JP2005209070A - Distribution server and secure OS terminal - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a software update system capable of easily operating a secure OS terminal.
When a distribution server 2 receives update request information from a secure OS terminal 3, the distribution server 2 collects information of the secure OS terminal 3, and based on the collection result, a program and security stored in a program / security policy correspondence DB Search for the relevant update program and update security policy from the policies, and make an update decision. When it is determined that it has been updated, the update program and the update security policy are distributed to the secure OS terminal 3, and when it is determined that it has not been updated, this is notified to the secure OS terminal 3. The process ends. The secure OS terminal 3 receives and installs the update program and the update security policy.
[Selection] Figure 1

Description

  The present invention relates to a software update system capable of easily operating a secure OS.

Conventionally, computers connected to the Internet have been exposed to attacks such as unauthorized intrusion, and in order to deal with these attacks, patches to server programs are applied, firewalls are installed, intrusion detection systems (IDS) ) Was introduced. However, since these measures are all focused on preventing intrusion, measures must be taken for new intrusion techniques. In addition, once the root authority is obtained after being invaded, the intruder becomes free, and there remains a problem that damage such as destruction is enlarged. In order to solve this problem, the secure OS has attracted attention. This secure OS extends the OS itself, so even if it has root authority, it is subject to access control, and it is also possible to divide the root authority. (For example, refer nonpatent literature 1).
Nikkei Linux, May 2003 (pages 30-55)

  However, a user who uses a terminal equipped with a conventional secure OS needs to perform a security policy setting operation when updating a program, and it is complicated and difficult to operate the secure OS terminal. was there.

  Further, a user who uses a terminal equipped with a conventional secure OS needs to perform a security policy setting operation when, for example, a vulnerability is found in the security policy or when a program distributed from various program manufacturers is updated. There is a problem that it is difficult and difficult to operate a secure OS terminal.

  The present invention has been made to solve the above-described conventional problems, and an object of the present invention is to provide a secure OS terminal and a distribution server and a secure OS terminal that constitute a software update system that can easily operate the secure OS terminal. Is to provide.

  The software update system of the present invention receives an update program and an update security policy corresponding to the update program, a distribution server that is preinstalled with a secure OS, and receives the update program and the update security policy distributed from the distribution server. A secure OS terminal.

  According to the first aspect of the present invention, the distribution server receives, from the secure OS terminal, the update program information requesting the update of the implementation program pre-installed in the secure OS terminal and the implementation security policy corresponding to the implementation program. An update request receiving unit; and a distribution unit that distributes the update program and the update security policy when update request information is received by the update request receiving unit. The secure OS terminal includes update request information transmitting means for transmitting update request information to a distribution server, and installation means for installing the update program and update security policy distributed by the distribution means.

  With this configuration, the user does not need to set a security policy and can easily operate the secure OS terminal.

  According to the embodiment of the present invention, the secure OS terminal distributes the abnormality detection means for detecting an abnormality and the abnormality information detected by the abnormality detection means when the program and the security policy are installed by the installation means. An abnormality information transmission means for transmitting to the server, and the distribution server corrects the security policy based on the abnormality information by the abnormality information receiving means for receiving the abnormality information transmitted by the abnormality information transmission means, and the abnormality information receiving means. And a distribution unit distributes the security policy modified by the modification unit, and the installation unit installs the modified security policy.

  With this configuration, when the user fails to install a security policy or the like, a new security policy can be distributed. Therefore, it is not necessary to set a security policy, and the secure OS terminal can be easily operated.

  In another embodiment of the present invention, the distribution server has an abnormality notifying means for notifying an abnormality when the abnormality information is received by the abnormality information receiving means.

  With this configuration, when the user fails in installation, an abnormality can be notified and a quick response can be made.

  According to the second aspect of the present invention, the distribution server collects the mounting program information of the mounting program pre-installed in the secure OS terminal and the mounting security policy information of the mounting security policy corresponding to the mounting program; When it is determined that the mounting program and the mounting security policy are updated based on the information collected by the information collecting unit, and whether the mounting program is updated by the update determining unit And the distribution means for distributing the update security policy corresponding to the implementation program when the update determination means determines that the implementation security policy is updated by the update determination means, and the secure OS terminal Update programs and updates distributed by distribution means It has the installation means for installing the security policy.

  With this configuration, the user does not need to set a security policy every time the program is updated, and the secure OS terminal can be easily operated.

