JP5463112B2 - Information processing apparatus, file access control method, program, and computer-readable recording medium - Google Patents

Description

The present invention relates to an information processing apparatus, a file access control method, a program, and a computer-readable recording medium, and more particularly to a technique that is preferably applied to a security measure in a PC used by a corporate user, for example.

  In general, in an organization such as a company, an information processing apparatus such as a PC used by a user such as an employee for business is prepared by the organization and lent or provided to the user. Information processing devices used in such organizations' business operations are responsible for the user's departmental responsibility in order to prevent leakage of confidential information, use other than business operations, and use of users who are not intended by the organization even for business use. Must be constantly monitored and managed by the administrator or system administrator.

  As one form of management by a system administrator or the like, there is a use restriction of software that is used by a user to effectively protect a file stored in a protection target folder (a file in a so-called protection area). For example, the registry editor is one piece of software that the system administrator wants to restrict use because it can freely change the settings of the terminal, and if the usage method is incorrect, the OS cannot even be started. In addition, peer-to-peer file exchange software such as Winny can cause leakage of confidential information, so it can be said that the system administrator wants to restrict use.

  As a method of restricting the use of software to be used by the user, it is desired to register the use permission information in association with the OS user in the attribute information of the software to be managed, and to prohibit the use of the software for the anti-virus software. There is a method of managing a list of software file names (black list) and restricting the use of software corresponding to the black list.

  In relation to the latter method, for example, Patent Document 1 discloses an electronic data leakage prevention program that permits or denies a request based on a permission list when a file access request from an application program is received. In the electronic data leakage prevention program, if the program name of the request source program is in the permission list, the request is transmitted to the file system, and if the program name is not in the permission list, the input by the user is awaited and permitted. If the request is transmitted to the file system, the program name is added to the permission list, and if there is an input not permitting, the request is rejected.

JP 2007-249782 A

  With the technology of Patent Document 1, it is only possible to completely prohibit or permit the use of software to be managed. In other words, if you want to restrict software startup (starting from the start menu, etc.) while all functions of the software can be used, but want to run it when called by another program to perform a specific operation There is a problem that you can not.

  For example, with regard to the registry editor mentioned above, there is utility software that changes terminal settings within the range permitted by the system administrator, etc., and it manages registry change data. If it is realized by calling, if the use of the registry editor is restricted, the utility software will not operate normally.

  Therefore, in view of the circumstances described above, the present invention flexibly restricts the use of software by a user, and does not interfere with the function of the parent software that uses the restricted software. The purpose is to enable effective protection.

The information processing apparatus according to the embodiment of the present invention is to identify a second program that calls the first program to attempt to access a protected file stored in the specified protected folder for protection, the protected using the second list for limiting the second program invoking the first program to access the file, determines accessibility determination of accessibility to the protected file using said first program by the second program means and monitors access the to the protected file by the first program using a first list for limiting the first program to access the protected file, first program that has accessed the secure files notify the name to the accessibility determination unit, the accessibility determination unit Has an access monitoring means for permitting or prohibiting access to the protected file by the first program based on the determination result, wherein the accessibility determination means, it notified the first program by the access monitoring means The second program calling the first program is identified from the name, the access to the protection target file using the first program is determined by the second program, and the determination result is sent to the access monitoring means. notified, the accessibility determination unit, and the case where not the case and inhibited there is permission for access monitoring means, said second program calls the first program, called the first program the protected You can access the file.

An access control method according to one aspect of the present invention uses a first list for restricting a first program for access monitoring means to access a protection target file stored in a protection target folder designated as a protection target. , first a first determination step of determining accessibility to the protected file by the first program, said access monitoring means, for notifying the first program name that has accessed the protected file access permission determination unit And the first program notified by the first notification step of the second program calling the first program determined to be accessible by the first determination step. second flop identified from the name, calling the first program to access the protected file Using the second list for limiting grams, and a second determination step of determining accessibility to the second program the protected file using said first program by, said access permission determination unit, determination a second notification step of notifying the result of access permission to the access monitoring means, said access monitoring means, on the basis of the second determination result of the determination in step, access to the protected file by the first program anda access monitoring step to permit or prohibit, the first determination step, and if if there is accessible determined and there is no inaccessible determined by the second determination step, the second program is the first 1 call program, the invoked first program can access the protected file .

