JP4907371B2 - Virus infection and confidential information leakage prevention system - Google Patents

Description

  The present invention relates to virus countermeasures for computers, and more particularly to a virus infection and confidential information leakage prevention system for safely opening files and Web pages that may contain viruses.

  As a technique for receiving an e-mail, for example, there is a technique described in Patent Document 1. As shown in FIG. 9, according to the technique described in Patent Document 1, two OS (Operating System) environments are constructed using two virtual machines 52 and 53 on one computer 51. One OS environment is a confidential OS that handles confidential information such as business, and the other OS environment is a general-purpose OS that can access the Internet 54 and has a risk of virus infection.

  An electronic mail transmitted for business use in the company is transmitted / received via the confidential mail server 56 using the mail client 55 on the confidential OS. Electronic mail transmitted / received via the Internet 54 is transmitted / received via the general mail server 58 using the mail client 57 on the general OS. With this configuration, although the general-purpose OS may be infected with a virus, even if it is infected, the confidential information is handled by the confidential OS, which is a virtual separate machine, so the confidential information is leaked or destroyed. Never do.

  Further, there is a technique described in Patent Document 2 as a virus infection prevention means using another virtual machine. According to this technology, open an attached file on a virtual machine for inspection, send an e-mail, tamper with an existing file, change execution conditions such as the date and time of the virtual machine, etc. I am inspecting.

  Furthermore, there is a technique described in Patent Document 3 as a macrovirus infection prevention means. According to this technique, a macro included in an e-mail from a specific e-mail sender is encrypted in advance, and if the macro cannot be decrypted, it is regarded as a virus and the macro execution is stopped. This technique prevents viruses from infecting computers. Further, macros that are at risk of being infected by a virus are registered in advance, and the execution of such macros is stopped to prevent virus infection.

JP 2006-201845 A JP 2004-038273 A JP 2002-351686 A

  However, in the case of the technique described in Patent Document 1, it is necessary to use a confidential mail client and a general mail client separately, which is inconvenient. Although it is certain that it is safer to separate general use and confidential use in terms of security, until now there has not been such a proper use, and when introducing such a system such as educating users and getting used to operations, etc. The threshold was high.

  Moreover, in the technique described in Patent Document 2, there is no method for determining how long an e-mail is to be observed, and there remains a possibility that the e-mail is transmitted after a time exceeding the observation time. Even if the conditions such as date and time are changed, there is a possibility that the virus may be missed depending on when the observation is made. Also, with recent viruses, there is a virus that checks whether it is running on a virtual machine and stops its activity if it is on a virtual machine. The technique of Patent Document 2 cannot exert any effect.

  In the technique described in Patent Document 3, an unauthorized macro is encrypted by stealing a key held by a specific communication partner, and the macro is executed without being aware of this. There is a risk of running macros and getting infected.

  The object of the present invention is to solve these various problems of the prior art, and safely open a file that may contain a virus without increasing the number of mail clients. It is to provide a countermeasure system for preventing virus infection and confidential information leakage.

In order to achieve the above object, a virus infection and confidential information leakage prevention system according to claim 1 includes a general-purpose computer that handles general information,
A confidential computer that handles confidential information;
A first gateway having a function of encrypting a file, adding a signature to the file, and transmitting the file to the confidential computer;
A second gateway having a function of verifying a signature of a file received from the confidential computer and transmitting it to the general computer;
Is configured with a control means for controlling the transmission and reception of the file in the general for computers and sensitive for computer and the first gateway and second gateway, wherein, the file in the secret for computer via a network when capturing is by way of the first gateway, when displaying the captured file is characterized in that transfer files to the second gateway from the confidential computing.

  As an example, an electronic mail received via the Internet encrypts a part of an attached file that is likely to contain a virus with a mail gateway and attaches a signature. And it receives with the mail client of a confidential virtual machine. When displaying the attached file, the mail client sends it to the file gateway, and the file gateway confirms the signature and transfers it to the general virtual machine. In the general virtual machine, the attached file is decrypted and displayed.

Further , according to a second aspect of the present invention, in the virus infection and confidential information leakage prevention system according to the first aspect, the first gateway further encrypts the entire received mail and sends the signed data to the confidential computer. It has the function to transmit to.

  In the confidential computer, since the attached file in the received electronic mail is encrypted, the contents of the file cannot be accessed. Therefore, the computer is not infected with a virus. As a result, leakage or destruction of confidential information can be prevented. In addition, if the mail client on the confidential computer instructs the display of the attached file, it is automatically displayed on the general computer side, so that the display time is not increased. Therefore, as before, using a single mail client, it is possible to send and receive e-mails received via the Internet and in-house confidential e-mails without changing usability.

