JP2005275669A - Data monitoring method, information processor, program, recording medium, and information processing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent information leakage when using data or a file of confidential information or the like that is not allowed to be taken outside via a network. <P>SOLUTION: A user computer 100 has a protocol analyzing part 116 analyzing a protocol of transmission/reception data, a communication monitoring part 115 referring to an analysis result and status information to monitor the transmission/reception data, and a file monitoring part 114 monitoring a file accessed by a command of an application program AP120. The status information comprises a process ID of the AP120 issuing a communication or access command to data subjected to monitoring, and a transmission source address of the monitoring object data. The communication monitoring part 115 prohibits transmission of data with registered status information to others than a transmission source. The file monitoring part 114 cancels a file writing command of the data with registered status information to an external storage. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a data monitoring method for monitoring monitoring target data in order to prevent leakage of the monitoring target data from an information processing apparatus capable of receiving and using the monitoring target data held by the monitoring target server, The present invention relates to an information processing apparatus having a data monitoring processing function, a program and a recording medium for executing data monitoring processing, and an information processing system including an information processing apparatus and a monitoring target server.

  If electronic confidential information in an organization such as a company leaks out of the organization due to negligence or intention, it causes a great loss to the company. Various technologies for preventing such leakage of confidential information have been developed. For example, it is possible to prevent the intentional removal of information by a person who has access authority to a confidential file, and to create a confidential file or a non-confidential file. An example of a method that does not hinder editing work is described in Patent Document 1. In the confidential file export prohibiting method described in Patent Document 1, a system administrator sets a confidential file folder for storing a specific confidential file in an auxiliary storage device in a computer, and distinguishes it from other folders. Save confidential files that users use in their work in the confidential file folder. When any of a plurality of application programs of the user PC makes a request to open a file, the access to the file in the confidential folder is monitored by the I / O monitoring program and the filter program. In other words, it is determined whether or not the requested file is a confidential file, and if it is a confidential file, it is output to a folder other than the confidential file folder and the confidential information file is copied to another general folder. Is prohibited.

  Patent Document 2 describes an information providing system and method for preventing confidential information stored in a database on a Web server from being leaked to a third party by a user browsing the Web server. The technology described in Patent Document 2 has a proxy server that controls access to a Web server, and a dedicated viewer that cannot perform operations such as saving information obtained by communicating with the proxy server in a general folder. Leakage of confidential information is prevented between client terminals.

Patent Document 3 describes a content management system in which copyright management is performed without special modification of encryption on the content itself. In the technology described in Patent Document 3, the content server has transfer enable / disable attribute information indicating whether or not a client terminal that has downloaded the content together with the content permits the transfer of the content to the outside. Acquires the transfer permission / inhibition attribute information when the content is downloaded. The file system of the client terminal checks the transfer propriety attribute information when there is a content transfer request, and stops the transfer of the content if it is not possible.
JP 2002-288030 A JP 2002-41347 A JP 2003-345661 A

  However, in the technology described in Patent Document 1, it is assumed that confidential information is placed in a file format, and information other than files such as information stored in the form of a database on a server is transmitted via a network. Therefore, there is a problem that the act of transferring is not considered. In addition, it is necessary to prepare a filter program for each application, and it is easy to take data outside by intentionally copying information to an external medium using an application program that does not have a filter program. There is.

  In addition, the technique described in Patent Document 2 has a problem in that an application that can be used on the client side is limited to the dedicated viewer and a proxy server needs to be newly introduced on the server side.

  Furthermore, in the technique described in Patent Document 3, the storage routine and the reading routine in the file system are configured to operate only under specific download means, reproduction means, and external transfer means, and the normal file I It is necessary to use an interface different from that of / O, and it is only possible to cope with an operation by an application in accordance with this file I / O. In addition, when checking whether or not transfer is possible based only on whether or not transfer is permitted in this way, transfer is not prohibited at all for a predetermined content, but transfer is restricted depending on the transfer destination. There is a problem that can not be.

  In summary, the above-described conventional techniques have the following problems. That is, as a first problem, in order to adapt to a business system in which customer information stored in a database is downloaded after searching using a Web browser, a major change is made to the conventional business system. The need is mentioned. The reason is that data is generated at the server every time it is used and does not exist in the folder as a file in advance, so it cannot be dealt with, for example, in Patent Document 1, and in order to apply Patent Document 2 and Patent Document 3, the existing This is because migration from client software to a dedicated viewer is required.

