JP2007072969A - Operation history protection device and operation history protection program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To safely protect an operation history of a process from a buffer overflow attack or the like while suppressing performance degradation of an entire system. <P>SOLUTION: A restricted authorization process processing part 200 controls a restricted authorization process operating based on a restricted authorization level which is the restricted authorization level lower than a privilege level which the various functions of an operation system can be utilized, and which only a part of various functions can be utilized. A kernel privilege process processing part 300 controls a kernel privilege process operating based on the privilege level. The restricted authorization process processing part 200 records a history of operation of the restricted authorization process in the restricted authorization process processing part 200. The kernel privilege process processing part 300 records a history of specific operation out of the operation history recorded in the restricted authorization process processing part in the kernel privilege process processing part 300. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an operation history protection device and an operation history protection program for protecting an operation history of a process from a buffer overflow attack or the like.

  A terminal device such as a personal computer, a PDA (Personal Digital Assistant), or a mobile phone receives the program via the network and executes the received program. According to this, since the terminal device can quickly acquire a program for executing a necessary application, the convenience of the terminal device can be improved.

  On the other hand, the code that constitutes the program transmitted via the network includes illegal codes such as a code that destroys internal data of the terminal device, a code that executes an illegal operation on the terminal device, and a code that abuses resources used by the terminal device May be included. For this reason, the importance of processing to prevent system failure due to the malicious code in advance with the expansion of downloadable applications, or processing to properly restore the system state even if system failure due to the malicious code occurs is important. It is increasing.

  Conventionally, the terminal device sequentially records the operation history of the process generated by the program (for example, SYSLOG used in the operating system records the operation history sequentially), and records when a system failure occurs due to the process. By referring to the operation history of the process, the system state before the occurrence of the system failure is restored.

  However, in order to recover the system failure, it is necessary to guarantee the reliability of the process operation history itself. For this reason, when the operation history related to the system failure is destroyed or the operation history is falsified by the program including the illegal code, the terminal device cannot use the operation history for the original purpose.

  An operation history validity verification technique proposed in Patent Document 1 will be described as an example of a conventional technique for solving this point.

  In the operation history correctness verification technique, an electronic signature is applied to data including the current operation history and the previous operation history and recorded. The recorded electronic signature is decrypted with the public key, and if the decrypted data matches the data calculated in advance, the decrypted data is determined to be valid data.

On the other hand, if the decrypted data and the pre-calculated data do not match, it is determined that the decrypted data is not legitimate data but is falsified data. According to the operation history validity verification technology, the validity of the operation history can be verified by verifying the validity of the electronic signature.
JP 2003-143139 A

  By the way, the process generated by the program is a kernel privilege process that operates based on a privilege level that can use various functions of the operating system, a restricted authority level that is lower than the privilege level, and one of various functions. It is classified into a restricted authority process that operates based on a restricted authority level that can use only the functions of the department.

  The restricted authority process has an access right only to the restricted authority process area in which the restricted authority process operates, and does not have an access right to the kernel privileged process area in which the kernel privileged process operates. Therefore, the restricted authority process records the operation history of the restricted authority process itself in the restricted authority process area.

  However, files, programs, and the like used in the restricted authority process area are more likely to be falsified by a malicious person who uses the terminal device for malicious purposes than the kernel privileged process area. For example, a Service-to-Self who has acquired the administrator authority of the terminal device using a buffer overflow attack or the like can tamper with a file or program in the restricted authority process area. For this reason, the reliability of the operation history recorded in the restricted authority process area is lower than that in the kernel privileged process area.

  The operation history of the conventional restricted authority process is protected in the restricted authority process area. For this reason, when the Service-to-Self acquires the administrator authority of the terminal device, verification information such as an electronic signature for verifying the validity of the operation history is destroyed, or the process itself for creating the verification information is falsified. There was a risk that the safety might be impaired.

  In order to solve this point, a method in which the kernel privilege process, not the restricted authority process, protects the operation history of the restricted authority process from the buffer overflow attack or the like can be considered. As a first method, a method in which a kernel privileged process monitors the operation of a restricted authority process, the kernel privileged process acquires an operation history of the restricted authority process, and records the operation history can be considered. Second, in order to guarantee the validity of the operation history of the restricted authority process, it is conceivable that the kernel privileged process records an electronic signature for the operation history of all restricted authority processes in the kernel privileged process area. .

  However, in the first method, the operation history of the restricted authority process recorded by the kernel privileged process itself is compared with the operation history of the restricted authority process recorded by the restricted authority process itself and understood by the user. It is composed of difficult language systems and is not very useful.

  On the other hand, in the second method, when the terminal device can execute a multitasking operating system, a number of restricted authority processes usually operate in parallel at the same time. Therefore, when the kernel privileged process applies an electronic signature to the operation history of the “all” restricted authority process and stores the electronic signature in the kernel privileged process area, the kernel privileged process itself becomes the kernel privileged process itself. May cause serious performance degradation of the terminal device system as a whole.

  Therefore, the present invention has been made in view of the above points, and an operation history protection device that can safely protect a process operation history from a buffer overflow attack or the like while suppressing performance deterioration of the entire system, and An object is to provide an operation history protection program.

  In order to solve the above-described problem, a first feature of the present invention is that a kernel privileged process processing unit that controls a kernel privileged process that operates based on a privilege level that can use various functions of an operating system, and a privilege level A restricted authority process processing unit that controls a restricted authority process that operates based on a restricted authority level that can use only a part of various functions. The privileged process processing unit records the history of operations of the restricted privileged process in the restricted privileged process processing unit, and the kernel privileged process processing unit selects a specific operation from the history of operations recorded in the restricted privileged process processing unit. The history is recorded in the kernel privileged process processing unit.

  According to such a feature, the kernel privileged process processing unit does not protect the history of “all operations” of the restricted authority process, but stores the history of “specific operations” of all the operations of the restricted authority process. Record in the privileged process processing part. Thereby, the operation history protection device can prevent the processing load on the kernel privileged process processing unit from increasing. For this reason, the operation history protection device records the history of the “specific operation” of the restricted authority process in the kernel privileged process processing unit, thereby suppressing the performance degradation of the entire system and suppressing the specific operation of the restricted authority process. History can be safely protected from buffer overflow attacks.

  The gist of the second feature of the present invention is that the specific operation is an operation related to setting of the operating system.

  A third feature of the present invention is that the restricted authority process includes a first process and a second process, and the kernel privileged process processing unit is executing inter-process communication between the first process and the second process. In some cases, the history of specific operations of the first process and the second process is recorded in the kernel privileged process processing unit.

  According to a fourth aspect of the present invention, when the restricted authority process includes a first process and a second process, and the kernel privileged process processing unit executes the specific operation of the first process, the first process is performed. When the specific operation of the second process generated based on the process is being executed, the history of the specific operation of each of the first process and the second process is recorded in the kernel privileged process processing unit. To do.

  The fifth feature of the present invention is that the kernel privileged process processing unit stores the history of the specific operation according to the degree of reliability indicating the degree of reliability of the restricted authority process that is executing the specific operation. The gist is to determine whether or not to record in the process processing unit.

  The sixth feature of the present invention is that the kernel privileged process processing unit encrypts a history of specific operations recorded in the restricted authority process processing unit by using key information that can be referred to only by the kernel privileged process processing unit. The gist is to do.

  The gist of the seventh feature of the present invention is that the kernel privileged process processing unit records a copy of the history of the specific operation recorded in the restricted authority process processing unit in the kernel privileged process processing unit.

  The eighth feature of the present invention is summarized in that the kernel privileged process processing unit records the hash value of the history of the specific operation recorded in the restricted authority process processing unit in the kernel privileged process processing unit.

  According to a ninth feature of the present invention, the kernel privileged process processing unit records, in the kernel privileged process processing unit, a copy of a history of specific operations recorded in the restricted authority process processing unit according to the reliability level. The gist of the present invention is to determine either the process or the process of recording the hash value of the history of the specific operation recorded in the restricted authority process processing unit in the kernel privileged process processing unit.