Embodiments of a virus infection and confidential information leakage prevention system to which the present invention is applied will be described below.
(Embodiment 1)
As shown in FIG. 1, the virus infection and confidential information leakage prevention countermeasure system according to this embodiment includes a virus infection and confidential information leakage prevention countermeasure computer (hereinafter simply referred to as “computer”) 11 and a mail server 12. Yes. The computer 11 and the mail server 12 are connected via a LAN (Local Area Network) 13 so that they can communicate with each other.

As shown in FIG. 1, a computer 11 includes a general virtual machine 14 as a general computer, a confidential virtual machine 15 as a confidential computer, a mail gateway 16 (first gateway), and a file gateway 17 (second gateway). The CPU 18 is provided as a control means.
As an emulator for realizing the general virtual machine 14 and the confidential virtual machine 15, for example, there is VMware (registered trademark) as an existing product. The general virtual machine 14 and the confidential virtual machine 15 are configured to operate independently by different OSs.

  The general virtual machine 14 can directly access the mail server 12 and the like via the LAN 13 and handles general information other than confidential information. Therefore, there is a risk of being infected with a virus. On the other hand, the confidential virtual machine 15 cannot directly access the mail server 12 or the like via the LAN 13, and handles confidential information in business or the like.

  The mail gateway 16 is a program through which an electronic mail is received from the mail server 12 by the confidential virtual machine 15. The mail gateway 16 has a function of encrypting the attached file, adding a signature to the attached file, and transmitting the attached file to the confidential virtual machine 15. The mail gateway 16 holds a public key and a signature key.

The file gateway 17 is a program used when transferring the attached file to the general virtual machine 14. The file gateway 17 has a function of verifying the signature of the attached file received from the confidential virtual machine 15 and transmitting it to the general virtual machine 14. The file gateway 17 holds a verification key.
Further, the display program operating on the general virtual machine 14 holds a secret key.

The signature key of the mail gateway 16 and the verification key of the file gateway 17 correspond to each other, and the verification key is used for verifying the signature generated by the signature key in the mail gateway 16. Further, the public key of the mail gateway 16 corresponds to the private key of the display program operating on the general virtual machine 14, and data encrypted with the public key can be decrypted with the private key.
The CPU 18 has a function of controlling operations of the general virtual machine 14, the confidential virtual machine 15, and other general computers 11 based on a program stored in a hard disk (not shown).

In the confidential virtual machine 15, a mail client 19, which is software for creating and sending / receiving e-mails, storing and managing received mails, and the like operates.
An e-mail transmitted from an external terminal device or the like via the Internet (not shown) or an e-mail transmitted from an in-house terminal device connected to the LAN 13 is sent to the mail server 12.

  Here, the configuration of the e-mail will be described. An e-mail generally includes a header part, a text body file, and an attached file. The header part includes information such as the sender address, subject, and transmission time. There is also an electronic mail that does not include a body text file and includes only a header part and an attached file. Also, there may be a plurality of attached files. Many of the viruses included in the e-mail are included in the attached file portion.

Next, the configuration of an encrypted file generated when an attached file attached to an e-mail received via the LAN 13 passes through the mail gateway 16 will be described. The encrypted file includes an encryption key, a file name, an attached file, and a signature.
The encryption key is randomly generated data and is encrypted with a public key. The generation and encryption of the encryption key are executed by the mail gateway 16.
The file name and the attached file are encrypted with the encryption key. The encryption is executed by the mail gateway 16. Then, the signature is generated in the mail gateway 16 using the signature key.

Next, the operation of the mail gateway 16 when the mail client 19 operating on the confidential virtual machine 15 receives an e-mail will be described. The following processing is executed under the control of the CPU 18 based on a program or the like stored in a storage unit such as a hard disk.
As shown in FIG. 2, first, the mail gateway 16 receives an e-mail reception request from the mail client 19 (step S21). The request includes authentication information such as a user ID and password information. Next, the mail gateway 16 transfers the previous reception request to the mail server 12 and receives an e-mail (step S22).

  Next, the mail gateway 16 determines whether or not an attached file is included in the received electronic mail (step S23). If it is determined that the attached file is included, the mail gateway 16 performs encryption and signature processing on the attached file, re-attaches it to the e-mail, and transmits it to the mail client 19 (step S24). ). On the other hand, if it is determined that the attached file is not included, the e-mail is transmitted as it is to the mail client 19 without performing encryption and signature addition processing (step S25).

