JP2001142788A - Method and device for preserving data by data updating monitor and storage medium with data preservation program stored therein - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method and device for preserving data by data updating monitor to properly preserve data without a complicated manual work and a storage medium with a data preservation program stored therein, to monitor the illegal forgery or erasion of data and to save data in the case of the probability of the forgery or erasion. SOLUTION: A data management program having a function for registering, saving or restoring necessary and indispensable data is prepared and registered in a management database. The updating or erasion of data to be monitored and the execution state of a program using the data to be monitored are monitored based on the information of the management database. When data is updated while the program is stopped, data is saved. Besides, when data is updated or erased during the execution of the program, data is restored.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data protection method and device for monitoring data update for protecting data on a mass storage device or the like, and a storage medium storing a data protection program.

[0002]

2. Description of the Related Art Generally, a program includes an execution section and a definition data section. To protect this definition data from unauthorized tampering, it is common to add data protection processing to the execution part, but this can be broken, so back up the entire program including the definition data part in advance and Data recovery is done by manual recovery in cases.

Conventionally, as such a data security technique, for example, there is a technique disclosed in Japanese Patent Application Laid-Open No. Hei 10-171694, "backup method". In this method, an administrator identifies all data indispensable for system operation and business that exist in a distributed manner on all systems, determines a backup schedule, and periodically performs differential backup. The backup program having the differential backup function checks whether or not the backup target file has been changed at the time of the backup processing, and backs up only the file including the changed data to the backup device. When recovering data due to disk failure, improper data tampering, or accidental data loss, insert a storage medium that has backed up the data into a backup device and restore the data manually.

On the other hand, in recent years, there are service providers that provide various types of information in a large-scale Internet environment. In order to protect against unauthorized tampering or accidental data loss,
The data was regularly backed up in advance, and manually recovered when necessary.

[0005]

In the data security by the regular backup described above, an update operation is performed such that during a regular backup schedule, unauthorized information is once changed to invalid information by an unauthorized user and then restored. In such a case, it is difficult for the system administrator to notice the data tampering. Also, since the contents of data that has been properly updated by the system administrator are not backed up until the next regular backup process, if the data is destroyed before the next backup or if there is a data change by an unauthorized user, the administrator The updated data content is completely lost. In such a case, the system administrator has to recover the latest backup data for the time being and manually return the updated contents thereafter. In particular, in the case of a regular file other than a database, since the difference data is not acquired in the journal, it has been difficult to reproduce the updated contents, for example, depending on the memory of the system administrator. This applies particularly to a definition file that stores operation parameters of a program.

In a large-scale system, the operation of selecting and registering data that must be backed up becomes enormous. Further, when the number of files to be backed up increases, the entire backup time becomes longer due to the update data check processing of the backup program itself, and the backup device itself is occupied, thereby imposing a load on the entire system.

Further, when data is falsified or deleted by an unauthorized user, the system administrator considers data recovery first, so that the identification of the unauthorized user is postponed. Then, in many cases, the time has elapsed since the data was updated or lost, and the system operation log file was updated, and the unauthorized user had time to erase the evidence of unauthorized use. Is difficult to identify. Further, when the system administrator recovers the backup data, since this is performed manually, there is a danger of recovering another data or recovering the data to a wrong place, which is complicated and error-prone.

SUMMARY OF THE INVENTION An object of the present invention is to solve the above-mentioned problems in data security and to store a data security method, device, and data security program by monitoring data update so that proper data security can be performed without complicated manual operations. It is an object of the present invention to provide an improved storage medium. Another object of the present invention is to monitor unauthorized data tampering and deletion,
The object of the present invention is to save data when there is a possibility that unauthorized data may be falsified or deleted.

[0009]

In order to solve the above-mentioned object, the present invention provides an operation definition file for storing operation definition data of a business program at the time of installation of the business program. Is registered as an object to be saved, and the update of the registered operation definition file is monitored and detected, and when the update of the registered operation definition file is detected, the update content is saved. It is characterized by.

