JP2000354036A - Protection method for operation history file - Google Patents

Abstract

PROBLEM TO BE SOLVED: To monitor in real time the operation contents of all users and also to monitor the illegal operations to ensure the security by storing an operation history file in an area, where a user cannot perform the input/output operations. SOLUTION: A control program is always resident at a server 11, and a login user monitor program is started, when a user performs a login operation via the terminals 12 existing in a wide range. When the monitor program is started, an operation history file store area definition file 50 which can be accessed only by a system manager is read, and an operation history file 130 is produced in an area where the user cannot perform the input/output operations. When a user's operation occurs, the login user monitor program calls an operation contents output program and starts the writing of the operation contents. Meanwhile, a monitor screen output program is always resident at a monitor terminal 13, and a monitor screen is started when a monitor screen start instruction is received from the login user monitor program.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001] 1. Field of the Invention [0002] The present invention relates to a method for protecting an operation history file which monitors user operations and can be used in any system where security is important.

2. Description of the Related Art Conventionally, systems require security,
Regardless of the necessity, when the user logs in to the system, the operation content is unknown at all. Further, there is no system that can monitor the contents of user operations in real time. For example, even if a user who has a user ID and password, or a user who has illegally entered the system, intentionally destroys the system or steals important data, even after the operation, It is impossible to pursue an individual's operation history. For example, Japanese Patent Laid-Open No.
Although the technology described in Japanese Patent No. 64064 is known, this conventional technology can only pursue an intrusion route of a computer from which the intrusion has occurred, and can pursue the operation contents of an intruder when the intrusion occurs. However, only traces of an intruder remain, and it is not possible to grasp the effect on the system.

The prior art described above is
Once compromised, unauthorized operations cannot be monitored. When the system is destroyed, it is known that the system has been destroyed, such as by an unauthorized intruder into the system, or by a user who is permitted to operate the system, but it is impossible to confirm which user has operated the system. Alternatively, if the data is stolen, there is a problem that the user may not notice that the unauthorized operation has been performed. An object of the present invention is to obtain the operation history of a user in an operation history file and protect the operation history file so that all operation contents can be grasped, and always perform operations in the system from a monitoring terminal. It is an object of the present invention to provide a method of protecting an operation history file for monitoring an unauthorized operation and ensuring security since the operation contents of all users can be monitored in real time.

