JP2005149394A - Information processor, information processing method, program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To flexibly execute an application program by dynamically setting a secure level. <P>SOLUTION: A secure level module 71 is applicable, for example, to an OS executed on a computer, determines whether the application program is a trusted application program 42 with a legitimate electronic signature, and when determining that the application program is a trusted application program 42, recognizes a secure level which the trusted application program 42 requests. Then, the secure level module 71 sets the highest secure level among the secure levels of the application programs being executed and to be executed subsequently as a secure level of the computer. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an information processing device, an information processing method, a program, and a recording medium, and in particular, an information processing device and information that can flexibly execute an application program by dynamically setting a secure level. The present invention relates to a processing method, a program, and a recording medium.

  For example, in BSD (Berkeley Software Distribution), a secure level is set at boot time at the kernel level. Then, after booting, the super user (administrator) can raise the secure level.

  Here, as a technology related to computer security, for example, the security level of each task executed on the OS (Operating System) is held in the OS, and the security level and the security level of the communication function between tasks As a task memory, there is an inter-task communication method for selecting one of a secure memory block in which a level with security is written and a non-secure memory block in which a level without security is written (for example, Patent Documents) 1).

  Conventionally, in order to protect the integrity of the OS, a virtual environment is provided to the application so that the operation of the application does not affect other applications or the entire OS. A method of making a virtual environment into a compartment may be used.

JP 2002-49499 A

  However, if the super user can only raise the secure level during the operation of the OS, the trusted application (Trusted Application) that is an application having a valid digital signature (Signature) is executed. ) In the above, there is a problem that it is difficult to execute an untrusted application (program) without a valid electronic signature.

  That is, in order to execute a trusted application, if the secure level is set to a high level at the time of booting, the secure level remains high even after the execution of the trusted application is completed. Untrusted applications that cannot be limited to a high secure level and cannot be executed.

  Therefore, it has been difficult to meet the general user's expectation to execute an untrusted application such as open source on the trusted platform without executing the trusted application.

  In addition, in the method of compartmentalizing the virtual environment, it is necessary to prepare resources for each application for each compartment separately from the host system, which wastes resources.

  The present invention has been made in view of such a situation, and enables a flexible execution of an application program by dynamically setting a secure level.

  The information processing apparatus according to the present invention has a determination unit that determines whether an application program is a trusted application program with a valid electronic signature, and the determination unit determines that the application program is a trusted application program. Recognizing means for recognizing the secure level required by the application program and setting for setting the highest secure level among the secure levels required by the trusted application program being executed and to be executed as the secure level of the information processing apparatus Means.

  The information processing apparatus further includes resource restriction means for restricting use of resources of the untrusted application program that is an application program other than the trusted application program according to the secure level of the information processing apparatus set by the setting means. Can do.

  When the execution of the trusted application program is finished, the information processing device changes the secure level of the information processing device set by the setting means to the highest secure level requested by the trusted application program being executed. Further, a changing means can be provided.

  The trusted application program may have at least a valid electronic signature and a secure level required by the trusted application.

  The information processing apparatus further includes a storage unit that stores a secure level table in which a trusted application program that is being executed and is about to be executed and a secure level requested by the trusted application program are associated with each other. The secure level of the information processing apparatus can be set based on the secure level table stored by the storage means.

  In the information processing method of the present invention, when the application program is a trusted application program having a valid electronic signature, and when the application program is determined to be a trusted application program by the processing of the determination step The recognition step for recognizing the secure level required by the trusted application program, and the highest secure level required by the trusted application program that is being executed and is going to be executed is set as the secure level of the information processing apparatus. And a setting step.

  The program of the present invention has a determination step for determining whether or not the application program is a trusted application program with a valid electronic signature, and when the application program is determined to be a trusted application program by the processing of the determination step, A recognition step for recognizing the secure level required by the application program, and a setting step for setting the highest secure level among the secure levels required by the trusted application program to be executed and to be executed to the computer secure level. It is characterized by including.

  The program recorded on the recording medium of the present invention determines whether the application program is a trusted application program with an electronic signature, and determines that the application program is a trusted application program by the processing of the determination step. A recognition step for recognizing the secure level required by the trusted application program, and the highest secure level required by the trusted application program being executed and to be executed is set as the computer secure level. And a setting step.

  In the present invention, when it is determined whether the application program is a trusted application program with a valid electronic signature, and it is determined that the application program is a trusted application program, the secure level required by the trusted application program is recognized. Is done. Then, the highest secure level among the secure levels required by the trusted application program to be executed and to be executed in the future is set as the secure level of the information processing apparatus.

