JP2004013607A - File monitoring device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To extremely secure the detection processing of the presence/absence of alternation for a file preserved in an information processor and the restoration processing of the altered file. <P>SOLUTION: In the information processor, a multi-OS environment where operation is performed by using two OS such as an OS 110 for a service and an OS 120 for security, for different purpose, is established. A file 115 to be monitored, having the possibility of being altered by operation from the outside such as virus is put under the control of the OS 110 for a service. A function of monitoring the presence/absence of the alternation of the file 115 to be monitored is operated on the OS 120 for security. Monitor information and a back file to be used for detecting the presence/absence of alternation are put under the control of the OS 120 for security. Monitor information or the like is isolated from the OS 110 for a service to be used for normal processing so that it is possible to prevent the alteration, and to secure the monitoring and restoring function of the file. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a technique for monitoring unauthorized alteration of a file stored in an information processing device.
[0002]
[Prior art]
There is a problem that a file stored in the information processing device is illegally altered or destroyed by a virus or the like transmitted via the Internet (hereinafter, illegal alteration to a file is collectively referred to as “alteration”). ). As one of measures against these problems, for example, a technique described in JP-A-10-69417 and a technique described in JP-A-2001-337864 are cited. The former is a technology in which a resident file monitoring program is provided on an information processing apparatus to periodically monitor file tampering. The latter is a technique for preventing file falsification by permitting access to a file only when a condition defined in a policy is satisfied.
[0003]
[Problems to be solved by the invention]
However, the latter technique cannot detect if the file has been tampered with. In the former technique, there is a possibility that information itself such as a file monitoring program and a parameter setting file used for monitoring falsification of a file may be falsified. If such information is falsified, file monitoring may not function properly. As described above, in the related art, there is room for improvement in the reliability of monitoring the falsification of the file. This is a common problem not only due to a virus but also for illegal tampering of a file.
[0004]
[Means for Solving the Problems]
In order to solve at least a part of the above problems, the present invention provides a file monitoring device that monitors a file stored in an information processing device. This file monitoring device includes a file access unit, a monitoring information storage unit, a parameter acquisition unit, and a falsification determination unit. The file access unit is used for accessing a file. The monitoring information storage unit stores monitoring information for monitoring whether the file has been tampered with. The parameter acquisition unit acquires a parameter value corresponding to the monitoring information for the file to be monitored. The tampering determination unit compares the acquired parameter value with the monitoring information to determine whether there is tampering.
[0005]
The monitoring information storage unit is configured so that the file access unit cannot access the monitoring information. Such a configuration can be realized by separating the file access unit and the monitoring information storage unit in terms of hardware or software. Further, a configuration similar to a so-called firewall may be applied to restrict access to the monitoring information storage unit based on a predetermined rule. In other words, such a configuration can be expressed as a configuration in which the monitoring information storage unit is concealed from the outside of the file monitoring device, and a configuration in which general users cannot access the monitoring information storage unit. By applying such a configuration, it is possible to prevent the monitoring information from being targeted for unauthorized tampering, and it is possible to more reliably monitor tampering with the file.
[0006]
As the monitoring information, various information that can be changed by falsification of the file, for example, a file size, an update date, a hash value, a copy of the file itself, and the like can be used. If the file has been tampered with, the information obtained from the file after tampering is inconsistent with the monitoring information stored in the monitoring information storage unit, so that the presence or absence of tampering can be detected.
[0007]
When the access right is set for the file, information on the access right may be used as the monitoring information. This makes it possible to detect, for example, falsification in which a highly confidential file can be illegally viewed by an unspecified number of people.
[0008]
Various settings can be made for the timing at which the falsification determination unit makes the determination. For example, the determination may be made periodically in a preset period, or may be made in synchronization with the access by the file access unit.
[0009]
In the present invention, recovery information for recovering a falsified file may be stored together, and when falsification of the file is detected, the file may be recovered using this information. As the recovery information, for example, a backup file can be used. It is not always necessary to store the latest backup file, and the original backup file and log information relating to the modification performed thereafter may be stored together as recovery information.