  Further, according to the embodiment of the present invention, the secure OS terminal includes an abnormality detection unit that detects an abnormality when the update security policy is installed by the installation unit, and an abnormality information detected by the abnormality detection unit. The distribution server includes an abnormality information receiving unit for receiving the abnormality information transmitted by the abnormality information transmitting unit, and the update security policy based on the abnormality information by the abnormality information receiving unit. Correction means for correcting, the distribution means distributes the security policy corrected by the correction means, and the installation means installs the corrected security policy.

  With this configuration, when the user fails to install a security policy or the like, a new security policy can be distributed. Therefore, it is not necessary to set a security policy, and the secure OS terminal can be easily operated.

  According to another embodiment of the present invention, the distribution server has the abnormality notifying means for notifying abnormality when the abnormality information is received by the abnormality information receiving means.

  With this configuration, when the user fails in installation, an abnormality can be notified and a quick response can be made.

  The present invention can provide a secure OS distribution system capable of easily operating a secure OS terminal.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram of a software update system according to the first embodiment of this invention.

  In FIG. 1, a software update system 1 includes a distribution server 2 that distributes a program such as an application program and a security policy corresponding to the program, and a secure OS installed in advance, and the program and security policy distributed from the distribution server 2. A plurality of secure OS terminals 3 to be received, a program development server 4 that distributes a program to the distribution server 2, and a security policy development server 5 that distributes a security policy to the distribution server 2 are provided. The distribution server 2, the plurality of secure OS terminals 3, the program development server 4, and the security policy development server 5 are connected via the network 6 and can communicate with each other through a secure session such as encryption so as to prevent data tapping and tampering. It is like that.

  The secure OS means TrustedOS, SELinux, TrustedBSD, and the like, and the secure OS terminal 3 is assumed to have one or more of these secure OSs installed in advance. The security policy means a broad security policy, and the broad security policy (hereinafter simply referred to as a security policy) includes a security context and a narrow security policy (hereinafter simply referred to as a narrow security policy). ing.

  A security context means what kind of label is assigned to a resource such as a file. A narrowly defined security policy is what a process generated by executing an executable file with a certain label. It means something that assigns such a label or describes the definition of the label and the permission (access control) between the labels.

  The program development server 4 includes a program development unit (not shown) that develops a program to be stored in a program / security policy DB described later, and a program delivery unit (not shown) that distributes the program developed by the program development unit to the distribution server 2. And have. The program development means is designed to develop a new program by a program developer.

  The security policy development server 5 distributes to the distribution server 2 a security policy development means (not shown) for developing a security policy to be stored in the program / security policy correspondence DB, which will be described later, and a security policy developed by the security policy development means. Security policy distribution means (not shown). The security policy development means develops a new security policy by a security policy developer.

  As shown in FIG. 2, the distribution server 2 includes a communication unit 12 that receives a program and a security policy distributed by the program development server 4 and the security policy development server 5, respectively, and a program and security received by the communication unit 12. It has a program / security policy correspondence DB 11 for storing a combination of policies. Note that there may be a plurality of combinations of programs stored in the program / security policy correspondence DB 11 and security policies corresponding to the programs, and an operation guideline or the like for one program among the plurality of programs. There may be a plurality of security policies.

  As shown in FIG. 3, the secure OS terminal 3 sends a request unit 24 for requesting distribution of a program and a security policy corresponding to the program, and transmits request information requested by the request unit 24 to the distribution server 2 (not shown). Request information transmission means. The request information transmitting means constitutes the communication unit 21.

  The distribution server 2 receives the request information transmitted by the request information transmitting unit, and the program stored in the program / security policy correspondence DB 11 based on the request information received by the request information receiving unit. Based on the request information received by the request information receiving means, there is provided a security policy distribution means for distributing the security policy stored in the program / security policy corresponding DB 11 based on the request information received by the request information receiving means. The request information receiving unit, the program distribution unit, and the security policy distribution unit constitute a communication unit 12. The program distribution means and the security policy distribution means are configured to distribute the distributed program and security policy in a package.

  The secure OS terminal 3 includes a distribution program receiving unit that receives a program distributed by the program distribution unit, a distribution security policy receiving unit that receives a security policy distributed by the security policy distribution unit, a distribution program receiving unit, and distribution security. And an installation unit 22 for installing the program and security policy received by the policy receiving means. The distribution program receiving unit and the distribution security policy receiving unit constitute a communication unit 21.

  As described above, the software update system 1 provides a distribution service for distributing a program and a security policy based on a distribution request for the program and the security policy by the secure OS terminal 3.