Program which is an aspect of the present invention is to identify a second program that calls the first program to attempt to access a protected file stored in the computer, the designated protected folder for protection, the protection using the second list for limiting the second program invoking the first program to access the target file, determines accessibility of accessibility to the said protected file using the first program according to the second program and determining function, the access by using the first list for limiting the first program to gain access to secure files to the protected file by the first program monitors the has accessed the secure files 1 notify the name of the program in the access determination function, the access An access monitoring function for permitting or prohibiting access to the determination result to the protected file by the first program based by determination function is realized, the accessibility determination function is notified by the access monitoring function A second program that calls the first program is identified from the first program name, whether or not the second program can access the protection target file using the first program is determined, and the determination result is obtained notifies the access monitoring function, the access permission determination function, and the case where not the case and inhibited there is permission from the access monitoring function, the second program calls the first program, called the first program There can be access to the protected file.

A computer-readable recording medium according to one aspect of the present invention stores the above program.

  According to the present invention, it is possible to flexibly limit the use of software by a user and effectively protect files in the protection area without affecting the function of the parent software that uses the restricted software. It becomes possible.

It is the figure which showed the hardware constitutions of PC which concerns on embodiment of this invention. It is the figure which showed the function structure of PC which concerns on embodiment of this invention. It is a block diagram for demonstrating the file access control which concerns on embodiment (1st) of this invention. It is the chart which showed the flow of the file access control process which concerns on embodiment (1st) of this invention. It is a block diagram for demonstrating file access control which concerns on embodiment (2nd) of this invention. It is the chart which showed the flow of the file access control process which concerns on embodiment (2nd) of this invention. It is a block diagram for demonstrating file access control which concerns on embodiment (2nd) of this invention.

  Embodiments of the present invention will be described below with reference to the drawings.

[First Embodiment]
In the first embodiment of the present invention, the first access permission determination is performed for the first program that directly accesses the protection target file, and the second access permission determination is performed for the second program that calls the first program. It is intended to effectively and flexibly restrict access to the protection target file of the second program via one program.

  First, the configuration of the PC according to the present embodiment will be described. FIG. 1 is a diagram illustrating a hardware configuration of a PC according to the present embodiment. The PC 1 of this embodiment is a PC having a general hardware configuration, and includes a CPU 2, a memory 3, a hard disk 4, an input device 5, and an output device 6. The CPU 2 controls the overall operation of the information processing apparatus in accordance with the OS stored in the memory 3 and the program specific to the present embodiment, determines the first access permission for the first program that directly accesses the protection target file, A second access permission determination is performed for the second program that calls the first program. The memory 3 has a storage area (ROM) for storing the OS and programs unique to the present embodiment, and a work storage area (RAM) used for various processes of the CPU 2. The hard disk 4 is an external storage device that holds various data. The input device 5 is a device for inputting operation information by a user. The output device 6 is a device that performs screen output of various data.

  FIG. 2 is a diagram showing a functional configuration of the PC according to the present embodiment. In the PC according to the present embodiment, the CPU 2 reads a program unique to the present embodiment stored in the memory 3, performs a first access permission determination on the first program that directly accesses the protection target file, and calls the first program. The control unit 100 is configured as a functional unit for performing the second access permission determination on the second program. The control unit 100 logically includes a call source program monitoring unit 110 and a protection area monitoring unit 120.

  The call source program monitoring unit 110 corresponds to an access permission determination unit that performs a second access permission determination on the second program that is calling the first program that has accessed the protection target file. More specifically, the program name of the first program is received from the protection area monitoring means 120, and the second program calling the first program is searched and specified. Then, the second list for restricting the second program is used to determine whether the second program can access the protection target file using the first program (second access permission determination), and the determination result is protected. The area monitoring unit 120 is notified.