  According to the present invention, an application program can be flexibly executed by dynamically setting a secure level.

  BEST MODE FOR CARRYING OUT THE INVENTION The best mode of the present invention will be described below. The correspondence relationship between the disclosed invention and the embodiments is exemplified as follows. Although there are embodiments which are described in this specification but are not described here as corresponding to the invention, the embodiments correspond to the invention. It does not mean that it is not a thing. Conversely, even if an embodiment is described herein as corresponding to an invention, that means that the embodiment does not correspond to an invention other than the invention. Absent.

  Further, this description does not mean all the inventions described in the specification. In other words, this description is for the invention described in the specification and not claimed in this application, i.e., for the invention that will be applied for in the future or that will appear as a result of amendment and added. It does not deny existence.

  According to the present invention, an information processing apparatus is provided. In the information processing apparatus that controls the execution environment of the application program, the information processing apparatus determines whether the application program is a trusted application program with a valid electronic signature (for example, step S11 in FIG. 12). A secure level module 71) that executes the above-described processing, and a recognition unit that recognizes the secure level requested by the trusted application program when the determination unit determines that the application program is the trusted application program (for example, FIG. The secure level module 71) that executes the process of step S12 of 12 and the trusted application program that is being executed and is about to execute And setting means (for example, a secure level module 71 for executing the process of step S17 in FIG. 12) for setting the highest secure level among the secure levels to the secure level of the information processing apparatus. .

  The information processing apparatus is configured to limit resource use of an untrusted application program that is an application other than the trusted application according to a secure level of the information processing apparatus set by the setting means (for example, FIG. It is possible to further include a kernel 51) that executes the processing of step S52 in FIG.

  When the execution of the trusted application program ends, the information processing apparatus has the highest secure level of the information processing apparatus set by the setting unit among the secure levels required by the trusted application program being executed. Changing means for changing to a secure level (for example, a secure level module 71 that executes the process of step S33 in FIG. 13) may be further provided.

  The trusted application program may have at least the legitimate electronic signature and a secure level required by the trusted application.

  Storage means (for example, RAM 13 in FIG. 1) for storing a secure level table in which the trusted application program to be executed in the future and the secure application level requested by the trusted application program are associated with each other is further provided. The setting means can set the secure level of the information processing apparatus based on the secure level table stored by the storage means.

  According to the present invention, an information processing method is also provided. In this information processing method, in the information processing method of the information processing apparatus that restricts the execution environment of the application program, a determination step of determining whether the application program is a trusted application program with a valid electronic signature (for example, 12 and a recognition step of recognizing a secure level required by the trusted application program when the application program is determined to be the trusted application program (for example, the step of FIG. 12). S12), the highest secure level among the secure levels required by the trusted application program being executed and to be executed Setting step of setting the security level of the broadcast processing apparatus (e.g., step S17 in FIG. 12), characterized in that it comprises a.

  Furthermore, according to the present invention, a program is also provided. This program is a program for causing a computer to execute a process for restricting the execution environment of an application program, and a determination step for determining whether or not the application program is a trusted application program with a valid electronic signature (for example, FIG. 12). Step S11) and a recognition step of recognizing a secure level required by the trusted application program when the application program is determined to be the trusted application program by the processing of the determination step (for example, step S12 of FIG. 12). ) And the highest secure level of the secure level required by the trusted application program being executed and to be executed in the future. Setting step of setting the Le secure level of the computer (e.g., step S17 in FIG. 12), characterized in that it comprises a.

  This program can be recorded on a recording medium.

  Hereinafter, specific embodiments to which the present invention is applied will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration example of an embodiment of a computer to which the present invention is applied.

  A CPU (Central Processing Unit) 11 executes various processes according to a program stored in a ROM (Read Only Memory) 12 or a program loaded from a storage unit 18 to a RAM (Random Access Memory) 13. The RAM 13 also appropriately stores data necessary for the CPU 11 to execute various processes.

  The CPU 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output interface 15 is also connected to the bus 14.

  The input / output interface 15 includes an input unit 16 including a keyboard and a mouse, an output unit 17 including a display and speakers such as a CRT (Cathode Ray Tube) and an LCD (Liquid Crystal Display), and a hard disk. A communication unit 19 including a unit 18, a modem, a terminal adapter, and the like is connected. The communication unit 19 performs communication processing via various networks including a telephone line and CATV.