  The software update system 1 updates the old version program and the old version security policy when the secure OS terminal 3 that provided the distribution service installs the upgraded program, that is, the new version program and the new version security corresponding to the new version program. A configuration for providing an update service for providing a policy will be described.

  The secure OS terminal 3 includes a preinstalled implementation program and an update request unit that requests an update of the implementation security policy corresponding to the implementation program, and update request information that transmits update request information requested by the request unit to the distribution server 2. It has a transmission means. The update request means is constituted by the request unit 24 (shown in FIG. 3), and the update request information transmission means is constituted by the communication unit 21 (shown in FIG. 3).

  As shown in FIG. 2, the distribution server 2 is based on update request information receiving means (not shown) that receives update request information transmitted by the update request information transmitting means, and update request information received by the update request information receiving means. The information collection unit 13 that collects the program information of the implementation program of the secure OS terminal 3 and the security policy information of the implementation security policy, and the program / program based on the implementation program information and the implementation security policy information collected by the information collection unit 13 A search unit 16 that searches for a program and a security policy stored in the security policy corresponding DB 11, an update determination unit 15 that determines whether or not an update is performed based on a search result of the search unit 16, and an update determination unit 15 Based on the determination result, the search unit 16 searches. It has a patch delivering device for delivering the update, and updates the security policy distribution means for distributing the updated security policy searched by the search unit 16. The update request information receiving unit, the update program distribution unit (distribution unit), and the update security policy distribution unit (distribution unit) constitute a communication unit 12.

  The information collection unit 13 is configured to collect the mount secure OS information, the mount program information, and the mount security policy information mounted on the secure OS terminal 3 based on the update request information.

  The secure OS terminal 3 has update program receiving means for receiving the update program distributed by the update program distribution means, and update security policy receiving means for receiving the security policy distributed by the update security policy distribution means. . The update program receiving unit and the update security policy receiving unit constitute a communication unit 21 (shown in FIG. 3).

  As shown in FIG. 3, the secure OS terminal 3 includes a program distributed by the program distribution unit, a security policy distributed by the security policy distribution unit, an update program distributed by the update program distribution unit, and an update security policy distribution unit. When the distributed security policy is installed, an abnormality detection unit 23 that detects an abnormality and an abnormality information transmission unit (not shown) that transmits abnormality information detected by the abnormality detection unit 23 to the distribution server 2 are provided. ing. The abnormality information transmitting means constitutes the communication unit 21.

  As shown in FIG. 2, the distribution server 2 manages the distribution server 2 when the abnormality information is received by the abnormality information receiving unit and the abnormality information receiving unit that receives the abnormality information transmitted by the abnormality information transmitting unit. An abnormality notifying unit 17 that notifies the administrator of the abnormality, and a correcting unit 18 that corrects the security policy when the abnormality is notified by the abnormality notifying unit 17. The abnormality information receiving means constitutes the communication unit 12.

  When the cause of abnormality is a security policy, the correction unit 18 controls the search unit 16 to search for a security policy corresponding to a distributed program among a plurality of security policies stored in the program / security policy correspondence DB 11. It is supposed to be. The retrieval unit 16 retrieves the corresponding security policy from the program / security policy correspondence DB 11 and distributes it to the secure OS terminal 3 via the communication unit 12.

  The correction unit 18 transmits development request information indicating a security policy development request to the security policy development server 5 via the network 6 when the corresponding security policy does not exist in the program / security policy correspondence DB 11. May be. In this case, the security policy development server 5 develops a new security policy and distributes it to the distribution server 2. The correction unit 18 may also correct the security policy in the distribution server 2 if the security policy is a simple correction. In addition, when the cause of abnormality is a program, the correction unit 18 may transmit development request information indicating a program development request to the program development server 4 via the network 6. In this case, the program development server 4 develops a new program and distributes it to the distribution server 2.

  The operation of the software update system configured as described above will be described with reference to FIG.

  First, as shown in FIG. 4, the update request information is transmitted by the update request information transmitting unit of the secure OS terminal 3 (step 101), and the update request information is received by the update request information receiving unit of the distribution server 2 (step 102). ).

  Next, information on the secure OS terminal 3 is collected by the information collecting unit 13 (step 103), and based on the collected result, the search unit 16 selects from the programs and security policies stored in the program / security policy correspondence DB 11. The corresponding update program and update security policy are searched (step 104), and the update determination unit 15 determines the update (step 105). Next, when it is determined that the update determination unit 15 has updated, the update program and update security policy are distributed to the secure OS terminal 3 by the distribution unit (step 106), while the update determination unit 15 updates the update program and update security policy. When it is determined that it has not been done, the secure OS terminal 3 is notified to that effect and the processing is terminated.