[0010]
The recovery information can be handled in the same way as the file to be monitored, that is, saved so that the file access unit can access it. However, it is preferable that the recovery information be handled in the same way as the monitoring information. By doing so, the recovery information can be prevented from being falsified, and the file can be recovered more reliably.
[0011]
When recovering a file using recovery information, when update information for updating a file is input, recovery information and monitoring information may be updated instead of the file itself. Even if the file itself has not been updated, the file monitoring apparatus considers that the file has been tampered with and restores the file in accordance with the update of the monitoring information. Therefore, the file can be updated indirectly. By doing so, it is possible to maintain consistency with the monitoring information at the time of regular updating of the file.
[0012]
In the present invention, modification to a file may be prohibited in principle, and modification may be permitted only at the time of file recovery. Regular updating of the file can be realized by updating the recovery information as described above. By restricting the alteration of the file in this way, it is possible to further prevent unauthorized alteration of the file.
[0013]
In the present invention, it is preferable to change the condition for judging falsification according to the file to be monitored. The condition for performing the determination means, for example, the timing for performing the determination, the type of monitoring information used for the determination, and the like. By changing these conditions according to the file, the monitoring load can be adjusted in response to a request for falsification prevention for each file.
[0014]
In the present invention, the method of separating the monitoring information storage unit and the file access unit by software can be realized in various modes. As an example, both may be operated by different operating systems (hereinafter, referred to as “OS”). The file access unit operates on the first OS. The function of accessing the monitoring information storage unit is provided by a second OS that operates using hardware resources separated from the first OS. A communication unit that controls transmission and reception of information is provided between the first OS and the second OS. Further, a multi-OS control unit that realizes a function of distributing hardware resources of the first OS and the second OS may be provided. When the recovery information described above is used, it is preferable that the function of accessing the recovery information storage unit is also applied to the second OS.
[0015]
The determination of tampering requires a parameter value obtained by the first OS through file access and monitoring information obtained from the monitoring information storage unit by the second OS. Therefore, at the time of determination of tampering, these pieces of information are obtained via the communication unit. In the case where the falsification is determined by the first OS, the monitoring information is obtained via the communication unit. When the falsification is determined by the second OS, the parameter value is obtained via the communication unit. When the falsification determination unit is configured by software, the latter mode is preferable in order to prevent the program file itself from being falsified.
[0016]
The separation between the monitoring information storage unit and the file access unit does not necessarily need to use a plurality of OSs, but may be realized by a single OS. For example, the file access unit may be configured as a basic module (hereinafter, referred to as “kernel”) provided by the OS, and access to the monitoring information storage unit may be configured as a kernel different from that of the file access unit. Similarly, access to the recovery information storage unit may be configured as a kernel different from that of the file access unit.
[0017]
The present invention does not need to include all of the various features described above, and may be configured by appropriately omitting or combining some of them. The file monitoring device of the present invention may be built in the information processing device or may be configured separately. In the latter, the information processing device and the file monitoring device are connected by a communication line such as a local connection or a network, and the file access unit accesses a file in the information processing device via the communication line. Further, the file monitoring device may be realized in cooperation with a plurality of hardware.
[0018]
According to the present invention, a file used by an application program may be monitored, but it is more preferable to monitor a file, such as a system file or a confidential file, which has a strong demand for falsification prevention and whose update frequency is relatively low. preferable.
[0019]
The present invention may be configured as a file monitoring method using a computer, in addition to the above-described embodiment as a file monitoring device. Further, by being installed in a computer, it may be configured as a computer program for configuring the above-described file monitoring device and a storage medium storing the computer program. Here, examples of the storage medium include a flexible disk, a CD-ROM, a DVD, a magneto-optical disk, an IC card, a ROM cartridge, a punched card, a printed matter on which a code such as a barcode is printed, and a computer internal storage device (RAM or ROM A variety of computer-readable media are available, such as a memory (e.g., memory) and external storage.
[0020]
BEST MODE FOR CARRYING OUT THE INVENTION
Embodiments of the present invention will be described in the following order.