  The tenth feature of the present invention is that the kernel privileged process processing unit has the same hash value recorded in the kernel privileged process processing unit and the hash value of the specific operation history recorded in the restricted authority process processing unit. The gist is to determine that the history of the specific action is a valid history.

  The eleventh feature of the present invention is that the kernel privileged process processing unit is configured to detect a specific operation being executed by the restricted authority process, and to detect that the history of the detected specific operation is a protection target. Based on the fact that the identification information issuing unit that issues unique identification information for identifying the operation history and the operation history protection request information for requesting protection of the operation history of the restricted authority process are obtained from the restricted authority process When the process ID of the restricted authority process that is the request source of the operation history protection request information is included in the identification information, the operation history record that records the history of the specific operation of the restricted authority process in the kernel privileged process processing unit It is a summary to provide a part.

  A twelfth feature of the present invention is that the specific action detecting unit detects a specific action being executed by the restricted authority process when the specific library function is included in the system call issued by the restricted authority process. The gist is to do.

  A thirteenth feature of the present invention is to calculate the number of detections by which the specific action detecting unit has detected a specific action per unit time, and when the calculated number of detections exceeds a preset number of times. The gist of the invention is that it includes a delay processing unit that delays the start of processing in the operation history recording unit after the operation history protection request information is acquired by the operation history recording unit for a predetermined time.

  A fourteenth feature of the present invention is that the identification information issuing unit has a high reliability indicating the type of a specific library function included in the system call issued by the restricted authority process and the degree of reliability of the restricted authority process. Accordingly, the gist is to determine whether or not to issue identification information.

  According to a fifteenth feature of the present invention, the operation history protection request information includes first operation history protection request information and second operation history protection request information, and the first operation history protection request information is an operation of a restricted authority process. Is a system call for requesting the granting of access right to the recording destination of the history, and the second operation history protection request information records the history of the operation of the restricted authority process for the recording destination to which the access right is granted. Second operation history protection request information when the operation history recording unit includes the process ID of the restricted authority process of the request source of the first operation history protection request information in the identification information. The gist is to record the history of the operation of the restricted authority process included in the kernel privileged process processing unit.

  According to a sixteenth feature of the present invention, the operation history protection request information includes the third operation history protection request information, and the third operation history protection request information requests release of the access right to the recording destination to which the access right is given. The operation history recording unit ends the processing of the operation history recording unit when the operation history recording unit acquires the third operation history protection request information from the restricted authority process.

  According to the characteristics of the present invention, it is possible to safely protect the operation history of a process from a buffer overflow attack and the like while suppressing the performance degradation of the entire system.

[First Embodiment]
(Configuration of operation history protection device)
FIG. 1 is a schematic configuration diagram of an operation history protection device 100 according to the present embodiment. As shown in FIG. 1, the operation history protection device 100 includes a restricted authority process processing unit 200 and a kernel privileged process processing unit 300.

  The restricted authority process processing unit 200 is a restricted authority level lower than a privilege level that can use various functions of the operating system, and is based on the restricted authority level that can use only some of the various functions. Control the process 210 that operates. The process 210 constitutes a restricted authority process.

  The restricted authority process processing unit 200 includes a process 210 and an operation history recording unit 220. The process 210 sequentially records the operation history of the process 210 in the operation history recording unit 220.

  The kernel privileged process processing unit 300 controls a kernel privileged process that operates based on a privilege level at which various functions of the operating system can be used.

  The kernel privileged process processing unit 300 includes a specific operation detection unit 310, an identification information issuing unit 320, an operation history protection rule information storage unit 330, an operation history protection request information detection unit 340, a monitoring list information storage unit 350, An operation history protection control unit 360 and a protection information recording unit 370 are provided. The specific operation detecting unit 310, the identification information issuing unit 320, the operation history protection request information detecting unit 340, and the operation history protection control unit 360 constitute a kernel privilege process.

  The specific action detection unit 310 detects a specific action that the process 210 is executing. For example, if a specific library function is included in a system call (such as a library function call system call 230 described later) issued by the process 210, the specific operation detection unit 310 performs a specific operation being executed by the process 210. To detect.

  Based on the specific operation detected by the specific operation detection unit 310, the identification information issuing unit 320 issues unique identification information 321 for individually identifying that the history of the specific operation is a protection target.

  Alternatively, the identification information issuing unit 320 refers to the operation history protection rule information 331 described later, and the reliability information indicating the type of a specific library function included in the system call issued by the process 210 and the reliability of the process. It is determined whether or not the identification information 321 is issued according to the size.

  The operation history protection rule information storage unit 330 stores the operation history protection rule information 331 shown in FIG. As shown in FIG. 2, the operation history protection rule information 331 is used to determine whether or not a library function related to a specific operation of the process 210 and a history of the specific operation of the process 210 that called the library function are to be protected. And operation history protection rules.

  Here, the operation history protection rule is determined by the reliability of the process 210. The reliability of the process 210 is determined by the degree of reliability of the program that generated the process 210.

  In the present embodiment, for example, when a program is provided from an arbitrary vendor, the reliability of the program is often low, so the reliability of the process 210 generated by the program is set to “low”. If the program is provided by a vendor with a certain track record, the reliability of the program 210 generated by the program is set to “medium” because the reliability of the program is higher than the program provided by any vendor. The If the program is set in the system in advance, the reliability of the program is higher than that of a program provided by a vendor with a certain track record, so the reliability of the process 210 generated by the program is set to “high”. The

  FIG. 3 is a diagram showing the contents of the identification information 321 in the present embodiment. As shown in FIG. 3, the identification information 321 is composed of a unique process ID for individually identifying the process 210 that is executing the specific operation, and a library function that the process 210 calls while executing the specific operation. Has been.

  The operation history protection request information detection unit 340 refers to the identification information 321 and the monitoring list information 351 based on the fact that the operation history protection request information for requesting the protection of the operation history of the process 210 is acquired from the process 210. Only specific operation history protection request information (second operation history protection request information described later) is transmitted to the operation history protection control unit 360.

  Based on the specific operation history protection request information acquired by the operation history protection request information detection unit 340, the operation history protection control unit 360 stores the specific operation history of the process 210 included in the operation history protection request information. Recorded in the protection information recording unit 370.

  In the present embodiment, the operation history protection request information includes first operation history protection request information (open system call 240 described later), second operation history protection request information (write system call 250 described later), and third operation history. It includes protection request information (a close system call 260 described later).

  The operation history protection request information detection unit 340, when the process ID of the process 210 of the request source of the first operation history protection request information (open system call 240) is included in the identification information, (Write system call 250) is transmitted to the operation history protection control unit 360. Based on the second operation history protection request information transmitted from the operation history protection request information detection unit 340, the operation history protection control unit 360 stores the operation history of the process 210 included in the second operation history protection request information. Recorded in the protection information recording unit 370.

  The operation history protection control unit 360 ends the process of the operation history protection control unit 360 based on the third operation history protection request information (close system call 260) transmitted from the operation history protection request information detection unit 340.

  The operation history protection request information detection unit 340, the monitoring list information storage unit 350, the operation history protection control unit 360, and the protection information recording unit 370 constitute an operation history recording unit.

(Operation of the operation history protection device)
Next, the operation of the operation history protection device 100 in this embodiment will be described with reference to FIG.

  As illustrated in FIG. 4, in S <b> 101, the specific action detection unit 310 detects a specific action that the process 210 is executing. Here, the specific operation being executed by the process 210 is an operation in which the process 210 calls a specific library function set in advance. The specific operation includes an operation related to setting of the operating system.

  In this embodiment, a library function call system call 230 (see FIG. 1) is set at the head of the code describing the library function. The library function call system call 230 includes information for specifying a library function, a specific library function name that the process 210 calls, and a flag for determining whether or not the process 210 calls a specific library function. Is included.