Next, the process of encrypting the attached file and assigning a signature in step S24 will be described. The following processing is executed under the control of the CPU 18 based on a program or the like stored in a storage unit such as a hard disk.
As shown in FIG. 3, first, the mail gateway 16 randomly generates an encryption key (step S31). Next, the generated encryption key is encrypted with the public key (step S32). Next, the file name of the attached file and the attached file are encrypted with the encryption key (step S33). Next, the mail gateway 16 generates a signature of the encrypted encryption key, the file name of the encrypted attached file, and the attached file body (step S34). Then, the mail gateway 16 concatenates the encryption key, file name, attached file, and signature into one file.

Next, an operation when the mail client 19 is encrypted and an attached file with a signature is displayed will be described. This operation is realized by the mail client 19 executing a program for transferring an electronic mail.
As shown in FIG. 4, first, the mail client 19 extracts the attached file with encryption and signature from the mail (step S41). Next, the mail client 19 transfers the attached file to the file gateway 17 (step S42). Next, the file gateway 17 verifies the signature of the attached file using the verification key (step S43).

  If the verification fails, it is determined that the attached file has been tampered with or is not attached via the mail gateway 16, an error is returned to the mail client, and the process is terminated (step S44). On the other hand, if the verification is successful, the signature is removed from the attached file and transferred to the general virtual machine 14 (step S45). The general virtual machine 14 decrypts the encryption key encrypted using the secret key, and decrypts the file name and the attached file encrypted using the key (step S46). Then, the attached file is displayed on a display means such as a liquid crystal display (not shown) using a corresponding document display program.

As described above, the virus infection and confidential information leakage prevention countermeasure system of Embodiment 1 has the following effects.
In the confidential virtual machine 15, since the attached file in the received electronic mail is encrypted, the contents of the file cannot be accessed. Therefore, the computer 11 is not infected with a virus. As a result, leakage or destruction of confidential information can be prevented.

  Further, when the mail client 19 on the confidential virtual machine 15 instructs the display of the attached file, it is automatically displayed on the general virtual machine 14 side, so that the display effort is not increased. Therefore, as usual, using one mail client 19, it is possible to send and receive electronic mails received via the Internet and in-house confidential electronic mails without changing usability.

(Embodiment 2)
In the first embodiment, a method for safely displaying an attached file that may be infected with a virus has been described. In the present embodiment, a method for safely displaying a Web page that may contain a virus will be described.
As shown in FIG. 5, the virus infection and confidential information leakage prevention countermeasure system according to the present embodiment is a virus infection and confidential information leakage prevention countermeasure computer (hereinafter simply referred to as “computer”) 21, an in-house Web server 22, and the Internet. 23, an external Web server 24 connected to be communicable with each other is provided.

As shown in FIG. 5, the computer 21 includes a general virtual machine 25, a confidential virtual machine 26, a Web gateway 27, and a CPU 28 as control means. The general virtual machine 25 and the confidential virtual machine 26 are configured to operate independently by different OSs.
The general virtual machine 25 can directly access the external Web server 24 and the like via the Internet 23 by a general Web browser 29 which is application software for browsing Web pages. Therefore, there is a risk of being infected with a virus.

  On the other hand, the confidential virtual machine 26 can directly access the internal Web server 22 by the confidential Web browser 30. However, it is configured so that the external Web server 24 or the like cannot be directly accessed via the Internet 23. When accessing the external Web server 24, it is configured to access via the Web gateway 27.

Next, a processing procedure when the confidential Web browser 30 operating on the confidential virtual machine 26 accesses the external Web server 24 will be described. The following processing is executed under the control of the CPU 28 based on a program stored in a storage means such as a hard disk.
As shown in FIG. 6, first, the confidential Web browser 30 on the confidential virtual machine 26 transmits a URL (Uniform Resource Locator) to the Web gateway 27, which is a proxy server, when determining that the access destination is outside the company. Thus, the relay is requested (step S61).

  Next, the Web gateway 27 receives the requested URL from the confidential Web browser 30 on the confidential virtual machine 26 (step S62). Next, the Web gateway 27 returns an error message to the confidential Web browser 30 on the confidential virtual machine 26, and the confidential Web browser 30 displays an error (Step S63). Next, the Web gateway on the confidential virtual machine 26 transfers the URL to the calling program operating on the general virtual machine 25 (step S64).

  Next, the calling program operating on the general virtual machine 25 starts the general Web browser 29 with the transferred URL as an argument (step S65). Then, the general Web browser 29 on the general virtual machine 25 directly accesses the external Web server 24 and displays an image of a page corresponding to the URL, a document (Web data), or the like on a display unit such as a liquid crystal display (not shown). To do.