  A drive 20 is also connected to the input / output interface 15 as necessary. A removable recording medium 21 composed of a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is appropriately installed in the drive 20, and a program read therefrom is installed in the storage unit 18 as necessary.

  The storage unit 18 (the read disk) includes, for example, an / etc directory, a / bin directory, a / sbin directory, a / user / bin directory, a / lib directory, and a / user / lib directory that can be used by application programs. It is configured. Further, the storage unit 18 stores a setting file in which information (compartment designation information) for designating compartments of secure levels L0 to L4 described later is described.

  FIG. 2 is a diagram for explaining a program executed on the computer of FIG.

  The secure level is set for the OS 41 as a platform, and limits the execution environment of the program such as resources that can be used and the range of the influence. In FIG. 2, the secure level is set, for example, in five levels of secure levels L0 to L4. Note that at the secure level Li (i = 1,..., 5), the greater i, the higher the security. That is, in the secure level Li, the execution environment restricted by the secure level Li becomes wider as i increases.

  The execution environments restricted by the secure levels L0 to L4 are referred to as compartments of the secure levels L0 to L4, respectively. The execution environments restricted by the trusted application program 42-1 and the trusted application program 42-2 described later are trusted applications. Called the compartment.

  In the computer shown in FIG. 1, a trusted application program 42-1, a trusted application program 42-2, an untrusted application program 44, a library 45, and the like are executed on the OS 41. Hereinafter, the trusted application program 42-1 and the trusted application program 42-2 are also referred to as a trusted application 42-1 and a trusted application 42-2, respectively, and the untrusted application program 44 is also referred to as an untrusted application 44. In addition, hereinafter, when it is not necessary to distinguish between the trusted application 42-1 and the trusted application 42-2, the trusted application 42-1 and the trusted application 42-2 are collectively referred to as a trusted application 42.

  The OS 41 is a basic program that controls basic operations of the computer.

  The OS 41 can be divided into a kernel 51, which is a program that implements the basic functions of the OS 41, and other parts. The kernel 51 has, for example, a secure level module 71 to be described later, and reads the compartment designation information of the secure levels L0 to L4 of the OS 41 set by the secure level module 71 from the storage unit 18, and the secure levels L0 to Based on the compartment designation information of L4, the use of resources of the untrusted application 44 described later is restricted.

  The secure level module 71 stores a secure level table (FIGS. 10 and 11 described later) in the RAM 13. The secure level module 71 controls the execution environment of the trusted application 42 and the untrusted application 44 by setting the secure level of the OS 41.

  The trusted application 42 and the untrusted application 44 are arbitrary application programs. However, the trusted application 42 is a reliable program with a valid electronic signature, and the untrusted application 44 is an untrusted program without a valid electronic signature or without an electronic signature itself. Further, as will be described later, the trusted application 42 has compartment designation information of the trusted application 42 including a secure level required for the OS 41 (hereinafter referred to as a requested secure level).

  Note that the trusted application 42 and the untrusted application 44 can use a plurality of processing routines stored in a library 45 described later, as necessary.

  The library 45 stores a plurality of processing routines used by the trusted application 42, the untrusted application 44, and the like.

  In the computer of FIG. 1, the secure level module 71 dynamically sets the secure level of the OS 41. When the untrusted application 44 is executed, the kernel 51 restricts (or permits) the use of the resource of the untrusted application 44 based on the secure level compartment designation information of the OS 41 set by the secure level module 71. To do.

  The trusted application 42 and the untrusted application 44 use processing routines stored in the library 45 as necessary.

  FIG. 3 shows an example of a basic format of the trusted application 42.

  In FIG. 3, the format of the trusted application 42 is a double layer application format. The trusted application 42 includes signature 101, plain text 102, dev_pkey (key) 103, and key (core) 104 arranged in order from the top.

  The signature 101 is an electronic signature of a package provider composed of plain text 102, dev_pkey (key) 103, and key (core) 104. This electronic signature is used to confirm the validity of the trusted application 42.

  The plaintext 102 is an unencrypted core (for example, an execution code of a program that does not require encryption for reproducing free content or untrusted content). The plain text 102 includes, for example, compartment designation information of the trusted application 42.

  The compartment designation information may be included not in the plain text 102 but in other parts.

  A dev_pkey (key) 103 is a common key key encrypted with a public key dev_pkey of a specific device or system.

  The key (core) 104 is a core part encrypted with the common key key.

  FIG. 4 shows an example of the compartment designation information of the secure level L1.

