JP2989487B2 - Virus check system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a virus check system, and more particularly, to a virus check system having a function of collecting the results of a virus check system process executed on a computer system physically separated via a network. About.

[0002]

2. Description of the Related Art When a user starts execution of a process using a program file, a portion for performing a process unrelated to the original process is added to a program file for executing a process on a computer system in advance. There is a malicious program called a virus program which aims to execute an unauthorized process that is not intended by the user.

[0003] Since this virus program is created by a malicious person and added to the program file using a method that is difficult for the user to recognize, it is determined whether a virus program has been added to a specific program file. It is necessary to check before using the program file.

Conventionally, the following method has been used for checking a virus program.

(1) Copy a program file in a stage where a virus program has not been added to a medium unaffected by other processing such as a floppy disk.
It is determined whether a virus program has been added to the program file by saving and comparing the program file executed by the user with the program file as needed.

(2) Whether or not a virus program has been added to a program file by holding the code of a specific virus program and searching whether or not the code pattern is included in an arbitrary program file Check if.

In the method (1), all the program files used by the user must be stored in a state where the virus program has not been added to the program files. Because of the enormous number, it is difficult to realize it, and the method (2) is mainly used for virus check.

[0008]

When the method (2) is performed, a virus check is performed on all program files so that the addition of a virus program can be immediately confirmed when performing the virus check. It needs to be done more frequently.

For this purpose, a computer that can access the auxiliary storage device storing the program file to be checked is set so that the virus check program can be started at any time. For example, when the program file to be checked is used. It is necessary to automatically start a virus check program immediately before that and check the program file for viruses.

However, in this method, since the program file of the virus check program itself is stored on the auxiliary storage device accessible from the same computer, the virus program may be added to the virus check program itself. If a virus program is added, there is a problem that the check result cannot be trusted.

The problem is that the virus check program itself is stored on a medium such as a floppy disk which is not affected by other processes, and is accessed from the computer only when the virus check is executed (for example, inserted into a floppy disk drive). By doing so).

However, it is necessary to perform a physical operation such as an operation of inserting a floppy disk into a floppy disk drive, and much trouble is required to increase the frequency of execution of the virus check process. Especially,
If there are a plurality of computers to be checked for viruses, this becomes a major obstacle.

An object of the present invention is to provide a virus check system capable of efficiently checking whether a virus program has been added and obtaining a highly reliable check result.

[0014]

In order to achieve the above object, the present invention basically positions a computer system that executes processing based on a program stored in a specific file as a terminal system. It comprises a central management system that receives the check result of the virus check program in the end system and monitors whether the program used in the end system is infected by a virus program.

That is, an end system including one-way function calculating means for converting a virus check program by a one-way function, transfer means for transferring the conversion result of the one-way function calculation means, and this end system Storage means for storing a copy of the virus check program, a one-way function calculation means for converting the virus check program stored in the storage means by a one-way function, and a conversion result of the one-way function calculation means And a comparison unit for comparing the conversion result of the one-way function calculation unit transferred from the transfer unit of the end system, and a matching unit for detecting whether or not the two match each other. .

Further, in contrast to this basic configuration, the end system combines the detection result of the virus check program and the conversion result of the one-way function calculation means into one set, and transfers the result to the central management system by the transfer means. The central management system further includes notifying means for notifying an administrator of the result of the comparison by the comparing means and the result of detection by the virus check program transferred from the end system. Features.

Further, the central management system further comprises means for instructing the end system to detect a virus program by the virus check program at regular intervals.

Further, the one-way function calculating means of the terminal system and the central management system is characterized in that the conversion is executed by combining information unique to the system in addition to the virus check program.

[0019]

According to the above arrangement, the end system converts a virus check program for checking whether a virus program has been added by a one-way function, and transfers the conversion result to the central management system.

Here, the one-way function is a function that, when a part of the input data changes, changes to a completely different code, and converts the input data before conversion into data that becomes unpredictable.

On the other hand, the central management system stores a copy of the virus check program of the end system in advance, but at the time of virus check, the stored virus check program is converted by a one-way function. The conversion result is compared with the conversion result of the one-way function calculation means transferred from the terminal system. If the two match, it is determined that the virus program has not been added. Is added, and the result of the certification is notified to the administrator.