According to the present invention, in preserving data on a storage device, information for specifying data to be saved and recovered is registered, and information for specifying a program for referring to data to be saved and recovered is stored. The update of the registered evacuation and recovery target data is monitored and detected, and when the update of the registered evacuation and recovery target data is detected, the evacuation and recovery target data is The updated contents are saved or the saved data is restored based on the execution state of the referenced program.

According to the present invention, in preserving data on a storage device, information for specifying data to be saved and recovered is registered, and information for specifying a program for referring to data to be saved and recovered is stored. The update of the registered evacuation and recovery target data is monitored and detected, the execution state of a program that refers to the registered evacuation and recovery target data is detected, and the registered evacuation and recovery target data is detected. When the update of the data to be restored is detected, and when the execution state of the program that refers to the data to be saved and restored is suspended, the updated contents are saved, and the execution state is active. When the data is saved, the saved data is recovered.

The data to be saved and restored include:
For example, HT provided by a predetermined server program
This is an ML document or an operation definition file of the server program. The update is detected by, for example, comparing the update time information of the data to be monitored for update stored in advance with the update time information of the operating system, or detecting and reporting the update of the data by the operating system. By doing so.

[0013]

Embodiments of the present invention will be described below with reference to the drawings. First, as a first embodiment, an example in which the data update monitoring method according to the present invention is applied to perform data update monitoring of an operation definition file of a business system will be described.

FIG. 1 schematically shows a system configuration of a business system according to the first embodiment. Business system 10
A business program 11 for operating the business system 10, an operation definition file 12 for storing parameter information relating to the operation of the business program 11, a data management program 14 for monitoring update and backup of the operation definition file 12, An information management database 13 for registering information used by the data management program 14 and specifying the operation definition file 12, and a save area 15 for saving backup data and the like.
These components operate on the operating system 16. 135 indicates various types of operating system information used by the operating system 16. The most important components among these components are a data management program 14 and an information management database 13.

Normally, when a business is performed in the business system 10, the operation definition file 12 is a file in which operation parameter information necessary for the operation of the business program 11 is written, and is essential for the operation of the business system. Things. If the operation definition file 12 is falsified or deleted by an unauthorized person, it affects the operation of the business program 11 and further affects the operation of the business system 10, so that the information management file must be managed as a data protection target file. It must be registered in the database 13.

In the present embodiment, an information management database 13 and a data management program 14 are used as components of the business system 10 in order to manage the integrity of the operation definition file 12, which greatly affects the operation of the business program 11. register.

FIG. 2 shows the components of the data management program 14. The data management program 14 includes a data registration unit 141 that registers information for specifying the operation definition file 12 in the information management database 13 and an update of the operation definition file 12 specified by the information registered in the information management database 13. A data update monitoring unit 142 for monitoring the presence / absence, and a data saving unit 1 for backing up data of the operation definition file 12 in which the update has been confirmed by the data update monitoring unit 142 to the saving area 15.
43, a data recovery unit 144 that recovers the data of the operation definition file 12 that has been updated or lost by the data update monitoring unit 142 from the save area 15, and updates or updates the data of the operation definition file 12 by the data update monitoring unit 142. A data update notifying unit 145 that identifies a changer from system operation history information such as an access log file and notifies a system administrator when the loss is confirmed, and a program that refers to data in the operation definition file 12. A program information registration unit 14 for registering information for specifying the business program 11 in the information management database 13
6 and a program status monitoring unit 147 for monitoring the operation status of the business program 11 based on the information specifying the program registered in the information management database 13.

FIG. 3 shows the components of the information management database 13 used by the data management program 14. The information management database 13 includes a data management program 14
File management information 130 is prepared for each file monitored by. The file management information 130 includes a file information area 131 for storing information for specifying the operation definition file 12 including data to be saved and recovered, and an operation definition file specified by the information stored in the file information area 131. Update time information area 134 for storing the update time information of the T.12, and the operation definition file 12 specified by the information stored in the file information area 131.
Information area 1 for storing information for specifying the business program 11 that is a program that refers to the program
33 and an updater information area 1 for storing information for specifying an updater who has updated the action definition file 12 specified by the information stored in the file information area 131.
32.