According to the present invention, the contents of a user operation are acquired in an operation history file, and only the system administrator can modify this operation history file.
Alternatively, since it is stored in an area where it is impossible to know the location, it is protected and realized from the user. By protecting the operation history file, the contents of the user's operation can be grasped, and if an illegal operation occurs, the operation history file can be traced by examining the operation history file. When accessing the operation history file, always check for the existence of the operation history file. If the operation history file does not exist, this user determines that there is a possibility that an unauthorized operation was performed, and Force termination. In addition, an operation monitoring window is opened on the monitoring terminal at the same time as the user logs in, the operation history file is read at a predetermined time interval, and if a user operation has occurred, an additional display is displayed on the screen, thereby real-time Since the operation contents are monitored and the operation monitoring window is closed at the same time as the user logs out, a method for protecting the operation history file is realized.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an embodiment of a method for protecting an operation history file according to the present invention will be described in detail with reference to the drawings. FIG. 1 is a configuration example of a method for protecting an operation history file according to the present invention. Monitoring terminal 13 that monitors user operations
And a terminal 12 operated by a user are connected to the server 11 via a network 14 such as a public network, a firewall, or a wide area WAN. Server 11
Includes an operation history file 130 and an operation history file storage area definition file 50. FIG. 2 is a configuration diagram of an embodiment in a server. In the server, the control program 20 is always resident, and when a user logs in from the terminal 12 existing in a wide area, the login user monitoring program 30 is started. When the login user monitoring program 30 is started, the operation history file storage area definition file 50 accessible only by the system administrator is read, and the operation history file 130 is created in an area where the user cannot input / output. If this occurs, the login user monitoring program 30 calls the operation content output program 40, and the operation content output program 40 starts writing the operation content. Also, the monitoring screen output program 60 is always resident in the monitoring terminal 13,
Upon receiving a monitor screen start instruction from the login user monitoring program 30, the monitor screen is started. FIG. 3 is a configuration diagram of the operation history file storage area definition file.
The operation history file storage area definition file 50 is accessible only by the system administrator, and the operation history file storage area definition file 50 describes only the output area 51 of the operation history file that the user cannot input / output. Since only the system administrator manages the storage location of the operation history file, the user has no way of knowing where the operation history file is obtained. FIGS. 4 to 5 show an example of a processing flow on the server side in the operation history file protection method according to the present invention. FIG. 4 is an example of a processing flow of the control program. The control program 20 executes until the server ends.
In a running state (step 21), the user's login is monitored at intervals of several seconds (22), and if there is a logged-in user (23), a login user monitoring program for monitoring the logged-in user until logging out is called (3).
0). This operation is repeated until the server ends. FIG.
Is an example of the processing flow of the login user monitoring program. When the login user monitoring program is called (step 30), the operation history file storage area definition file 50 is read (31), the operation history file 130 is created in the operation history file output area 51 of the file (32), and the monitoring terminal 13 issues a monitor screen activation instruction (33). Thereafter, the user operation is checked at intervals of several seconds until the user logs out (34) (3).
5) If a user operation (all screen output contents including a typo, backspace (retreat), etc.) has occurred (36), monitor the operation contents to write the operation contents to the operation history file 130. An operation content output program to be sent to the terminal 13 is called (40). When the user logs out, a monitoring screen end instruction is issued to the monitoring terminal, and the process ends (37). FIG. 6 is an example of a processing flow of the operation content output program. To confirm that no unauthorized operation has been performed, the operation content output program 40 checks whether an operation history file exists (step 41), and if so, writes the user operation content to the operation history file. (42) and read the operation history file (4
3) Only new operation content is extracted (44), and an operation content output instruction is issued to the monitoring terminal (45). FIG. 7 is an example of a processing flow of a monitoring screen output program in the monitoring terminal. The monitoring screen output program 60 receives the monitoring screen start instruction (step 61) and starts the monitoring screen (6).
2). Thereafter, until an end instruction from the login user monitoring program is received (63), an instruction is received from the login user monitoring program 30 (64), and the operation content is output to the monitoring screen (65). Upon receiving the end instruction,
The monitoring screen is terminated (66). In addition, UNIX (UNIX is X /
Open Company Limited is a registered trademark in the United States and other countries, exclusively licensed. ) Will be described in detail with reference to the drawings. The configuration example is the same as that of FIG. 1, but is an embodiment realized without using the operation history file storage area definition file 50. FIG. 8 is a configuration diagram of an embodiment in a server. The server 11 has a startup program (.profile) that is started when a user logs in from a terminal 12 existing in a wide area.
80 and directory 1 for temporarily creating operation history files
5, an operation history file creation program 90,
An operation content display program 100 for reading the user's operation content from the operation history file and displaying it on the monitoring terminal 13
An operation content output program 110 for writing the content of the user's operation to the operation history file, and an operation history file from the temporary creation directory 15 to the storage directory 16
The operation history file transfer program 120 moves to the operation history file. When the user logs in, the start-up program 80 is started, and the started-up program 80 reads and monitors the operation history file creation program 90 and the operation history file for creating the operation history file in the temporary creation directory 15. An operation content display program 100 for displaying the operation content on the screen 13 and an operation content output program 110 for outputting the operation content to the operation history file are called. The operation history file creation program 90 called from the startup program 80 creates an operation history file in the temporary creation directory 15. The operation content display program 100 called from the startup program 80 reads the operation history file, and
Display the contents of the operation to. The operation content output program 1 called from the startup program 80
