DEVICE, METHOD AND PROGRAM FOR PREVENTING INFORMATION LEAKAGE

• US 20140026226A1
• Filed: 03/16/2012
• Published: 01/23/2014
• Est. Priority Date: 03/25/2011
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Aoki, Satoshi, Kameda, Manabu
• Granted Patent: US 9,251,367 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Provided is a device for preventing information leakage including: a storage unit that stores message time, request source information, and request destination information in relation to each information requesting message; a unit that suspends a response message containing personal information in response messages in response to the information requesting messages, for a predetermined suspended time from a message time of the corresponding information requesting message; a unit that counts the number of information requesting messages transmitted from the same request source to the same destination and corresponding to the suspended response message on the basis of information stored in the storage unit; and a unit that, in the case where the counted number of the information requesting messages exceeds a predetermined threshold value, applies a protection process to the suspended response message so that the personal information contained in the suspended response message is not received by the request source.

Claims

1. A device for preventing information leakage, comprising:

a request information storage unit that stores a message time, request source information, and request destination information in relation to each information requesting message transmitted from a client terminal to a server device;

a suspending processing unit that suspends a response message containing personal information in response messages transmitted from the server device in response to the information requesting messages, for a predetermined suspended time from the message time of the corresponding information requesting message;

a counting unit that, based on information concerning the information requesting message stored in the request information storage unit, counts the number of information requesting messages transmitted from a same request source to a same request destination and corresponding to the suspended response message; and

a response processing unit that, in a case where the number of the information requesting messages counted by the counting unit exceeds a predetermined threshold value, applies a protection process to the suspended response message so that the personal information contained in the suspended response message is not received by the client terminal serving as the request source.

2. The device for preventing information leakage according to claim 1, further comprising:

a personal information judging unit that judges whether the response message contains the personal information, wherein

the suspending processing unit deletes, from the request information storage unit, information concerning the information requesting message corresponding to the response message judged by personal information judging unit as not containing the personal information and outputs the response message not containing the personal information without suspending the response message whereas the suspending processing unit suspends the response message judged by the personal information judging unit to contain the personal information.

3. The device for preventing information leakage according to claim 2, wherein

the suspending processing unit cancels the suspension of the response message corresponding to the information requesting message, and deletes the information concerning the information requesting message from the request information storage unit in a case where the number of the information requesting messages counted by the counting unit does not exceed the predetermined threshold value, and an elapsed time from the message time stored in the request information storage unit and related to the information requesting message corresponding to the suspended response message is more than or equal to the predetermined suspended time.

4. The device for preventing information leakage according to claim 2, further comprising:

a request information acquiring unit that acquires information concerning the information requesting message;

a first target determining unit that stores, in the request information storage unit, only the information concerning the information requesting message containing request destination information matching predetermined request destination information stored in advance, in the information concerning the information requesting message acquired by the request information acquiring unit; and

a second target determining unit that determines a response message other than the response message in response to the information requesting message having the request source information and the request destination information stored in the request information storage unit, from among the response messages transmitted from the server device, to be a response message outside a target of inspection, wherein

the personal information judging unit does not judge the response message outside the target of inspection, and

the suspending processing unit deletes, from the request information storage unit, information concerning information requesting message corresponding to the response message outside the target of inspection, and outputs the response message outside the target of inspection without suspending it.

8. The device for preventing information leakage according to claim 1, wherein

as the protection process, the response processing unit does not output the suspended response message, or applies a process of deleting the personal information to the suspended response message or a process of editing the personal information to the suspended response message, and then, outputs the response message having the process applied thereto.

5. A device for preventing information leakage, comprising:

a suspending processing unit that suspends a response message containing personal information in response messages transmitted from a server device in response to information requesting messages transmitted from a client terminal to the server device, for a predetermined suspended time from a message time related to each response message;

a counting unit that counts the number of response messages related to a same request source and a same request destination in the suspended response message; and

a response processing unit that, in a case where the number of the response messages counted by the counting unit exceeds a predetermined threshold value, applies a protection process to the suspended response message so that the personal information contained in the suspended response message is not received by the client terminal serving as the request source.

6. The device for preventing information leakage according to claim 5, further comprising:

a personal information judging unit that judges whether the response message contains the personal information, wherein

the suspending processing unit outputs the response message judged by the personal information judging unit as not containing the personal information without suspending the response message whereas the suspending processing unit suspends the response message judged by the personal information judging unit to contain the personal information.

7. The device for preventing information leakage according to claim 6, wherein

in a case where the number of the response messages counted by the counting unit does not exceed the predetermined threshold value, and an elapsed time from the message time related to the suspended response message is more than or equal to the predetermined suspended time, the suspending processing unit cancels the suspension of the response message having the elapsed time more than or equal to the predetermined suspended time.

9. A method for preventing information leakage, which is executed by a computer, the method including:

storing, in a request information storage unit, a message time, request source information, and request destination information in relation to each information requesting message transmitted from a client terminal to a server device;

suspending a response message containing personal information in response messages transmitted from the server device in response to the information requesting messages, for a predetermined suspended time from a message time of the corresponding information requesting message;

counting the number of information requesting messages transmitted from a same request source to a same request destination and corresponding to the suspended response message, based on information concerning the information requesting message stored in the request information storage unit; and

in a case where the counted number of the information requesting messages exceeds a predetermined threshold value, applying a protection process to the suspended response message so that the personal information contained in the suspended response message is not received by the client terminal serving as the request source.

10. A non-transitory computer-readable storage medium storing a program for causing the computer to realize:

a request information storage unit that stores a message time, request source information, and request destination information in relation to each information requesting message transmitted from a client terminal to a server device;

a suspending processing unit that suspends a response message containing personal information in response messages transmitted from the server device in response to the information requesting messages, for a predetermined suspended time from the message time of the corresponding information requesting message;

a counting unit that, based on information concerning the information requesting message stored in the request information storage unit, counts the number of information requesting messages transmitted from a same request source to a same request destination and corresponding to the suspended response message; and

a response processing unit that, in a case where the number of the information requesting messages counted by the counting unit exceeds a predetermined threshold value, applies a protection process to the suspended response message so that the personal information contained in the suspended response message is not received by the client terminal serving as the request source.

11. A method for preventing information leakage, which is executed by a computer, the method including:

suspending a response message containing personal information in response messages transmitted from a server device in response to information requesting messages transmitted from a client terminal to the server device, for a predetermined suspended time from a message time related to each response message;

counting the number of response messages related to a same request source and a same request destination in the suspended response message; and

in a case where the counted number of the response messages exceeds a predetermined threshold value, applying a protection process to the suspended response message so that the personal information contained in the suspended response message is not received by the client terminal serving as a request source.

12. A non-transitory computer-readable storage medium storing a program for causing the computer to realize:

a suspending processing unit that suspends a response message containing personal information in response messages transmitted from a server device in response to information requesting messages transmitted from a client terminal to the server device, for a predetermined suspended time from a message time related to each response message;

a counting unit that counts the number of response messages related to a same request source and a same request destination in the suspended response message; and

a response processing unit that, in a case where the number of the response messages counted by the counting unit exceeds a predetermined threshold value, applies a protection process to the suspended response message so that the personal information contained in the suspended response message is not received by a client terminal serving as the request source.