JP2002351686A - Data processing method and program for data processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the burdens of a user more than before especially regarding macro viruses and to prevent infection with the viruses by applying this invention to the various kinds of application programs of a personal computer for instance. SOLUTION: By the presence/absence of a registered command or by the registration of the safety of macro or by the preservation place of the macro or by the ciphering of the macro further, the performance of the macro is stopped.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a data processing method and a program for the data processing method, and can be applied to, for example, various application programs of a personal computer. The present invention provides a method for stopping execution of a macro based on the presence or absence of a registered instruction, or registering security of a macro and stopping execution of the macro based on the registration, or based on a storage location of the macro. By suspending the execution of macros and stopping the execution of macros based on the encryption of the macros, especially for macro viruses, the burden on the user can be significantly reduced compared to the past. Be able to prevent infection.

[0002]

2. Description of the Related Art Conventionally, a computer virus (hereinafter simply referred to as a virus) is inspected by using virus inspection software, a method of prohibiting automatic execution of macros in mail software, a floppy (registered) (Trademark), and attention to the handling of files attached to e-mails to prevent infection.

[0003] That is, a virus is a kind of program, and as shown in FIG. 8, can be classified into a macro virus, an intermediate language virus, and a machine language virus according to a forming language. Here, a macro virus is a virus created in a macro language, and a macro is used to automate operation procedures such as software (application) and to create a simple program. It is used by being incorporated into calculation software and e-mail software. On the other hand, the intermediate language viruses are JAVA (registered trademark), Acti
This is a virus written in an intermediate language such as vex (registered trademark).

[0004] On the other hand, a machine language virus is a program written in CPU instructions and infects general software. In BASIC and viruses created in various script languages, such classification is difficult, but in this case, if the program that constitutes the virus uses the help of specific software, or If it runs only in hardware, it is called a macro virus, and what can run alone on a system is called a machine virus. Note that the system here refers to an environment having a machine that executes a program, usually a processor,
It is composed of a memory, an input / output device, an OS and the like. Examples of the system include a computer, a PDA, and a mobile phone.

[0005]

However, such a conventional countermeasure method largely depends on the user, and the effect of the countermeasure greatly differs depending on the user's experience, knowledge, awareness of virus countermeasures, and the like.

That is, for example, even when using the virus inspection software, it is necessary to periodically update the type and version of the virus inspection software and the virus definition file. Increases the likelihood of infection. In a system connected to a local area network, a virus may infect the entire organization by one's carelessness. In addition, this method is effective only for known viruses, and has a problem that its effect is limited to new viruses.

[0007] It would be convenient if the burden on the user could be reduced and infection with a virus could be prevented.

[0008] The present invention has been made in view of the above points, and particularly for a macro virus, a data processing method that can significantly reduce the burden on the user and prevent the virus from being transmitted, as compared with the related art. It proposes a method and a program for a data processing method.

[0009]

According to the first aspect of the present invention, there is provided a danger instruction detecting step of detecting the presence or absence of a registered instruction from a macro by applying the present invention to a data processing method. And a macro stop step of stopping execution of the macro based on a detection result of the dangerous command detection step.

Further, in the invention according to claim 4, the method is applied to a data processing method, and based on the registration step of registering the security of the macro and the registration by this registration step,
And a macro stop step for stopping the execution of the macro.

Further, in the invention according to claim 7, the method is applied to a data processing method, and a step of determining a storage location for determining a storage location of a macro, and executing the macro based on the determination of the storage location determination step. And a macro stop step to stop.

According to the tenth aspect of the present invention, the method according to the present invention is applied to a data processing method, wherein an encryption determining step for determining encryption of a macro, and execution of the macro is performed based on the determination in the encryption determining step. And a macro stop step to stop.

According to a thirteenth aspect, the present invention is applied to a program of a data processing method, and a dangerous instruction detecting step of detecting presence or absence of a registered instruction from a macro,
A macro stop step for stopping the execution of the macro based on the detection result in the dangerous command detection step is provided.