10 outputs the operation content to the operation history file and calls the operation history file transfer program 120. The operation history file transfer program 120 called from the operation content output program 110 stores the temporary creation directory 15
Is moved to the storage directory 16 from the operation history file. First, in the operation history file, all screen outputs including a typo, a back space (retreat) and the like are recorded by the script command. The operation history file needs to be protected from a user who performs an illegal operation, such as updating or deleting, or erasing evidence by deleting the operation history file itself. There is a stage to protect, sc as the first stage
This is to prevent the ript command from starting, but this prevents illegal operation by starting the script command from the startup program (.profile) 80. However, simply executing the script command does not prevent modification or deletion of the operation history file. Therefore, as a second stage for protection, two types of directories for storing operation history files are prepared. In the description of the directory structure in FIG. 9, one is to make the owner root (system administrator),
The access authority is set so that the user cannot create an invalid operation history file or delete the operation history file.
A temporary creation directory 15 without write permission other than ot is created, and an operation history file creation program 90 for creating an operation history file is prepared. The operation history file creation program 90 sets the owner to root and sets the setuid. By doing so, it is possible to create an operation history file in the temporary creation directory 15, which is set so that the user cannot create a file. Then scri
The pt command is executed, the operation history file in the temporary creation directory 15 is opened, and the recording of the operation contents is started. At the time when the recording of the operation is started, the contents of the operation history file of the user can be falsified, but the operation history file itself cannot be deleted, and the record of the accessed data always remains. The second is to make the owner root, and give access rights other than root,
That is, except for the root, it is not possible to check what files exist in the directory, to check the files, or to update or delete the files.
Is prepared, and an operation history file moving program 120 for moving the operation history file from the temporary creation directory 15 to the storage directory 16 is prepared. The operation history file moving program 120 sets the owner to root, setsu
By setting the id, it is possible to move the operation history file to the storage directory 16 without any authority. At this time, writing to the operation history file is continued even though the operation history file has been moved to the storage directory 16 where no access is allowed. This is because UNIX checks file access authority only when it is opened. In other words, even if the file being written is moved, the authority is checked only at the time of opening the file, so that access to the moved file can be continued and realized.
Based on the above contents, an example of the processing flow of the method for protecting the operation history file according to the present invention in FIGS. 10 to 15 will be described.
FIG. 10 is an example of a processing flow of user login. When the user logs in (step 71), sh (shell) is started (72), and a startup program (.profile) 80 is started. As an extension of the start-up program 80, an operation history file creation program 90, an operation content display program 100, an operation content output program 100, and an operation history file movement program 1
20 is executed, and the logout 73 is reached. FIG. 11 is an example of a processing flow of the startup program. When the startup program is executed (Step 8
0), an operation history file creation program for creating an operation history file in the temporary creation directory 15 is called (90), and after the operation history file is created, the monitoring terminal 13 is created.
DISPLAY environment variables are set (81), and a real-time monitoring screen is activated on the monitoring terminal 13 (82).
An operation content display program for reading the operation history file and displaying the operation content on the monitoring screen 13 is called (10).
0), an operation content output program for writing the content of the user operation to the operation history file is called (110), and the content of the user operation is monitored. When the user logs out (7
3), end the real-time monitoring screen (83). FIG.
2 is an example of the processing flow of the operation history file creation program. The operation history file creation program 90 creates an operation history file in the non-writable temporary creation directory 15 by setting the setuid as described above. FIG. 13 is an example of a processing flow of the operation content display program. Operation content display program 10
0 checks whether the operation history file exists in the temporary creation directory 15 (step 101).
The operation history file is read every second by the tail command, and if the operation content is updated, it is displayed on the monitoring screen (102). If the operation history file does not exist, it is determined that the user has performed an illegal operation, the user ID sh (shell) is searched (103), and all the searched sh are killed (104). Forcibly ends the user session. FIG. 14 is an example of a processing flow of the operation content output program. The operation content output program 110 checks whether an operation history file exists in the temporary creation directory 15 (step 111), and if so, starts the script command and starts writing the user's operation content to the operation history file. Then, an operation history file transfer program for moving the operation history file from the temporary creation directory 15 to the protection directory 16 is called (120). If there is no operation history file in the temporary creation directory 15, this user is determined to have performed an unauthorized operation, and the user ID
Is searched (113), and all the searched sh are killed (114), thereby forcibly terminating the user session. FIG. 15 is an example of a processing flow of the operation history file transfer program. The operation history file transfer program 120 checks whether an operation history file exists in the temporary creation directory 15 (step 12).
1) If it exists, as described above, setuid is set in the operation history file transfer program 120 to change the temporary creation directory 15 to the protection directory 1
6 can be moved to the operation history file (12
2). If the operation history file does not exist in the temporary creation directory, it is determined that this user has performed an illegal operation, and the user ID sh (shell) is searched (1).
23) Kill all searched sh (124), thereby forcibly terminating the user's session. FIG.
It is a block diagram of an operation history file. Operation history file 1
In 30, the content 131 operated by the user is written as it is, and the return code 132 is not displayed, but a line feed is performed by the input of the return code 132 by the user. The contents 133 to the standard output are also written in the same format, and the back space 134 is also written. According to the present embodiment, by acquiring the operation history of the user in the operation history file and protecting the operation history file, it is possible to grasp all the operation contents and always perform the operation in the system from the monitoring terminal. Since the operation contents of all users can be monitored in real time, unauthorized operations can be monitored and security can be ensured.