A. Device configuration:
B. File monitoring process:
C. File update processing:
D. effect:
E. FIG. Modification:
[0021]
A. Device configuration:
FIG. 1 is an explanatory diagram showing a schematic configuration of a file monitoring device 100 as an embodiment. The file monitoring device 100 is constructed by installing software for realizing each functional block illustrated in a general-purpose computer. In the present embodiment, an application program 113 (hereinafter, simply referred to as “application”) that runs on the service OS 110 is also installed in the computer, and also functions as an information processing device that performs processing according to the application 113. . In the present embodiment, the file monitoring device 100 is built in or integrated with the information processing device.
[0022]
The computer is operated by two types of OS, a service OS 110 and a security OS 120. For example, Windows (trademark) can be used as the service OS 110, and LINUX (trademark) can be used as the security OS, for example. The service OS 110 and the security OS 120 may be unified with the same type of OS.
[0023]
The operations of the two types of OSs are controlled by the multi-OS control unit 102. The multi-OS control unit 102 first provides a hardware resource division function, that is, a function of appropriately allocating computer hardware resources such as CPU time, memory, external devices, and timers to the service OS 110 and the security OS 120. . The second function of the multi-OS control unit 102 is a function that mediates communication between the service OS 110 and the security OS 120. This function is provided by the inter-OS communication unit 104 provided in the multi-OS control unit 102. Since various kinds of software corresponding to the multi-OS control unit 102 are known, detailed description is omitted here.
[0024]
On the service OS 110, an application 113 for a user to perform various information processing is operated. In addition, the service OS 110 manages a predetermined area of the magnetic disk called the first storage device 114. Various files used by the application 113, system files, and the like are stored in the first storage device 114. In the present embodiment, these files correspond to files to be protected from tampering. Hereinafter, the file stored in the first storage device 114 is referred to as a monitoring target file 115.
[0025]
The service OS 110 has a file access unit 111 as a kernel for accessing the monitoring target file 115. The file access unit 111 may be configured as software running on the service OS 110.
[0026]
A parameter acquisition unit 112 is provided on the service OS 110 as a functional block of the file monitoring device 100. The parameter acquisition unit 112 appropriately accesses the monitoring target file 115 and acquires various parameters used for determining whether there is tampering. The obtained parameters are transferred to the functional blocks on the security OS 120 side via the inter-OS communication unit 104.
[0027]
The security OS 120 manages a predetermined area of a magnetic disk called a second storage device 122. The second storage device 122 only needs to be a memory area that is distinguished from the first storage device 114, and it is not always necessary to separate the two in terms of hardware. The second storage device 122 can be accessed via the security OS 120, but cannot be directly accessed using the function of the service OS 110. In this sense, the contents of the second storage device 122 are kept secret from general users, and are isolated from the outside of the file monitoring device 100.
[0028]
The second storage device 122 stores monitoring information 123 used for monitoring a file. Also, a backup file 124 for restoring the file to be monitored when the monitoring target file 115 has been tampered with is stored. The backup file 124 may be stored in the first storage device 114.
[0029]
On the security OS 120, a file recovery manager 121 is constructed. The file recovery manager 121 provides two functions: a function of detecting whether the monitoring target file 115 has been tampered with, and a function of restoring the file when tampering has been detected. The former function is performed by comparing the parameters received from the parameter acquisition unit 112 with the monitoring information 123 stored in the second storage device 122. The latter recovery is performed by overwriting the backup file 124 of the second storage device 122 with the monitoring target file 115.
[0030]
FIG. 2 is an explanatory diagram showing the contents of the monitoring information 123. In this embodiment, as the monitoring information 123, two types of monitoring timing for performing a file monitoring operation and information for detecting falsification of a file are stored for each file. In the example in the figure, “AM0700”, which means 7:00 am every day, is stored as the monitoring timing of the “SYSTEM” file. The monitoring timing may be specified by the time as described above, or may be specified by a monitoring cycle. When the time is specified, the day of the week, the date, and the like may be specified together, and monitoring may be performed on a weekly or monthly basis. In the present embodiment, the monitoring timing can be individually specified for each file, but may be unified for all files. However, by individually specifying each file, the monitoring load can be adjusted by avoiding the concentration of file monitoring processing, or by setting the monitoring frequency according to the importance of the file.