Further, in the invention according to claim 14, a step of registering the security of the macro by applying the program to the data processing method, and the execution of the macro is stopped based on the registration in the step of registering. And a macro stop step.

In the invention according to claim 15, the method is applied to a program of a data processing method, and a step of determining a storage location for determining a storage location of a macro, And a macro stop step for stopping the execution.

Further, in the invention according to claim 16, the method is applied to a program of a data processing method, and an encryption judging step for judging macro encryption is performed. And a macro stop step for stopping the execution.

According to the first aspect of the present invention, the present invention is applied to a data processing method, and based on a dangerous command detecting step of detecting presence / absence of a registered command from a macro, and based on a detection result of the dangerous command detecting step. Having a macro abort step to halt the execution of the macro, registering macro instructions that may cause serious problems on the system, other computers by malicious use, and may be a virus It is possible to stop the execution of a macro having a certain characteristic, thereby significantly reducing the burden on the user and preventing infection with a virus as compared with the related art.

According to a fourth aspect of the present invention, the method of the present invention is applied to a data processing method, wherein a registration step for registering the security of the macro and a macro for suspending the execution of the macro based on the registration in the registration step. By having a stop step, it is possible to stop the execution of a macro that is suspected to be safe, thereby significantly reducing the burden on the user and preventing infection with a virus as compared to the past. can do.

Further, according to the configuration of the seventh aspect, the present invention is applied to a data processing method, and a step of determining a storage location for determining a storage location of a macro, and executing the macro based on the determination by the storage location determination step. Suspicious macros can be stopped by having a macro stop step to stop the virus, thereby significantly reducing the burden on the user and preventing virus infection Can be.

According to a tenth aspect of the present invention, the method according to the present invention is applied to a data processing method, wherein the step of determining whether to encrypt the macro is performed, and the execution of the macro is performed based on the determination in the step of determining encryption. And a macro stop step for stopping the execution of a suspicious macro using encryption as a clue, thereby greatly reducing the user's burden and reducing the virus Infection can be prevented.

Thus, according to the configuration of claim 13, claim 14, claim 15 or claim 16, it is possible to significantly reduce the burden on the user and prevent infection with a virus as compared with the related art. A program for a possible data processing method can be provided.

[0022]

Embodiments of the present invention will be described below in detail with reference to the drawings as appropriate.

(1) First Embodiment (1-1) Configuration of First Embodiment FIG. 2 is a schematic diagram showing an information processing system according to a first embodiment of the present invention. . This information processing system 1
It is configured by connecting computers 3, 4, 5 and the like via the Internet 2. Thereby, in the computers 3 and 4 connected to the information processing system 1, a virus is transmitted from the computer 5 via the Internet 2 or the floppy disk 6 by e-mail, an execution file, or the like, and the virus is transmitted to the virus. Risk of infection.

FIG. 3 is a block diagram showing the computers 3 and 4. The computers 3 and 4 are MC
A series of arithmetic processing is executed by an MP (Multipurpose Crypto MicroProcessor) 10. Here, the MCMP is a processor that internally has an encryption processing function, and has a function of executing encrypted software while decrypting it using a designated decryption key. As a result, in the computers 3 and 4, the software to be executed is taken in the MCMP 10 in an encrypted state without being decrypted on the memory, and is decrypted and executed internally. Thus, in the computers 3 and 4, hacking of the decrypted program is prevented.

That is, in the computers 3 and 4, the modem 11, the external memory 12, the external storage device 13 and the like are connected to the bus BUS. Here, the external storage device 13
Is composed of a hard disk device (HDD) for recording various application programs executed by the computers 3 and 4, an operating system, an optical disk device for recording various data and the like, a floppy disk device, and the like.

