JP4431409B2 - Script processing method and script processing computer - Google Patents

Description

  The text format program is hereinafter referred to as “script”. The present invention relates to a script processing method and apparatus for executing encrypted script processing in a short time.

  In recent years, with the advancement of IT infrastructure, information communication using the Internet has been actively performed, and services for data processing and communication processing have been provided and utilized in a wide range of fields. It is coming. In addition, due to the increased convenience, these tools can be fully utilized as long as the user knows the minimum operation method such as the user interface even without special knowledge about IT infrastructure. One such background is the existence of an information sharing tool called “groupware software” that provides various conveniences through the use of data among multiple companies.

  However, since groupware software has only general-purpose functions, it can be used only as a form of information sharing in general companies. In order to use groupware software in industries that handle personal information such as medical institutions, special functions such as prevention of leakage of confidential information are necessary, and it is necessary to apply the operating environment for general companies as it is. difficult. Therefore, groupware developers often develop and provide customized functions for specific industries. In this way, groupware software is used in various industries by combining general functions that can be used widely and widely and special functions customized for special markets.

  For groupware developers, it is important how efficiently software development work can be performed for customization for a specific industry. As an example of a development form that increases efficiency, it is effective to provide customized software to the user in the form of a high-level language such as script processing in order to reduce the dependence on the user's OS and model as much as possible. is there.

  However, if the software is distributed as it is in the form of script processing, the software user can know the development contents of the software very easily just by looking at the contents of the script processing. In effect, such use will be permitted. Therefore, developers need to secure these scripts.

  The technique of Patent Document 1 is a recording medium used for distributing a text-format program described in an interpreter language to be interpreted and executed by an interpreter in a format that is difficult to decipher. A non-text format program (hereinafter referred to as “non-text script”) created by applying the process and a binary-format execution program for executing the non-text script are recorded. A decoding program for restoring the script by performing a decoding process that is a process opposite to the encoding process on the non-text script, and a script restored by the decoding program to the interpreter And a script providing program for passing. In other words, a script is executed by a decryption program for storing a code obtained by encrypting script processing in a recording medium, decrypting the encrypted code, and a script providing program for passing the decrypted script to an interpreter. It is.

  FIG. 4 is a conceptual diagram showing a program configuration of an application program recorded on a CD-ROM for Patent Document 1. This application program includes a non-text script corresponding to a text format program (hereinafter referred to as “script”) written in an interpreter language represented by Perl, and a binary format execution program for executing the non-text script. Each has a separate program and an interpreter for interpreting and executing the script one by one. It should be noted that if the script is written in a general-purpose interpreter language such as Perl and the user has a high probability of owning the general-purpose interpreter, and the general-purpose interpreter is easily available regardless of whether it is free of charge. In some cases, it is not always necessary to record the interpreter on a CD-ROM. However, if the script can only be executed by a dedicated interpreter, the dedicated interpreter must be recorded on the CD-ROM.

  The non-text script and the execution program are created by an encoding program. The encoding program also creates an execution program for executing the non-text script created in this way in a binary format. More specifically, the encoding program creates a decoding program for decoding the non-text script and a script providing program for passing the script restored as a result of decoding by the decoding program to the interpreter. In this case, the decryption program and the script providing program are described in machine language.

  In the prior art disclosed in Patent Document 1, script processing is not directly recorded on a recording medium that can be read very easily by the user, so the contents of the script recorded on the recording medium are kept secret, It is said that modification and secondary use by the user can be prevented.

  The contents of Patent Document 2 are shown in FIG. In FIG. 5, the information processing apparatus with security function of this technique has data processing means, first storage means, encryption means, decryption means, and second storage means. The encrypted instruction and data stored in the second storage means are decrypted, stored in the first storage means, and executed and processed by the data processing means. When data is output from the data processing means to the second storage means, the data is temporarily stored in the first storage means, then encrypted by the encryption means and stored in the second storage means. Accordingly, since the encrypted instruction and data stored in the second storage means can be decrypted and stored in the first storage means, execution and decryption of machine language instructions or data encryption are possible. Can be processed separately. Therefore, as long as the machine language instruction or data necessary for the first storage means is present (cached), there is no need for encryption or decryption, and the processing speed of the information processing apparatus with a security function can be increased.