  As shown in FIG. 4, the compartment designation information of the secure level L1 includes Mandatory security (Mandatory security) divided into process capabilities (Process capabilities) and Mandatory Access Controls (MAC), And Trusted paths.

  Note that mandatory security means that the security policy logic and the designation of security attributes are clearly managed by a security policy manager. The security policy of mandatori security is described in a rule format, for example.

  Process capabilities and mandatory access control in mandatori security can be provided as a common interface to any platform, such as POSIX (Portable Operating System Interface for UNIX (registered trademark)) 1.e. . According to the process capability, it is possible to divide and manage superuser privileges (authorities). The behavior of the kernel 51 differs depending on whether or not a privilege managed by a certain process capability is valid.

  In the example of FIG. 4, as process capabilities, a privilege (CAP_SYS_RAWIO) for accessing a memory space serving as a kernel space and a privilege (CAP_SYS_MODULE) for loading and unloading a kernel module are described. And the process capability representing both of these privileges is disabled (OFF). Accordingly, in the compartment of the secure level L1, access to the memory space serving as the kernel space and loading and unloading of the kernel module are not permitted.

  Mandatory access control indicates in what mode an entity can access another entity.

  In the example of FIG. 4, / etc is read in the mandatory access control. That is, in the secure level L1 compartment, operations on the / etc directory are limited to reading only. In the mandatory access control, / bin, / sbin, / use / bin, / lib, and / user / lib are read, so in the secure level L1 compartment, the / bin directory, the / sbin directory, Operations on the user / bin directory, / lib directory, and / user / lib directory are all restricted to reading only.

  The trusted path represents a condition for establishing a trusted path with a trusted entity that is an entity of the trusted application 42.

  For example, when the condition represented by the trusted path is satisfied between the trusted application 42-1 and the trusted application 42-2, when the trusted application 42-1 communicates with the trusted application 42-2, the trusted application 42-2 -1 can be trusted that the trusted app 42-2 is indeed the trusted app 42-2. Also, the trusted application 42-2 can trust that the trusted application 42-1 is really the trusted application 42-2.

  In the example of FIG. 4, in the trusted path, / lib is a signature and / user / bin is a signature. That is, in the secure level L1 compartment, since the / lib directory and the / user / bin directory establish a reliable path with the trusted application 42, the digital signature (signature) of the signature 101 (FIG. 3) of the trusted application 42 is valid. It is specified to determine if it exists.

  In the above description, the secure level L1 compartment has been described. Similarly, as the compartment designation information, by setting three attributes of process capability, mandatory access control, and trusted path for each secure level, Each secure level compartment can be specified.

  The compartment is designated by restricting the execution environment of the program such as the operating space of the OS 41, the resources that can be used, and the range affected by the use, by three attributes of process capability, mandatory access control, and trusted path. Therefore, it is not necessary to prepare a resource for each compartment separately from the resource of the OS 41, and the resource can be used efficiently.

  FIG. 5 shows an example of the compartment designation information of the secure level L2.

  In the compartment designation information of the secure level L2 of FIG. 5, “/ tmp read” is added to the mandatory access control of the compartment designation information of the secure level L1 shown in FIG. That is, in the compartment designation information at the secure level L2, a condition is added to the compartment designation information at the secure level L1 that the operation on the / tmp directory is limited to reading only.

  In secure level L1, there is no description about / tmp in the mandatory access control of the compartment designation information, so reading / writing, etc. can be performed on the / tmp directory. However, in secure level L2, the compartment designation information In Mandatory Access Control, / tmp is set to read, so operations on the / tmp directory are limited to reading only.

  That is, the operation (access) to the / tmp directory is not restricted at the secure level L1, but the operation is restricted at the secure level L2. That is, the secure level L2 compartment is wider than the secure level L1 compartment and includes the secure level L1 compartment.

  4 and 5, the compartment designation information of the secure level L0 and the secure level L1 has been described, but the compartment designation information of the secure level L2 to the secure level L4 is configured similarly.

  FIG. 6 shows the compartment relationship between the secure level L0 and the secure level L4.

  In the figure, each square represents each compartment.

  As shown in FIG. 6, the compartment of the secure level L1 includes the compartment of the secure level L0. Similarly, the secure level L2 compartment includes the secure level L1 compartment, the secure level L3 compartment includes the secure level L2 compartment, and the secure level L4 compartment includes the secure level L3 compartment. That is, the larger the i of the secure level Li (i = 1,..., 5), the higher the compartment, which is the execution environment restricted by the secure level Li, and the higher the security.

  FIG. 7 shows an example of compartment designation information of the trusted application 42-1.