In the MCMP 10, a central processing unit (CPU) 14 is configured in the same manner as a general processor, and executes a predetermined processing procedure using a secret memory 15 as an internal memory, thereby obtaining an address Address.
The ss is issued to the external memory 12 or the like, and the desired data Data is loaded with the ss, and the desired data Data is recorded therein. The central processing unit 14 processes the data Data thus loaded, executes a series of processing procedures, and accesses the external memory 12 and the like.

The cryptographic processing circuit 16 switches the operation under the control of the control unit 17, and switches the operation under the control of the control unit 17.
g) The work key 1 and / or work key 2 output from 18 encrypt the data Data output to the outside in this way. The external memory 1 is encrypted in this manner.
2 and the like, and the data is processed in the reverse manner to output the original data to the central processing unit 14.

The arithmetic circuit 19 is composed of, for example, an exclusive OR circuit, and converts data Data output from the encryption processing circuit 16 to the outside into a disturbance data generation circuit (F (A
dr)) The scramble processing is performed by the disturbance data output from 20. Conversely, the scramble processing of the data Data input from the external memory via the encryption processing circuit 16 is released.

Offset register (Offs.Reg)
Under the control of the central processing unit 14, the address 21 fetches and holds the address Address output from the central processing unit 14 at a predetermined timing, and outputs the address to the disturbance data generation circuit 20. The disturbance data generating circuit 20 switches its operation under the control of the control unit 17 and outputs the output data Address Off of the offset register 21.
set, and generates disturbance data according to the address output from the central processing unit 14. As a result, the MCMP 10 scrambles the Data according to the value of the address, and records the same command in the memory 12 or the like with different values even for the same instruction word, and makes it difficult to analyze the data recorded in the memory 12 or the like. And so on.

In this way, the control unit 17 sends the address Address outputted from the central processing unit 14.
The generation of the disturbance data based on the s
0, and input / output data Da using the work keys 1 and 2.
ta processing by the cryptographic processing circuit 16 and the key manager 18
To instruct.

The secret key Kcps is, for example, the MCMP1
0 is a decryption key unique to MCMP1.
Recorded at factory shipment of 0. Under the control of the central processing unit 14, the decryption circuit 23 converts the encryption of the permission code Pprg output from the central processing unit 14 into a secret key Kc.
Work keys 1 and 2 are output after being released by ps.

Thus, the MCMP 10 acquires the permission code Pprg encrypted by the public key system from the provider of the application program, and can decrypt the work keys 1 and 2 by the processing of the decryption circuit 23. Work key 1 decrypted in this way for an application program provided by a
2 allows decryption.

Thus, the MCMP 10 can store the data in the external memory 12 in an encrypted state and process the data while sequentially decrypting the data, thereby directly constituting an application program and the like. It is made possible to improve security by preventing command words and data from being grasped from outside. As a result, the computers 3 and 4 can effectively avoid infection with machine language viruses and macro viruses.

That is, as shown in FIG. 4, in a conventional computer, by processing a program which is not encrypted at all, even a normal virus can be executed without being distinguished from this program and infected with the virus. On the other hand, as shown in FIG. 5, the computers 3 and 4 can execute the encrypted program only when the encrypted program is processed with the correct key, so that the virus whose key does not match and the virus For a virus that has not been infected, the operation intended by the virus creator can be prevented, whereby the infection with the virus can be significantly prevented as compared with the related art.

That is, the MCMP 10 executes the inputted program while decrypting it with the determined key regardless of the presence or absence of the encryption, so that only the program encrypted with the same encryption method and with the same key is correctly executed. Can not. If a program by a virus which is not encrypted by this enters, MCMP
The data is converted into completely different random data inside the device 10, thereby preventing infection with a virus. Incidentally, since the currently distributed virus is an unencrypted program, it can be prevented by this method.

Thus, even if the user mistakenly executes the virus of the executable file attached to the electronic mail or the like, the security can be ensured because the MCMP 10 cannot execute the virus as a program. Even if a virus is encrypted and circulated, it cannot be executed unless the decryption keys coincide with each other, so that the keys can be appropriately managed and the security can be ensured.

