JP2002041173A - Method for authenticating program file - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method for authenticating a program file by which a user computer connected to a network environment can be prevented from opening unauthenticated program file. SOLUTION: An authentication database including authentication file records having a program file name field, a file version field, and a check code field calculated from the contents of the file is copied to a server computer and plural user computers. Then, whether or not plural files to approach/be transmitted to the server computer through a network environment are safe is analyzed based on the authentication database copied to the server computer. Also, whether or not a file to be opened by the user computer is safe is checked based on the authentication database copied to the user computer.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for authenticating a program file, and more particularly, to confirming the security of a file used in a network environment, and executing an unauthenticated program file.
To prevent the file from being opened by a user computer connected to the network environment.

[0002]

2. Description of the Related Art Due to the development and mass use of a network environment, an infinite number of files are transmitted and received through the network environment, whether in the Internet network environment or the intranet network environment. For this reason, many techniques have been developed to ensure the security of files received in a network environment. Among them, the firewall technology of the server computer is a typical example. A well-known technique of firewalls is to filter out files sent from unauthorized network stations, as well as to provide connectivity restrictions to safely isolate different networks. However, it cannot prevent the firewall from passing files sent from authorized network stations, which are ultimately opened and used on user computers. If the content of this file contains destructive program code or bug program code, the well-known technology of the firewall cannot filter this file and the user computer can also control the file by security control. It could not be prevented from opening and using.

[0003]

SUMMARY OF THE INVENTION It is an object of the present invention to prevent both a server computer and a user computer in a network environment from distributing and using unauthenticated files, thereby enabling an Internet network environment or an intranet network environment. The goal is to fulfill the requirements to make the files safe to use.

[0004]

According to a first aspect of the present invention, there is provided a program file authentication method implemented in a network environment including a plurality of user computers and one server computer for providing a server service to the plurality of user computers. An authentication database construction step, wherein the authentication database includes at least a plurality of authentication file records, wherein the authentication file record includes at least a file name field of a program file having a file type, a file version field, and contents of the file. The authentication database construction step including a check code field obtained by the above calculation; a step of copying the authentication database to a server computer and the plurality of user computers; Analyzing, by the authentication database copied to the computer, whether or not a plurality of files entering and exiting the server computer through the network environment are secure; an analyzing step performed in the server computer; A program file authentication method is characterized in that it includes a step of checking whether a file opened by a user computer is safe based on the copied authentication database, and a checking step performed by the user computer. The invention according to claim 2, wherein the analyzing step performed in the server computer includes a step of identifying whether a file type of the plurality of files entering and exiting the server computer is a program file, and the step of determining whether the file is a program file. Authorizing the file as secure when not identified; and an authentication database wherein the file name and file version of the file are copied to the server computer when the file is identified as a program file. Comparing the file name field and the file version field of one of the authentication file records, and if the comparison result is the same, use the same calculation step as the authentication database construction step, and use the contents of the file. Calculated by It is determined whether the check code is the same as the check code field of one authentication file record in the authentication database of the server computer, and if the check code of the file is the same, that is, the file is authorized as secure. Authorizing the file to be insecure and sending alarm information to the server computer if they are not the same, authorizing the file to be insecure when the comparison results are not the same, and sending the alarm information to the server computer. And sending the program file. 2. The method according to claim 1, further comprising: According to a third aspect of the present invention, the checking step performed in the user computer includes a step of identifying whether a file type of a file opened by the user computer is a program file, and a step of identifying that the file is not a program file. Authorizing the file as secure when performed, and, when the file is identified as a program file, storing the file name and file version of the file in an authentication database copied to the user computer. Comparing the file name and file version fields of two authentication file records for the same or not;
When the comparison result is the same, the check code obtained by using the same calculation step as the authentication database construction step and based on the contents of the file is the check code of one authentication file record in the authentication database of the user computer. Judge whether the file is the same as the field, and if the check code of the file is the same, that is, authorize the file as secure; otherwise, authorize the file as insecure and allow the user computer to Prohibiting the opening of the file, and authorizing the file to be insecure when the comparison results are not the same, and prohibiting the user computer from opening the file. A program file authentication method according to claim 1 is provided. According to a fourth aspect of the present invention, when the file type is a program file, the subfile name of the program file is “.EX”.
E. "," .COM "," .DOC "," .JAVA ",
2. The program file authentication method according to claim 1, wherein the program file authentication method is any one of ".WSH".
The invention according to claim 5 is the program file authentication method according to claim 1, wherein the authentication file record includes a supplier field of a file whose file type is a program file. The invention according to claim 6 is the program file authentication method according to claim 1, wherein MD5 is used for calculating a check code field based on file contents in the authentication database construction step. The invention according to claim 7 is the program file authentication method according to claim 1, characterized in that a CRC is used to calculate a check code field based on a file content in the authentication database construction step. The invention according to claim 8 is the program file authentication method according to claim 1, characterized in that a check sum is used for calculating a check code field based on file contents in the authentication database construction step. The invention according to claim 9 is the program file authentication method according to claim 1, wherein the network environment is an intranet. The invention according to claim 10 is the program file authentication method according to claim 1, wherein the network environment is the Internet. The invention of claim 11 is
The method according to claim 1, wherein the server computer that provides the server service to the plurality of user computers is an FTP server computer. A twelfth aspect of the present invention is the program file authentication method according to the first aspect, wherein the server computer that provides a server service to the plurality of user computers is a mail server computer. According to a thirteenth aspect of the present invention, the server computer for providing a server service to the plurality of user computers is HTT.
The program file authentication method according to claim 1, wherein the program file authentication method is a P server computer. The invention according to claim 14 is the program according to claim 1, wherein the server computer that provides a server service to the plurality of user computers is a server computer that combines an FTP, a mail, and an HTTP server service. File authentication method. According to a fifteenth aspect of the present invention, the server computer that provides the server service to the plurality of user computers is Microsoft, Unix, or L.
Linux or Linux or Lotus Not
The program file authentication method according to claim 1, wherein the program file authentication method is an es file server computer.