  In FIG. 7, the compartment designation information of the trusted application 42-1 will be described, but the compartment designation information of the trusted application 42-2 is configured in the same manner.

  As shown in FIG. 7, the compartment designation information of the trusted application 42-1 includes a required secure level for the OS 41.

  The requested secure level is the minimum secure level required for the OS 41. That is, the trusted application 42-1 requests the OS 41 for a secure level that is equal to or higher than the requested secure level. Accordingly, the compartment of the trusted application 42-1 includes a compartment at the required secure level.

  In the example of FIG. 7, since the requested secure level is the secure level L1, the trusted application 42 requests the OS 41 for a secure level equal to or higher than the secure level L1.

  If there is a required security in addition to the required secure level security, the process capability, mandatory access control, or trusted path related to the security is included in the compartment designation information of the trusted application 42-1 as necessary. Described.

  In FIG. 7, CAP_SYS_PTRACE is set to OFF and CAP_SYS_PROTMEM is set to ON in the process capability of the compartment designation information of the trusted application 42-1. That is, the trace capability (CAP_SYS_PTRACE) is disabled (OFF), and the trace of the trusted application 42-1 is prohibited. Further, the memory space on the RAM 13 used during operation of the trusted application 42-1 (CAP_SYS_PROTMEM) is protected. That is, access to the memory space used by the trusted application 42-1 is restricted so that it is not performed by an application program other than the trusted application 42-1.

  In Mandatory Access Control, Any is set to no_ptrace. That is, the access trace of the trusted application 42-1 for an arbitrary resource (Any) is not permitted (no_ptrace).

  In the trusted path, / user / local / trusted_apli_B is set as signature and encrypt, and / user / local / libA is set as signature. That is, for example, the trusted application B (trusted_apli_B), which is another trusted application 42-2, determines whether the electronic signature (signature) is valid in order to establish a trusted path with the trusted application 42-1. Is specified. Further, when communication is performed between the trusted application 42-1 and the trusted application 42-2, communication is performed so that the contents of communication between the trusted application 42-1 and the trusted application 42-2 are not falsified and leaked. Is specified to protect / encrypt the contents of.

  Further, for example, the library A (libA), which is the library 45, is designated to determine whether the electronic signature (signature) is valid in order to establish a trusted path with the trusted application 42.

  In the following, only the resource is considered as the target of restriction by the compartment.

  FIG. 8 shows an example of a compartment when the trusted application 42 is executed.

  In the figure, each square represents a compartment of each secure level. The relation between the compartments of the secure level L0 to the secure level L4 is the same as that in FIG.

  The trusted application 42 has a unique ID PID (Process ID) added thereto. The hatched portions to which PID 100 to PID 102 shown in FIG. 6 are added represent the compartments of the trusted application 42 to which PID is added.

  In FIG. 8, three trusted applications 42 of PID100 to PID102 are operating. The trusted application 42 of the PID 100 has the required secure level of the secure level L1, and the compartment of the secure level L1 includes the compartment of the trusted application 42 of the PID 100. Similarly, the trusted application 42 of PID100 and PID102 has a secure level L2 as the required secure level, and the compartment of the secure level L2 includes the compartments of the trusted application 42 of PID100 and PID102.

  When the trusted application 42 of PID100 to PID102 is operating, the secure level module 71 sets the secure level L2 that is the highest secure level among the required secure levels of the trusted application 42 of PID100 to PID102 to the secure level of the OS 41 To do. The OS 41 sets a resource space other than the resource space protected by the secure level L2, which is the secure level of the OS 41, as a free space. The resource space which is the free space can be used by any application including the untrusted application 44.

  Note that compartment designation information is not set for the untrusted application 44, and no special protection service is provided. Thereby, resources can be saved.

  FIG. 9 shows an example of compartments when the operation of the trusted application 42 of PID 100 and PID 102 of FIG. 8 is stopped (execution is completed).

  As shown in FIG. 9, for example, when the operation of the trusted application 42 of PID 100 and PID 102 in FIG. 8 stops, the secure level module 71 changes the secure level of the OS 41 to the secure level L1 that is the requested secure level of the operating PID 101 The resource space other than the resource space protected by the secure level L1 is set as a free space. Since the resource space protected by the secure level L2 is added to the free space, compared to the case where the trusted application 42 of PID100 to PID102 shown in FIG. 8 is operating, any application program including the untrusted application 44 can be used. More resources.