  The second problem is that it is difficult to deal with a general application that performs file transfer by a method that does not depend on the file system, such as mail or FTP (File Transfer Protocol). The reason is that in Patent Document 1, it is necessary to prepare for each application program a filter program for analyzing event processing that is different for each application program. In Patent Document 2, client software is limited to a dedicated viewer. Even in Patent Document 3, a dedicated file I / O is required, so that a general application cannot be used.

  The present invention has been proposed in view of such a conventional situation, and prevents information leakage when using data such as confidential information or files prohibited from being taken out via the network. An object of the present invention is to provide a data monitoring method, an information processing apparatus, a program and a recording medium, and an information processing system.

  The data monitoring method according to the present invention is a data monitoring method capable of transmitting / receiving data via a network to / from a monitoring target server that holds data to be monitored. When a transmission or reception command is issued from an arbitrary application program A communication monitoring step of monitoring communication of the transmitted / received data with reference to status information storage means in which status information relating to the data to be monitored is registered, and when a write or read command is issued from any application program A file monitoring step of monitoring access to a file having write or read data with reference to the status information storage means, and in the communication monitoring step, when a data transmission command is issued, the data transmission command Identification of the application program that issued Information is registered as the status information, and if it is registered, the data transmission command is limited. In the file monitoring process, if a data write command is issued, the data write command Whether or not program identification information indicating an application program that has issued a command is registered as the status information is confirmed. If registered, the data write command is limited.

  In the present invention, by registering status information about data to be monitored, data is transmitted / received via a network, and data is written to an external storage device or the like or data from its own storage means. When reading data, refer to the status information, and if the data to be transmitted / received or the data to be written / read is the data to be monitored, restrict its transmission or write. Can do.

  Further, it has a protocol analysis step of analyzing a protocol of transmission / reception data received from outside or transmitted to the outside by an instruction of an arbitrary application program, and in the communication monitoring step, the analysis result analyzed in the protocol analysis step and The communication of the transmission / reception data can be monitored with reference to the status information, and data transmission / reception can be performed using a desired protocol instead of a fixed protocol.

  Furthermore, in the communication monitoring step, when a data reception command whose transmission source is the monitoring target server is issued, server identification information for identifying the monitoring target server together with program identification information of the application program that issued the data reception command Can be registered as the status information, and the status information can be registered when data from the monitoring target server is received.

  Furthermore, in the communication monitoring step, the program identification information of the application program that issued the data transmission command is registered as the status information, and the data transmission command corresponds to the program identification information. In the case of a command for transmitting data to a server other than the monitoring target server indicated by the server identification information, the data transmission command can be invalidated and data transfer can be restricted.

  In the file monitoring step, when a data write command is issued to the external storage device, and the program identification information of the application program that has issued the data write command is registered as the status information In this case, the data write command can be invalidated, and writing of data to be monitored to the external storage device can be prohibited.

  In the file monitoring step, the data identification command of the application program that issued the data write command is the status information when a data write command is issued to the data storage means of the information processing apparatus. If the file is registered, the additional information having the server identification information corresponding to the program identification information can be written together with the data. Thus, when this file is accessed thereafter, the additional information is monitored. It can be recognized that it is target data.

  Further, in the file monitoring step, when a data read command for data having the additional information is issued, program identification information indicating the application program that issued the data read command is registered as the status information together with the additional information, The data can be read, and thereby identification information for identifying the application program that has accessed the file can be registered as status information.

  The information processing apparatus according to the present invention is a status in which status information relating to data to be monitored is registered in an information processing apparatus capable of transmitting and receiving data to and from a monitoring target server that holds data to be monitored. Upon receiving a transmission or reception command from an information storage means and an arbitrary application program, a communication monitoring means for monitoring communication of transmitted / received data with reference to the status information storage means, and writing or reading from an arbitrary application program A file monitoring step of monitoring access to the file with reference to the status information storage means when receiving the command, and the communication monitoring means issued the data transmission command when the data transmission command is issued Program identification information indicating an application program is stored in the station. Whether or not it is registered as a file information, and restricts the data transmission command if registered, and the file monitoring unit issues the file write command when a data write command is issued. It is characterized by checking whether or not the program identification information indicating the application program is registered as the status information, and restricting the data writing command if it is registered.