  The flag is “1” when the process 210 calls a specific library function, and is “0” when the process 210 does not call a specific library function. An example of the library function call system call 230 is shown below.

Func_CALL ("library function name", flag)
For example, the specific operation detection unit 310 acquires a library function call system call 230 issued by the process 210. When the flag included in the library function call system call 230 is “1”, the specific operation detection unit 310 specifies a specific function corresponding to the “library function name” included in the library function call system call 230. It detects that process 210 is calling a library function. In this case, the specific operation detection unit 310 can detect that the process 210 is executing a specific operation by detecting that the process 210 is calling a specific library function.

  In S103, the specific operation detection unit 310 transmits information indicating that the process 210 is executing the specific operation to the identification information issuing unit 320 as detection result information. The detection result information includes a unique process ID for individually identifying the process 210 that is executing the specific operation, and a specific library function called by the process 210.

  In S105, the identification information issuing unit 320 determines the identification information based on the detection result information according to the type of the library function included in the detection result information and the reliability of the process that is executing the specific operation. It is determined whether or not 321 is issued.

  For example, consider a case where the library function included in the detection result information is “func_1” and the process ID of the process 210 that called the library function “func_1” is “3828”. In this case, the identification information issuing unit 320 refers to the operation history protection rule information shown in FIG. 2, and the operation history protection rule corresponding to the library function “func_1” is a rule that “protects all processes”. Therefore, it is determined to issue the identification information 321 corresponding to the detection result information. The identification information issuing unit 320 issues identification information 321 configured by the process ID “3828” and the library function “func_1” (see FIG. 3).

  In S107, the identification information issuing unit 320 transmits the issued identification information 321 to the operation history protection request information detection unit 340.

  In S <b> 109, the operation history protection request information detection unit 340 detects “specific operation history protection request information” transmitted by the process 210 based on the identification information 321.

  Here, the operation history protection request information is transmitted from the process 210 in three stages. Hereinafter, the operation history protection request information transmitted at each stage will be described. In the present embodiment, the operation history protection request information transmitted in the second stage is detected as the “specific operation history protection request information”. Library functions are described in the order shown in FIG.

(1) Operation History Protection Request Information Transmitted in the First Stage The operation history protection request information (first operation history protection request information) transmitted in the first stage is an operation history recording destination (operation history record) of the process 210. This is an open system call 240 (see FIG. 1) for requesting the granting of the access right to the recording destination in the section 220. An example of the open system call 240 is shown below.

open (“file path name”, “access right”, “file permission”, “flag”)
As described above, the open system call 240 includes the “path name of the file” that is the recording destination of the operation history of the process 210, the access right (access right when performing additional writing) set as necessary, Includes a file permission for uniquely identifying a file and a flag for determining whether or not the system call is an open system call 240 related to operation history protection request information.

  The flag is “1” when the system call is an open system call 240 related to operation history protection request information, and is “0” when the system call is not an open system call 240 related to operation history protection request information.

  When the operation history protection request information detection unit 340 acquires the open system call 240 in which the flag “1” is set from the process 210, the identification information 321 including the process ID of the process 210 that issued the open system call 240 is obtained. If issued, the process ID and the file descriptor corresponding to the “file path name” included in the open system call 240 are registered in the monitoring list information 351.

  For example, consider the open system call 240 shown below.

open (“var / log / xxx”, “0_WONLY | 0_APPEND”, “0644”, “1”)
When the above open system call 240 is issued by the process 210 having the process ID “3828”, the operation history protection request information detecting unit 340 includes the process ID “3828” in the identification information 321 shown in FIG. Therefore, the process ID “3828” and the file descriptor “11” corresponding to “var / log / xxx” are registered in the monitoring list information 351 (see FIG. 6).

(2) Operation history protection request information transmitted in the second stage The operation history protection request information (second operation history protection request information) transmitted in the second stage is a process for the recording destination to which the access right is given. This is a write system call 250 (see FIG. 1) for recording an operation history 210. An example of the write system call 250 is shown below.

write ("recording file descriptor", "recording contents", "recording size")
As described above, the write system call 250 has the same contents as the commonly used write system call.

  When the write system call 250 is acquired from the process 210, the operation history protection request information detection unit 340 stores the process ID of the process 210 that issued the write system call 250 and the “registered file descriptor” in the monitoring list information 351. If it is registered, the write system call 250 is detected as the specific operation history protection request information.

  For example, consider the following write system call 250.

write (“11”, “record contents”, “10”)
When the write system call 250 is issued by the process 210 with the process ID “3828”, the operation history protection request information detection unit 340 adds the process ID “3828” and the file to the monitoring list information 351 shown in FIG. Since the descriptor “11” is included, the write system call 250 is detected as the specific operation history protection request information.

(3) Operation history protection request information transmitted in the third stage The operation history protection request information (third operation history protection request information) transmitted in the third stage is the access right for the recording destination to which the access right is given. This is a close system call 260 (see FIG. 1) for requesting release. An example of the close system call 260 is shown below.

close ("record descriptor of the recording destination")
As described above, the close system call 260 includes the same content as a generally used close system call.

  If the operation history protection request information detection unit 340 acquires the close system call 260 from the process 210, the process ID of the process 210 that issued the close system call 260 and the “recording destination file descriptor” are the monitoring list information 351. Registered in the monitoring list information 351, the registered contents constituted by the process ID and “recording destination file descriptor” are deleted from the monitoring list information 351.

  For example, consider the following close system call 260.

close (“11”)
When the above close system call 260 is issued by the process 210 with the process ID “3828”, the operation history protection request information detection unit 340 adds the process ID “3828” and the file to the monitoring list information 351 shown in FIG. The registered content constituted by the descriptor “11” is deleted from the monitoring list information 351. The monitoring list information 351 after the registration contents are deleted is as shown in FIG.

  In S113, the operation history protection request information detection unit 340 transmits the detected operation history protection request information (write system call 250) to the operation history protection control unit 360 as detection result information.

  In S115, the operation history protection control unit 360 protects “record contents (history of specific operation of process 210)” included in the detection result information (write system call 250). For example, the operation history protection control unit 360 causes the protection information recording unit 370 to record the hash value of “recording content” included in the detection result information, or the “recording content” included in the detection result information as it is. It is stored in the protection information recording unit 370. These protection methods will be described in detail in an embodiment described later.

  According to this feature, the kernel privileged process processing unit 300 does not record the history of “all operations” of the process 210, but stores the history of “specific operations” of all the operations of the process 210. Recorded in the unit 300. As a result, the operation history protection device 100 can prevent the processing load on the kernel privileged process processing unit 300 from increasing. For this reason, the operation history protection apparatus 100 records the history of the “specific operation” of the process 210 in the kernel privileged process processing unit 300, thereby suppressing the performance degradation of the entire system and the history of the specific operation of the process 210. Can be safely protected from buffer overflow attacks and the like.

  Further, even if the kernel privileged process processing unit 300 does not always monitor whether or not the process 210 is executing a specific operation, the kernel privileged process processing unit 300 can specify the process 210 only by acquiring the open system call 240 and the close system call 260. The start / end of the operation can be detected. For this reason, the kernel privileged process processing unit 300 can prevent the processing load of the kernel privileged process processing unit 300 from increasing, and can suppress deterioration in performance of the entire system.

  Further, the kernel privileged process processing unit 300 displays the history of specific operations of the process 210 according to the type of the specific library function issued by the process 210 and the reliability of the process 210. Decide whether to record (protect).

  For example, the kernel privileged process processing unit 300 does not protect the history of specific operations of the process 210 generated by a highly reliable program originally stored in the system, and is not originally stored in the system. A history of specific operations of the process 210 generated by a program that is likely to cause a failure is recorded in the kernel privileged process processing unit 300.

  Thereby, since the kernel privileged process processing unit 300 does not record the history of the specific operation of the process 210 more than necessary, the processing load on the kernel privileged process processing unit 300 can be prevented from increasing.