  The protection area monitoring unit 120 corresponds to an access monitoring unit that performs first access permission determination on the first program that directly accesses the protection target file. More specifically, the first program monitors the access to the protection target file by the first program, and uses the first list for limiting the first program when the first program accesses the protection target file. It is determined whether or not access to the protection target file is performed (first access permission determination). If the first list is a white list (list that lists accessible programs), it is determined that access is possible. If the first list is a black list (list that lists inaccessible programs), it is determined that access is not possible. In this case, that is, when it is determined that the second access permission determination is to be performed, the calling program monitoring unit 110 is notified of the program name of the first program. Then, the second access permission determination result is received from the call source program monitoring unit 110, and the final permission or prohibition of access to the protection target file by the first program is performed.

  Next, operations performed by the PC according to the present embodiment will be described. FIG. 3 is a block diagram for explaining the file access control of this embodiment, and FIG. 4 is a chart showing the flow of the file access control process of this embodiment. The caller permission list is a list corresponding to the second list used for determination by the caller program monitoring unit 110, and is a list (white list) in which programs that can access the protection area and the caller programs of the programs are listed. . The permission list is a list corresponding to the first list used for determination by the protection area monitoring unit 120, and is a list (white list) in which programs that can access the protection area are listed. Here, program 1 will be described as a registry editor, program 2 as utility software, and protected area 1 as a registry.

  First, the program 2, which is utility software, calls the program 1, which is a registry editor, in order to change terminal settings (S101). The program 1 called by the program 2 makes an access request to the registry in the protection area 1 to the protection area monitoring means (S102).

  The protected area monitoring means that has received the access request from the program 1 refers to the permission list and checks whether the program name of the program 1 is in the list (S103). As shown in FIG. 3, since the program name of the program 1 is in the permission list, the protection area monitoring means can access the protection target file in the protection area 1 (the possibility that it can be correctly accessed). (If the result of the determination by the call source program monitoring means is not accessible, access is ultimately not permitted), and the program name of the program 1 is notified to the call source program monitoring means.

  If the program name of the program 1 is not in the permission list, it is determined that the program 1 cannot access the protection target file in the protection area 1, and an NG response is sent to the program 1 (S104). In response to this, the program 1 makes an NG response to the program 2 (S105).

  The calling source program monitoring means that has received the program name of the program 1 searches the calling source program (the program that called the program 1) from the program name, and acquires the program name of the program 2 (S107). Then, the calling source program monitoring means checks whether the program name of the program 2 is in the list with reference to the calling source permission list (S108).

  As shown in FIG. 3, since the program name of the program 2 is in the call source permission list, the call source program monitoring unit can access the protection target file in the protection area 1 when the program 1 is called by the program 2. It is determined that there is, and an OK response is sent to the protection area monitoring means (S112). In response to this, the protection area monitoring means makes an OK response to the program 1 (S113), and the program 1 accesses the protection target file in the protection area 1 and changes the setting of the terminal (S114).

  When the program name of the program 2 is not in the call source permission list, the call source program monitoring unit determines that the program 1 called by the program 2 cannot access the protection target file in the protection area 1, and the protection area An NG response is sent to the monitoring means (S109). In response to this, the protection area monitoring means makes an NG response to the program 1 (S110), and the program 1 makes an NG response to the program 2 (S111).

  In the present embodiment, the first access permission determination is performed for the first program that directly accesses the protection target file, the second access permission determination is performed for the second program that calls the first program, and finally the protection target file is determined. Therefore, the access to the protection target file of the second program via the first program can be effectively and flexibly restricted.

[Second Embodiment]
In the second embodiment of the present invention, the permission list and the caller permission list are used as protection areas, and access to these lists by the caller program monitoring means, the protection area monitoring means, and the like is as in the first embodiment described above. Access is restricted by determining whether access is possible. In the second embodiment, file access control is performed in a so-called nested manner in which file access using a permission list and a caller permission list is also applied to access to these lists. Since the hardware configuration and functional configuration of the PC are the same as those in the first embodiment, description thereof is omitted.