FIG. 4 shows components of the operating system information 135 on which the data management program 14 operates. The operating system information 135 contains file information 1351 as information for managing files for each file existing on the operating system.
And program information 1350 as information for specifying a program running on the operating system. Further, the components of the file information 1351 include a file name 13511 as information for identifying the file, owner information 13512 as information for identifying the owner of the file, and an update time for identifying the update time for the file. Update time information 1 as information
3513, and a component of the program information 1350 is a process name 13501 for specifying an operating program.

FIG. 5 shows a processing flow (operation of the data management program 14) of a data backup and recovery procedure in the operation of the business system 10 according to the present embodiment, the contents of which will be described below.

First, a data registration process 51 is performed. In the data registration process 51, when the business program 11 is installed, the data registration unit 1 of the data management program 14
41, the file name of the operation definition file 12, which is information for specifying the operation definition file 12, is assigned to the file name 135 in the operating system information 135.
11 and registered in the file information area 131 in the information management database 13. Data registration unit 1
Similarly, 41 acquires the creation time information and the owner information of the operation definition file 12 from the update time information 13513 and the owner information 13512, and obtains the update time information 13
2 and the updater information area 134, respectively. The program information for specifying the business program referring to the operation definition file 12 is stored in the program information area 133.
Remember. In addition, the file information area 13
1 based on the file name registered in
The contents of the operation definition file 12 included in the operation definition file 12 are specified, and the contents of the operation definition file 12 are backed up by the data saving unit 143.

Next, a data update monitoring process 52 is performed. In the data update monitoring process 52, the data update monitoring unit 142
Checks whether the operation definition file 12 has been updated based on the information in the file information area 131 of the information management database 13. In the checking method by the data monitoring unit 142, the update time information 134 of the information management database 13 is compared with the update time information 13513 of the operating system information 135, and if there is a difference, it is determined that the data has been updated.
The data update monitoring process 52 is repeatedly performed (steps 52 and 53). When the data update is detected, the process proceeds to the next data saving process 54.

Here, the data update monitoring process 52 will be described in more detail with reference to FIG. FIG. 6 is a diagram illustrating a data update monitoring processing method by the data update monitoring unit 142 according to the present embodiment. The information management database 13 contains several operation definition files (A.CO.
NF, B.CONF, C.CONF, ...) are registered. The data update monitoring unit 142 checks the information management database 13 and the operating system information 1 based on the file management information 130 in the information management database 13 from the first record.
The 35 updated time information items are compared, and those having different updated time information are detected. In the example of FIG. 6, the first record (A.
CONF record), it is detected that the update time information 134 is different. Here, the data update monitoring unit 142
The file name of the operation definition file 12 is acquired from the file information area 131 of the information management database 13, and the operation definition file 12 in which the operation parameters of the business program 11 have been updated is specified.

Returning to FIG. 5, the processing after the data update is detected will be described. In the data save processing 54, the file save information 143, which is a component of the data management program 14, causes the file information to be updated by the data save monitor 143 only when the data update monitor 142 detects the update of the data in the operation definition file 12 in the data update monitor 52 Area 13
The updated operation definition file 12 is specified based on the information of No. 1 and the operation definition file 12 is backed up to the save area 15. Further, in response to the backup of the operation definition file 12 by the data saving unit 143,
The data update notifying unit 145 reads the update time information from the update time information 13513 of the operating system information 135, stores the read update time information in the update time information area 134 in the information management database 13, and collects the owner information 135.
The updater information is read from 12 and the updater information area 132
To remember.

Next, in the data update notifying process 55, in response to the fact that the operation definition file 12 has been updated and backed up, the data update notifying unit 145 sends the file information area 131 and the updater information area 132 , And the contents of the update time information area 134 are read, displayed and output on the terminal screen.