(Modification 1)
Note that the operation history protection device 100 according to the present embodiment is not limited to the above contents, and can be modified as follows. In this modification, the operation history protection device 100 has already issued the identification information 321 corresponding to the history of the specific operation of the process 210, and (1) the processing of the library function called by the process 210 is completed. Or (2) when the process 210 calls another library function), the identification information 321 is deleted or added as shown below.

  FIG. 8 is a diagram illustrating an internal configuration of the operation history protection device 100 according to this modification. The functions of the specific operation detection unit 310 and the identification information issuing unit 320 shown in FIG. 8 are only different from the functions of the respective units shown in FIG. 1, and functions other than the specific operation detection unit 310 and the identification information issuing unit 320 shown in FIG. Is the same as the function of each part shown in FIG. For this reason, the processes of only the specific operation detection unit 310 and the identification information issuing unit 320 will be described separately for the above (1) and (2).

(1) When the processing of the library function called by the process 210 is completed The specific operation detection unit 310 acquires the library function call system call whose flag is set to “0” from the process 210 as the library function end system call 231. As a result, it is detected that the processing of the library function called by the process 210 has ended (that is, the specific operation of the process 210 has ended).

  For example, the specific operation detection unit 310 acquires the library function end system call 231 issued by the process 210 with the process ID “3828”, and thereby acquires the library function “func_1” called by the process 210 with the process ID “3828”. Detect that the process is complete. The identification information issuing unit 320 deletes the identification information 321 including the row of the process ID “3828” from the identification information 321 that has already been issued (see FIG. 9). Since the subsequent processes are the same as those in the first embodiment, a detailed description thereof is omitted here.

  According to such a feature, the kernel privileged process processing unit 300 does not always monitor the end of the special operation of the process 210, but only acquires the library function end system call 231 issued by the process 210. Since the end of the specific operation can be detected, the processing load of the kernel privileged process processing unit 300 can be prevented from increasing.

(2) When the process 210 calls another library function
The specific operation detection unit 310 further acquires a library function call system call 230 whose flag is set to “1”, thereby detecting that the process 210 has called another library function.

  For example, the specific operation detection unit 310 further detects that the process 210 with the process ID “3828” further calls the library function “func_2” based on the acquired library function call system call 230. In this case, the identification information issuing unit 320 adds the library function “func_2” to a line with the process ID “3828”, and issues the identification information 321 configured by the process ID “3828” and the library function “func_2”. (See FIG. 10). Since the subsequent processes are the same as those in the first embodiment, a detailed description thereof is omitted here.

  According to this feature, the kernel privileged process processing unit 300 further issues identification information corresponding to the other library function when the process 210 calls the other library function. As a result, the kernel privileged process processing unit 300 can also record in the kernel privileged process processing unit 300 the history of the specific operation of the process 210 that called the other library function using the issued identification information.

(Modification 2)
Note that the operation history protection device 100 according to the present embodiment is not limited to the above contents, and can be modified as follows. The operation history protection device 100 according to this modification corresponds to the specific operation history of each of the first process and the second process when inter-process communication between the first process and the second process is being executed. The identification information 321 may be issued.

  Here, it is assumed that the identification information 321 corresponding to the history of the specific operation of the process 211 as the first process and the identification information 321 corresponding to the history of the operation of the process 210 as the second process have already been issued. explain.

  In this modified example, the process 211 and the process 210 execute inter-process communication, so that a resource accessed while the process 211 is executing a specific operation may be passed to the process 210. For this reason, the process 210 may access the resource, and may execute a specific operation equivalent to the process 211. As a result, the operation history protection apparatus 100 needs to newly issue the identification information 321 corresponding to the specific operation history of the process 210 as being equivalent to the identification information 321 corresponding to the specific operation history of the process 211. is there. Hereinafter, the processing up to this point will be described in detail.

  FIG. 11 is a diagram illustrating an internal configuration of the operation history protection device 100 according to the present modification. The functions of the specific operation detecting unit 310 and the identification information issuing unit 320 shown in FIG. 11 are only different from the functions of the respective units shown in FIG. 1, and functions other than the specific operation detecting unit 310 and the identification information issuing unit 320 shown in FIG. Is the same as the function of each part shown in FIG. Therefore, only the specific operation detection unit 310 and the identification information issuing unit 320 will be described.

  FIG. 12 is a diagram showing the contents of the identification information 321 in the present modification example. As shown in FIG. 12, “transmission side file descriptor” and “reception source process ID” are further added to the identification information 321 shown in FIG. In the “transmission side file descriptor”, a file descriptor when a process on the transmission side generates a pipe or the like is recorded. In the “reception source process ID”, when the process on the reception side receives the data on the transmission side, the process ID on the reception side is recorded as the process ID on the transmission side.

  In the following, it is assumed that the process 210 with the process ID “3828” is the data receiving side in the inter-process communication. Assume that the process 211 with the process ID “11556” is the transmission side in the inter-process communication. In this case, an explanation will be given taking as an example that interprocess communication using pipe has been executed.

  Assuming that the storage destination of the pipe file reception descriptor is pp [0] and the storage destination of the transmission file descriptor is pp [1], the process 211 (transmission side) first issues the following inter-process communication system call 232. . It is assumed that the value of the transmission file descriptor is “21”.

pipe (pp); pipe generation The specific operation detection unit 110 acquires the inter-process communication system call 232 issued by the process 211 (transmission side) with the process ID “11556”, and performs transmission for the process ID “11556”. “21” is set as the value of the file descriptor (see the identification information shown in FIG. 13).

  When the process 210 (reception side) receives the data of the process 211 (transmission side) using the pipe generated by the process 211 (transmission side), the process 211 and the process 210 make the following system call. Issue.

write (pp [1], outmsg, strlen (msg)); data transmission (process 211)
read (pp [0], inmsg, strlen (msg)); data reception (process 210)
The specific operation detection unit 310 transmits data from the process 211 (transmission side) to the process 210 (reception side) based on the acquisition of the read system call in which the value “21” of pp [0] is set. Detect that. In this case, the process 210 (reception side) inherits the library function (func_2) called by the process 211 (transmission side).

  For this reason, the identification information issuing unit 320 adds new identification information 321 configured by the process ID “3828” of the process 210 and the library function “func_2” after inheritance, and the transmission source in the new identification information 321 “11556” is set in the process ID (see FIG. 14). When the identification information 321 set with the process ID “11556” of the process 211 is deleted, the new identification information 321 is also deleted.

  Since the subsequent processes are the same as those in the first embodiment, a detailed description thereof is omitted here.

  According to such a feature, even if the kernel privileged process processing unit 300 issues the identification information 321 corresponding to the history of the specific operation of the process 210 (receiving side) (the first-stage identification information shown in FIG. 14), Furthermore, the identification information 321 corresponding to the specific operation history of the process 210 (reception side) is replaced with identification information equivalent to the identification information corresponding to the specific operation history of the process 211 (transmission side) (second level shown in FIG. 14). New identification information).

  As a result, the kernel privileged process processing unit 300 can appropriately issue identification information corresponding to the history of the specific operation of the process 210 (receiving side) executing the inter-process communication, and therefore executes the inter-process communication. The specific operation history of each of the process 211 (transmission side) and the process 210 (reception side) can be appropriately recorded.

(Modification 3)
Note that the operation history protection device 100 according to the present embodiment is not limited to the above contents, and can be modified as follows. When the specific operation of the first process is being executed and the specific operation of the second process generated based on the first process is being executed when the specific operation of the first process is being executed, Identification information 321 corresponding to the specific operation history of each of the first process and the second process may be issued. FIG. 15 is a diagram illustrating an internal configuration of the operation history protection device 100 according to the present modification. The functions of the specific operation detecting unit 310 and the identification information issuing unit 320 shown in FIG. 15 are only different from the functions of the respective units shown in FIG. 1, and functions other than the specific operation detecting unit 310 and the identification information issuing unit 320 shown in FIG. Is the same as the function of each part shown in FIG. Therefore, only the specific operation detection unit 310 and the identification information issuing unit 320 will be described.