  A program according to the present invention causes a computer to execute the above-described data monitoring process, and a recording medium according to the present invention is a computer-readable medium on which such a program is recorded.

  An information processing system according to the present invention includes a monitoring target server that holds data to be monitored, and the information processing apparatus that can transmit and receive data to and from the monitoring target server via a network. .

  According to the present invention, it is possible to prevent leakage from an information processing apparatus that uses data such as confidential information or information such as files that are prohibited from being taken out to the outside via a network.

  Hereinafter, specific embodiments to which the present invention is applied will be described in detail with reference to the drawings. In this embodiment, according to the present invention, the server information of the download source is added to the file downloaded from the server and written, and this additional information is confirmed when accessing the subsequent file, and the confidential information etc. The present invention is applied to an information processing apparatus and a data monitoring method that prevent a file copy to an external medium or a file transfer action via a network that leads to data leakage (illegal data takeout).

  FIG. 1 is a block diagram showing a computer system that executes a data monitoring method and a program therefor in the present embodiment. As shown in FIG. 1, a computer system 1 according to the present embodiment has a user computer 100 such as a personal computer PC that operates by program control, a network 200, and confidential information to be protected that is data to be monitored. Server computer 300. The user computer 100 includes an operating system 110, an arbitrary application program 120, a magnetic disk device 130 such as a hard disk, other input devices (not shown) such as a mouse and a keyboard, a display device such as a monitor (not shown), a CPU. (Not shown) are connected via a bus. The user computer 100 is also connected to an external storage device 140 from which a recording medium such as a magnetic disk such as a flexible disk and an optical disk such as a CD-R can be removed.

  The operating system 110 includes a disk driver 111, a network driver 112, and a filter driver 113. These configurations and operations are known to those skilled in the art. For example, the filter driver 113 has a mounting method described in Japanese Patent Laid-Open No. 2003-304269.

  The filter driver 113 is a program that is additionally inserted in order to change the operation of a part of the hierarchized driver group, and is a main body that performs filtering. In order to monitor target data or files, it has the following functions. In other words, the filter driver 113 according to the present embodiment includes a status information storage unit 117 that stores status information about data or files to be monitored, and transmission / reception that is received from the outside or transmitted to the outside in accordance with an instruction from an arbitrary application program 120. A protocol analysis unit 116 that analyzes a protocol of data, a communication monitoring unit 115 that monitors communication of transmission / reception data with reference to an analysis result of the protocol analysis unit 116 and status information of the status information storage unit 117, and an arbitrary application program 120 And a file monitoring unit 114 that monitors files written or read in response to the above command.

  The status information storage unit 117 stores the status information shown in FIG. As shown in FIG. 2, the status information includes, for example, a process ID and additional information including a reception source server and a file name.

  The process ID recorded in the process ID column indicates the process ID of the application program 120 instructed to access the data or file to be monitored. For example, when data to be monitored is received, this data reception command The process ID of the application program 120 that issued is registered. At this time, the protocol analysis unit 116 uses the server identification information as the reception source (download destination) of the data to be monitored, ie, the address of the server 300 to be monitored, and adds additional information to the reception server column corresponding to the process ID. Register as When the received monitoring target data is written back to the magnetic disk device 130, the file name having the monitoring target data is added as additional information in the file name column corresponding to the process ID registered when the data is received. register.

  The status information stored in the status storage unit 117 prepares a program for managing the status information, and deletes the record having the process ID of the application program 120 when each application program 120 is finished.

  By referring to the status information, the communication monitoring unit 115 and the file monitoring unit 114 recognize the communication data and file to be monitored, respectively, and the monitoring target file is written to the external storage device 140 or is stored in an external device. This prevents the monitoring target data or file from being transferred.

  The protocol analysis unit 116 analyzes the protocol of the communication packet passed from the communication monitoring unit 115 and returns the result to the communication monitoring unit 115. In the protocol analysis unit 116, the communication is performed using, for example, HTTP (Hypertext Transfer Protocol) which is a client / server protocol used when connecting to a server on the World Wide Web. For example, a command appearing in a packet, such as GET or POST of a method defined in HTTP, is analyzed to determine whether data is to be transmitted to the server computer 300 or received. Further, it is determined to which server the data is to be transmitted from the transmission destination described in the URL. In the case of reception, it is determined from the URL whether data from the server is to be received. These analysis results are passed to the communication monitoring unit 115.