Thus, there is no need to perform a physical operation such as an operation of inserting the disk into the floppy disk drive, and the virus can be efficiently checked.

Further, since it is known whether or not the virus check program itself is affected by the virus program, a highly reliable check result can be obtained.

Further, in a configuration in which the result of detection by the virus check program and the result of conversion by the one-way function calculating means are combined into one set and transferred to the central management system, You can know if you are infected by a virus program.

In a configuration in which the central management system instructs the end system to detect a virus program by the virus check program at regular intervals, the administrator automatically obtains a virus check result at regular intervals. be able to.

Furthermore, the one-way function calculating means of the terminal system and the central management system causes the virus check program to execute conversion by combining information unique to the system in addition to the virus check program. Copy, perform a one-way function conversion from the copied virus check program, and use this conversion result to transfer a false check result indicating that no virus program has entered the central management system. Immediate detection of a false check result is possible.

[0027]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a system configuration diagram showing an embodiment of a virus check system according to the present invention. A plurality of end systems 102 to 104 are connected to a central management system 105 via a network 101.

The terminal systems and the central management systems 102 to 105 are constituted by general-purpose computer systems.
To 111, and the central management system 105 includes auxiliary storage devices 112 and 113.

Auxiliary storage devices 106, 108, 110, 1
Reference numeral 12 denotes an auxiliary storage device for storing a virus check program of the present system.
Reference numeral 1 denotes an auxiliary storage device for storing other general programs to be checked for viruses by the present system. Reference numeral 113 denotes an auxiliary storage device for sequentially storing the results of the virus check processing executed a plurality of times.

FIG. 2 is a functional block diagram showing a detailed configuration of the terminal system and the central management system.

The terminal system 102 comprises a virus check processing unit and other parts.

Reference numeral 203 denotes a data receiving unit for receiving a virus check processing start request (data) from the central management system 105 from the network 101.

Reference numeral 204 denotes a program starting unit for reading the virus check program from the auxiliary storage device 106 and operating it on the terminal system.

A data transmission unit 205 transfers the result (data) of the virus check process to the central management system 105 via the network 101.

Reference numeral 206 denotes a serial number adding unit for adding "1" to the serial number set and recorded in the initialization stage of the present system.

Reference numeral 207 denotes a one-way function calculator for using a bit string of an arbitrary length as input data and converting the data into an irreversible shorter bit string using a one-way function.

Reference numeral 208 denotes a virus program pattern search unit that searches for a finite type of known virus programs to determine whether a code pattern exists in a specific program file.

Reference numeral 209 denotes a virus check program stored in the auxiliary storage device 106. The virus check processing unit started by the virus check program 209 includes the data transmission unit 205 to the virus program pattern search unit 208.

Reference numerals 210 and 211 are general program files to be checked for whether a virus program has been added.

Reference numeral 212 denotes a data transmission unit for transmitting a virus check start request to the data reception unit 203 of each of the end systems 102, 103, and 104.

Reference numeral 213 denotes each terminal system 102 to 104
This is a data receiving unit for receiving the result of the virus check processing by.

Reference numeral 214 denotes a virus check start request creation unit for instructing each of the end systems 102 to 104 to start a virus check process by a virus check manager.

In this case, the virus check start request is created directly from an input device such as a terminal device by the virus check manager, or is automatically created periodically or as needed using a timer function or the like.

Reference numeral 215 denotes a serial number adding unit for adding "1" to the serial number set and recorded in the initialization stage of the system.

Reference numeral 216 denotes a one-way function calculator.

Reference numeral 217 denotes a collation unit which inputs the calculation results of the one-way function calculated by the one-way function calculation units 207 and 216, and determines whether or not the values match.

Reference numeral 218 denotes each terminal system 102-104.
This is a virus check result accumulation unit for recording the result of the virus check process received from the server.

Reference numeral 219 denotes a virus check result analysis unit for analyzing the result of the virus check processing in each of the end systems 102 to 104 recorded in the storage unit 218 and outputting the result in a format that is easy for the administrator to read.

Reference numeral 220 denotes a copy / copy operation when the system is initialized.
This is the virus check program on the end system that is stored.

FIG. 3 is a configuration diagram of a message including the result of the virus check process transmitted from the end system 102 to the central management system 105.

In FIG. 3, reference numeral 301 denotes a calculation result by the one-way function of the program file of the virus check processing unit of the end system that transmitted this message.