According to the present invention as described above,
It is possible to monitor the operation contents of all users in real time, and even if the occurrence of unauthorized operation is found later, it is possible to track the unauthorized operation by analyzing the operation history file Therefore, there is an effect that security can be ensured.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration example of a method for protecting an operation history file according to the present invention.

FIG. 2 is a block diagram showing a configuration of a server according to an embodiment of the present invention.

FIG. 3 is a block diagram illustrating a configuration example of an operation history file storage area definition file.

FIG. 4 is a flowchart illustrating a processing operation of a control program.

FIG. 5 is a flowchart illustrating a processing operation of a login user monitoring program.

FIG. 6 is a flowchart illustrating a processing operation of an operation content output program.

FIG. 7 is a flowchart illustrating a processing operation of a monitoring screen output program.

FIG. 8 is a block diagram illustrating a configuration of a server according to an embodiment of the present invention.

FIG. 9 is a diagram illustrating a directory configuration.

FIG. 10 is a flowchart illustrating a user login processing operation.

FIG. 11 is a flowchart illustrating a processing operation of a startup program.

FIG. 12 is a flowchart illustrating a processing operation of an operation history file creation program.

FIG. 13 is a flowchart illustrating a processing operation of an operation content display program.

FIG. 14 is a flowchart illustrating a processing operation of an operation content output program.

FIG. 15 is a flowchart illustrating a processing operation of an operation history file transfer program.

FIG. 16 is a block diagram illustrating a configuration example of an operation history file.

[Explanation of symbols]

11 server, 12 user terminal, 13 monitoring terminal, 1
4 Network, 15 Temporary directory, 1
6 ... Storage directory, 20 ... Control program, 30
... Login user monitoring program, 40 ... Operation content output program, 50 ... Operation history file storage area definition file, 60 ... Monitoring screen output program, 80 ... Startup program, 90 ... Operation history file creation program, 100 ... Operation content display program, 110: operation content output program, 120: operation history file moving program, 130: operation history file.

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 12/22 (72) Inventor Takafumi Hatsenji 2-4-1-16 Uchihonmachi, Chuo-ku, Osaka-shi, Osaka Hitachi Western Software Co., Ltd. (72) Inventor Toshio Hata 2-4-1-16 Uchihonmachi, Chuo-ku, Osaka City, Osaka Prefecture F-term within Hitachi Western Software Co., Ltd. 5B042 GA12 JJ17 JJ40 KK01 MA08 MC37 NN04 5B085 AC11 BC01 5B089 GA11 GA21 GB02 HA01 HA06 HA10 JB22 KA17 KB13 LB14 5K030 GA15 HC01 HC14 HD05 JA10 MA01 MB00 MC09 9A001 BB01 BB03 BB04 CC07 CC08 DD06 FF03 JJ27 KK31 LL03

Claims (3)

[Claims] In a network system in which a terminal and a server are configured by a LAN, a wide area WAN, and a public network, an operation history up to logout after a user logs in is acquired in an operation history file. A means for storing the operation history file in an area where the user cannot input / output data, and the means for protecting the operation history file from the user and confirming the contents of the operation history file. Therefore, a method of protecting an operation history file having a feature of monitoring operation contents. 2. The operation history file according to claim 1, wherein when an operation history file to be protected is operated illegally, security is ensured by forcibly terminating all user sessions. Protection method. 3. An operation history file is read at the same time as the user logs in, whereby the operation content is automatically displayed on the monitoring terminal, enabling real-time monitoring.
2. The method for protecting an operation history file according to claim 1, wherein the real-time monitoring is terminated at the same time as the user logs out, so that the operation content is monitored to ensure security.