  Note that when the secure level of the OS 41 is changed, resource sanitizing is performed in order to protect the security of the OS 41. Resource sanitizing means, for example, initialization of a memory space used by an application secured in the RAM 13 or a cache secured in the storage unit 18.

  10 and 11 are conceptual diagrams of the secure level table stored in the RAM 13.

  In the secure level tables of FIGS. 10 and 11, the PID column of the trusted application 42 that is being executed and will be executed in the future is listed in the heading of the required secure level of the trusted application 42 as a chain structure (list structure). Connected to. That is, in the secure level table, the requested secure level is associated with the PID of the trusted application 42 that is being executed and will be executed in the future.

  FIG. 10 shows an initial state of the secure level table.

  The PID field is not connected to the secure level L0 to secure level L4 (heading), and the secure level L0 to secure level L4 has an empty PID field for the secure level L0 to secure level L4. Connected to NULL to represent

  In FIG. 11, the trusted application 42 of PID100 whose secure request level is secure level L2, the trusted application 42 of PID101 whose secure request level is secure level L1, and the trusted application 42 of PID102 whose secure request level is secure level L1 are executed in order. The secure level table in the case of

  First, when the trusted application 42 of the PID 100 whose requested secure level is the secure level L2 is executed, the PID column of the PID 100 representing the trusted application 42 of the PID 100 is connected to the secure level L2 in the secure level table. , NULL is connected to the PID column.

  Next, when the trusted application 42 of the PID 102 whose requested secure level is the secure level L2 is executed, the secure level table is connected to the PID column of the trusted application 42 of the already operating PID 100, that is, the secure level L2. Before the PID column of the PID 100 that has been set, the PID 102 column representing the newly executed trusted application 42 of the PID 102 is inserted. Therefore, as shown in FIG. 11, in the secure level table, the PID column of PID 102, the PID column of PID 100, and NULL are connected in order to the secure level L2.

  Finally, when the trusted application 42 of the PID 101 whose requested secure level is the secure level L1 is executed, in the secure level table, the PID column of the PID 101 representing the trusted application 42 of the PID 101 is connected to the secure level L1. NULL is connected to the PID column.

  Since the trusted application 42 having the secure level L0, the secure level L3, and the secure level L4 as the requested secure level is not operating, the PID column is not connected to the secure level L0, the secure level L3, and the secure level L4. . That is, the secure level L0, the secure level L3, and the secure level L4 (headings thereof) are connected to NULL indicating that the PID column is empty.

  In the secure level table, one of the secure level L0 and the secure level L4 is set as a default level, and a mark (flag) indicating a default level (not shown) is added to the heading of the secure level that is the default level. Has been. This default level can be set by the user, for example. When no trusted application 42 is operating, the secure level module 71 sets, for example, the secure level of the OS 41 to the default level.

  FIG. 12 is a flowchart for explaining a first secure level setting process in which the secure level module 71 of FIG. 2 sets the secure level of the OS 41. This secure level setting process is started, for example, when an application program including the trusted application 42 and the untrusted application 44 is executed, or when a security level setting request is received from the application program.

  In step S11, the secure level module 71 determines whether or not the electronic signature of the application program to be executed is valid, and if it is determined to be valid, that is, the application program to be executed is the trusted application 42. If there is, the process proceeds to step S12.

  In step S12, the secure level module 71 recognizes the required secure level of the trusted application 42 to be executed, and proceeds to step S13.

  In step S13, the secure level module 71 determines whether or not the PID column connected to the requested secure level of the trusted application 42 to be executed in the secure level table (FIG. 11) is empty.

  For example, when the secure level table as shown in FIG. 11 is stored in the secure level module 71, NULL indicating that the PID column is empty for the secure level L0, the secure level L3, and the secure level L4. Therefore, the secure level module 71 connects to the required secure level of the trusted application 42 when the required secure level of the trusted application 42 is any one of the secure level L0, the secure level L3, and the secure level L4. It is determined that the assigned PID column is empty.

  If it is determined in step S13 that the PID column connected to the requested secure level of the trusted application 42 to be executed in the secure level table is empty, the process proceeds to step S14, and the requested secure level is set. On the other hand, the PID column of the PID of the trusted application 42 to be executed is connected (added), and the process proceeds to step S16.

  For example, when the requested secure level of the trusted application 42 to be executed is the secure level L1 and the PID of the trusted application 42 is 101, the secure level module 71, as shown in FIG. A PID column of PID 101 is connected to level L1, and NULL is connected to the PID 101 column.