[0005]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention provides a kind of program file authentication method. It is implemented in a network environment that includes a plurality of user computers and one server computer that provides server services to the plurality of user computers. The method includes the following steps. That is, a step of constructing an authentication database. In this step, the authentication database includes at least a plurality of authentication file records, and the authentication file records are calculated based on at least a file name field, a file version field, and a file content field of a program file that is a file type. Check code field. And copying the authentication database to a server computer and the plurality of user computers. And analyzing whether or not a plurality of files entering / sending to / from the server computer through the network environment are secure, based on the authentication database copied to the server computer. The analysis step is performed on a server computer. And checking whether the file opened by the user computer is safe based on the authentication database copied to the user computer. This inspection step is performed by a user computer.

[0006]

FIG. 1 shows an embodiment for implementing the present invention in a network environment. The network connecting line 30 in FIG. 1 connects the server computer 10 and a plurality of user computers 20, user computers 21, user computers 22, and user computers 23.
Server computer 10 is FTP, MAI
L, HTTP, or other server services, or one of FTP, MAIL, HTTP, or another server computer, or a Microsoft Windows operating system, such as Windows
NT 4.0, Windows 2000, or Pr
Windows NT4.0, Wi with oxy
Windows 2000, or Unix, Linux or Lotus Notes file server computer. Server computer 1
0 hardware platforms are available from commercially available server workstation computers. Among them, a plurality of user computers 20
-23 receives a file sent from the server computer 10 by the network connection line 30 and the above-described respective types of server services.

FIG. 2 is a flowchart of the method of the present invention. First, an authentication database construction step 40 is executed. The present invention relates to a program file (executio).
nfile) is subjected to authentication processing. In a specific embodiment, these program files have customary names such as “.EXE”, “.
COM "," .DOC "," .JAVA "," .WS "
H ", and these subfile name forms are used only slightly for explanation and interpretation. The program file in which the present invention is applied is not limited to the above-described sub-file name. For this reason, a system administrator applying the present invention establishes an authentication database using a plurality of program files distributed and used in the network environment of FIG. FIG. 3 shows a specific embodiment of the authentication database. The authentication database 80 of FIG. 3 includes at least a plurality of authentication file records 100 and 200, and each of the authentication file records 100 and 200 includes at least a file name field 101, 201 of a program file having a file type, and a file version field 10
2 and 202, and check code fields 103 and 303 calculated according to the contents of the file, and the authentication database 80 further includes one supplier field 104 and 204. Authentication file record 10 of FIG.
0 is the file name of one “WINWORD.EXE”, which is the “8.0” version, the check code is “25061166”, and “ABC”
Product.