  FIG. 5 is a block diagram for explaining the file access control of this embodiment, and FIG. 6 is a chart showing the flow of the file access control processing of this embodiment. In this embodiment, the permission list is a file in the protection area 2, the caller permission list is a file in the protection area 3, and a protection area setting means for creating a new permission list, changing contents, and holding data, a caller permission list The PC is further provided with a caller program setting means for creating a new file, changing contents, and holding data, a protection area setting means and a personal authentication means for calling the caller program setting means.

  The permission list includes a program 1 as software that allows access to the protection area 1, a protection area monitoring means and protection area setting means as software that allows access to the protection area 2, and software that allows access to the protection area 3. As shown, caller program monitoring means and caller program setting means are listed.

  The caller permission list includes a program 1 as software permitted to access the protected area 1, a program 2 as its caller, a protected area monitoring means as software permitted to access the protected area 2, an OS as its caller, Protection area setting means as software permitted to access the protection area 2, personal authentication means as its caller, caller program monitoring means as software permitted to access the protection area 3, OS as its caller, protection area 3 Caller program setting means is listed as software that is allowed to access the device, and personal authentication means is listed as the caller.

  Since the case where the program 1 called the program 2 accesses the protection area 1 is described in the first embodiment, the protection area setting means called by the personal authentication means accesses the permission list for changing the contents. File access control will be described. The file access control in this case is basically the same as that shown in FIG. 4 in the first embodiment.

  When the protection area setting means tries to access the permission list, since the permission list is in the protection area 2, the protection area monitoring means temporarily restricts access (S201, S202). Then, the protection area monitoring means refers to the permission list (S203), confirms that the protection area setting means is listed as software that can access the protection area 2, and is attempting to access the protection area 2 Is notified to the calling source program monitoring means (S204).

  The calling source program monitoring unit searches for the calling source of the protection area setting unit and grasps that the calling source is a personal authentication unit (S205). Then, the calling source program monitoring unit refers to the calling source permission list (S206), and confirms that the protected area setting unit and the personal authentication unit are listed as software that can access the protected area and its calling source. Then, an OK response is notified to the protection area monitoring means (S207).

  The protection area monitoring means receives the OK response from the caller program monitoring means, notifies the protection area setting means of the OK response, and permits the protection area setting means to access the permission list (S208).

  The protection area monitoring means does not access the permission list in the protection area 2 but refers to the permission list in its own memory when determining whether or not the software that attempts to access the data in the protection area is accessible. To do. The protection area monitoring means accesses the permission list in the protection area 2 and copies it to its own memory until it is in a state where the file access restriction can be performed after being started up. The permission list can be accessed before the file access restriction by the protected area monitoring means functions. The same applies to the case where the caller program monitoring refers to the caller permission list.

  The protection area setting means receives the OK response from the protection area monitoring means, accesses the permission list in the protection area 2 (S209), changes the contents, and saves the contents (S210). When the protection area setting means updates the permission list, it notifies the protection area monitoring means that the permission list has been updated (S211). The protected area monitoring means that has received the notification of permission list update tries to access the permission list in the protected area 2 in order to rewrite the permission list in its own memory with the updated contents.

  At this time, since file access restriction by the protection area monitoring means is functioning, access to the protection area 2 itself is temporarily restricted. The protection area monitoring means refers to the permission list in its own memory (S212), confirms that the protection area monitoring means is listed as software that can access the protection area 2, and tries to access the protection area 2 The calling source program monitoring means is notified that the software is protected area monitoring means (S213).

  The calling source program monitoring unit searches for the calling source of the protection area monitoring unit and grasps that the calling source is the OS (S214). Then, the calling source program monitoring unit refers to the calling source permission list (S215), confirms that the protected area monitoring unit and the OS are listed as software that can access the protected area and its calling source, An OK response is notified to the protection area monitoring means (S216).