  If it is determined in step S13 that the PID column connected to the requested secure level of the trusted application 42 to be executed in the secure level table is not empty, the secure level module 71 proceeds to step S15. The PID field of the PID of the trusted application 42 to be executed is the PID field connected to the required secure level of the trusted application 42 (the first PID of the PID field existing for the required secure level). And proceed to step S16.

  For example, when the requested secure level of the trusted application 42 to be executed is the secure level L2, and the PID column of the PID 100 is connected to the secure level L2, that is, the PID whose requested secure level is the secure level L2. When the trusted application 42 is running, the secure level module 71 inserts the PID field of the PID 102 before the PID field of the PID 100 connected to the secure level L2, as shown in FIG. To do.

  In step S16, the secure level module 71 scans the secure level table from the top to the bottom, and determines the secure level to which the first non-empty PID column detected is connected as a candidate secure for the OS 41. Set to level and proceed to step S16. That is, the secure level module 71 sets the highest secure level among the requested secure levels of the trusted application 42 to be executed during execution to which the PID in the PID column is added as the candidate secure level of the OS 41. .

  In step S16, the secure level module 71 also detects the secure level marked as the default level, and if the secure level to which the first non-empty PID field detected is lower than the default level, the candidate The secure level can also be set to the default level.

  For example, when a secure level table as shown in FIG. 11 is stored in the secure level module 71, the secure level module 71 scans the secure level table in the direction from the secure level L4 to the secure level L0. The secure level L2, which is the secure level to which the detected non-empty PID column is connected, is set as the candidate secure level of the OS 41.

  In step S17, the secure level module 71 sets the secure level of the OS 41 to the candidate secure level set in step S16, and ends the process.

  For example, when the candidate secure level is the secure level L2, as shown in FIG. 8, the kernel 51 includes a free space that is a resource space other than the resource space protected by the secure level L2, including the untrusted application 44. To be used by any application program. Accordingly, the security required by the trusted application 42 can be ensured, and the untrusted application 44 can use the free space.

  According to the processing from step S12 to step S17, the secure level of the OS 41 dynamically changes corresponding to the trusted application 42 to be executed. Since the free space changes according to the secure level of the OS 41, the resource space, which is the free space, is used by an arbitrary application program including the untrusted application 42, so that it depends on the trusted application 42 to be executed. The usable resource space of the untrusted application 42 can be changed.

  On the other hand, when it is determined in step S11 that the electronic signature of the application program is not valid, that is, the untrusted application 44 that does not have an electronic signature or has an electronic signature, the electronic signature is not valid. If YES, the process proceeds to step S18, and the secure level module 71 does not set the secure level of the OS 41 and ends the process. In this case, the application program can use only the resource space which is free space.

  FIG. 13 is a flowchart for explaining a second secure level setting process in which the secure level module 71 sets the secure level of the OS 41. This secure level setting process is started when the execution of the trusted application 42 is completed.

  In step S31, the secure level module 71 deletes the PID column of the PID of the trusted application 42 that has been executed from the secure level table, and proceeds to step S32.

  In step S32, the secure level module 71 scans the secure level table from the top to the bottom, and changes the secure level to which the non-empty PID column detected first is connected to the secure level of the OS 41. Set. That is, the secure level module 71 changes the secure level of the OS 41 to the highest secure level among the secure levels required by the trusted application 42 being executed.

  The secure level module 71 is marked as a default level when no trusted application 42 is running, that is, when no PID column is connected to the secure level L0 to the secure level L4. The secure level being set is set as a candidate secure level of the OS 41.

  After the process of step S32, the process proceeds to step S33, and the secure level module 71 sets the secure level of the OS 41 to the candidate secure level set in step S32 as in step S17 of FIG. 12, and ends the process.

  FIG. 14 is a flowchart for explaining a resource restriction process in which the kernel 51 of FIG. 2 restricts the use of resources to the untrusted application 44. This resource restriction process is started, for example, when the untrusted application 44 requests use of a resource.

  In step S51, the kernel 51 recognizes the secure level of the OS 41 set in step S17 of FIG. 12 or step S33 of FIG. 13, and proceeds to step S52.

  In step S52, the kernel 51 restricts (denies) the use of the resource of the untrusted application 44 according to the secure level of the OS 41, and ends the process.

  For example, when the secure level of the OS 41 is the secure level L2, as shown in FIG. 8, the kernel 51 can use the untrusted application 44 by setting a resource space other than the resource space protected by the secure level L2 as a free space. Limit the resource space to free space only.

  In the above description, the secure level has five levels of secure levels L0 to L4, but any number of levels may be used.