[0031]
As the latter information, information on the file size, the latest update date, the hash value of the file, and the access right to the file is used. The access authority means a user name that can access the file. Such information registered for each file in order to detect the presence or absence of tampering is hereinafter referred to as registration information. The registration information is not limited to the information illustrated here, and other information that may change due to falsification of the file may be used, or a part of the illustrated information may be omitted.
[0032]
B. File monitoring process:
FIG. 3 is a flowchart of the file monitoring process. The right side shows the processing executed by the security OS 120, and the left side shows the processing executed by the service OS 110. Each of the processes is a process executed by the CPU of the computer, but for convenience of explanation, the following description will be made such that each OS executes the process.
[0033]
When the processing is started, the security OS 120 inputs monitoring information (step S20). As described with reference to FIG. 2, the monitoring information includes monitoring timing and monitoring registration information. In the present embodiment, since the monitoring information is stored for each file, here, the monitoring information corresponding to the file name to be monitored is read.
[0034]
When the security timing corresponds to the monitoring timing (step S21), the security OS 120 transmits a parameter acquisition instruction to the service OS 110 via the inter-OS communication unit 104 (step S22). The parameter means a value obtained from the monitoring target file for the item corresponding to the registration information. In the present embodiment, the file size, the update date, the hash value, and the access right correspond to the parameters.
[0035]
In response to this instruction, the service OS 110 accesses a file to be monitored and acquires these parameters. This parameter is transferred to the security OS 120 via the inter-OS communication unit 104 again.
[0036]
Upon receiving the parameter (step S23), the security OS 120 compares the parameter with the registration information included in the monitoring information 123, and determines whether or not tampering has been performed (step S24). If all the parameters match, it is determined that the monitoring target file has not been tampered. If any of the parameters are different, it is determined that the monitoring target file has been tampered.
[0037]
If it is determined that the file has been tampered with, the security OS 120 attempts to recover the monitoring target file. That is, the backup file 124 is read (step S25), and a change instruction is output to the service OS 110 via the inter-OS communication unit 104 (step S26). The backup file 124 is also delivered together with the change instruction. The service OS 110 restores the file by overwriting the monitoring target file with the received backup file 124 (step S12). The above processing is sequentially executed for each monitoring target file.
[0038]
In this embodiment, the file access unit 111 overwrites the file to be monitored. However, the file may be directly overwritten from the security OS 120 side. For example, it can be realized by providing the security OS 120 with a function capable of managing the first storage device 114 as well. By doing so, there is an advantage that the file can be restored even if the system file of the service OS 110 is falsified and the service OS 110 itself becomes inoperable.
[0039]
C. File update processing:
FIG. 4 is a flowchart of the file update process. This is the process when the file to be monitored is updated regularly. For example, this corresponds to a process in which the user modifies the monitoring target file 115 with the application 113 and saves it.
[0040]
When the process is started, the service OS 110 inputs a file update instruction (step S30) and transmits the file update instruction to the security OS 120 via the inter-OS communication unit 104 (step S31). The update instruction includes a file name to be updated and a file after the update. In the present embodiment, the update instruction is input on the service OS 110 side, but may be input on the security OS 120 side.
[0041]
The security OS 120 receives the update instruction (Step S41) and generates registration information (Step S42). For example, based on the updated file, a file size, a hash value, and the like are calculated. The generation of the registration information may be performed on the service OS 110 side before transmitting the update instruction. The obtained registration information is stored as monitoring information 123, and the updated file is stored as a backup file 124 (step S43).
[0042]
The target to be updated is the monitoring target file 115 stored in the first storage device 114. In the present embodiment, the monitoring target file 115 is not directly updated, and the monitoring information in the second storage device 122 is not updated. And update the backup file. In this state, a mismatch occurs between a parameter obtained from the monitoring target file 115 in the first storage device 114 and registration information in the second storage device. If the file monitoring process is executed in this state, the security OS 120 overwrites the monitoring target file 115 with the contents of the backup file 124. As a result, the monitoring target file 115 is indirectly updated.