Reference numerals 302 to 304 denote the names of known virus programs (or I
D).

Reference numerals 305 to 307 denote the number of program files for which it has been determined that the virus programs 302 to 304 have been added.

Reference numerals 308 to 312 denote the names (or IDs) of the program files for which it has been determined that the virus programs 302 to 304 have been added.

Note that 308 is blank when there is no program file determined to have been added for virus A described in 302.

FIGS. 4 and 5 are flowcharts showing the flow of the processing of this system.

The contents of the processing of the present system will be described below with reference to FIGS.

First, in steps 401 to 403, an initialization process is performed.

Specifically, the central management system 105 calculates the serial number as a random number (step 40).
1). In this case, the serial number may be a simple positive number, but it is not necessarily required to be a complete random number as long as the value has a structure that is difficult to predict, such as a date or a user ID.

Next, the serial number created here is recorded in the serial number adding unit 215, and at the same time, transmitted to each of the terminal systems 102 to 104 via the network 101 (step 402).

Each of the terminal systems 102 to 104 records the received serial number in the serial number adding unit 215 (step 403). In this case, the location where the serial number is recorded may be on an auxiliary storage device or the like, but it is desirable that the serial number can be freely set at a location not expected by the virus program.

The virus check process is executed by creating a request on the virus check start request creating unit 214 and transmitting it to each of the end systems 102 to 104.

Here, the virus check start request is created manually by an administrator using an input device such as a terminal device or automatically by using a timer function on the central management system 105. Method of creating a system or each end system 102 to be checked for viruses
A method of creating a time zone in which the use frequency of the data items 104 to 104 is small is conceivable.

The virus check start request is separately created for each of the plurality of end systems 102 to 104. The same request message may be copied and transmitted to all the end systems 102 to 104 at the same time. .

The virus check start request thus created is sent to the corresponding end system 102,1.
03 and 104 are transmitted from the data transmission unit 212 (step 404).

In the terminal system 102, the data receiving unit 2
03, a virus check start request is received (step 405), and the virus check processing unit is started by the program start unit 204 by referring to the virus check program 209 of the auxiliary storage unit 106 (step 4).
06).

The activated virus check processing unit first takes out the virus check program from the auxiliary storage unit 106 and creates data linked to the serial number data recorded in the serial number addition unit 206 (step 407).

The concatenated data is converted to a one-way function
Then, the conversion by the one-way function is performed as input data to 7 (step 408).

Next, all program files operating in the end system 102 are listed (step 409), and a virus check process is executed for each of them by the virus program pattern search unit 208 (step 410).

The obtained virus check result, that is, data indicating which program file has been added with which kind of virus program, is stored in step 4.
In addition to the calculation result of the one-way function obtained in step 08, the data is stored in the table shown in FIG.
1).

In the central management system 105, the result of the virus check process from the end system 102 is received by the data receiving unit 213. The received result is stored in the auxiliary storage device 113 by the virus check result storage unit 218.
To be stored.

On the other hand, in the central management system 105, the serial number recorded in the serial number adding section 215 and the virus check program 22 of the corresponding end system 102 copied and stored in the auxiliary storage device 112 are stored.
0 is concatenated (step 412), and the data is used as an input to the one-way function calculation unit 216 to perform conversion by a one-way function (step 413).

Next, the collation unit 2 compares the conversion result 301 of the one-way function received from the terminal system 201 extracted from the auxiliary storage unit 113 with the result of step 413.
17 (step 414).

The result of the comparison and the results 302 to 312 of the virus check processing are notified to the virus check manager (step 415).

If the conversion result 301 by the one-way function 301
If the result of the conversion in step 413 does not match, the virus check program 209 of the end system 102
Since the virus check program 209 itself is invaded by the virus program, the administrator can determine whether or not the virus check program 209 itself has an abnormality based on whether or not the comparison results match.

Here, when the virus check processing is executed for all the end systems 102 to 104 under the control of the central management system 105 (step 41)
6) The serial number recorded in the serial number adding unit 215 is increased by "1". At the same time each terminal system 1
Also in 02 to 104, the serial number recorded in the serial number adding unit 206 is incremented by "1", and the virus check processing of all the end systems is completed.