  Note that the processing described above can also be executed by dedicated hardware.

  Here, in this specification, the processing steps for describing a program for causing a computer to perform various types of processing do not necessarily have to be processed in time series according to the order described in the flowchart, but in parallel or individually. This includes processing to be executed (for example, parallel processing or processing by an object).

  Further, the program may be processed by a single computer, or may be processed in a distributed manner by a plurality of computers. Furthermore, the program may be transferred to a remote computer and executed.

  The present invention can be applied to a general-purpose computer (workstation), a mobile phone, an OS executed on other electronic devices, and the like.

It is a block diagram which shows the structural example of one Embodiment of the computer to which this invention is applied. It is a figure explaining the program run on the computer of FIG. It is a figure which shows the example of the basic format of a trusted application. It is a figure which shows the example of the compartment designation | designated information of the secure level L1. It is a figure which shows the example of the compartment specification information of the secure level L2. It is a figure showing the relationship of the compartment of the secure level L0 thru | or the secure level L4. It is a figure which shows the example of the compartment specification information of a trusted application. It is a figure showing the example of the compartment in case the trusted application is performed. It is a figure which shows the example of the compartment when execution of the trusted application of PID100 and PID102 of FIG. 8 is complete | finished. It is a conceptual diagram of the secure level table which RAM of FIG. 1 memorize | stores. It is a conceptual diagram of the secure level table which RAM of FIG. 1 memorize | stores. 3 is a flowchart illustrating a first secure level setting process in which the secure level module of FIG. 2 sets the OS secure level. 6 is a flowchart for explaining a second secure level setting process in which the secure level module of FIG. 2 sets the secure level of the OS. FIG. 3 is a flowchart for explaining resource restriction processing in which the kernel of FIG.

Explanation of symbols

11 CPU, 12 ROM, 13 RAM, 14 bus, 15 input / output interface, 16 input unit, 17 output unit, 18 storage unit, 19 communication unit, 20 drive, 21 removable recording medium, 41 OS, 42 trusted application program, 44 Untrusted application program, 45 library, 51 kernel, 71 secure level module

Claims (8)

In an information processing apparatus that controls an execution environment of an application program,
Determining means for determining whether the application program is a trusted application program with a valid electronic signature;
Recognizing means for recognizing a secure level required by the trusted application program when the determining means determines that the application program is the trusted application program;
An information processing system comprising: setting means for setting the highest secure level among the secure levels required by the trusted application program to be executed and to be executed in the future to the secure level of the information processing apparatus. apparatus. According to a secure level of the information processing apparatus set by the setting means, further comprising resource restriction means for restricting use of resources of an untrusted application program that is an application program other than the trusted application program. The information processing apparatus according to claim 1. When the execution of the trusted application program ends, the secure level of the information processing apparatus set by the setting unit is changed to the highest secure level among the secure levels requested by the trusted application program being executed. The information processing apparatus according to claim 1, further comprising a changing unit. The information processing apparatus according to claim 1, wherein the trusted application program has at least a valid digital signature and a secure level required by the trusted application. Storage means for storing a secure level table that associates the trusted application program that is being executed and is about to be executed with the secure level requested by the trusted application program,
The information processing apparatus according to claim 1, wherein the setting unit sets a secure level of the information processing apparatus based on a secure level table stored by the storage unit. In an information processing method of an information processing apparatus that restricts an execution environment of an application program,
Determining whether the application program is a trusted application program with a valid electronic signature;
A recognition step for recognizing a secure level requested by the trusted application program when the application program is determined to be the trusted application program by the process of the determining step;
A setting step for setting the highest secure level among the secure levels required by the trusted application program to be executed in the future and the secure level of the information processing apparatus. Method. In a program that causes a computer to perform processing that restricts the execution environment of an application program,
Determining whether the application program is a trusted application program with a valid electronic signature;
A recognition step for recognizing a secure level requested by the trusted application program when the application program is determined to be the trusted application program by the process of the determining step;
A setting step of setting the highest secure level among the secure levels required by the trusted application program to be executed in the future and the secure level of the computer. In a recording medium on which a program for causing a computer to perform processing for controlling an execution environment of an application program is recorded,
A determination step of determining whether the application program is a trusted application program with an electronic signature;
A recognition step for recognizing a secure level requested by the trusted application program when the application program is determined to be the trusted application program by the process of the determining step;
And a setting step for setting the highest secure level among the secure levels required by the trusted application program to be executed in the future as the secure level of the computer. Recording medium.

Images