Here, the first storage means and the second storage means form a storage hierarchy, and it is desirable that the first storage means is a higher-speed device than the second storage means. For example, a combination of a relatively high-speed storage device such as a semiconductor memory as the first storage means and a relatively low-speed storage device such as a disk device as the second storage means can be considered. Furthermore, the inside of the first storage means and the second storage means can be made into a hierarchical structure. As encryption and decryption algorithms, DES (Data Encryption Standard) and RSA (Rivest-Shamir-Adleman) encryption, relatively easy processing of address scramble and data bit scramble, simple encryption key and data exclusive There is a method of taking a logical sum.
Japanese Patent Laid-Open No. 11-353172 (page 6 and FIG. 2) JP 09-259044 (FIG. 1)

  However, customized groupware is often installed on a server managed by the user, and when the client requests script processing, the encrypted script processing is called from the storage medium, and the encryption is decrypted. When the procedure occurs repeatedly, especially when multiple clients request script processing, the number of times required to access a storage medium such as a hard disk, CD-ROM, or DVD increases, reducing the processing capacity of the server machine, Eventually, this was one of the causes of increasing the total processing time required to execute encrypted script processing on a computer.

  In Patent Document 2, two storage means (first and second storage means) for storing an encrypted instruction and a decrypted instruction are provided, and the two storage means are connected by a decryption means. Thus, “information obtained by encrypting script processing” is recorded in the second storage means, and “decrypted script processing” is recorded in the first storage means. That is, unless a special measure is taken, the user can access the first storage means, so that the contents of the script process can be read.

  Patent Document 2 discloses an example in which these functions are incorporated in an IC package and used as a protective container together with the IC so that the user cannot access the first storage means. Depends on the individual hardware, and the usefulness of describing by script processing is lost. Although it is possible to directly translate the processing into machine language by the decoding means described in Patent Document 2, it is necessary to include a compiler function for script processing in the decoding means. Will disappear.

Script execution is processed by a script processing execution unit (program) comprising means for compiling script processing to generate intermediate code and means for interpreter executing intermediate code. In general, it often depends on the OS of the computer, and in order to take advantage of the above-mentioned advantage of reducing the dependence on the user's OS and model as much as possible, it is necessary to customize the script processing execution unit without making any changes. Is done.
However, according to the prior art disclosed in Patent Document 1, the decryption script process is performed by referring to the memory from the outside, since the process after the decryption of the code is held in a partial area of the memory for a relatively long time. There was a problem that the information was leaked to third parties other than the developer.

  The present invention has been made to solve the above problems, and its purpose is to perform decryption generated when an encrypted script process is executed by a computer without modifying the script process execution unit. An object of the present invention is to provide a script processing method and a processing computer that prevent information on the script processing from being externally referenced and prevent the development contents from leaking to a third party other than the developer. Another object of the present invention is to provide a script processing method and its processing computer that can reduce the total processing time required when the encrypted script processing is executed by the computer.

  In order to solve the above problems, the invention according to claim 1 is characterized in that a script process constituted by one or more programs is encrypted in advance, and the encrypted code is recorded in a storage medium, and the script is recorded. When causing the computer to execute the script process in response to an execution request for processing, a first storage area in which the code is read from the recording medium in advance and the code is secured in the memory of the computer prior to the execution request. When the execution request is made, a reading process (S1) for storing the data in a batch is decoded, and a script process is generated by decoding only a necessary part of the code in the first storage area, and the script process is performed. A decryption step (S2) for storing in a second storage area secured in the memory of the computer; and the second description storing the script process. An address notifying step (S3) for notifying the address of the memory in the storage area to the next step, and referring to and translating the script processing based on the address, generating an execution format, and storing in the memory of the computer Each time the execution request is made by the script processing execution step (S4) of executing a predetermined process based on the execution format of the third storage area after being stored in the third storage area secured in In this script processing method, the decryption step (S2) and subsequent steps are executed.

In the invention according to claim 2, the execution format that is repeatedly executed in the script processing execution step (S4) is continuously stored and held in the third storage area as it is, and the decoding step S2 This is a script processing method that omits decryption of the script processing related to the execution format stored and retained.
The invention according to claim 3 is the script processing at the address after a predetermined time has elapsed since the address was notified to the script processing execution step (S4) in the address notification step (S3). This is a script processing method for erasing the stored contents.
According to a fourth aspect of the present invention, there is provided a computer capable of reading a storage medium storing a code obtained by encrypting a script process composed of one or more programs in advance, and prior to the execution request of the script process, A reading unit that reads the code from the recording medium and stores the code in a batch in a first storage area secured in a memory of the computer; and when there is an execution request, the reading unit stores the code in the first storage area Only a necessary part of the code is decoded to generate a script process, and the script process is stored in a second storage area secured in the memory of the computer, and the script process is stored An address notifying unit for notifying a script processing execution unit of a memory address in the second storage area; and the script based on the address. The reference processing is referred to, translated, and an execution format is generated and stored in a third storage area secured in the memory of the computer. Then, a predetermined processing is performed based on the execution format in the third storage area. A script processing execution unit that executes processing, and a script processing computer that executes the decryption unit, the address notification unit, and the script processing execution unit each time the execution request is made.