That is, as shown in FIG.
In the case where the program is decrypted with the decryption key A and executed, it is possible to prevent infection of the encrypted virus of the decryption key B and unencrypted virus. This can prevent the machine language virus from being transmitted.

On the other hand, the macro virus infects the data, encrypts all the data in the computers 3 and 4, and thereby protects against the macro virus.
Infection can be prevented. That is, as in the case of machine language virus countermeasures, all data in the computers 3 and 4 are encrypted with one key, and when processing the data, regardless of whether the data is actually encrypted, Processing is performed while decrypting using a predetermined key. In this case, the key for encrypting the data may be the same as the key for encrypting the program, or the key may be changed for each individual data. If each data is processed in this way, if the data including the macro virus invading from the outside is not encrypted, such data will become unrecognizable and meaningless data for the application, and the file will be deleted. It cannot be opened, and as a result, infection with a macro virus can be prevented.

However, for example, the need to exchange data with an external device such as e-mail can be considered. In this case, an encryption key may be notified to a specific object. In this case, a person who knows the key encrypts a file containing a virus. If you distribute it, you will be infected with a virus. That is, in this case, the macro virus cannot be prevented.

In the case of exchanging data with the outside, it may be necessary to process data that has not been subjected to any encryption processing. In this case, the MCMP 10 stops the encryption processing. Become. In such a case, infection with the macro virus cannot be prevented.

In a Web document or the like containing a Java applet, an unspecified majority accesses the Web document.
Encrypting for individual users is difficult,
Also, since the creator of the homepage is not always reliable, even if it is encrypted, it cannot be said that it is safe. This makes it impossible to completely prevent the transmission of intermediate language viruses.

For this reason, in this embodiment, the application program mounted on the personal computers 3 and 4 executes the processing procedure shown in FIG. 1 when the user instructs the execution of the macro. That is, when the execution of the macro is instructed by the user, the MCMP 10 proceeds from step SP1 to step SP2, and inspects the contents of the macro to be executed. Then, the process proceeds to step SP3, where it is determined whether a dangerous command is detected.

That is, some of the macro instructions can delete a file or input / output data to / from an external device. Also, in the macro of mail software,
It is also possible to automatically send an e-mail to an address recorded in the address book. Any of these instructions, when used maliciously (ie, instructions by a macro virus), can cause serious problems for the system and other computers.

For this reason, in this application program, for a command which may be executed by such a macro virus in advance and which may cause a serious accident, a switch (hereinafter referred to as a switch) which can prohibit execution of the command by a software developer. MCMP 10 determines whether or not there is a dangerous command by determining whether the macro to be executed includes such a command of the dangerous command inhibiting switch. judge.

Here, if such a dangerous command is not included, the MCMP 10 moves to step SP4, executes this macro, and then moves to step SP5 to end this processing procedure. Thus, in this case, even if a macro virus invades, it is possible to minimize the damage.

On the other hand, if a dangerous command is detected,
The MCMP 10 proceeds from step SP3 to step SP6, displays a predetermined message to notify the user that the dangerous command is included, and then proceeds to step SP5 to end this processing procedure. Thus, when a macro virus invades, the infection with the macro virus can be prevented.

On the other hand, even when a dangerous command is included, a macro sent from a third party that is sufficiently reliable can be determined by the user as not being a macro virus. Further, even if a macro is once determined to contain a dangerous command by executing this processing procedure, there may be a case where confirmation can be obtained by virus inspection software.

For this reason, the MCMP 10 displays a button for temporarily releasing the dangerous command prohibition switch, and executes this processing procedure by temporarily operating the dangerous command prohibition switch by the user's operation of this button. If the user sets the danger command prohibition switch to the OFF state at all times, the protection function against the virus will not substantially function, and in this embodiment, this button is displayed at an easy-to-understand position on the screen. The setting can be switched by a simple operation. Also, when the dangerous command prohibition switch is turned off,
The button color and characters are displayed prominently to indicate a dangerous state that cannot be protected from viruses, and a warning dialog is displayed when execution is started. When new data is incorporated, the dangerous command prohibition switch must be set to ON in the initial state, and the dangerous command prohibition switch must be released before execution.