[0043]
D. effect:
According to the embodiment described above, it is possible to detect the falsification of the monitoring target file by the file monitoring process and recover the falsified file. In this embodiment, since the monitoring information is stored in a state isolated from the service OS 110, unauthorized alteration of the monitoring information can be avoided, and the monitoring function can be further strengthened. Also, since the backup file 124 is similarly isolated, the file recovery function can be strengthened.
[0044]
In the file update process, the contents of the first storage device 114 are indirectly updated by updating the second storage device 122. By performing such processing, it is possible to prohibit the application 113 from directly changing the monitoring target file 115. It is sufficient that the file access unit 111 has a function of prohibiting writing to the monitoring target file 115 unless an overwrite instruction is issued from the file recovery manager 121. By doing so, there is an advantage that the falsification of the monitoring target file 115 can be easily avoided.
[0045]
In the present embodiment, when falsification is detected, a file recovery process is performed (steps S25 and S26 in FIG. 3), but this process may be replaced with a simple display of the detection result. In this case, the administrator may separately perform the file recovery processing.
[0046]
In the present embodiment, the file is updated by the process shown in FIG. 4, but the file update does not necessarily have to be performed by this process, and it is permitted that the file is directly updated based on an instruction from the application 113. You may.
[0047]
E. FIG. Modification:
In the embodiment, the case where the two OSs are selectively used to realize the file monitoring function is illustrated. The present invention can be realized by using a single OS. FIG. 5 is an explanatory diagram showing a schematic configuration of a file monitoring device 100A as a first modification. Functional blocks having the same functions as in the first embodiment are denoted by the same reference numerals.
[0048]
The file monitoring device 100A has no security OS, and operates on a single service OS 110A. The service OS 110A includes a kernel that realizes the function of the file recovery manager 121A. The file access unit 111A and the file recovery manager 121A can directly send and receive information without having to go through the inter-OS communication unit 104 as in the first embodiment.
[0049]
The file recovery manager 121A also has a function of managing the second storage device 122. The file access unit 111A is prohibited from accessing the second storage device 122. By placing the second storage device 122 under the control of the kernel that operates in a limited manner as described above, it is possible to avoid unauthorized tampering of monitoring information and the like as in the embodiment.
[0050]
In the embodiment, the case where the file monitoring apparatus is built in or integrated with the information processing apparatus is illustrated. The file monitoring device may be separate from the information processing device. FIG. 6 is an explanatory diagram showing a schematic configuration of a file monitoring device 110B as a second modification.
[0051]
The file monitoring device 110B is connected to a client computer 114B as an information processing device via a network INT. As the network INT, a wide area network such as the Internet, a LAN, or another limited network can be used.
[0052]
The internal structure of the file monitoring device 110B is the same as in the first embodiment. However, the service OS 110 includes a network interface 111B for accessing the monitoring target file 115B in the information processing apparatus via a network. The function of the network interface 111B is the same as that of the file access unit of the embodiment from the viewpoint of file monitoring processing. The application 113 may be omitted. Further, in the second modified example, the configuration example of the device that uses two OSs properly has been described, but the configuration of the first modified example may be applied.
[0053]
The second modification is different from the embodiment in that the acquisition of parameters in the file monitoring process and the overwriting of the monitoring target file 115B in the file recovery process are performed on the network INT, but other processes are the same as the embodiment. is there. According to the second modification, the monitoring target file 115B of the information processing device connected to the network INT can be remotely monitored and restored.
[0054]
Although various embodiments of the present invention have been described above, the present invention is not limited to these embodiments, and it goes without saying that various configurations can be adopted without departing from the spirit of the present invention. For example, the above-described control processing may be realized by software or by hardware.
[0055]
In the present embodiment, the method of isolating the monitoring information from the outside by software is exemplified, but the monitoring information may be isolated by hardware. For example, it is possible to adopt a configuration in which the second storage device 122 and its management circuit are hardware different from the first storage device 114 and the like, and the communication between them is restricted.