  Next, the update program receiving unit and the update security policy receiving unit receive the update program and the update security policy (step 107), and the received update program and update security policy are installed by the installation unit 22 (step 108). If the update program process is a daemon, the process is restarted. Next, when an abnormality is detected by the abnormality detection unit 23 during installation by the installation unit 22, the abnormality information is transmitted to the distribution server 2 by the abnormality information transmission unit (step 109).

  Next, the abnormality information transmitted by the abnormality information transmitting unit is received by the abnormality information receiving unit (step 110), and the abnormality notification unit 17 notifies the abnormality (step 111). Next, the new security policy searched by the search unit 16 is distributed to the secure OS terminal 3 via the communication unit 12 (step 112).

  The new security policy distributed by the communication unit 12 is received (step 113), and the new security policy is installed by the installation unit 22 (step 114).

  In the software update system 1 according to the first embodiment of the present invention as described above, the program distributes the combination of the update program and the update security policy corresponding to the update program to the secure OS terminal 3 in response to the update request. Therefore, the user can easily operate the secure OS terminal 3.

  Next, the software update system 1 according to the first embodiment described above distributes an update program and an update security policy in response to an update request from the secure OS terminal 3 in the update service. For example, in order to cope with the vulnerability of the implementation program and the implementation security policy when a certain problem occurs in the implementation program and the implementation security policy pre-installed in the secure OS terminal and the vulnerability is discovered. The software update system according to the second embodiment described below may be used to distribute the update program and the update security policy.

[Second Embodiment]
FIG. 5 is a block diagram of the distribution server 2 constituting the software update system according to the second embodiment of this invention. Since the configuration of the software update system of the first embodiment is the same except for the information collection unit 13 ′ of the distribution server 2, the same parts are denoted by the same reference numerals and the description thereof is omitted.

  In the software update system according to the first embodiment, the information collection unit 13 collects the program information of the implementation program of the secure OS terminal 3 and the security policy information of the implementation security policy based on the update request information. However, the information collection unit 13 ′ in the software update system according to the present embodiment transmits the information collection request, and the mounted secure OS information, the installed program information, the installed security policy information, and the like of the secure OS terminal 3 are transmitted according to the response. It comes to collect.

  The operation of the software update system configured as described above will be described with reference to FIG.

  First, as shown in FIG. 5, information on the secure OS terminal 3 is collected by the information collection unit 13 ′ (step 201), and the program and security policy stored in the program / security policy correspondence DB 11 based on the collection result. The corresponding update program and update security policy are searched from among them (step 202), and the update determination unit 15 determines the update (step 203). Next, when it is determined that the update is determined to be updated by the update determination unit 15, the update program and the update security policy are distributed to the secure OS terminal 3 by the distribution unit (step 204), while the update determination unit 15 is updated. If it is determined that the process has not been performed, the process ends without performing the update process.

  Next, the update program and update security policy are received by the update program and update security policy receiving means (step 205), and the received update program and update security policy are installed by the installation unit 22 (step 206). Next, when the abnormality is detected by the abnormality detection unit 23 during installation by the installation unit 22, the abnormality information is transmitted to the distribution server 2 by the abnormality information transmission means (step 207).

  Next, the abnormality information transmitted by the abnormality information transmitting unit is received by the abnormality information receiving unit (step 208), and the abnormality notification unit 17 notifies the abnormality (step 209). Next, the new security policy searched by the search unit 16 is distributed to the secure OS terminal 3 via the communication unit 12 (step 210).

  The new security policy distributed by the communication unit 12 is received (step 211), and the new security policy is installed by the installation unit 22 (step 212).

  Such a software update system according to the second embodiment of the present invention is, for example, an update program and update even if there is no update request from the user when some vulnerability is found in the implementation program and the implementation security policy. Since the security policy is distributed, the user can easily operate the secure OS terminal.

  The software update system according to the second embodiment of the present invention distributes update programs and update security policies. For example, when a program update is installed using another site, etc. In order to cope with this, only the update security policy may be distributed. In this case, since the update security policy is distributed even if there is no update request, the user can easily operate the secure OS terminal.

  The distribution server and secure OS terminal according to the present invention are recorded on a computer-readable recording medium, and a program for realizing the functions is recorded on the recording medium, in addition to those realized by dedicated hardware. The read program may be read into a computer system and executed. The computer-readable recording medium refers to a recording medium such as a floppy disk, a magneto-optical disk, a CD-ROM, or a storage device such as a hard disk device built in the computer system. Furthermore, a computer-readable recording medium is a server that dynamically holds a program (transmission medium or transmission wave) for a short period of time, as in the case of transmitting a program via the Internet, and a server in that case. Some of them hold programs for a certain period of time, such as volatile memory inside computer systems.