With this function, in this embodiment, even if data containing a macro virus is erroneously opened, execution of a dangerous process attempted by the macro virus is prohibited, and damage is minimized accordingly. It is made so that it can be stopped.

Further, in the computers 3 and 4, the intermediate language program can be accessed only in the virtual machine that executes the intermediate language, that is, the information such as the user's disk, memory, and network outside the virtual machine is stored in the virtual machine. It is set so that it cannot be accessed at all. The execution of the intermediate language sent from the outside via the network 2 can be prohibited by the setting of the user. In addition, the reliability of each URL (Uniform Resource Locator) is determined based on a digital signature or the like, and distribution of the intermediate language is permitted only for the URL having reliability or only for the URL designated by the user.

Thus, with regard to the personal computers 3 and 4, the intermediate language virus is prevented from being infected to prevent damage.

(1-2) Operation of the First Embodiment In the above configuration, in the computers 3 and 4 (FIG. 3), the records in the external storage device 13, the external memory 12, etc. are sequentially loaded into the MCMP 10 While the encryption is being decrypted, a series of programs is executed by processing the decrypted data.

As a result, it is difficult for the computers 3 and 4 to correctly execute only the program encrypted with the same encryption method and the same key. When a program is entered by a virus encrypted with a different key,
It is converted into completely different random data inside the CMP 10 to prevent infection with a virus. As a result, for example, even if the user tries to execute a virus in an executable file attached to an e-mail or the like by mistake, safety can be ensured, thereby preventing machine language virus infection. .

On the other hand, for macro viruses that infect data, as in the case of machine language virus countermeasures,
It is always processed while being decrypted using a predetermined key, so that if the data including the macro virus that has entered from the outside is not encrypted, such data will become unrecognizable and meaningless data for the application. In addition, infection with a macro virus can be prevented.

For example, it is conceivable that an encryption key is notified to a specific target due to the necessity of exchanging data with an external device such as an electronic mail. In this case, a person who knows the key encrypts a file containing a virus. If you distribute by simply MCMP
Depending on the processing by 10, the virus may be infected. In addition, even when processing data that has not been encrypted at all, infection with a macro virus cannot be prevented.

Therefore, in the computers 3 and 4, a dangerous command prohibition switch is registered in advance for a macro command that may cause a serious problem in the system and other computers due to malicious use, and a macro by the user is used. It is determined whether or not the macro to be executed includes such a command of the dangerous command prohibition switch. If the dangerous command is not included, the macro is executed. If a dangerous command is included, the macro execution is stopped and executed only when the dangerous command prohibition switch is temporarily set to OFF by the user's confirmation with virus inspection software. You.

Thus, in this embodiment, even if a macro virus is infected, the effect is minimized.

On the other hand, the intermediate language virus is set so that it can be accessed only in the virtual machine executing the intermediate language, and the intermediate language sent from outside via the network 2 is set according to the user setting. Can be prohibited, and the reliability of each URL is determined by a digital signature or the like, and only the URL having the reliability or the URL designated by the user is determined.
Only, the distribution of the intermediate language is permitted, thereby preventing the virus from being transmitted.

Even if countermeasures are taken against macro viruses and intermediate language viruses in this way, the software itself is infected by viruses (usually machine language viruses created in machine language), and these macro viruses If the function of the countermeasure is invalidated, it is difficult to effectively implement such a countermeasure.

In this case, it is conceivable to detect falsification (ie, virus infection) by attaching an electronic signature to the software and confirming it before or during execution. However, since a digital signature is basically attached to a software file, it is prevented when a virus is infected in the memory of the computer during execution and an abnormal operation is performed. It becomes difficult. Incidentally, if the original file is infected with a virus, the infection with the virus can be detected because the consistency with the electronic signature is lost.