  The communication monitoring unit 115 monitors all external communications performed by the arbitrary application program 120 via the network 200, and updates information in the status storage unit 117 as necessary. Further, the contents of the status storage unit 117 are referred to, and communication with the outside performed via the network 200 is permitted or denied.

  Specifically, when receiving data, the communication monitoring unit 115 receives the analysis result from the protocol analysis unit 116, recognizes from which server the received data is data, and the receiving server monitors the data. In the case of the target server 300, it is determined that the received data is monitoring target data, and the address of the server 300 is registered in the status storage unit 117 together with the process ID of the application program that issued the reception command. Thus, when the monitoring target data is handled thereafter, the status information is referred to thereby recognizing which application 120 has received the monitoring target data and which monitoring target server 300 has received. Can do. Note that not all data from the monitoring target server 300 is set as monitoring target data, but additional information such as a flag is attached to the monitoring target data so that only specific data from the monitoring target server is recognized as monitoring target data. The protocol analysis unit 116 or the communication monitoring unit 115 may recognize this.

  In this way, when receiving the monitoring target data from the monitoring target server 300, the communication monitoring unit 115 registers the process ID and the address of the reception source server as status information, receives the reception data from the network driver 112, and sets the operating system 110. Through the application program 120.

  Further, even in the case of transmitting data, first, by receiving the analysis result of the data to be transmitted by the protocol analysis unit 116 and referring to the status information in the status storage unit 117, whether the transmission data is the monitoring target data, That is, it is recognized whether or not the process ID of the application program 120 that issued the transmission command for the transmission data is registered in the status information. If it is monitoring target data, the source address is obtained from the status information, and it is confirmed whether or not it matches the transmission destination address obtained from the protocol analysis result. If the transmission is to a server other than the original monitoring target server, it is determined that the monitoring target data has been taken out, and processing for invalidating the transmission command is performed.

  In this way, the communication monitoring unit 115 manages all transmission / reception data, recognizes which application program 120 has received confidential information from the server computer 300 to be monitored, and the monitoring target data is other than the transmission source of the monitoring target data. Transmission / reception data can be managed so that data other than the monitoring target data can be transmitted / received as usual.

  The file monitoring unit 114 monitors all data that an arbitrary application program 120 accesses to the magnetic disk device 130 and the external storage device 140 that can write data to a removable recording medium, and the status storage unit 117 as necessary. Update the information. Further, referring to the status information in the status storage unit 117, writing to the magnetic disk device 130 and the external storage device 140 is permitted or rejected.

  Specifically, when there is a file write command, the file monitoring unit 114 refers to the status information in the status storage unit 117, and the process ID of the application program 120 that issued the file write command indicates the status. It is confirmed whether the writing file is a monitoring target file based on whether it is registered as information. Here, if the process ID and its source address are registered and the file name is not registered, it is registered. If the write destination is the external storage device 140, the write command is invalidated because there is a possibility that the monitored file may be taken out to the outside, and the write command to the magnetic disk device 130 such as a hard disk is used. In some cases, the transmission source address and file name registered in the status information are attached to the write file as additional information, and writing is executed together with the file.

  In addition, when there is a file read command, the file monitoring unit 114 checks whether or not additional information is attached to the file. The server address and file name are registered in the status storage unit 117 together with the process ID of the application program 120 that issued the read command. Then, the data excluding the additional information is read as usual and a process of passing to the application program 120 is performed. Further, it can be determined that data without additional information is not a monitoring target file, and a read process is executed as usual.

  In this way, the file monitoring unit 114 monitors all the write or read files, and recognizes whether or not the file is a monitoring target from the status information and the additional information. Appropriate processing can be executed so as not to be taken out.

  As described above, when the management target data is received, it is registered as status information together with the server information of the download source, and when the management target data is recorded, the file is a monitoring target data file. By adding the additional information to be written, the file or data to be managed can be written to the external storage device 140 and communication with the outside via the network 200 can be blocked.