  The specific operation detection unit 310 acquires the child process generation system call 234 issued by the process 210 of the process ID constituting the identification information 321 that has already been issued, and confirms that the child process 233 has been generated based on the process 210. To detect.

  The child process generation system call 234 in this embodiment is a system call for generating a child process 233 by duplicating the process 210 (so-called parent process). The child process generation system call 234 includes a fork system call, a clone system call, and the like.

  When the child process 233 is generated based on the process 210, the identification information issuing unit 320 issues the identification information 321 corresponding to the specific operation history of the child process 233.

  For example, consider a case where the process ID of the process 210 is “3828” and the process ID of the child process 233 generated based on the process 210 is “3829”. Further, as shown in FIG. 3, a case is considered in which identification information 321 in which the process ID “3828” and the corresponding library function “func_1” are set has already been issued.

  The identification information issuing unit 320 duplicates the library function “func_1” of the process 210 that is the parent process, and includes identification information 321 including the process ID “3829” of the child process 233 and the duplicated library function “func_1” (see FIG. 16). Is newly issued. Since the subsequent processes are the same as those in the first embodiment, a detailed description thereof is omitted here.

  According to such a feature, the kernel privileged process processing unit 300 issues the identification information 321 corresponding to the history of the specific operation of the child process 233 by generating the child process 233 based on the process 210 (parent process). To do. Therefore, the kernel privileged process processing unit 300 not only records the specific operation history of the process 210 using the identification information of the process 210 and the identification information including the child process 233, but also records the specific operation history of the child process 210. Can also be recorded.

[Second Embodiment]
In the first embodiment, the kernel privileged process processing unit determines whether or not to protect the specific operation history of the process. However, in this embodiment, the restricted authority process processing unit stores the specific operation history of the process. It differs in that it is determined whether or not to protect. This will be specifically described below.

  FIG. 17 is a schematic configuration diagram of the operation history protection device 400 in the present embodiment. As illustrated in FIG. 17, the operation history protection device 400 includes a restricted authority process processing unit 500 and a kernel privileged process processing unit 600.

  The restricted authority process processing unit 500 includes a process 510 and an operation history recording unit 520. The kernel privileged process processing unit 600 includes a specific operation detection unit 610, an identification information issuing unit 620, an operation history protection rule information storage unit 630, an operation history protection request information detection unit 640, a monitoring list information storage unit 650, An encryption setting rule information storage unit 660, an operation history protection control unit 670, and a protection information recording unit 680 are provided.

  An encryption setting rule information storage unit 660 shown in FIG. 17 is added to the configuration shown in FIG. 1, and only the function of the operation history protection control unit 670 is different from the function of the same unit shown in FIG. Functions other than the encryption setting rule information storage unit 660 and the operation history protection control unit 670 shown in FIG. 17 are the same as the functions of the respective units shown in FIG. Therefore, only the processing of the encryption setting rule information storage unit 660 and the operation history protection control unit 670 will be described.

  An example of the write system call 540 used in this embodiment is shown below.

write (“recording file descriptor”, “recording content”, “recording size”, “protection flag”)
In the above write system call 540, a protection flag is added in addition to the contents of the write system call of the first embodiment.

  The encryption setting rule information storage unit 660 stores encryption setting rule information 661 shown in FIG. As shown in FIG. 18, the encryption setting rule information 661 includes the content of the protection flag and the content of the protection method (recording method) of the operation history of the process 510 corresponding thereto.

  If the corresponding write system call 540 is detected by the operation history protection request information detection unit 640, the operation history protection control unit 670 refers to the protection flag set in the write system call 540. When the protection flag is “0”, the operation history protection control unit 670 transmits the recorded content set in the write system call 540 to the process 510 as it is. The process 510 causes the operation history recording unit 520 to record the recorded content.

  On the other hand, when the protection flag is “1”, the operation history protection control unit 670 uses the key information that can be referred to only by the kernel privileged process processing unit 600 and the recorded contents set in the write system call 540. Is encrypted, and the recorded content after the encryption is transmitted to the process 510 as the protection target specific operation history. The process 510 causes the operation history recording unit 520 to record the protection target specific operation history.

  According to such a feature, not only the kernel privileged process processing unit 600 but also the restricted authority process processing unit 500 can determine whether or not to protect the history of specific operations of the process 510 using the protection flag. Thereby, the operation history protection device 400 can easily set from the “process 510 side” whether or not to protect the history of the specific operation of the process 510 using the protection flag.

  Further, the kernel privileged process processing unit 600 encrypts a history of specific operations of the process 510. As a result, the kernel privileged process processing unit 600 prevents the specific operation of the process 510 from being executed even if a malicious user acquires a history of the specific operation of the process 510 (for example, an operation related to access to personal information). And leakage of personal information can be prevented.

  Furthermore, since the key information for encrypting the history of the specific operation of the process 510 is stored only in the kernel privileged process processing unit 600, the kernel privileged process processing unit 600 can easily obtain the key information for a malicious person. You can prevent it from getting.

[Third Embodiment]
In the present embodiment, a protection method different from the process operation history protection method in the second embodiment will be described.

  FIG. 19 is a schematic configuration diagram of an operation history protection device 700 according to this embodiment. As illustrated in FIG. 19, the operation history protection device 700 includes a restricted authority process processing unit 800 and a kernel privileged process processing unit 900.

  The restricted authority process processing unit 800 includes a process 810 and an operation history recording unit 820. The kernel privileged process processing unit 900 includes a specific operation detection unit 910, an identification information issuance unit 920, an importance determination rule information storage unit 930, an operation history protection rule information storage unit 935, and an operation history protection request information detection unit 940. A monitoring list information storage unit 950, a protection level determination rule information storage unit 960, an operation history protection control unit 970, and a protection information recording unit 980. Note that, among the parts shown in FIG. 19, the parts having the same names shown in FIG. 1 have the same functions unless otherwise specified.

  The importance determination rule information storage unit 930 stores importance determination rule information 931 shown in FIG. As shown in FIG. 20, the importance determination rule information 931 includes a specific library function called by the process 810, the reliability of the process 810 calling the specific library function, and the history of the specific operation of the process 810. And importance indicating the degree of importance.

  The identification information issuing unit 920 issues identification information 921 (see FIG. 3) corresponding to the history of the specific operation of the process 810 with reference to the operation history protection rule information 936 shown in FIG. The identification information issuing unit 920 refers to the importance determination rule information 931 shown in FIG. 20, determines the importance based on the library function included in the identification information 921, and assigns the importance and the identification ID to the identification information 921 (FIG. 21). The identification information issuing unit 920 transmits the identification information 921 to the operation history protection request information detection unit 940 and the operation history protection control unit 970.

  The protection level determination rule information storage unit 960 stores protection level determination rule information 961 shown in FIG. As shown in FIG. 22, the protection level determination rule information 961 includes the importance level and the method of protecting the operation history of the process 810 corresponding to the importance level.

  When the operation history protection request information (write system call 840) is detected from the operation history protection request information, the operation history protection control unit 970 includes the process ID of the process 810 that requested the operation history protection request information. The identification information 921 is referred to. The operation history protection control unit 970 determines a method for protecting the recorded content included in the operation history protection request information according to the importance set in the identification information 921.

  The protection method includes a method of storing a copy of the history of the specific operation of the process 810 as it is in the protection information storage unit 980, a method of recording a hash value corresponding to the history of the specific operation of the process 810 in the protection information storage unit 980, and the like. It is included. The protection information storage unit 980 constitutes a hash value recording unit.