The calculation means used in a specific embodiment of the check code field obtained by calculating based on the file contents in the authentication database construction step 40 of the present invention will be described below. Figure 4 shows D in the Microsoft Windows operating system.
EMO. Here is an example of running an EXE file,
Hexadecimal numerical values for DEMO. Displays the EXE target binary file. First, from the contents "4D5A" of the address 00 and the address 01, it is known that the file is in the format of the "EXE" file.
The address composed of bits is “00000080”, and then the second
The contents of four consecutive addresses of the eight addresses are “00”.
01145 ", which allows the DEMO. The execution entry address of the EXE program code (address
f entry point) has a length of “0000011”.
45 ". The subsequent F8th address starting from the address 178 is the address 178, and the length of the 28 addresses starting from the address 178 is “.tex
The 4-bit data obtained from the address 08 starting from the “.text” section is “0000”.
0280 ”, which is the virtual size (indicating the size in the memory) of the data in the“ .text ”section. Similarly, other sections such as “.bss” and “.
The virtual address and the size of each section of “rdata”, “.data”,.
0000280 ”), it is possible to know that the program entrance is located in the“ .text ”section. From this “.text” section, DEM
O. EXE program code entry (entrypoi
nt) and the program code length, and the address 17
The contents of the subsequent 10 addresses starting from 8 are “00000400” and the obtained program code length is 400, and the contents of the remaining 14 addresses starting from address 178 are “0000040”.
0 ", and the start address of the obtained program code is" 00004000 ". Further, the length of 400 pieces starting from the start address 400 reaches the address 7FF and extends from the address 400 to the contents of the address 7FF. The above-described calculating means of the present invention is, in a specific embodiment, MD5 (message digest ve).
5) Using the calculation means, calculate the contents of the program code having a length of 400 in MD5 to obtain one specific value “C50E97FEA12345C57691B47A”.
9F5E32B1 ". This specific value is the DEMO. E
It can be used as an XE check code. The MD5 calculation means described above has a purpose of describing a specific example of generation of a check code in the authentication program file, and other different calculation means, for example, CRC (cy).
clinic redundancy check) calculation,
It can also be performed using a checksum calculation. The above file name is ".EXE" DE
MO. EXE and other file types according to the present invention are defined as program files when the file name is “.
COM, ".DOC", ".JAVA", and ".W"
SH ”. All of the file formats are published related SDK (system d
(Equipment kit) You can get it from the manual. The above-mentioned MD5 technology is an Internet R
It is understood from the data of FCs 1319-1321.

In the authentication database copy step 50 of FIG. 2, the server computer 10 and the user computers 20-23 copy the authentication database generated in the authentication database construction step 40 via the network environment shown in FIG. Have the same authentication database with the same contents.

The analysis step 60 and the check step 70 of FIG. 2 are executed in the server computer 10 and each user computer 20-23, respectively. First, the analysis step 60 in the server computer 10 will be described. FIG. 5 shows an analysis step flow performed in the server computer of the present invention. In an identification step 61 of FIG. 5, for a plurality of files entering and leaving the server computer 10, it is identified whether or not the file type is a program file. The specific implementation of the identification is performed by an API (Appli) for processing a file system provided by the above-mentioned SDK manual.
session Program Interface)
By calling (call), all the data of the file, for example, the file name and version of the file, and the company product of the file can be obtained. The file is read by the above-mentioned API call, and the check code of the file is calculated. Step 62 verifies that the file is secure when the file is not a program file. In step 63, when the file is a program file, a comparison is made as to whether the file name and version are the same as the file name field and file version field of one authentication file record in the authentication database copied to the server computer. . If they are the same, step 64 is entered. If they are not the same, the process proceeds to step 67. In step 64, when the file name and the version are the same, the same calculation means as in the authentication database construction step 40 is used. In step 65, a comparison is made as to whether the check code calculated based on the contents of the file is the same as the check code field of one authentication file record in the authentication database copied to the server computer. If the check codes of the files are the same, proceed to step 66 and authorize the file as secure; if not, proceed to step 67 and authorize the file as insecure and send the alarm information to the server computer. Send to If the file is found to be insecure, the embodiment may be to delete the file directly or to store it locally on the server computer.
At the same time as moving to e), the alarm information is displayed on the display (not shown) of the server computer. FIG.
Shows an analysis step of the present invention, and a specific implementation method is one program code. FIG. 6 is a state diagram of the main memory when the server computer 10 executes the present invention. The main memory shown in FIG. 6 includes an operation system, an API, an analysis step program code, an authentication database read into the main memory, and a file system driving program. When a plurality of files enter and exit from a storage device (not shown) similar to the hard disk of the server computer 10, the processing of all the incoming and outgoing files must pass through the analysis step program code of the main memory in an intermediate process. Thus, the purpose of the program file authentication of the server computer 10 is specifically achieved.