Further, in the invention according to claim 5, the script processing execution unit continues to store the execution format repeatedly executed in the third storage area as it is, and the decryption unit stores and holds the execution format. A script processing computer that omits decryption of the script processing according to the execution format.
According to a sixth aspect of the present invention, the address notification unit erases the stored content of the script processing at the address after a predetermined time has elapsed after notifying the script processing execution unit of the address. Script processing computer.
By the above means, the present invention reads script processing encrypted in a storage medium such as a hard disk, CD-ROM, or DVD in advance when the computer is turned on and stored in the memory, and accesses the memory when executing the script. You can execute the process just by doing.

According to the present invention, script processing composed of one or more programs is encrypted in advance, the encrypted code is recorded in a storage medium, and the script processing is executed in response to a script processing execution request. When executing the processing, a reading step (S1) of reading the code from the recording medium in advance and storing the code in a first storage area secured in the memory of the computer prior to the execution request. When there is the execution request, the script processing is generated by decoding only the necessary portion of the code in the first storage area, and the script processing is secured in the memory of the computer. And the address of the memory in the second storage area where the script process is stored is stored in the next step. An address notifying step (S3) for notifying the system, and referring to and translating the script processing based on the address, generating an execution format, and storing it in a third storage area secured in the memory of the computer After that, the decryption step (S2) and subsequent steps are executed each time the execution request is made by the script processing execution step (S4) for executing a predetermined process based on the execution format in the third storage area. Therefore, without modifying the script processing execution unit, the decryption script processing information generated when the encrypted script processing is executed on the computer can not be referred to from the outside. Security protection is possible.
Further, the execution format repeatedly executed in the script processing execution step (S4) is continuously stored and held in the third storage area as it is, and the execution format stored and held in the decryption step S2. Since the decryption of the script process is omitted, the total processing time required for executing the encrypted script process on the computer can be reduced.

  Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram of a first embodiment of the present invention. In the figure, 2 is a storage medium, 3 is a memory, 4 is a CPU as a central processing unit, and 5 is a script execution request to the script processing computer 1. The script processing computer 1 includes a storage medium 2, a memory 3, and a CPU 4.
The storage medium 2 is a built-in computer main body such as a hard disk drive device, a CD-ROM, or a form such that the storage medium itself can be read by another computer such as a DVD-ROM. It may be. In the storage medium 2, one or more programs described as script processing are recorded in the form of a code 21 that is encrypted in a form that cannot be decrypted even by a third party. As an encryption method, for example, there are encryption processing methods such as RSA and AES in addition to DES encryption.

  In the memory 3, three storage areas of a first storage area 31, a second storage area 32, and a third storage area 33 are secured.

  The CPU 4 has a read unit 41 that reads the code 21 from the recording medium 2 in advance when the computer is turned on, and stores the code 34 in the first storage area 31 as it is, and an execution request 5. Sometimes, only the necessary part of the reference numeral 34 in the first storage area 31 is decrypted to generate a script process, and the script process 35 is stored in the second storage area 32, and the script process 35 stores the script process 35. The address notifying unit 43 for notifying the address of the memory in the second storage area 32 to the script processing executing unit 44 and the script processing 35 are referred to and translated based on the address to generate the execution format 36. The script processing execution unit 44 executes a predetermined process based on the execution format 36 after being stored in the third storage area 33.

  As described above, the script process composed of one or more programs is encrypted in advance, the encrypted code 21 is recorded in the storage medium 2, and the script process is executed in response to the script process execution request 5. Let the computer execute it.

  FIG. 2 is a flowchart showing a script processing procedure according to the first embodiment of the present invention. That is, prior to the execution request 5, the reading unit 41 reads the code 21 from the recording medium 2 in advance and stores the code 34 in the first storage area 31 in advance. The script process 21 encrypted in the storage medium 2 such as a DVD is read in advance and stored in the memory 3 when the computer 1 is turned on.

  When there is an execution request 5, in the decoding step S 2, the decoding unit 42 generates a script process by decoding only a necessary part of the code 34 and stores the script process 36 in the second storage area 32. Then, in the address notification step S3, the address notification unit 43 notifies the next step of the address of the memory 3 in the second storage area 32 in which the script process 36 is stored. In the decryption step S2, since the script process 36 is decrypted only by accessing the memory 3, the processing time required for file access to the storage medium 2 is shortened.

  In the script processing execution step S4, the script processing execution unit 44 refers to and translates the script processing 35 based on the address of the memory 3 in which the script processing 35 notified from the address notification unit 43 is described, and executes the execution format 36. Is generated and stored (memory cache) in the third storage area 33 secured in the memory 3, and then predetermined processing is executed based on the execution format 36 of the third storage area 33. That is, the script process execution unit 44 compiles the script process 35 to generate an intermediate code, which is converted into an execution format 36, and the interpreter that executes the intermediate code interprets the execution format 36 and executes the script process. Is done.