  Next, the operation of the computer system 1 will be described. As described above, the communication monitoring unit 115 in the filter driver 113 constantly monitors data that the application program 120 intends to download from the server computer 300. Further, when the application program 120 writes the monitoring target data to the file, additional information indicating whether the file is data downloaded from the server computer 300 so that the file can be recognized as the monitoring target file. Write. Then, if there is an application program 120 that has accessed the monitoring target file with this additional information, the file monitoring unit 114 and the communication determine whether this application program 120 performs file transfer via the network 200 or writing to another file. Monitoring is performed by the monitoring unit 115. When the application program 120 tries to transfer a file, it checks whether or not the connection destination is the server computer 300 of the download source. Return to program 120. In addition, when writing a file, if the writing destination is an unauthorized device such as the external storage device 140, an error is returned to the application program 120 without writing, so that confidential information, etc. Data can be prevented from being taken out. Note that file writing is not limited to the external storage device 140 but a dedicated area writable by the user computer 100 is provided, and writing to other areas or areas easily accessible from external devices is also prohibited. You may make it do.

  Next, the operation of the computer system shown in FIG. 1 will be described in more detail. In the system 1 of FIG. 1, confidential information to be protected is stored in the server computer 300, and this confidential information is downloaded from the server computer 300 when working from the application program 120 on the user computer 100. The system is intended to prevent data from being leaked to the outside of the user computer 100 intentionally or accidentally. As the leaked route, for example, writing of download data to the external storage device 140, transfer of a file by e-mail outside the company or outside the network 200, and the like are assumed. It is assumed that the server computer 300 is a server to be monitored having confidential information, and is set in advance by an administrator or the like for the communication monitoring unit 115.

  First, a method for monitoring transmission / reception data via the network 200 will be described. FIG. 3 is a flowchart showing a data monitoring method via the network 200 among the data monitoring methods of the computer system 1 shown in FIG. As shown in FIG. 3, first, after the user computer 100 is started, the communication monitoring unit 115 waits until an external data transmission / reception request instructed from the arbitrary application program 120 via the operating system 110 is sent. (Step S1). When a communication request is received, the data taken in via the network driver 112 or the data requested to be transmitted to the outside via the network driver 112 is passed to the protocol analysis unit 116 to analyze the communication protocol ( Step S2).

  As described above, if the protocol is HTTP, the protocol analysis unit 116 analyzes a command appearing in the packet, such as a method GET or POST defined in HTTP, and transmits data to the server computer 300. Or which server is receiving or transmitting from the transmission / reception destination described in the URL, and outputs to the communication monitoring unit 115 as an analysis result. Based on the result of the protocol analysis unit 116, the communication monitoring unit 115 distributes processing.

  If the analysis result in step S2 is the start of data reception, the process proceeds to step S5, and it is determined whether the download source of the received data is the server computer 300 to be monitored (step S5). Here, in the case of the server computer 300 to be monitored, the status information in the status storage unit 117 is updated (step S6). That is, the process ID of the application program 120 that issued the reception command and the address information of the server computer 300 received as the analysis result are registered as status information.

  In step S6, after writing the process ID and the reception source server in the status information, the communication monitoring unit 115 pulls up the received data from the network driver 112 and passes the data to the application program 120 via the operating system 110. (Step S7). If it is determined in step S5 that it is not the monitoring target server computer 300, the process proceeds to step S7, and the data is received as it is.

  Further, in step S3, it is determined whether the data determined not to start data reception is the start of data transmission in step S4. If the communication request is a data transmission command, it is checked whether or not the process ID of the application program 120 that issued the command is registered as status information in the status storage unit 117 (step S8). When registered in the status storage unit 117 (step S8: Yes), it indicates that the transmission data is data to be monitored, and the current transmission destination is registered as status information of the corresponding record in the status storage unit 117. It is determined whether it is the same as the receiving server (step S10). If the transmission destination is the same as the reception source server registered in the status storage unit 117, the transmission source is the transmission source that originally downloaded the monitoring target transmission data to be transmitted. The process proceeds to step S9, and data is transmitted to the server computer 300.

  On the other hand, when it is determined in step S10 that the transmission destination address is different from the address of the monitoring target data (reception source server) that originally received the transmission data (step S10: No), the process proceeds to step S11. Since the act is an information leakage act, the fact that transmission is not possible is returned to the application program 120 as an error notification (step S11).