  In addition, the operation history protection control unit 970 calculates a hash value of the history of the specific operation of the process 810 and records the hash value in the protection information storage unit 980. The operation history protection control unit 970 calculates a hash value of the history of the specific operation recorded in the operation history recording unit 820 before executing rollback of the history of the specific operation recorded in the operation history recording unit 820. If the hash value and the hash value recorded in the protection information storage unit 980 are the same, it is determined that the history of the specific operation stored in the operation history recording unit 820 is valid. Note that the operation history protection control unit 970 constitutes a calculation unit and a determination unit.

  Next, the operation of the operation history protection device 700 in this embodiment will be described with reference to FIG.

  As illustrated in FIG. 23, in S201, the specific action detection unit 910 detects a specific action that the process 810 is executing.

  In step S <b> 203, the specific operation detection unit 910 transmits information indicating that the process 810 is executing the specific operation to the identification information issuing unit 920 as detection result information. The detection result information includes a unique process ID for individually identifying the process 810 that is executing the specific operation, and a specific library function called by the process 810.

  In S205, based on the detection result information, the identification information issuing unit 920 corresponds to the type of library function included in the detection result information and the reliability of the process 810 that is executing the specific operation. Then, it is determined whether or not the history of the specific operation of the process 810 is to be protected (see FIG. 2).

  Further, when the identification information issuing unit 920 determines that the history of the specific operation of the process 810 is to be protected, the identification information issuing unit 920 executes the specific operation of the process 810 with reference to the importance determination rule information 931 illustrated in FIG. The importance is determined using the type of library function called in and the reliability of the process 810.

  The identification information issuing unit 920 includes a process ID of the process 810 executing the specific operation, a library function called during execution of the specific operation of the process 810, a unique identification ID for individually identifying the identification information, Identification information 921 including the determined importance is issued.

  In step S <b> 207, the identification information issuing unit 920 transmits the issued identification information 921 to the operation history protection request information detection unit 940 and the operation history protection control unit 970.

  In step S209, the operation history protection request information detection unit 940 obtains an open system call 830 that is operation history protection request information from the process 810.

  In step S <b> 211, the operation history protection request information detection unit 940 specifies identification information 921 including the process ID of the process 810 that issued the open system call 830 from among the issued identification information.

  The operation history protection request information detection unit 940 returns the identification ID included in the identified identification information 921 to the process 810 as a return value for the open system call 830. The process 810 records the identification ID as a return value and the operation history of the process 810 in the operation history recording unit 820.

  The operation history protection request information detection unit 940 also monitors the process ID of the process 810 that issued the open system call 830 and the file descriptor corresponding to the “file path name” included in the open system call 830. Register in the list information 951.

  Further, when the operation history protection request information detection unit 940 obtains the write system call 840 that is the operation history protection request information from the process 810, the process ID of the process 810 that issued the write system call 840 and the “registration destination” Is registered in the monitoring list information 951, the write system call 840 is transmitted to the operation history protection control unit 970 as detection result information in S213.

  In S215, the operation history protection control unit 970 is included in the received write system call 840 according to the importance included in the identification information 921 based on the identification information 921 specified in S211. A protection method of “record contents (history of specific operation of process 210)” is determined. Specifically, it is as follows.

  In step S215-1, the operation history protection control unit 970 determines whether the importance included in the identification information 921 is “high”, “medium”, or “low”.

  In S215-2, when the importance set in the identification information 921 is “high”, the operation history protection control unit 970 determines the identification ID included in the identification information 921 and the operation history protection request. The protection information recording unit 980 records the copy of the recording content (the history of the specific operation of the process 210) included in the information.

  In S215-3, when the importance level included in the identification information 921 is “medium”, the operation history protection control unit 970 records the content included in the operation history protection request information of one entry ( A hash value of a specific operation history of the process 210, that is, a hash value of the recorded content included in one write system call 840, and the hash value and the importance and identification included in the identification information 921 The protection information recording unit 980 records the ID.

  In S215-4, when the importance level included in the identification information 921 is “low”, the operation history protection control unit 970 records included in all the operation history protection request information of the process 810. The hash value of the content (the history of the specific operation of the process 210) is calculated, and the protection information recording unit 980 records the hash value, the importance level and the identification ID included in the identification information 921.

  According to such a feature, the kernel privileged process processing unit 900 copies the history of the specific operation of the process 810 as it is according to the level of importance, and accesses only at the privilege level possessed by the kernel privileged process processing unit 900. It is recorded in the possible kernel privileged process processing unit 900, or a hash value corresponding to the history of the specific operation of the process 810 is recorded in the kernel privileged process processing unit 900. Thereby, the kernel privileged process processing unit 900 can appropriately protect the history of the specific operation of the process 810 from a buffer overflow attack that falsifies information stored in an area other than the kernel privileged process processing unit 900.

  In particular, when the importance level is “high”, the kernel privileged process processing unit 900 copies the history of the specific operation of the process 810 as it is, and can be accessed only at the privilege level possessed by the kernel privileged process processing unit 900. By recording in the kernel privileged process processing unit 900, it is possible to appropriately protect the history of specific operations of the important process 810.

  Further, when the importance level is “medium”, the kernel privileged process processing unit 900 records the hash value of the history of the specific operation of the process 810 for each entry. As a result, the kernel privileged process processing unit 900 copies the specific operation history of the process 810 as it is and records it in the kernel privileged process processing unit 900 when recording the history of the specific operation of the less important process 810. Instead, the hash value of the history of the specific operation of the process 810 is recorded in the kernel privileged process processing unit 900 for each entry. For this reason, the kernel privileged process processing unit 900 can further reduce the amount of information to be recorded in the kernel privileged process processing unit 900, and can further suppress performance degradation of the entire system.

  Furthermore, the operation history protection apparatus 700 records the hash value of the history of specific operations of “all” in the process 810 when the importance is “low”. As a result, the operation history protection device 700 does not record the hash value of the specific operation history of the process 810 for each entry when recording the specific operation history of the less important process 810. Record the hash value of “all” in the history of specific operations of the process 810. For this reason, the kernel privileged process processing unit 900 can further reduce the amount of information to be recorded in the kernel privileged process processing unit 900, and can further suppress performance degradation of the entire system.

  Here, a method for verifying the validity of the history of the specific operation of the process 810 recorded in the operation history recording unit 820 will be described.

  As shown in FIG. 24, it is assumed here that the identification ID “38280001” and the system setting change operations 1 to 3 corresponding to the operation history are recorded in the operation history recording unit 820. System setting change operations 1 to 3 are operations for changing system settings.

  If any abnormality occurs in the system due to the system setting changing operations 1 to 3, the system setting changing operations 1 to 3 are executed again by executing the rollback of the system setting changing operations 1 to 3. Is done.

  However, if the system setting change operations 1 to 3 themselves are unfairly tampered with, the system settings may deteriorate due to the rollback of the system setting change operations 1 to 3 being executed.

  Therefore, the operation history protection device 700 according to the present embodiment verifies the validity of the system setting change operations 1 to 3, and prevents deterioration of the system state due to the rollback of the system setting change operations 1 to 3.

  Specifically, the operation history protection device 700 is recorded in the restricted authority process processing unit 800 (operation history recording unit 820) illustrated in FIG. 24 before executing the rollback of the system setting change operations 1 to 3. The identification ID “38280001” of the system setting changing operations 1 to 3 is specified. The operation history protection device 700 refers to the kernel privileged process processing unit 900 (protection information recording unit 980) illustrated in FIG. 25, and refers to the importance corresponding to the identified identification ID “38280001”.

  Since the importance corresponding to the identification ID “3828281” shown in FIG. 25 is “medium”, the operation history protection device 700 records the hash value in the protection information recording unit 980 for each entry (each system setting change operation). It is determined that In this case, the operation history protection apparatus 700 calculates a hash value for each of the system setting change operations 1 to 3 (for each entry) corresponding to the identification ID “38280001” illustrated in FIG.

  The operation history protection device 700 includes each of the hash values of the system setting change operations 1 to 3 corresponding to the identification ID “38280001” illustrated in FIG. 24 and each of the hash values corresponding to the identification ID “38280001” illustrated in FIG. Are the same, the system setting change operations 1 to 3 as the operation history of the process 810 are determined to be valid histories, and the system setting change operations 1 to 3 are rolled back.