However, in this embodiment, the computers 3 and 4 can directly execute the software encrypted by the MCMP 10 to prevent the transmission of the machine language virus, so that the machine language virus causes the macro virus. It is possible to effectively avoid a situation in which the countermeasure and the function of the intermediate language countermeasure are invalidated, and thereby it is also possible to effectively avoid infection by a virus.

(1-3) Effects of the First Embodiment According to the above configuration, a macro instruction which may cause a serious problem in a system or another computer due to malicious use is registered, By stopping the execution of the macro when this registered instruction is included,
The burden on the user can be significantly reduced as compared with the related art, and infection with a virus can be prevented.

At this time, by sequentially processing the program while deciphering the encryption, it is possible to prevent virus infection by a machine language that invalidates the setting for such a macro virus. It is possible to reduce the burden on the user and prevent infection with the virus.

(2) Second Embodiment In this embodiment, a macro instruction which may cause a serious problem on another computer by the above-described prior confirmation of the first embodiment is included. Instead of checking whether or not each instruction is executed, it is determined whether or not each instruction is such a dangerous instruction while sequentially executing macro instructions.
If a dangerous command is detected, the processing is stopped. Note that this embodiment is configured in the same manner as the first embodiment except that such macro processing is different.

That is, in this embodiment, the MCM
As shown in FIG. 6, when the user instructs the execution of the macro, as shown in FIG.
The process proceeds to 0, and one line of the macro script is loaded from the external storage device, the external memory, or the like. In the next step SP13, it is determined whether or not the loaded content is a dangerous command.
If a positive result is obtained here, MCMP proceeds to step S
After proceeding to P14 to display a message to the user, proceed to step SP15 and end this processing procedure. As a result, in this embodiment, a process such as checking a macro with virus checking software is executed according to a user's instruction.

On the other hand, if a negative result is obtained in step SP13, the MCMP proceeds to step SP16.
Here, after executing the loaded script, the MCMP proceeds to step SP17 and determines whether or not the macro processing has been completed. If a positive result is obtained here, MCM
P proceeds to step SP15 and ends this processing procedure. If a negative result is obtained, P proceeds to step SP10.
And load the next script for one line.

According to the configuration of this embodiment, the same effect as in the first embodiment can be obtained even if it is determined whether each instruction is a dangerous instruction while sequentially executing macro instructions. Obtainable.

(3) Third Embodiment In this embodiment, a secure macro is registered, and the processing of the macro is stopped depending on the presence or absence of this registration. Note that this embodiment is also configured in the same manner as the first embodiment, except that such macro processing is different.

That is, in this embodiment, the virus inspection software registers data that is confirmed to be safe by virus inspection so that it can be recognized by the corresponding application program. Also, a macro created by an application program stored in the personal computer (that is, a macro created by the user himself) is registered so as to be recognizable by the application program. In such a registration, specifically, when an electronic signature is attached to a file that has been subjected to virus inspection by virus inspection software, or when a user's own electronic signature is attached to data created by a user. And so on. Such a digital signature may be embedded in a data file or recorded in a file separate from the data. Which method is used depends on the suitability for the system, the purpose, the application, etc. It can be set appropriately as needed.

With such registration, the MCMP executes the macro by executing the processing procedure shown in FIG. 7 when the execution of the macro is instructed on such an application program by the user.

That is, when the user instructs the execution of the macro, the MCMP proceeds from step SP21 to step SP22, and determines whether or not the macro whose execution is instructed by the user is registered. Here, if a negative result is obtained, the MCMP proceeds from step SP22 to step SP23, notifies the user of the message, and then proceeds to step SP24 to end this processing procedure.

On the other hand, if a positive result is obtained in step SP22, the process proceeds from step SP22 to step SP25.
After executing the macro, the process proceeds to step SP24 and ends the processing procedure.

According to this embodiment, the same effect as in the first embodiment can be obtained by registering a secure macro and suspending the processing of the macro depending on the presence or absence of this registration.