  If the process ID of the application program is not registered in the status information storage unit 117 (step SS8: No), it can be determined that the transmission data is not data to be monitored, and the process of step S9 is performed. Proceeding and transmitting data to server computer 300.

  In step S3, if the communication request received by the communication monitoring unit 115 is not data reception in step S3 and data transmission is not in step S4, the analysis result in step S2 is data. The command is irrelevant to the transmission / reception of the message, or when the current request alone cannot be determined. In such a case, the process returns to step S1 to wait for the next communication request. Note that the communication request for data transmission or reception may be determined in any order, or in parallel.

  Next, a monitoring method for file reading and writing processing will be described. FIG. 4 is a flowchart showing a monitoring method for file read and write processing. As shown in FIG. 4, after the user computer 100 is started, the file monitoring unit 114 waits for a file access request to the magnetic disk device 130 or the external storage device 140 that is instructed from the arbitrary application program 120 via the operating system 110. (Step S21). When there is an access request, processing is distributed according to the access type.

  That is, it is determined whether or not the type of the file access request is a write command (step S22). If it is a write command, the process proceeds to step S27, and the process ID of the application program 120 that issued the write command is determined. Is registered as status information in the status storage unit 117. If it is registered as status information (step S27: Yes), the process proceeds to step 28 to check whether or not the file storage destination is the external storage device 140. If the file writing destination is the external storage device 140 (step S28: Yes), it is determined that the writing action is an information leakage action, and an error indicating that the writing is impossible is returned to the application program 120. (Step 30).

  On the other hand, if the write destination is not the external storage device 140 but the magnetic disk device 130, the process proceeds to step S29. In this step S29, the address information in the receiving server column in the status information of the corresponding record in the status storage unit 117 is extracted and added as additional information to the head of the file that has received the write instruction (step S29). If the file name of the file to be written is not registered in the file name column of the status information of the record, add the file name of the file to be written to the record. Update the status information with.

  After adding the additional information to the monitoring target file in step 29, the process proceeds to step S31, and the file with the additional information is written. If the process ID of the application program that issued the write request in step S27 is not registered as status information, the write file is not a monitoring target file, so the process proceeds to step S31 and the write process is executed as usual. That's fine.

  In step S22, it is determined whether the access type determined not to be a write command is a read command in step S23. If it is determined in step S23 that the access type is a read command, it is confirmed whether additional information is written at the head of the read file (step S24). When the additional information is written, the file to be read is a monitoring target file. In this case, the process proceeds to step S25, in which the file name to be read and the address of the receiving server added as additional information, together with the process ID of the application program 120 that issued the read command, the status information in the status storage unit 117 (Step S25). Thereafter, the process proceeds to step S26, and the data excluding the additional information is read as usual and passed to the application program 120. If no additional information is added to the file (step S24: No), the file to be read is not the monitoring target file, and therefore the reading process may be executed as usual.

  If the access type is neither a write command (Step S22: No) nor a read command (Step S23: No), that is, if the access type is other than file read / write, the process returns to Step S21. Wait for the next access request. Note that the access type for reading or writing may be determined in any order or in parallel.

  Further, in step S29, the server information may be added to the encrypted file itself in addition to adding the server information to, for example, the head of the file. By doing so, it is possible to prevent malicious acts such as removing the additional portion and leaking the file.

  In the present embodiment, the information acquired from the server computer 300 is monitored by the communication monitoring unit 115 and the file monitoring unit 114, so that the monitoring target data downloaded from the monitoring target server computer 300 is the work of the monitoring target data. It is possible to prevent recording in the external storage device 140 or sending to other than the server computer 300 via the network 200 in the above process.

  That is, based on the analysis result obtained by analyzing the communication contents by the protocol analysis unit 115, the communication monitoring unit 115 manages all the information communicated and downloaded with the outside, and further stores the information with additional information. Since it is possible to block the writing of the attached file to the external storage device 140 and communication with the outside via the network 200, the server computer 300 does not depend on a dedicated server or proxy, and does not depend on the type of server. It is possible to prevent the above confidential information from being leaked to the outside from the user computer 100 intentionally or accidentally.