As described above, the virus infection and confidential information leakage prevention system according to the second embodiment has the following effects.
When the confidential virtual machine 26 accesses the external Web server 24, it is configured to access via the Web gateway 27. Therefore, it is possible to prevent the Web page that may contain a virus from being displayed in the confidential virtual machine 26.

The above embodiment may be modified as follows.
In the first embodiment, the general virtual machine 14 and the confidential virtual machine 15 exist on the same computer 11, but the two virtual machines 14 and 15 may exist on different computers. The same applies to the second embodiment.

  Further, the mail gateway 16 and the file gateway 17 in the first embodiment and the web gateway 27 in the second embodiment may also exist on different computers. Further, the confidential virtual machine 15 according to the first embodiment is configured as a confidential computer without using a virtual machine, the general virtual machine 14 is constructed thereon, and the mail gateway 16 and the file gateway 17 are set on the confidential computer. It is also possible to operate with The same applies to the second embodiment.

  In the first embodiment, public key encryption is assumed when encrypting an encryption key or generating a signature. That is, the public key and the private key, and the signature key and the verification key are in pairs. However, in order to increase the processing speed, secret key encryption (common key encryption or symmetric key encryption) may be used instead of the public key. In this case, it is necessary that the signature key and the verification key cannot be accessed except for the mail gateway 16 and the file gateway 17, and that the public key and the secret key cannot be accessed except for the mail gateway 16 and the display program.

  In the first embodiment, the attached file of the e-mail is encrypted and signed by the mail gateway 16, and the signature is verified by the file gateway 17 at the time of display, and the display program decrypts and displays it. This mechanism is not limited to email attachments, but can also be applied to file transfer and instant message attachments.

(Embodiment 3)
In the first embodiment, a method for safely displaying an attached file that may be infected with a virus has been described. In the second embodiment, a method for safely displaying a Web page that may contain a virus has been described. In the present embodiment, a safe usage method of an application that handles data that may contain a virus will be described.
As shown in FIG. 7, the virus infection and confidential information leakage prevention countermeasure system according to the present embodiment is a virus infection and confidential information leakage prevention countermeasure computer (hereinafter simply referred to as “computer”) 31, an in-house computer 32, and the Internet 33. The external computer 34 is connected to the computer 31 and the in-house computer 32 so as to communicate with each other.

As shown in FIG. 7, the computer 31 includes a general virtual machine 35, a relay virtual machine 36, a confidential virtual machine 37, and a CPU 38 as control means. The general virtual machine 35, the relay virtual machine 36, and the confidential virtual machine 37 are configured to operate independently by different OSs.
An application 39 runs on the general virtual machine 35. The application 39 can directly access the external computer 34 via the Internet 33. Therefore, there is a risk of being infected with a virus.

  On the other hand, the relay virtual machine 36 can operate the application 39 on the general virtual machine 35 via the virtual terminal server 41 by the virtual terminal 40. A virtual terminal is a program that receives screen information of a server machine from a virtual server, and remotely operates the server machine from a client by transmitting input information input by an input means such as a keyboard and a mouse to the server. Representative examples of virtual terminals include TELNET that remotely operates Linux and UNIX (registered trademark) servers, Remote Desktop Protocol that can remotely operate Windows (registered trademark), MetaFrame, and Virtual Network Computing.

  The relay virtual machine 36 can communicate only with the general virtual machine 35 and the confidential virtual machine 37. Further, a secure OS is running on the relay virtual machine 36. Further, the virtual terminal 40 and the virtual terminal server 42 are logically separated so that even if one is infected with a virus, the infection does not spread to the other. Here, the secure OS is an OS in which functions related to security are enhanced, and an example is Security-Enhanced Linux.

The confidential virtual machine 37 can access the relay virtual machine 36 and the in-house computer 32 via the virtual terminal server 42 using the virtual terminal 43. However, it is configured such that the external computer 34 or the like cannot be directly accessed via the general virtual machine 35 or the Internet 33.
The confidential virtual machine 37 can use the general virtual machine by operating the virtual terminal 40 on the relay virtual machine 36 using the virtual terminal 43.

The CPU 38 has a function of controlling the operations of the general virtual machine 35, the relay virtual machine 36, the confidential virtual machine 37, and other computers 31 in general, based on a program or the like stored in a hard disk (not shown).
When the secret virtual machine 37 uses the application 39, the application 39 is accessed via the virtual terminal server 42 and the virtual terminal 40. This process is executed under the control of the CPU 38 based on a program stored in a storage means such as a hard disk.