  On the other hand, if each of the hash values of the system setting change operations 1 to 3 and the hash value corresponding to the identification ID “38280001” are not the same, the operation history protection device 700 performs the system setting change operations 1 to 3. Is determined to be invalid, that is, it is determined that the system setting change operations 1 to 3 are falsified (or rewritten), and the system setting change operations 1 to 3 are not rolled back.

  As described above, the operation history protection device 700 verifies the validity of the system setting change operations 1 to 3 before executing the rollback of the system setting change operations 1 to 3. It is possible to prevent the deterioration of the system state due to the rollback.

[Fourth Embodiment]
Here, when the restricted authority process processing unit records a large amount of process operation history, the restricted authority process processing unit makes a system call (library function call system call, frequently (open system call, write system call, close system call, etc.). As a result, the processing load on the kernel privileged process processing unit increases, and as a result, there is a concern about the performance degradation of the entire system.

  Therefore, when the restricted authority process processing unit frequently sends system calls to the kernel privileged process processing unit within a certain period, the kernel privileged process processing unit does not increase the processing load on the kernel privileged process processing unit. I am doing so. This will be specifically described below.

  FIG. 26 is a diagram illustrating an internal configuration of the operation history protection apparatus 1000 according to the present embodiment. As shown in FIG. 26, the operation history protection apparatus 1000 includes a restricted authority process processing unit 1100 and a kernel privileged process processing unit 1200.

  The restricted authority process processing unit 1100 includes a process 1110 and an operation history recording unit 1120. The kernel privileged process processing unit 1200 includes a specific operation detection unit 1210, an identification information issuing unit 1220, an operation history protection rule information storage unit 1230, a specific operation execution history information recording unit 1240, and a specific operation control rule information storage unit 1250. A specific operation control unit 1260, an operation history protection request information detection unit 1270, a monitoring list information storage unit 1280, an operation history protection control unit 1290, and a protection information recording unit 1300. Note that, among the parts shown in FIG. 26, the parts having the same names shown in FIG. 1 have the same functions unless otherwise specified.

  The specific operation detection unit 1210 calculates the number of times that the process 1110 has detected a specific operation per unit time. In the present embodiment, the number of times of detection is an average number of times per second.

  For example, the specific operation detection unit 1210 detects the specific operation of the process 1110 based on the acquisition of the library function call system call 1130 issued by the process 1110, and the library function is called by the library function call system call 1130. The specific operation execution history information recording unit 1240 records the call time, the library function, and the average number of times the library function is called per second as the specific operation execution history information (see FIGS. 28 and 29 described later).

  The specific operation control rule information storage unit 1250 stores specific operation control rule information in which a set number of times (number of times / second) described later is set.

  When the average number of times per second recorded in the specific operation execution history information recording unit 1240 exceeds a preset number of times (number of times / second), the specific operation control unit 1260 detects an operation history protection request information detection unit. The start of processing in the operation history protection request information detection unit 1270 after the operation history protection request information is acquired by 1270 is delayed for a predetermined time. The specific operation control unit 1260 and the operation history protection request information detection unit 1270 constitute a delay processing unit.

  Next, the operation of the operation history protection apparatus 1000 in this embodiment will be described with reference to FIG. Except for the part A shown in FIG. 27, the operation is the same as that shown in FIG. Therefore, only the portion A shown in FIG. 27 will be described.

  In step S309 of part A shown in FIG. 27, the specific operation detection unit 1210 has called the library function by the library function call system call 1130 based on the acquisition of the library function call system call 1130 issued by the process 1110. The specific operation execution history information recording unit 1240 records the call time, the library function, and the average number of times per second that the library function is called as specific operation execution history information.

  In S311, the specific operation control unit 1260 determines that the process 1110 is performed when the average number of times per second stored in the specific operation execution history information recording unit 1240 exceeds the preset number of times according to the specific operation control rule information. The control instruction information for delaying the processing for the operation history protection request information from is transmitted to the operation history protection request information detection unit 1270.

  For example, when the specific operation execution history information has the content shown in FIG. 28, the specific operation control unit 1260 sets the preset average number of times [3.5] per second [3.5] to “20” ( Since the number of library function calls per second does not exceed 20), the control instruction information is not transmitted to the operation history protection request information detection unit 1270. For this reason, since the control instruction information is not transmitted, the operation history protection request information detection unit 1270 does not delay the processing for the operation history protection request information issued by the process with the process ID “3828” illustrated in FIG.

  In addition, when the specific operation execution history information has the contents shown in FIG. 29, the specific operation control unit 1260 sets the preset number of times “20” in which the latest average number [20.5] per second is set in advance. Therefore, the control instruction information is transmitted to the operation history protection request information detection unit 1270. For this reason, the operation history protection request information detection unit 1270 receives the control instruction information in S313, so that the operation history protection request information (open system call, write system) issued by the process with the process ID “11556” shown in FIG. A process for a call, a close system call, etc.) is delayed for a predetermined time (1 ms, etc.).

  According to such a feature, when the restricted authority process processing unit 1100 transmits a system call to the kernel privileged process processing unit 1200 more than the set number of times within a certain period, the kernel privileged process processing unit 1200 Delay processing of protection request information. Thereby, the kernel privileged process processing unit 1200 can prevent the processing load on the kernel privileged process processing unit 1200 from increasing within the certain period.

  For this reason, a large amount of external access is made to the operation history protection device 1000 within a certain period, and a large amount of access is made from the restricted privileged process processing unit 1100 to the kernel privileged process processing unit 1200 accordingly. Therefore, the kernel privileged process processing unit 1200 can protect the entire system from a denial of service attack that increases the processing load on the kernel privileged process processing unit 1200 and disables the operation processing of the entire system.

  In the above, an example of the present invention has been described, but only a specific example has been illustrated, and the present invention is not particularly limited. Specific configurations and the like in each embodiment and each modified example can be appropriately changed in design. . In addition, each of the specific configurations of each embodiment and each modified example can be combined. Furthermore, the actions and effects of each embodiment and each modified example are merely a list of the most preferable actions and effects resulting from the present invention, and the actions and effects according to the present invention are described in each embodiment and each modified example. It is not limited to the ones.