By executing this registration using an electronic signature, if a virus is detected, the source of the virus can be easily specified from the signer of the data.

(4) Fourth Embodiment In this embodiment, instead of the registration by the electronic signature described above in the third embodiment, the secure data is replaced by the file name, size, date, data Register a check code of the contents and build a database. Also, the macro is executed by registering the database in this way. Here, the check code of the data content is
This is for confirming that the content of the data has not been rewritten since the registration, and a checksum, a CRC, a hash function, an electronic signature, and the like in a binary unit can be used.

Thus, in this embodiment, MC
The MP executes a macro process depending on the presence or absence of registration in the database. At this time, it is confirmed that the data has not been rewritten based on the file name, size, date, data content check code, and the like, and if the data has been rewritten, the process is stopped.

That is, it is possible to determine whether or not the data has been rewritten based on the file name, size, and date information. However, in this method, there is a possibility that the file name, size, date, and the like are also rewritten. However, if a check code for data contents is set as in this embodiment and rewriting is detected by using the check code in combination with the check code, it is effective against such attacks on the database. Can be defended.

According to the fourth embodiment, the same effects as in the first embodiment can be obtained even if the processing of the macro is stopped depending on the presence or absence of registration in the database.

At this time, a check code for the file name, size, date, and data content is registered in the database, and rewriting of the data is detected based on the code, thereby effectively preventing such an attack on the database. You can defend.

(5) Fifth Embodiment In this embodiment, the execution of the macro is stopped according to the storage location of the macro. That is, a virus generally invades from the outside through a removable medium such as a floppy disk, an attached file of an e-mail, or the like. For this reason, macro execution is prohibited for a file stored in a location that is a path through which a virus enters, and is executed only when a virus check is performed.

The file of the storage location for which the execution is restricted is a floppy disk, a CD-ROM, or the like.
/ R / RW, DVD-ROM / R / RW, MO, Zip
Files on removable media, e-mail attachments (including temporary files created when opening attachments), network files (especially files on the Internet), and download files. Files etc.

The MCMP determines the path of this macro when the execution of the macro is instructed by the user, and executes the processing of the macro only in the case of a file in the above-mentioned storage location set in advance, and only when a virus is checked. I do. On the other hand, if the macro is stored outside of these locations,
Execute the macro.

Thus, even if the processing of the macro is stopped in accordance with the storage location, the same effect as in the first embodiment can be obtained.

(6) Sixth Embodiment In this embodiment, macro processing is executed according to the presence or absence of encryption. That is, usually, data is encrypted when data is secretly exchanged, and is considered when trusted parties exchange data. Such data exchange between the parties is considered to be safe without viruses.

As a result, in this embodiment, MC
When the file to be processed is encrypted, the MP immediately executes the macro processing. On the other hand, if the file to be processed is not encrypted, the macro processing is executed only when a virus check is performed.

As in the sixth embodiment, the macro processing is executed depending on the presence or absence of encryption.
The same effect as that of the embodiment can be obtained.

(7) Seventh Embodiment In this embodiment, macro processing is executed by an encryption method and a key value. In other words, all encrypted data may not be secure. However, even in such a case, the reliability can be determined based on the encryption method and the key value. Thus, in this embodiment, it is determined whether or not the encryption method and the key value are registered in advance, and if the reliability is lacking, the macro processing is executed only when a virus check is performed.

As in the seventh embodiment, the same effects as in the first embodiment can be obtained by executing a macro process using an encryption method and a key value.

(8) Other Embodiments In the above-described embodiment, a case has been described in which each processing is executed by an application program that executes each macro. However, the present invention is not limited to this. These functions may be performed.

Further, in the above-described embodiment, the case where the execution of the macro is restricted by the instruction, registration, etc. has been described. However, the present invention is not limited to this, and the execution of the macro is restricted by combining these. Alternatively, the execution of the macro may be restricted by a combination of these and other conditions.