Subsequently, the user computer 20- shown in FIG.
The execution of the check step 70 in 24 will be described. FIG. 7 is a flowchart of a check step performed in the user computer according to the present invention. FIG.
In the identification step 71, the file type of the file opened by the user computer is identified as a program file. If it is a program file, the process proceeds to step 73; otherwise, the process proceeds to step 72. Among them, the explanation of the specific implementation means of the identification means of the user computer,
This is as described in the specific means for executing the identification step of the server computer described above. At step 72, the file is approved as safe because it is determined that the file is not a program file. In step 73, since the file is a program file, that is, whether the file name and the file version are the same as the file name field and the file version field of one authentication file record in the authentication database copied to the user computer. Judge, if the same file name and file version, go to step 74, otherwise go to step 77. In step 74, the same calculation steps as those in the authentication database construction step 40 are used. In step 75, it is determined whether or not the check code obtained from the content of the file is the same as the check code field of one authentication file record in the authentication database copied to the user computer. If so, the process proceeds to step 76, in which the file is approved as safe and the file open execution is permitted. Otherwise, step 76 is entered to authorize that the file is not secure, as well as to prohibit the user computer from executing the file. Steps 73 and 75 described above
The comparison means used for authentication are the same as those described in the specific means for executing the comparison step in the server computer. Regarding the checking step 70 performed in the user computer 20-24 in FIG. 2, it is necessary to explain a little more that the file opened by the user computer is a file stored in the server computer 10 due to its specific implementation. Alternatively, the file may be a file previously downloaded from the server computer 10 to the user computer. FIG. 8 is a main memory state diagram when the user computer implements the present invention. The main memory of FIG. 8 includes an operation system, an API, a check step program code, an authentication database read into the main memory, and a file system driving program. When a user computer opens a file, the file to be opened may be a file in the server computer or a file in the user computer. In the intermediate process of opening a file, it is necessary to pass a check step program code in the main memory, thereby specifically achieving the purpose of program file authentication of the user computer.

The above is a description of a specific embodiment of the present invention, but this does not limit the scope of the present invention.
Modifications or alterations of details that may be made by one of ordinary skill in the art to which this invention pertains based on the present invention include:
All of them belong to the claims of the present invention.

[0013]

According to the present invention, both a server computer and a user computer in a network environment can prevent the unauthorized use of an unauthenticated file, thereby securely using the file in an Internet network environment or an intranet network environment. To be able to meet the demands. Therefore, it can be said that the present invention is an invention having novelty, inventive step, and industrial value.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating an embodiment in which a method of the present invention is implemented in a network environment.

FIG. 2 is a flowchart of the method of the present invention.

FIG. 3 is a diagram showing a specific embodiment of the authentication database of the present invention.

FIG. 4 shows the DEMO. It is a program code display figure which uses EXE as an example.

FIG. 5 is a flowchart of an analysis step performed by the server computer of the present invention.

FIG. 6 is a state diagram of a main memory when the present invention is implemented by a server computer.

FIG. 7 is a flowchart of a check step performed by the user computer of the present invention.

FIG. 8 is a state diagram of a memory when the present invention is implemented by a user computer.