This serial number is information unique to the system of this embodiment, and the virus program cannot know this serial number. Therefore, the terminal systems 102-1
In addition, the one-way function calculation units 206 and 216 of the central management system 105 and the one-way function calculation units 206 and 216 cause the virus check program to execute conversion by combining the serial number unique to the system, so that the virus check program 209 is copied. Even if a false check result indicating that no virus program has entered the central management system 105 using the converted result is transferred from the copied virus check program to the central At 217, the comparison result becomes inconsistent, and a false check result can be immediately detected.

[0079]

As is apparent from the above description, according to the present invention, the virus check program used by the terminal system is converted by a one-way function, and the conversion result is transferred to the central management system. In step (1), the virus check program of the terminal system, which has been copied and stored in advance, is converted by the one-way function, and the conversion result is compared with the conversion result of the one-way function calculation means transferred from the terminal system, and the two match. If so, it is determined that the virus program has not been added, and if they do not match, it is determined that the virus program has been added, and the result of the certification is notified to the administrator. There is no need to perform physical operations such as insertion into the It is possible to perform the click.

Further, since it is known whether or not the virus check program itself is affected by the virus program, a highly reliable check result can be obtained.

Further, in a configuration in which the detection result by the virus check program and the conversion result of the one-way function calculation means are combined into one set and transferred to the central management system, You can know if you are infected by a virus program.

In a configuration in which the central management system instructs the end system to detect a virus program by the virus check program at regular intervals, the administrator automatically obtains the virus check result at regular intervals. be able to.

Further, the one-way function calculating means of the terminal system and the central management system causes the virus check program to execute conversion by combining information unique to the system in addition to the virus check program, so that the virus program can execute the virus check program. Copy, perform a one-way function conversion from the copied virus check program, and use this conversion result to transfer a false check result indicating that no virus program has entered the central management system. Immediate detection of a false check result is possible.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram showing one embodiment of a virus check system of the present invention.

FIG. 2 is a functional block diagram showing a detailed configuration of a terminal system and a central management system of the embodiment of FIG. 1;

FIG. 3 is a structural diagram of data transferred from an end system to a central management system.

FIG. 4 is a flowchart illustrating a flow of a virus check process.

FIG. 5 is a flowchart showing a continuation of FIG. 4;

[Explanation of symbols]

101: Network, 102 to 104: Terminal system, 105: Central management system, 106 to 113: Auxiliary storage device, 203, 213: Data receiving unit, 205, 2
12 data transmission unit, 206, 215 serial number adding unit, 207, 216 one-way function calculation unit, 208
Virus program pattern search unit, 209, 220 ...
Virus check program, 210, 211 ... program file, 218 ... virus check result storage unit,
219: Virus check result analysis unit.

Continuation of the front page (56) References JP-A-4-100147 (JP, A) JP-A-4-338823 (JP, A) JP-A-4-163627 (JP, A) JP-A-4-100147 (JP) , A) B. Schneier "ONE-WA Y HASHING FUNCTION S (Using Cryptograp hic Algorithm for Hashing" Doctor Dob b's Journal (1991-9) (58) investigated the field (Int.Cl. ^6, DB name) G06F 9/06

Claims (3)

(57) [Claims] 1. A virus check system for detecting, by a virus check program, that a specific file contains a virus program intended to execute an illegal process, wherein the virus check program includes a one-way function. One-way function calculating means for converting by using the one-way function calculating means and the virus check program
System comprising a transfer means for combining and transferring the detection results obtained by the above-mentioned methods into one set, a storage means for storing a copy of the virus check program of the end system, and a virus check program stored in the storage means Is converted by a one-way function, and the conversion result of the one-way function calculation means is compared with the conversion result of the one-way function calculation means transferred from the transfer means of the terminal system. a matching means for detecting whether or not they match, the verification hands
The verification result by the step and transfer from the transfer means of the terminal system
Detection result by the sent virus check program
A central management system including a notification unit for notifying a result ,
Virus check system. 2. The system according to claim 1, wherein the central management system includes the terminal system.
Virus by the virus check program
2. The virus check system according to claim 1, further comprising means for instructing a virus program detection process at regular intervals . 3. The end system and a central management system.
The one-way function calculation means for the virus check program
In addition to RAM, combine and convert information unique to the system
Virus checking system according to claim 1 or 2, wherein the performing.