As described above, the virus infection and confidential information leakage prevention system according to the third embodiment has the following effects.
When the confidential virtual machine 37 uses an application 39 that may be infected with a virus, the virtual terminal server 42 and the virtual terminal 40 on the relay virtual machine 36 are relayed and accessed. Therefore, even if the general virtual machine 35 is infected with a virus by the application 39 and the virtual terminal 40 on the relay virtual machine 36 is infected with a virus via the virtual terminal server 41, the virus is further expanded by the function of the secure OS. The virtual terminal server 42 and the confidential virtual machine 37 can prevent virus infection.

The above embodiment may be modified as follows.
In this embodiment, the three virtual machines are configured to operate on one computer 61. However, the three virtual machines may be configured as separate computers without using the virtual machines.

(Embodiment 4)
In the first embodiment, a method for safely displaying an attached file that may be infected with a virus has been described. Next, a mode in which a mail including an attached file can be returned or transferred will be described. In addition, since the basic composition in this embodiment is the same as Embodiment 1, it abbreviate | omits here.
When replying or transferring only the text, the text is not encrypted, so that the mail client 19 can be used for replying as usual. However, if you try to send a reply or transfer including the attached file, the other party cannot read the text even if you send it because it is encrypted.

Therefore, in addition to encrypting and signing each attached file described in the first embodiment, the mail gateway 16 encrypts and signs the entire mail and adds it as an attached file. This is shown in FIG. The original mail consists of a header 44, a body text 45, and two attached files 46 and 47. In the first embodiment, the attached files are encrypted and signed, respectively, to obtain the attached files 48 and 49.
In addition, in this embodiment, the mail gateway 16 encrypts the entire mails 44 to 47 from the header to the attached file together with the processes of steps S3 and S34 in FIG. I tried to run. Then, the entire encrypted mail 50 is transmitted to the confidential virtual machine 15.

  When it is desired to reply or transfer including the attached file, the entire mail 50 with the encryption signature at the end of the attached file is selected and displayed. Then, the mail client 19 transmits to the file gateway 17 in the same manner as in the first embodiment, and finally the entire mail is displayed on the general virtual machine 14. Here, the reply or transfer operation is performed as usual. Just do it.

As described above, the virus infection and confidential information leakage prevention system according to the fourth embodiment has the following effects.
-When replying to mail by the mail client 19 on the confidential virtual machine 15, it is sufficient to reply with the general virtual machine 14 after instructing the display of the attached file of the entire mail, without greatly changing the conventional usability. It is possible to send and receive e-mails received via the Internet and in-house confidential e-mails.

  In the first and fourth embodiments, it is assumed that a virus is included in the attached file of the mail, and the confidential computer is prevented from being infected by the virus by encrypting the attached file. However, the possibility that a virus is included in the header and body cannot be denied. In addition to encrypting and adding a signature in the same way as the attached file, check whether the text contains characters other than the specified characters, whether the line length is within the specified range, etc. There are a method of replacing with a specific character and a method of breaking a line that is too long to fit within a specified number of lines.

1 is an overall configuration of Embodiment 1. The flowchart which shows operation | movement of a mail gateway. The flowchart which shows an encryption of an attached file and a signature provision process. The flowchart which shows the display process of an encryption file. Overall configuration of the second embodiment. The flowchart which shows a process when a confidential web browser accesses an external server. 4 shows an overall configuration of the third embodiment. Explanatory drawing of Embodiment 4. FIG. Configuration of the prior art.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 14 ... General virtual machine as general computer, 15 ... Confidential virtual machine as confidential computer, 16 ... Mail gateway as 1st gateway, 17 ... File gateway as 2nd gateway, 18, 28 ... Control means CPU, 27... Web gateway as gateway, 24.

Claims (2)

A general-purpose computer that handles general information;
A confidential computer that handles confidential information;
A first gateway having a function of encrypting a file, adding a signature to the file, and transmitting the file to the confidential computer;
A second gateway having a function of verifying a signature of a file received from the confidential computer and transmitting it to the general computer;
Is configured with a control means for controlling the transmission and reception of the file in the general for computers and sensitive for computer and the first gateway and second gateway, wherein, the file in the secret for computer via a network when capturing is by way of the first gateway, viral infections and confidential information leakage prevention when displaying the captured file, characterized in that transfer files to the second gateway from the confidential computing Countermeasure system. 2. The virus infection and confidential information leakage prevention according to claim 1, wherein the first gateway further has a function of encrypting the entire received mail and transmitting the signed data to the confidential computer. Countermeasure system.