[Explanation of symbols]

 Reference Signs List 10 server computer 20, 21, 22, 23 user computer 30 network connection line 40 authentication database construction step 50 authentication database copy step 70 check step 80 authentication database 100, 200 authentication file record 102, 202 file version field 103, 203 check code field 104, 204 Supplier field

Claims (15)

[Claims] 1. A program file authentication method implemented in a network environment including a plurality of user computers and one server computer for providing a server service to the plurality of user computers, the method comprising an authentication database construction step, wherein the authentication database is The authentication file record includes at least a plurality of authentication file records, and the authentication file record includes at least a file name field, a file version field, and a check code field obtained by calculation based on the contents of the file as a file type. The authentication database building step, the step of copying the authentication database to a server computer and the plurality of user computers, and the authentication data copied to the server computer Analyzing the plurality of files entering and leaving the server computer through the network environment as to whether or not the files are secure, the analyzing step being performed in the server computer, and the authentication database copied to the user computer. Checking the file opened by the user computer for security, and performing the checking step on the user computer, the program file authentication method. 2. The analyzing step performed in the server computer, the step of identifying whether a file type of a plurality of files entering and exiting the server computer is a program file, and if the file is not a program file. Authorizing the file as secure when identified; and, when identifying the file as a program file, the file name and file version of the file in an authentication database copied to the server computer. Comparing the file name field and file version field of one authentication file record with each other, and if the comparison result is the same, use the same calculation step as the authentication database construction step, and calculate according to the contents of the file I got it It is determined whether the check code is the same as the check code field of one authentication file record in the authentication database of the server computer. If the check code of the file is the same, that is, the file is authorized as safe. Authorizing the file as insecure and sending alarm information to the server computer if they are not the same, authorizing the file as insecure if the comparison results are not the same, and sending the alarm information to the server computer. The method according to claim 1, further comprising: sending. 3. The checking step performed in the user computer includes: identifying whether a file type of a file opened by the user computer is a program file; and identifying that the file is not a program file. Authorizing the file to be secure, and, when the file is identified as a program file, the file name and file version of the file being copied to one of the authentication databases in the authentication database. Comparing the file name field and the file version field of the file record with each other to determine whether or not they are the same. If the comparison result is the same, use the same calculation step as the authentication database construction step, and calculate by using the contents of the file. Check Determines whether the check code field is the same as the check code field of one authentication file record in the authentication database of the user computer, and if the check code of the file is the same, that is, the file is regarded as secure. Authorizing the file to be insecure if it is not the same and prohibiting the user computer from opening the file; and if the comparison results are not the same, authorizing the file to be insecure; and 2. The method according to claim 1, further comprising: prohibiting opening of the file. 4. If the file type is a program file, its subfile name is “.EX”.
E. "," .COM "," .DOC "," .JAVA ",
2. The program file authentication method according to claim 1, wherein the program file authentication method is any one of ".WSH". 5. The program file authentication method according to claim 1, wherein the authentication file record includes a supplier field of a file whose file type is a program file. 6. The program file authentication method according to claim 1, wherein MD5 is used for calculating a check code field based on file contents in the authentication database construction step. 7. The program file authentication method according to claim 1, wherein a CRC is used for calculating a check code field based on a file content in the authentication database construction step. 8. The program file authentication method according to claim 1, wherein a check sum is used for calculating a check code field based on a file content in the authentication database construction step. 9. The method according to claim 1, wherein the network environment is an intranet. 10. The program file authentication method according to claim 1, wherein the network environment is the Internet. 11. A server computer that provides a server service to the plurality of user computers is an FT.
2. The program file authentication method according to claim 1, wherein the program file authentication method is a P server computer. 12. A server computer that provides a server service to the plurality of user computers is an MA.
Characterized as an IL server computer,
The program file authentication method according to claim 1. 13. The server computer that provides a server service to the plurality of user computers is an HT.
Characterized by being a TP server computer,
The program file authentication method according to claim 1. 14. A server computer for providing a server service to the plurality of user computers, comprising:
Characterized in that the server computer is a combination of TP, MAIL, and HTTP server services.
The program file authentication method according to claim 1. 15. The server computer that provides a server service to the plurality of user computers is Microsoft, Unix (registered trademark), or Lin.
ux or Linux or Lotus Notes
The program file authentication method according to claim 1, wherein the program file authentication method is a (registered trademark) file server computer.