  Further, the file monitoring unit 114, the communication monitoring unit 115, and the protocol analysis unit 116 in the filter driver 113 can be realized only by knowledge of general protocols, and depend on the file access and network access implementation method of the application program 120. Since processing is not used, information leakage to any application program 120 can be prevented without depending on a dedicated client application and without depending on an application program.

  Further, since each application program 120 manages whether or not each application program 120 has read confidential information from the server computer 300 or the magnetic disk device 130 based on the status information in the status storage unit 117, it is not a file downloaded from the monitored server computer 300. Is not affected at all, and therefore, for other files, arbitrary communication, file copying to the external storage device 140, and the like are possible.

  It should be noted that the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the present invention. For example, in the first embodiment shown in FIG. 1, all data on the server computer 300 to be monitored is the monitoring target, but a specific folder, server group, or the like is designated as one monitoring target. be able to. Further, the number of monitoring targets is not necessarily one, and a plurality of servers, folders and the like can be targeted. This can be realized by adding a folder name, a domain name, or the like that can identify the monitoring target as a reception source to the status information or the additional information of the file. Further, when there are a plurality of monitoring targets, it is possible to prohibit the exchange of information across the monitoring targets.

  The monitoring target information on the server computer 300 may be encrypted in advance. In this case, the file monitoring unit 114 and the communication monitoring unit 115 have a common encryption library, and the encrypted information is combined at the time of reception and reading of a file with additional information, and encrypted at the time of transmission and writing. Can be realized. As a result, it is possible to prevent communication interception and leakage events such as connecting the magnetic disk device 130 to another device to steal information. Further, instead of encrypting the monitoring target information on the server computer 300 in advance, the server computer 300 may encrypt and transmit each time a download request is made. Even in this case, the same effects as described above can be obtained.

  In addition, when realizing part or all of the data monitoring process for preventing information leakage described above by causing a CPU (Central Processing Unit) to execute a computer program, the computer program is recorded on a recording medium. It can also be provided, and can also be provided by transmitting via the Internet or other transmission media.

  According to the present invention, there are provided a data monitoring method for preventing leakage of confidential information from a general computer using a file or a database via a network or preventing information from being taken out, a computer program for executing this data monitoring process, and this Can be provided, an information processing apparatus having a data monitoring function, and an information processing system including the information processing apparatus and a monitoring target server that holds monitoring target data.

It is a block diagram which shows the computer system which performs the data illegal taking-out prevention method in the embodiment of this invention, and the program for it. It is a figure which shows the status information memorize | stored in the status memory | storage part 117 of the computer system in embodiment of this invention. It is a flowchart which shows the data monitoring method via a network among the data monitoring methods of the computer system in embodiment of this invention. It is a flowchart which shows the monitoring method with respect to the reading and writing process of the file of the computer system in embodiment of this invention.

Explanation of symbols

117 Status information storage unit 120 Application program 130 Magnetic disk device 140 External storage device 200 Network 300 Server computer

Claims (11)

