HTTP request is discarded, and response data indicating the rejection of the HTTP request is transmitted to the client to notify the user of the non-permission. The data relay system according to claim 1, further comprising a transmission unit. 2. The data relay system according to claim 1, wherein the data relay device is a proxy server. 2. The data relay system according to claim 1, wherein the method to be controlled is a type of method for changing a resource environment of the access destination. 2. The data relay system according to claim 1, wherein the method to be controlled is a type of method that refers to the resource of the access destination. 2. The data relay system according to claim 1, wherein each method to be controlled can be individually set for each URL stored in the URL database. The method regulation information registration means is adapted to register the identification information in association with a category which is a classification element of the URL database, and when the category is set in the method regulation information, the method control means 2. The data relay system according to claim 1, wherein all URLs belonging to the category are processed as URLs to be restricted. 2. The data relay system according to claim 1, wherein said method control means and said URL database are provided in said data relay device. 3. The data relay system according to claim 2, wherein the method regulation information registration unit is provided in the client, and the method regulation information can be registered from the client. 2. The data relay system according to claim 1, wherein the method to be controlled includes a method used in a Web mail system and a Web bulletin board system. A method control method of an HTTP request in a data relay system having a data relay device for relaying communication data between a client and a WWW server, wherein a URL information group of each WWW server is classified and stored in a predetermined category and stored. A database is provided, and identification information indicating whether or not to use a method to be controlled with a specific method as a control target among the methods specified by HTTP is associated with a URL stored in the URL database. The method control information is stored in advance in the storage unit as the method restriction information, and the control unit of the data relay device sets the method to be controlled in the header information of the HTTP request when receiving the HTTP request from the client to the WWW server. To determine whether the Source URL is determined based on the URL database and the method restriction information, and if the URL is determined to be a control target method and a URL to be restricted, the WWW server A method of controlling an HTTP request, wherein use of the method of the HTTP request is restricted for each URL of an access destination by disallowing the HTTP request to the HTTP request. The identification information is associated with the URL stored in the URL database, and is associated with the user of the client or the group to which the user belongs. The control means, when judging that the method is the control target method and the URL is a control target URL, determines whether the method set in the HTTP request is permitted to be used by the user of the client. Judgment is made based on the method regulation information, and when the use is not permitted, the HTTP request to the WWW server is disallowed, so that the use of the method of the HTTP request is performed for each user of the client or for each group to which the user belongs. 14. The method according to claim 13, wherein Method control method of TTP request.

Images