Thereafter, by repeating these procedures, every time the operation definition file 12 is updated, the contents of the operation definition file 12 are surely backed up to the save area 15 by the data saving unit 13 and the terminal By checking the update time information area 134 and the updater information area 132 displayed on the screen, the updater can be specified. Since the operation definition file is automatically registered as a backup target when the business program is installed, the system administrator does not need to perform a complicated operation of registering the backup target. When the operation definition file is updated, it is backed up almost immediately, so the data that was updated before the next backup process was not protected by the conventional regular backup,
Be improved.

In the above embodiment, whether or not data has been updated is detected by comparing the update time information in the data update monitoring process 52 of FIG. 5, but the operating system detects whether or not the data of the file has been updated. Alternatively, a method of causing the data monitoring unit 142 to report from the operating system may be adopted. As a method of checking, a method of comparing file sizes may be adopted instead of comparing update times.

Next, as a second embodiment of the present invention, an example in which the present invention is applied to service provider information provision in a large-scale Internet environment will be described.

FIG. 7 shows a service provider operation method in a large-scale Internet environment to which the present invention is applied. The system includes a service provider 40 that provides information, an administrator terminal 46 used by an operation manager who monitors the operation of the service provider 40, and a service user that acquires information transmitted from the service provider 40. And a user terminal 47 to be used. The service provider 40 includes a server program httpd41 for providing information on the operating system 16.
An HTML document 42 describing information provided by the server program httpd41 to the service user;
An operation definition file 12 including root directory information of the HTML document 42, an information management database 13 for registering list information of the HTML document 42, a data management program 14 for managing service operation, and an HTML
The storage area 15 includes a save area 15 for saving and restoring the document 42, and an access log file 48 for the server program httpd41 to output the operation status of the program.

In particular, the server program httpd 41 and the HTML document 42 are important components and must be protected in order for the user terminal 47 to provide information. Normally, in the system operation mode of the service provider 40, the server program 41 receives an information provision request for the HTML document 42 from the user terminal 47, determines a corresponding document of the HTML document 42 to be provided, and provides it to the user terminal 47. ing. Further, at the same time that the server program httpd41 provides the HTML information 42, the
Information on whether or not the access log file 48 is provided.
I remember.

In this embodiment, the server program http
Operating status of pd41 and HTM provided to user terminal 47
In order to manage the integrity of the L document 42, components of the information management database 13 and the data management program 14 are registered in the service provider 40.

The configurations of the data management program 14, the information management database 13, and the operating system information 135 are the same as those described in the first embodiment with reference to FIGS.

FIG. 8 shows a processing flow (operation of the data management program 14) of a procedure for backing up or recovering the HTML document 42 based on the operation status of the server program 41 in the service provider 40. The details will be described below.

First, in the data registration process 61, the data registration unit 141 in the data management program 14
For the TML document 42, the file name 13511 and the update time information 135 of the operating system information 135
13 is read and stored in the file information area 131 and the update time information area 134 of the information management database 13.
Here, the HTML to be monitored by the data registration unit 141
In the registration process of the document 42, the root directory information in which the HTML document 42 is located is read from the operation definition file 12 of the httpd 41, and the file name 13511 of the operating system information 135 is changed to specify the HTML document 42 under this directory. The update time information 13513 is read and stored in the update time information area 134 of the information management database 13. At the same time, based on the file name registered in the file information area 131, the HTML document 4
2 is backed up in the save area 15 in advance. Further, similarly, the operation definition file 12 is registered as a monitoring target.

Next, in the program information registration process 62,
The program information registration unit 146 causes the HTML document 42
Server program http as a program (monitoring target program) that references the operation definition file 12
Program name httpd which is information for specifying d41
Is stored in the program information area 133 in the information management database 13.