It is a figure which shows the internal structure of the operation | movement history protection apparatus in 1st Embodiment. It is a figure which shows the content of the operation history protection rule information in 1st Embodiment. It is a figure which shows the content of the identification information in 1st Embodiment. It is a figure which shows operation | movement of the operation history protection apparatus in 1st Embodiment. It is a figure which shows the execution order of each process in 1st Embodiment. It is a figure which shows the content of the monitoring list information in 1st Embodiment. It is a figure which shows the content of the monitoring list information in 1st Embodiment. It is a figure which shows the internal structure of the operation history protection apparatus in the example 1 of a change. It is a figure which shows the content of the identification information in the example 1 of a change. It is a figure which shows the content of the identification information in the example 1 of a change. It is a figure which shows the internal structure of the operation log | history protection apparatus in the example 2 of a change. It is a figure which shows the content of the identification information in the example 2 of a change. It is a figure which shows the content of the identification information in the example 2 of a change. It is a figure which shows the content of the identification information in the example 2 of a change. It is a figure which shows the internal structure of the operation history protection apparatus in the example 3 of a change. It is a figure which shows the content of the identification information in the example 3 of a change. It is a figure which shows the internal structure of the operation log | history protection apparatus in 2nd Embodiment. It is a figure which shows the content of the encryption setting rule information in 2nd Embodiment. It is a figure which shows the internal structure of the operation log | history protection apparatus in 3rd Embodiment. It is a figure which shows the content of the importance determination rule information in 3rd Embodiment. It is a figure which shows the content of the identification information in 3rd Embodiment. It is a figure which shows the content of the protection level determination rule information in 3rd Embodiment. It is a figure which shows operation | movement of the operation history protection apparatus in 3rd Embodiment. It is a figure which shows the content of the operation | movement history in the restricted authority process processing part in 3rd Embodiment. It is a figure which shows the content of the operation history in the kernel privileged process processing part in 3rd Embodiment. It is a figure which shows the internal structure of the operation | movement history protection apparatus in 4th Embodiment. It is a figure which shows operation | movement of the operation history protection apparatus in 4th Embodiment. It is a figure which shows the content of the specific operation execution log | history in 4th Embodiment. It is a figure which shows the content of the specific operation execution log | history in 4th Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Operation history protection apparatus, 110 ... Specific operation detection part, 200 ... Restricted authority process processing part, 210 ... Process, 220 ... Operation history recording part, 300 ... Kernel privileged process processing part, 310 ... Specific operation detection part, 320 ... identification information issuing unit, 330 ... operation history protection rule information storage unit, 340 ... operation history protection request information detection unit, 350 ... monitoring list information storage unit, 360 ... operation history protection control unit, 370 ... protection information recording unit, 400 ... operation history protection device, 500 ... restricted authority process processing unit, 510 ... process, 520 ... operation history recording unit, 600 ... kernel privileged process processing unit, 610 ... specific operation detection unit, 620 ... identification information issuing unit, 630 ... Operation history protection rule information storage unit, 640 ... Operation history protection request information detection unit, 650 ... Monitoring list information storage unit, 660 ... Encryption Regular rule information storage unit, 670 ... operation history protection control unit, 680 ... protection information recording unit, 700 ... operation history protection device, 800 ... restricted authority process processing unit, 810 ... process, 820 ... operation history recording unit, 900 ... Kernel privileged process processing unit, 910 ... specific operation detection unit, 920 ... identification information issuing unit, 930 ... importance level decision rule information storage unit, 935 ... operation history protection rule information storage unit, 940 ... operation history protection request information detection unit, 950 ... Monitoring list information storage unit, 960 ... Protection level determination rule information storage unit, 970 ... Operation history protection control unit, 980 ... Protection information recording unit, 1000 ... Operation history protection device, 1100 ... Restricted authority process processing unit, 1110 ... Process, 1120 ... Operation history recording unit, 1200 ... Kernel privileged process processing unit, 1210 ... Specific operation detection unit, 1220 Identification information issuing unit, 1230 ... reliability determination rule information storage unit, 1240 ... specific operation execution history information recording unit, 1250 ... specific operation control rule information storage unit, 1260 ... specific operation control unit, 1270 ... operation history protection request information detection Unit, 1280 ... monitoring list information storage unit, 1290 ... operation history protection control unit, 1300 ... protection information recording unit

Claims (17)

A kernel privileged process processing unit for controlling a kernel privileged process operating based on a privilege level capable of using various functions of the operating system;
A restricted authority process processing unit that controls a restricted authority process that is based on the restricted authority level that is a restricted authority level lower than the privilege level and that can use only a part of the various functions; With
The restricted authority process processing unit records an operation history of the restricted authority process in the restricted authority process processing unit,
The kernel privileged process processing unit records in the kernel privileged process processing unit a history of specific operations out of operation histories recorded in the restricted authority process processing unit.   The operation history protection device according to claim 1, wherein the specific operation is an operation related to setting of the operating system. The restricted authority process includes a first process and a second process,
When the inter-process communication between the first process and the second process is being executed, the kernel privileged process processing unit records the specific operation history of each of the first process and the second process. The operation history protection device according to claim 1, wherein the operation history protection device records the information in the kernel privileged process processing unit. The restricted authority process includes a first process and a second process,
When the specific operation of the second process generated based on the first process is being executed when the specific operation of the first process is being executed, the kernel privileged process processing unit 2. The operation history protection device according to claim 1, wherein the history of the specific operation of each of the first process and the second process is recorded in the kernel privileged process processing unit.   The kernel privileged process processing unit stores the history of the specific operation in the kernel privileged process processing unit according to a reliability level indicating a reliability level of the restricted authority process that is executing the specific operation. 2. The operation history protection device according to claim 1, wherein it is determined whether or not to record.   The kernel privileged process processing unit encrypts the history of the specific operation recorded in the restricted authority process processing unit by using key information that can be referred to only by the kernel privileged process processing unit. The operation history protection device according to claim 1.   The operation history protection according to claim 1, wherein the kernel privileged process processing unit records a copy of the history of the specific operation recorded in the restricted privileged process processing unit in the kernel privileged process processing unit. apparatus.   2. The operation history according to claim 1, wherein the kernel privileged process processing unit records a hash value of the history of the specific operation recorded in the restricted authority process processing unit in the kernel privileged process processing unit. Protective device.   The kernel privileged process processing unit is configured to record a copy of the history of the specific operation recorded in the restricted privileged process processing unit in the kernel privileged process processing unit according to the reliability level, or 6. The operation history protection device according to claim 5, wherein one of processes for recording a hash value of the history of the specific operation recorded in the restricted authority process processing unit in the kernel privileged process processing unit is determined. .   The kernel privileged process processing unit, when the hash value recorded in the kernel privileged process processing unit is the same as the hash value of the history of the specific operation recorded in the restricted authority process processing unit, The operation history protection device according to claim 8, wherein the specific operation history is determined to be a valid history. The kernel privileged process processing unit
A specific action detecting unit for detecting the specific action being executed by the restricted authority process;
An identification information issuing unit that issues unique identification information for individually identifying that the detected history of the specific operation is a protection target;
Based on the fact that the operation history protection request information for requesting the protection of the operation history of the restricted authority process is acquired from the restricted authority process, the restricted authority process of the request source of the operation history protection request information And an operation history recording unit that records the history of the specific operation of the restricted authority process in the kernel privileged process processing unit when the process ID is included in the identification information. Item 6. The operation history protection device according to Item 5.   The specific action detecting unit detects the specific action being executed by the restricted authority process when a specific library function is included in a system call issued by the restricted authority process. The operation history protection device according to claim 11. The specific action detection unit calculates the number of times of detection of the specific action per unit time,
When the calculated number of detections exceeds a preset number of times, a predetermined start of processing in the operation history recording unit after the operation history protection request information is acquired by the operation history recording unit The operation history protection device according to claim 11, further comprising a delay processing unit that delays the time.   The identification information issuing unit is responsive to a type of the specific library function included in the system call issued by the restricted authority process and a reliability level indicating a degree of reliability of the restricted authority process. The operation history protection device according to claim 12, wherein whether or not to issue the identification information is determined. The operation history protection request information includes first operation history protection request information and second operation history protection request information,
The first operation history protection request information is a system call for requesting the granting of access right to the recording destination of the operation history of the restricted authority process,
The second operation history protection request information is a system call for recording an operation history of the restricted authority process for the recording destination to which the access right is granted,
The operation history recording unit includes the second operation history protection request information when the process ID of the restricted authority process requesting the first operation history protection request information is included in the identification information. The operation history protection apparatus according to claim 11, wherein the operation history of the restricted authority process included is recorded in the kernel privileged process processing unit. The operation history protection request information includes third operation history protection request information,
The third operation history protection request information is a system call for requesting release of the access right to the recording destination to which the access right is granted,
16. The operation according to claim 15, wherein the operation history recording unit terminates the process of the operation history recording unit when the third operation history protection request information is acquired from the restricted authority process. History protection device. Computer
A kernel privileged process processing unit for controlling a kernel privileged process operating based on a privilege level capable of using various functions of the operating system;
As a restricted authority process processing unit that controls a restricted authority process that operates based on the restricted authority level that is a restricted authority level lower than the privilege level and that can use only a part of the various functions. An operation history protection program to function,
The restricted authority process processing unit records an operation history of the restricted authority process in the restricted authority process processing unit,
The kernel privileged process processing unit records a specific operation history among the operation histories recorded in the restricted authority process processing unit in the kernel privileged process processing unit.

Images