  Then, after the completion of the script processing execution step S4, the decryption step S2 is executed every time there is an execution request 5, and when there is an execution request 5 again, the code 21 of the storage medium 2 is accessed. Instead, the code 34 in the memory 3 is accessed.

  In the script process execution step S4, the memory cache is controlled so that the execution format 36 repeatedly executed in the script process execution unit 44 is stored and held in the third storage area 33 as it is, and the decryption step is performed. In S <b> 2, it is preferable that the decoding unit 42 omits the decryption of the script processing related to the stored execution format 36. In this way, decoding and compilation can be omitted for frequently executed execution formats, so that high-speed script processing can be executed.

  Next, a second embodiment of the present invention will be described with reference to FIG. FIG. 3 is an explanatory diagram showing the configuration of the script processing computer according to the second embodiment of the present invention. 3 differs from FIG. 1 in that it includes a clock 6 and the other components are basically the same. That is, the script processing computer 1 includes a clock 6 that outputs pulse signals at regular intervals in addition to the configuration described in the first embodiment, and the address notification unit 43 counts the pulse signals. The address notification unit 43 (notification step S3) notifies the script processing execution unit 44 of the address of the script processing 35 recorded in the second storage area 32 of the memory 3, and then starts counting pulse signals. After the time (the time when the script processing execution unit 44 seems to have read the script processing 35) has elapsed, the stored contents of the script processing 35 in the second storage area 35 are erased.

  Confidential processing content for processing executed in script processing, such as script processing used as customized software such as groupware software and script processing used as a data communication method managed by conditional access It is useful as a means to use when you want to.

It is explanatory drawing which shows the structure of the script processing computer concerning 1st Example of this invention. It is a flowchart which shows the procedure of the script process concerning 1st Example of this invention. It is explanatory drawing which shows the structure of the script processing computer concerning 2nd Example of this invention. The content explanatory view of conventional technology (patent documents 1). The content explanatory view of conventional technology (patent document 2).

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Script processing computer 2 Storage medium 21,34 Code | symbol 3 Memory 31 1st storage area 32 2nd storage area 33 3rd storage area 35 Script process 36 Execution format 4 CPU
41 Reading unit 42 Decoding unit 43 Address notification unit 44 Script processing execution unit 5 Execution request 6 Clock

Claims (6)

When encrypting a script process composed of one or more programs in advance, recording the encrypted code in a storage medium, and causing the computer to execute the script process in response to a script process execution request ,
Prior to the execution request, a reading step (S1) of reading the code from the recording medium in advance and storing the code in a first storage area secured in the memory of the computer;
When there is the execution request, only the necessary part of the code in the first storage area is decoded to generate a script process, and the script process is stored in the second storage area secured in the memory of the computer A decoding step (S2) to be stored;
An address notification step (S3) for notifying the next step of the address of the memory in the second storage area in which the script processing is stored;
The script processing is referred to and translated based on the address, an execution format is generated, stored in the third storage area secured in the memory of the computer, and then the execution of the third storage area A script process execution step (S4) for executing a predetermined process based on the format;
The script processing method is characterized in that the decryption step (S2) and subsequent steps are executed each time the execution request is made.   The execution format repeatedly executed in the script processing execution step (S4) is continuously stored and held in the third storage area as it is, and the execution format stored and held in the decoding step (S2). The script processing method according to claim 1, wherein decoding of the script processing according to claim 1 is omitted.   In the address notification step (S3), after the address is notified to the script processing execution step (S4), the stored content of the script processing at the address is erased after a predetermined time has elapsed. The script processing method according to claim 1. A computer capable of reading a storage medium storing a code obtained by encrypting a script process constituted by one or more programs in advance,
Prior to the execution request of script processing, a reading unit that reads the code from the recording medium in advance and stores the code in a first storage area secured in the memory of the computer;
When there is the execution request, only the necessary part of the code in the first storage area is decoded to generate a script process, and the script process is stored in the second storage area secured in the memory of the computer A decryption unit for storing;
An address notification unit for notifying the script processing execution unit of the address of the memory in the second storage area in which the script processing is stored;
The script processing is referred to and translated based on the address, an execution format is generated, stored in the third storage area secured in the memory of the computer, and then the execution of the third storage area A script process execution unit that executes a predetermined process based on the format;
A script processing computer that executes the decryption unit, the address notification unit, and the script processing execution unit each time the execution request is made.   The script processing execution unit continues to store and retain the execution format that is repeatedly executed in the third storage area, and the decryption unit performs the script processing of the execution format that is stored and retained. 5. The script processing computer according to claim 4, wherein decryption is omitted.   The address notification unit, after notifying the script processing execution unit of the address, erasing the stored content of the script processing at the address after a predetermined time has elapsed. Script processing calculator.

Images