Next, in the data update monitoring process 63, the data update monitoring unit 142 sets each HTML document 42 itself as a monitoring target based on the file name information registered in the file information area 131, Document 4
The presence / absence of data update and monitoring of its disappearance are performed. In the same manner, the presence / absence of data update of the operation definition file 12 and monitoring of the disappearance are monitored. Here, as a method of detecting data update, the update time information 13513 of the operating system information 135 and the information management database 13
May be compared with the update time information stored in the update time information area 132, and a method that detects a difference as an update file may be used. In addition, as a method of detecting the loss of data, the existence of the monitoring target file may be confirmed by checking the existence of the file information 1351 of the operating system information 135. In the data update monitoring process 63, as described above, the presence / absence and disappearance of data update of the file to be monitored (specifically,
When monitoring creation, change, or deletion), the contents of the access log file 48 indicate whether the creation, change, or deletion of the data is an instruction from the administrator terminal 46 or an instruction from the user terminal 47. Judgment based on

The data update monitoring process 63 is repeatedly performed (steps 63 and 631). When the data update is detected, the process proceeds to the program status monitoring process 64.

Next, in the program status monitoring process 64,
According to the data monitoring by the data update monitoring unit 142,
The program status monitor 147 monitors the execution status of the server program httpd41. As a method of monitoring the execution state of the server program httpd41, the program name stored in the program information area 133 in the information management database 13 is compared with the operating process name 13501 of the operating system information 135. It is assumed that the monitoring target program is running, and conversely, if they do not match, the monitoring target program is stopped.

Next, in the monitoring result combination determination processing 65,
The update occurrence result of the HTML document 42 or the operation definition file 12 by the data update monitoring unit 142 in the data update monitoring process 63 and the server program http by the program status monitoring unit 147 in the program status monitoring process 64
The combination with the monitoring result of the activation state of d41 is determined. As a result of the combination determination, in the case of the combination, data saving processing 6
72, the process proceeds to the data update notifying process 68 without doing anything in the case of the combination, and performs the data recovery process 671 in the case of the combination (step 68). Data save processing 67
2. The data recovery processing 671 and the data update notification processing 68 will be described later.

FIG. 9 shows a list of branch conditions based on the combination determination result. In this case, the change of the operation definition file due to the instruction from the administrator terminal 46 is detected, and the server program httpd, which is the program to be monitored at that time, is detected.
When the server 41 is stopped, the creation of a new HTML document in accordance with an instruction from the administrator terminal 46 is detected, and the server program httpd4 which is the monitoring target program at that time is detected.
1 is operating or stopped, or the change of the HTML document by the instruction from the administrator terminal 46 is detected, and the server program httpd41 which is the monitoring target program is stopped at that time. In the case of, it is considered that the data is valid update from the administrator terminal 46, and the data saving process 672 is performed.

In the case of, a new creation of an HTML document in accordance with an instruction from the user terminal 47 is detected, and the server program httpd4 which is a program to be monitored at that time is detected.
1 is being operated or stopped, or the deletion of the HTML document by the instruction from the administrator terminal 46 is detected, and the server program httpd41 which is the monitoring target program is being stopped at that time. In this case, the process is ignored and the process proceeds to the data update notification process 68.

The case (1) is a case other than and (2). In this case, the data recovery processing 6
Move to 71.

FIG. 10 shows a data update monitor 142 and a program status monitor 1 in an application embodiment of the present invention.
47 shows a condition combination determination method according to the present embodiment.
Several HTML documents (index.html, open.html, close.html,...) Are registered in the information management database 13. The data update monitoring unit 142 compares the update time information of the information management database 13 and the update time information of the operating system information 135 from the first record of the file management information 130 in the information management database 13 and detects a difference in the update time information. I do. In the example of FIG. 10, it is detected that the update time information 134 is different in the first record. Here, the data update monitoring unit 142
Acquires the file name of the HTML document from the file information area of the information management database 13 and specifies the HTML document 42 whose data has been updated. Further, the program status monitor 147 includes a data update monitor 142
The server program httpd41 that refers to the HTML document 42 is specified from the program information area 133 related to the HTML document 42 specified by. Based on the specified program information area 133, it is compared with the program information 1350 in the operating system information 135, and if it matches the httpd server 41, it is detected that the server is operating.