  The protection area monitoring means receives the OK response from the calling source program monitoring means, accesses the permission list in the protection area 2 (S217), and rewrites the permission list in its own memory with the updated contents (S218). .

  In the flow described above, the caller program setting unit called by the personal authentication unit accesses the caller permission list to change the contents, and the caller program monitoring unit updates the caller permission list in its own memory. The same applies when rewriting the contents.

FIG. 7 is a diagram for explaining the effect of the file access control of the present embodiment. As shown in FIG. 7 (1), when an unauthorized program directly accesses the protected area 1, the protected area monitoring means can prohibit unauthorized access by the unauthorized program. In addition, as shown in FIG. 7 (2), when a malicious program accesses directly to add itself to the permission list in the protected area 2, the protected area monitoring means can prohibit unauthorized access by the unauthorized program. It is.

Further, as shown in FIG. 7 (3), when an unauthorized program calls the program 1 and accesses the protection area 1, the calling source program monitoring means may prohibit unauthorized access via the program 1 by the unauthorized program. Is possible. Further, as shown in FIG. 7 (4), when an unauthorized program directly accesses to add to the caller permission list in the protected area 3, the protected area monitoring means prohibits unauthorized access by the unauthorized program. Is possible.

Further, as shown in FIG. 7 (5), when the unauthorized program calls and accesses the protection area setting means to add itself to the permission list in the protection area 2, the calling source program monitoring means is caused by the unauthorized program. Unauthorized access via the protected area setting means can be prohibited. As shown in FIG. 7 (6), when an unauthorized program calls and accesses the caller program setting means to add itself to the caller permission list in the protected area 3, the caller program monitoring means It is possible to prohibit unauthorized access via a caller program setting means by an unauthorized program.

  The above-described embodiment is a preferred embodiment of the present invention, and the scope of the present invention is not limited to the above-described embodiment alone, and various modifications are made without departing from the gist of the present invention. Implementation is possible.

  That is, the program executed on the PC according to this embodiment has a module configuration including the above-described units (caller program monitoring unit 110 and protection area monitoring unit 120), and uses actual hardware. Realize concrete means. That is, when the computer (CPU) reads a program from a predetermined recording medium and executes it, the above-mentioned means are loaded onto the main storage device and generated.

  The program executed by the PC according to the present embodiment may be configured to be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. Further, the program may be provided or distributed via a network such as the Internet.

  The program is a file in an installable or executable format, such as a floppy (registered trademark) disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD, nonvolatile memory card, or the like. It may be configured to be provided by being recorded on a computer-readable recording medium. Further, the program may be provided by being incorporated in advance in a ROM or the like.

  In this case, the program code itself read from the recording medium or loaded and executed through the communication line realizes the functions of the above-described embodiments. And the recording medium which recorded the program code comprises this invention.

1 PC
2 CPU
3 Memory 4 Hard Disk 5 Input Device 6 Output Device 100 Control Unit 110 Caller Program Monitoring Unit 120 Protection Area Monitoring Unit

Claims (10)