In a data monitoring method capable of sending and receiving data via a network with a monitoring target server holding data to be monitored,
When a transmission or reception command is issued from any application program, a communication monitoring step of monitoring communication of the transmitted / received data with reference to status information storage means in which status information regarding the data to be monitored is registered;
A file monitoring step of monitoring access to a file having write or read data with reference to the status information storage means when a write or read command is issued from any application program;
In the communication monitoring step, when a data transmission command is issued, it is confirmed whether program identification information indicating an application program that has issued the data transmission command is registered as the status information. Restrict the data transmission command,
In the file monitoring step, when a data write command is issued, it is confirmed whether or not program identification information indicating an application program that has issued the data write command is registered as the status information. In this case, the data monitoring method is characterized by restricting the data writing command. A protocol analysis step of analyzing a protocol of transmission / reception data received from outside or transmitted to the outside by a command of an arbitrary application program;
The data monitoring method according to claim 1, wherein in the communication monitoring step, communication of the transmission / reception data is monitored with reference to the analysis result analyzed in the protocol analysis step and the status information. In the communication monitoring step, when a data reception command whose source is the monitoring target server is issued, server identification information for identifying the monitoring target server is included together with program identification information of the application program that has issued the data reception command. The data monitoring method according to claim 1, wherein additional information is registered as the status information. In the communication monitoring step, when the program identification information of the application program that has issued the data transmission command is registered as the status information, the data transmission command corresponds to the server identification information corresponding to the program identification information 4. The data monitoring method according to claim 3, wherein the data transmission command is invalidated when the command is to transmit data to a server other than the monitoring target server indicated by. In the file monitoring step, when a data write command is issued to the external storage device, and the program identification information of the application program that has issued the data write command is registered as the status information The data monitoring method according to claim 1, wherein the data write command is invalidated. In the file monitoring step, the program identification information of the application program that has issued the data write command is registered as the status information when a data write command is issued to the data storage means of the information processing apparatus. If it is, the data monitoring method according to claim 1, wherein the additional information having the server identification information corresponding to the program identification information is written together with the data. In the file monitoring step, when a data read command for data having the additional information is issued, program identification information indicating an application program that has issued the data read command is registered as the status information together with the additional information, and the data The data monitoring method according to claim 6, wherein the data is read out. In an information processing device capable of sending and receiving data via a network with a monitoring target server that holds data to be monitored,
Status information storage means in which status information regarding the data to be monitored is registered;
Upon receiving a transmission or reception command from an arbitrary application program, communication monitoring means for monitoring communication of transmission / reception data with reference to the status information storage means;
A file monitoring step of monitoring file access with reference to the status information storage means upon receiving a write or read command from an arbitrary application program;
When the data transmission command is issued, the communication monitoring unit checks whether or not the program identification information indicating the application program that has issued the data transmission command is registered as the status information. Restrict the data transmission command,
In the file monitoring means, when a data write command is issued, it is confirmed whether or not program identification information indicating an application program that has issued the file write command is registered as the status information. An information processing apparatus that restricts the data write command in some cases. A program for causing a computer to execute data monitoring processing in an information processing apparatus capable of transmitting and receiving data via a network with a monitoring target server holding data to be monitored,
When a transmission or reception command is issued from any application program, a communication monitoring step of monitoring communication of the transmission / reception data with reference to status information storage means in which status information related to the monitoring target data is registered;
A file monitoring step of monitoring access to a file having write or read data with reference to the status information storage means when a write or read command is issued from any application program;
In the communication monitoring step, when a data transmission command is issued, it is confirmed whether program identification information indicating an application program that has issued the data transmission command is registered as the status information. Restrict the data transmission command,
In the file monitoring step, when a data write command is issued, it is confirmed whether or not program identification information indicating an application program that has issued the data write command is registered as the status information. In some cases, the program restricts the data write command. A computer-readable recording medium recorded with a program for executing data monitoring processing in an information processing apparatus capable of transmitting and receiving data via a network with a monitoring target server holding data to be monitored,
When a transmission or reception command is issued from any application program, a communication monitoring step of monitoring communication of the transmission / reception data with reference to status information storage means in which status information related to the monitoring target data is registered;
A file monitoring step of monitoring access to a file having write or read data with reference to the status information storage means when a write or read command is issued from any application program;
In the communication monitoring step, when a data transmission command is issued, it is confirmed whether program identification information indicating an application program that has issued the data transmission command is registered as the status information. Restrict the data transmission command,
In the file monitoring step, when a data write command is issued, it is confirmed whether or not program identification information indicating an application program that has issued the data write command is registered as the status information. In such a case, a recording medium storing a program characterized by restricting the data writing command. In an information processing system having a monitoring target server holding data to be monitored, and an information processing apparatus capable of transmitting and receiving data via the monitoring target server and a network,
The information processing apparatus includes:
Status information storage means in which status information regarding the data to be monitored is registered;
Upon receiving a transmission or reception command from an arbitrary application program, communication monitoring means for monitoring communication of transmission / reception data with reference to the status information storage means;
A file monitoring step of monitoring file access with reference to the status information storage means upon receiving a write or read command from an arbitrary application program;
When the data transmission command is issued, the communication monitoring unit checks whether or not the program identification information indicating the application program that has issued the data transmission command is registered as the status information. Restrict the data transmission command,
In the file monitoring means, when a data write command is issued, it is confirmed whether or not program identification information indicating an application program that has issued the file write command is registered as the status information. An information processing system characterized by restricting the data writing command in some cases.

Images