Returning again to FIG. 8, the data saving process 67
In step 2, the data update monitoring unit 142 backs up the updated HTML document 42 file or the operation definition file 12 determined to have been updated to the save area 15 by the data save unit 143. At this time, the data saving unit 143
Immediately after the changed file is backed up in the save area 15, the update time information is read from the update time information 13513 in the operating system information 135 and stored in the update time information area 132 in the information management database 13. At the same time, updater information is also read from the owner information 13512 and stored in the updater information area 134.

On the other hand, in the data recovery processing 671, the data recovery section 144 in the data management program 14
The changed or lost HTML document 42 file or the operation definition file 12 is restored to the contents backed up in the save area 15.

Next, in the data update notification process 68, the access log file 4 of the server program httpd41
8 and the contents of the file information area 131, the updater information 132, and the update time information 134 in the file management information 130 from the information management database 13, and the terminal and updater information that updated or lost the file. Is displayed and output on the administrator terminal 46.

According to the above procedure, the service provider 4
0 before service operation starts (server program h
When the ttpd 41 is stopped), the HTML document 42 and the operation definition file 12 can be automatically backed up, and even after the system operation is started, the HTML file can be automatically backed up from the administrator terminal. Further, after the system operation has been started, recovery processing can be automatically performed with respect to unauthorized alteration or loss of the HTML document 42 or the operation definition file 12. Further, the system administrator can immediately monitor the HTML document 42 and the operation definition file 12 for tampering or disappearance at the administrator terminal 46, and the service provider 4
Data integrity of the entire HTML document 42 and the operation definition file 12 can be maintained.

In the above-described second embodiment, a data management program is prepared, and the data registration unit registers indispensable data in advance as a backup target. Work time required for indexing can be reduced,
It is also possible to eliminate indispensable backup data. In addition, since only specific files are backed up when data is updated, and only the target data is recovered when unauthorized data tampering or accidental data loss occurs, there is no work time required for studying the scheduling of regular backup operations. At the same time, the long-term occupation of the evacuation area such as the backup device and the long-term residency of the backup process are released, and the system operation and maintenance work become easy.

According to the first and second embodiments, when the business program is installed, the operation definition file is registered as a save target, so that the system administrator can perform a complicated operation of registering the file to be maintained. Need not be performed. Since the operation definition file is saved as soon as it is updated, the updated contents before the next regular backup, which could not be completely protected by the regular backup, are also protected. Further, the contents saved at the time of updating the data are restored when the alteration or deletion of the data which is considered to be illegal is detected, so that the system administrator can perform data security without complicated work. Therefore, it is possible to eliminate the work time for studying the scheduling of the regular backup operation and the like, and to be free from the long-term occupation of the evacuation area such as the backup device and the long-term residence of the backup process, thereby facilitating the system operation and maintenance work.

[0050]

As described above, according to the present invention,
Monitoring of unauthorized alteration or deletion of data performed by the system administrator, and the burden of work related to data backup / recovery can be reduced.

[Brief description of the drawings]

FIG. 1 is a diagram showing an operation mode of a general business system operation mode which is a basic embodiment of the present invention.

FIG. 2 is a diagram showing details of a data management program.

FIG. 3 is a diagram showing details of an information management database.

FIG. 4 is a diagram showing details of operating system information.

FIG. 5 is a diagram showing a processing flow of a backup procedure in the business system.

FIG. 6 is a diagram showing details of a data monitoring method in a business system.

FIG. 7 is a diagram illustrating an operation method of an Internet service provider in a distributed system environment according to a second embodiment of the present invention.

FIG. 8 is a diagram showing a processing flow of a backup and recovery procedure in a service provider.

FIG. 9 is a diagram illustrating a processing list based on a combination determination result of monitoring results.