[0056]
【The invention's effect】
According to the present invention, by monitoring the monitoring information separately from the management of the OS used by the application 113 or the like, it is possible to prevent the monitoring information from being subject to unauthorized tampering, and The monitoring function of tampering can be strengthened.
[Brief description of the drawings]
FIG. 1 is an explanatory diagram showing a schematic configuration of a file monitoring device 100 as an embodiment.
FIG. 2 is an explanatory diagram showing the contents of monitoring information 123.
FIG. 3 is a flowchart of a file monitoring process.
FIG. 4 is a flowchart of a file update process.
FIG. 5 is an explanatory diagram showing a schematic configuration of a file monitoring device 100A as a first modified example.
FIG. 6 is an explanatory diagram showing a schematic configuration of a file monitoring device 110B as a second modification.
[Explanation of symbols]
100, 100A, 100B ... file monitoring device
102: Multi-OS control unit
104: Inter-OS communication unit
110 ... Service OS
111, 111A: File access unit
111B ... Network interface
112 ... parameter acquisition unit
113 ... Application
114 ... First storage device
114B ... Client computer
115, 115B ... monitoring target file
120 ... Security OS
121, 121A: File recovery manager
122: second storage device
123 monitoring information
124 ... Backup file

Claims (10)

A file monitoring device that monitors a file stored in an information processing device,
A file access unit for accessing the file;
A monitoring information storage unit that stores monitoring information for monitoring whether the file has been tampered with;
For a file to be monitored, a parameter acquisition unit that acquires a parameter value corresponding to the monitoring information,
Comparing the parameter value and the monitoring information, comprising a falsification determination unit that determines the presence or absence of the falsification,
The file monitoring device, wherein the monitoring information storage unit is configured so that the file access unit cannot access the monitoring information. The file monitoring device according to claim 1, wherein
A recovery information storage unit that also stores recovery information for recovering the falsified file;
A file monitoring device comprising: a file recovery unit that recovers the falsified file using the recovery information when the falsification is detected. 3. The file monitoring device according to claim 2, wherein
The file monitoring device, wherein the restoration information storage unit is configured to be inaccessible to the restoration information by the file access unit. The file monitoring device according to claim 2 or 3,
A file monitoring device, comprising: an update information input unit that inputs update information for updating the file in a regular manner; and an update unit that updates the recovery information and the monitoring information based on the update information. The file monitoring device according to any one of claims 2 to 4,
A file monitoring device, wherein the file access unit prohibits modification of the file without relying on the file recovery unit. The file monitoring device according to claim 1, wherein:
A file monitoring device comprising: a determination condition control unit that changes a condition regarding determination by the falsification determination unit according to the file to be monitored. The file monitoring device according to claim 1, wherein:
A first operating system for operating the file access unit;
A second operating system that operates using hardware resources separated from the first operating system;
A communication unit that controls transmission and reception of information between the first operating system and the second operating system;
The function of accessing the monitoring information storage unit is provided by the second operating system,
The falsification determination unit is a file monitoring device that acquires the parameter value and the monitoring information using the communication unit. A file monitoring method for monitoring a file stored in an information processing device,
A step of acquiring monitoring information for monitoring the presence or absence of tampering with the file, which is managed in a state where access in the same process as the process for accessing the file is prohibited,
For a file to be monitored, a step of acquiring a parameter value corresponding to the monitoring information,
Comparing the parameter value with the monitoring information to determine whether the data has been tampered with. A computer program for monitoring a file stored in an information processing device,
A file access function for accessing the file;
A monitoring information management function for managing monitoring information for monitoring whether the file has been tampered with;
A function of acquiring a parameter value corresponding to the monitoring information for a file to be monitored,
By comparing the parameter value and the monitoring information, to implement the function of determining the presence or absence of the falsification,
A computer program provided in a mode in which the monitoring information management function makes it impossible to access the monitoring information by the file access function. A computer-readable recording medium on which the computer program according to claim 8 is recorded.

Images