It is a block diagram of the software update system in the 1st Embodiment and 2nd Embodiment of this invention. It is a block diagram of the delivery server which comprises the software update system in the 1st Embodiment and 2nd Embodiment of this invention. It is a block diagram of the secure OS terminal which comprises the software update system in the 1st Embodiment and 2nd Embodiment of this invention. It is a flowchart for demonstrating operation | movement of the delivery server and the secure OS terminal which comprise the software update system in the 1st Embodiment of this invention. It is a block diagram of the delivery server which comprises the software update system in the 2nd Embodiment of this invention. It is a flowchart for demonstrating operation | movement of the delivery server and secure OS terminal which comprise the software update system in the 2nd Embodiment of this invention.

Explanation of symbols

1 Software Update System 2 Distribution Server 3 Secure OS Terminal 4 Program Development Server 5 Security Policy Development Server 6 Network 11 Program / Security Policy DB
12 communication unit 13, 13 'information collection unit 15 update determination unit 16 search unit 17 abnormality notification unit 18 correction unit 21 communication unit 22 installation unit 23 abnormality detection unit 24 request unit 101-114, 201-212 steps

Claims (9)

In a distribution server that distributes an update program and an update security policy corresponding to the update program,
An update request receiving means for receiving, from the secure OS terminal, an update request information for requesting an update of an implementation security policy corresponding to the implementation program implemented in advance in the secure OS terminal in which the secure OS is implemented;
A distribution server comprising: distribution means for distributing the update program and the update security policy when the update request information is received by the update request receiving means. In the secure OS terminal, anomaly information receiving means for receiving the anomaly information detected when the program and the security policy are installed from the secure OS, and an anomaly information receiving means for executing the security policy based on the anomaly information. Correction means for correcting,
The delivery means delivers the security policy modified by the modification means;
The distribution server according to claim 1. In a distribution server that distributes an update program and an update security policy corresponding to the update program,
Information collecting means for collecting mounting program information of a mounting program pre-installed in a secure OS terminal and mounting security policy information of a mounting security policy corresponding to the mounting program;
Update determination means for determining whether or not the implementation program and the implementation security policy are updated based on the information collected by the information collection means;
When the update determination unit determines that the implementation program is updated, the update program is distributed, and when the update determination unit determines that the implementation security policy is updated, the implementation program is updated. And a distribution means for distributing an update security policy corresponding to the distribution server. In the secure OS terminal, anomaly information receiving means for receiving the anomaly information detected when the updated security policy is installed from the secure OS, and the update based on the anomaly information received by the anomaly information receiving means And a correction means for correcting the security policy,
The delivery means delivers the security policy modified by the modification means;
The distribution server according to claim 3.   5. The distribution server according to claim 2, further comprising abnormality notifying means for notifying the abnormality when abnormality information is received by the abnormality information receiving means. In the secure OS terminal that receives the update program and the update security policy distributed from the distribution server that distributes the update program and the update security policy corresponding to the update program, in which the secure OS is mounted in advance
Update request information transmitting means for transmitting, to the distribution server, update request information for requesting an update of an implementation program pre-installed in the secure OS terminal and an implementation security policy corresponding to the implementation program;
An secure OS terminal comprising: an installation unit that installs the update program and the update security policy distributed by the distribution server when the update request information is received. An abnormality detection means for detecting an abnormality when the program and the security policy are installed by the installation means;
An anomaly information transmitting means for transmitting the anomaly information detected by the anomaly detecting means to the distribution server;
The installation means installs a security policy modified by the distribution server based on the abnormality information;
The secure OS terminal according to claim 6. In a secure OS terminal in which a secure OS is mounted in advance,
When it is determined that the implementation program installed in advance in the secure OS terminal is updated, the update program distributed by the distribution server is installed, and the implementation security policy corresponding to the implementation program is updated A secure OS terminal comprising: installation means for installing an update security policy corresponding to the implementation program distributed by the distribution server when it is determined that An abnormality detecting means for detecting an abnormality when the update security policy is installed by the installing means;
An anomaly information transmitting means for transmitting the anomaly information detected by the anomaly detecting means to the distribution server;
The installation means installs a security policy that has been corrected and distributed based on abnormality information by the distribution server,
The secure OS terminal according to claim 8.

Images