A second program that specifies a second program that is calling a first program that attempts to access a protection target file stored in a protection target folder that is designated as a protection target, and that calls the first program that accesses the protection target file Access permission determination means for determining whether the second program can access the protection target file using the first program using a second list for restricting
The access to the protection target file by the first program is monitored by using a first list for restricting the first program that accesses the protection target file, and the name of the first program that has accessed the protection target file is An access monitoring unit that notifies an access permission determination unit, and permits or prohibits access to the protection target file by the first program based on a determination result of the access permission determination unit;
Have
The access permission determination unit specifies a second program calling the first program from the first program name notified by the access monitoring unit, and the protection using the first program by the second program Determining whether the target file is accessible and notifying the access monitoring means of the determination result;
The accessibility determination unit, and the case where not the case and inhibited there is permission for access monitoring means, access to the second program calls the first program, called the first program the secured files An information processing apparatus characterized by being capable of performing. The first list and the second list are protection target files stored in the protection target folder,
The access monitoring means monitors access to the first list in the protection target folder by the access monitoring means and access to the second list in the protection target folder by the access permission determination means. The information processing apparatus according to claim 1. First list management means for newly creating the first list, changing contents, and holding data;
A second list management means for newly creating the second list, changing contents, and holding data;
Have
The first list and the second list are protection target files stored in the protection target folder,
The access monitoring means monitors access to the first list in the protection target folder by the first list management means and access to the second list in the protection target folder by the second list management means. The information processing apparatus according to claim 1 or 2. The accessibility determination unit includes a second list holding unit that holds the second list, and uses the second list held by the second list holding unit to execute the first program by the second program. Determine whether to access the protected file used,
The access monitoring means has a first list holding means for holding the first list, and the first program uses the first list held by the first list holding means to access the protection target file. The information processing apparatus according to any one of claims 1 to 3, wherein the information processing apparatus is monitored. The first list lists the first program that can access the protected file,
When the first program that has accessed the protection target file is listed in the first list, the access monitoring unit notifies the access permission determination unit of the first program name,
In the second list, a second program that calls the first program that can access the protected file is listed.
The access permission determination means specifies a second program that is calling the first program from the first program name, and when the second program is listed in the second list, the second program calls the second program Determining that access to the protected file using the first program is possible, and notifying the determination result to the access monitoring means;
The access monitoring means, on the basis of the accessible the determination result of the accessibility determination unit, any one of the four claim 1, characterized in that to allow access to the protected file by the first program The information processing apparatus according to item. The access monitoring means accesses the protection target file by the first program using the first list for restricting the first program that accesses the protection target file stored in the protection target folder designated as the protection target. A first determination step for determining availability;
A first notification step in which the access monitoring unit notifies the access permission determination unit of the name of the first program that has accessed the protection target file;
The access permission determination means identifies the second program calling the first program determined to be accessible in the first determination step from the first program name notified in the first notification step , Using the second list for restricting the second program that calls the first program that accesses the protection target file, it is determined whether or not the second program can access the protection target file using the first program. A second determination step;
A second notification step in which the access permission determination unit notifies the access monitoring unit of access permission of the determination result;
An access monitoring step in which the access monitoring means permits or prohibits access to the protection target file by the first program based on a determination result in the second determination step;
Have
When there is an access permission determination in the first determination step and the second determination step, and when there is no access disapproval determination, the second program calls the first program, and the called first program is A file access control method characterized in that a protected file can be accessed. On the computer,
A second program that specifies a second program that is calling a first program that attempts to access a protection target file stored in a protection target folder that is designated as a protection target, and that calls the first program that accesses the protection target file An access permission determination function for determining whether to access the protection target file using the first program by the second program, using a second list for restricting
The access to the protection target file by the first program is monitored by using a first list for restricting the first program that accesses the protection target file, and the name of the first program that has accessed the protection target file is An access monitoring function for notifying an access permission determination function and permitting or prohibiting access to the protection target file by the first program based on a determination result by the access permission determination function;
Realized,
The access permission determination function identifies the second program calling the first program from the first program name notified by the access monitoring function, and the protection using the first program by the second program Judge whether access to the target file is possible and notify the judgment result to the access monitoring function,
The access permission determination function, and the access monitoring function by when it is not the case and inhibited there is permission, the second program calls the first program, access to the called first program the secured files A program characterized by being able to. The first list and the second list are protection target files stored in the protection target folder,
The access monitoring function monitors access to the first list in the protection target folder by the access monitoring function and access to the second list in the protection target folder by the access permission determination function. The program according to claim 7 . The first list and the second list are protection target files stored in the protection target folder,
The access monitoring function is for creating a new first list, changing the contents, accessing the first list in the protected folder by a first list managing means for holding data, and creating the second list. , content change, the program according to claim 7 or 8, characterized in that for monitoring the access to the second list within the protected folder by the second list management means for performing data retention. A computer-readable recording medium storing the program according to any one of claims 7 to 9 .

Images