FIG. 10 is a diagram showing details of a data monitoring method in a service provider.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 ... Business system 11 ... Business program 12 ... Operation definition file 13 ... Information management database 14 ... Data management program 15 ... Save area 131 ... File information area 132 ... Update time information area 133 ... Program information area 134 ... Updater information area 135 ... Operating system information 1350 ... Program information 1351 ... File information 13501 ... Process name 13511 ... File name 13512 ... Owner information 13513 ... Update time information 141 ... Data registration unit 142 ... Data update monitoring unit 143 ... Data save unit 144 ... Data recovery Unit 145 data update notification unit 146 program information registration unit 147 program status monitoring unit 40 service provider 41 server program httpd 42 HTML document 46 administrator terminal 47 ... User terminal 48 ... Access log file 51 ... Data registration processing 52 ... Data update monitoring processing 53 ... Data update determination processing 54 ... Data save processing 55 ... Data update notification processing 61 ... Data registration processing 62 ... Program information registration processing 63 ... Data update monitoring processing 64 Program information monitoring processing 65 Monitoring result combination determination processing 66 Combination determination result processing 671 Data recovery processing 672 Data storage processing 68 Data update notification processing

Claims (9)

[Claims] 1. A data preservation method for preserving operation definition data of a business program, comprising: registering an operation definition file storing operation definition data of the business program as a save target when the business program is installed. A step of monitoring and detecting an update of the registered operation definition file; and a step of saving the updated content when an update of the registered operation definition file is detected. Data maintenance method by monitoring data update. 2. A data preservation method for preserving data in a storage device, comprising: a step of registering information for specifying data to be saved and recovered; and a program for referring to the data to be saved and recovered. Registering information for specifying the information, monitoring and detecting the update of the registered evacuation and recovery target data, and detecting the update of the registered evacuation and recovery target data. Saving the updated contents or recovering the saved data based on the execution state of a program that refers to the data to be saved and restored. Conservation method. 3. A data preservation method for preserving data on a storage device, comprising: a step of registering information for specifying data to be saved and recovered; and a program for referring to the data to be saved and recovered. Registering information for identifying the data, the step of monitoring and detecting the update of the registered data to be saved and restored, and the execution state of a program that refers to the registered data to be saved and restored. Detecting the update of the registered evacuation and recovery target data, and when the execution state of the program that refers to the evacuation and recovery target data is suspended, the update content is deleted. Saving the data that has been saved when the execution state is in operation. Data integrity method by the monitoring. 4. The data security method according to claim 2, wherein the data to be saved and restored is an HTML document provided by a predetermined server program, or an operation of the server program. A data preservation method based on data update monitoring, which is a definition file. 5. The data security method according to claim 1, wherein the update is detected by the operating system having update time information of data to be monitored for update stored in advance. A data maintenance method by monitoring data update, which is performed by comparing with update time information or by detecting and reporting an update of the data by an operating system. 6. A data preservation device for preserving operation definition data of a business program, wherein the operation definition file storing the operation definition data of the business program is registered as a save target when the business program is installed. Means, data update monitoring means for monitoring and detecting the update of the registered operation definition file, and data saving means for saving the update content when the update of the registered operation definition file is detected. A data maintenance device based on data update monitoring, comprising: 7. A data preservation method for preserving data in a storage device, comprising: data registration means for registering information for specifying data to be saved and recovered; and reference to data to be saved and recovered. Program information registering means for registering information for specifying a program to be saved; data update monitoring means for monitoring and detecting update of the registered data to be saved and recovered; And a data save / recovery unit that saves the update content or restores the saved data based on the execution state of the program that refers to the data to be saved and restored when the update is detected. A data preservation method by monitoring data update. 8. A storage medium storing a data maintenance program for preserving operation definition data of a business program, wherein the data maintenance program stores operation definition data of the business program when the business program is installed. Registering the file as a save target; monitoring and detecting the update of the registered action definition file; saving the updated content when the update of the registered action definition file is detected And a storage medium storing a data security program. 9. A storage medium storing a data security program for securing data on a storage device, wherein the data security program registers information for specifying data to be saved and restored; Registering information that specifies a program that refers to the data to be saved and recovered; monitoring and detecting the update of the registered data to be saved and recovered; When the update of the data is detected, the update contents are saved or the saved data is restored based on the execution state of the program that refers to the data to be saved and restored. A storage medium storing a data security program characterized by the following.