Further, in the above embodiment, MC
Although the case where a series of processing is executed by the arithmetic processing unit by the MP has been described, the present invention is not limited to this, and can be widely applied to the case where a series of processing is executed by a normal central processing unit.

[0092]

As described above, according to the present invention, the execution of a macro is stopped by stopping the execution of a macro depending on the presence or absence of a registered instruction, or by registering the security of the macro, and stopping the execution of the macro based on this registration. By stopping the execution of the macro based on the storage location of the macro, or by stopping the execution of the macro based on the encryption of the macro, especially with respect to the macro virus, The burden on the user can be remarkably reduced, and infection with a virus can be prevented.

[Brief description of the drawings]

FIG. 1 is a flowchart showing a processing procedure of MCMP of a computer according to a first embodiment of the present invention.

FIG. 2 is a schematic diagram illustrating a computer system of FIG. 1;

FIG. 3 is a block diagram showing the computer of FIG. 1;

FIG. 4 is a diagram provided to explain a virus infection in a normal computer.

FIG. 5 is a diagram provided for explanation of a virus in the computer of FIG. 1;

FIG. 6 is a flowchart illustrating an MCMP processing procedure of the computer according to the second embodiment of the present invention.

FIG. 7 is a flowchart showing an MCMP processing procedure of the computer according to the third embodiment of the present invention.

FIG. 8 is a chart showing types of viruses.

[Explanation of symbols]

1 ... Information processing system 2 ... Internet 3
4, 5 ... Computer, 10 ... MCMP, 12 ...
External memory 13, external storage device

Claims (16)

[Claims] 1. A dangerous command detecting step of detecting presence or absence of a registered command from a macro, and a macro stopping step of stopping execution of the macro based on a detection result of the dangerous command detecting step. A data processing method comprising: 2. The data processing method according to claim 1, wherein the step of detecting the dangerous command and the step of canceling the macro are executed by an application program that executes the macro. 3. The data processing method according to claim 1, wherein the arithmetic processing unit for executing the macro is a processor that sequentially processes a program while decrypting the data. 4. A data processing method, comprising: a registration step of registering security of a macro; and a macro stop step of stopping execution of the macro based on the registration in the registration step. 5. The data according to claim 4, wherein the step of registering is executed by software for inspecting a virus, and the step of canceling the macro is executed by an application program that executes the macro. Processing method. 6. The data processing method according to claim 4, wherein the arithmetic processing unit for executing the macro is a processor that sequentially processes a program while decrypting the macro. 7. A storage location determining step of determining a storage location of a macro, and a macro stopping step of stopping execution of the macro based on the determination of the storage location determining step. Data processing method. 8. The data processing method according to claim 7, wherein the step of determining the storage location and the step of canceling the macro are executed by an application program that executes the macro. 9. The data processing method according to claim 7, wherein the arithmetic processing unit for executing the macro is a processor that sequentially processes programs while decrypting the data. 10. An apparatus according to claim 1, further comprising: an encryption determining step of determining encryption of the macro; and a macro stopping step of stopping the execution of the macro based on the determination in the encryption determining step. Data processing method. 11. The data processing method according to claim 10, wherein the encryption determination step and the macro stop step are executed by an application program that executes the macro. 12. The data processing method according to claim 10, wherein the arithmetic processing unit for executing the macro is a processor that sequentially processes a program while decrypting the data. 13. A dangerous command detecting step for detecting presence or absence of a registered command from a macro, and a macro stopping step for stopping execution of the macro based on a detection result of the dangerous command detecting step. A program for a data processing method, comprising: 14. A program for a data processing method, comprising the step of: stopping macro execution based on registration in the registration step of registering the security of a macro. 15. A storage location determining step of determining a storage location of a macro, and a macro stopping step of stopping the execution of the macro based on the determination of the storage location determining step. Data processing program. 16. An apparatus according to claim 16, further comprising: an encryption determining step of determining encryption of the macro; and a macro stopping step of stopping execution of the macro based on the determination in the encryption determining step. Data processing program.