JP2006309416A - Anti-computer virus software updating method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To automatically determine a client within a subnetwork holding a latest component by mutual information exchange between clients and to distribute the component mutually. <P>SOLUTION: This anti-computer virus software updating method includes a representative client selection process for selecting any one of a plurality of clients 1, 2, 3 connected to the subnetwork 4 wherein a server and the subnetwork are connected to a network 6, as a representative client which can receive distribution of the updated component from the server, and a component mutual distribution process in which a plurality of clients exchange information including the kind of component, the version number and the identification information of the client which are already obtained respectively with the clients within the subnetwork, and each client receives the desired component from the client having already obtained the component based on the exchanged information. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a computer antivirus software update method for updating computer antivirus software components and virus pattern definition files in a plurality of computers connected via a network such as the Internet.

Computer virus detection software must constantly update software components and virus pattern definition files (hereinafter components) so that new viruses can be detected.
Generally, a method in which a vendor provides a server for distributing update components and distributes components via a network is widely used. Detection software (hereinafter referred to as a client) installed on each user's computer periodically inquires of the distribution server whether there is an update, and if there is an update, automatically downloads the component (for example, Non-Patent Document 1).

In order to cope with the threat of computer viruses that have become commonplace, computer virus detection software is installed in most terminals, and it is necessary to frequently update components in order to cope with new types of viruses that occur daily. Therefore, a large load is applied to the communication band of the distribution server and distribution route.
Conventionally, as a method for reducing the component distribution load, a method of distributing a load by providing a server for secondary distribution and tertiary distribution in a user organization has been put into practical use (Non-patent Document 1).
In addition, a method (Patent Document 1) has been proposed in which distribution is performed using a cyclic program that circulates a network.
Furthermore, for a similar purpose, a method (Patent Document 2) has been proposed in which an OS component is distributed with one terminal in a subnetwork as a representative.

Japanese Patent Laid-Open No. 10-313337 "Network System, Information Processing Device" Japanese Patent Laid-Open No. 2001-101001 “Data Update Method” "Symantec AntiVirus (TM) Corporate Edition Administrator's Guide", 2004, Symantec Corporation, Chapter 4, "Updating Virus Definition Files"

The conventional computer anti-virus software update method described above requires additional hardware such as a gateway device or a secondary distribution server in order to reduce the load of component distribution during installation and operation, or There is a problem that it is necessary to manage the setting of the distribution route and the like.
For example, Non-Patent Document 1 introduces a secondary distribution server that receives distribution from a vendor or the like on behalf of an organization and distributes the information within the organization. Depending on the scale, a server for tertiary distribution is introduced to perform distribution hierarchically. The introduction of these servers will reduce the load appropriately, but additional hardware, software, and labor costs are required to install and operate secondary and tertiary distribution servers.

  Japanese Patent Application Laid-Open No. 2004-228561 discloses a method of distributing by a cyclic program that circulates a network. A traveling program is released from the management device into the network, and each local area network (LAN) in the organization is sequentially visited via a WAN (Wide Area Network). A representative device (router or the like) of each LAN controls a cyclic route across the LAN, distributes a cyclic program to the terminals in the LAN using broadcast, and collects the results from the terminals. Such a function required for the representative device of each LAN is not included in a router that is widely installed, and therefore additional hardware and software are required.

  Further, the OS update method shown in Patent Document 2 can be obviously applied to computer virus countermeasure software, and one terminal receives component distribution on behalf of a LAN and secondarily distributes to other terminals. It is a method. A gateway device located between the LAN and WAN collects a list of terminals connected in the LAN, and each terminal knows the configuration of the terminals in the LAN via the gateway and distributes the obtained components to other terminals. To do. The gateway device also has a function of selecting one terminal as a “representative terminal” that receives component distribution from the outside and notifying each terminal. This method also requires the gateway device to have a function that is not found in existing routers that are widely installed, and requires additional hardware, software, and labor costs.

The present invention has been made to solve the above-described problems, and its purpose is to allow clients in a neighboring relationship on the network to collaborate with each other by devising the client software, thereby providing other special features. It is to realize efficient component distribution only by devising the client software without requiring the additional cost of hardware and software.
It is another object of the present invention to exchange components among the clients other than the representative client by exchanging component configuration information obtained between the clients, thereby realizing more efficient distribution.

The computer anti-virus software update method according to the present invention comprises:
A plurality of clients connected to the subnetwork, and the plurality of clients in the network system connected to the network to which the subnetwork is connected via the router via the router, distribute update distribution of computer antivirus software from the server. Receiving computer antivirus software update method,
Any one of a plurality of clients connected to the sub-network represents the network, runs as a representative client who receives distribution of the updated component from the server, and notifies the other clients through the sub-network The process of
When the other client receives the notification and can be approved as a representative client, a representative client selecting step including a step of notifying a candidate client that the client has been approved as a representative client;
The plurality of clients performing broadcast communication with the clients in the sub-network, thereby exchanging component configuration information including the type and version number of the components already obtained by each client and client identification information;
Each client includes a component mutual distribution step between clients, which includes a step of identifying a client that has obtained a component to be acquired based on the exchanged configuration information and receiving a component distribution from the client.

According to the present invention described above, each client automatically determines which client in the sub-network has the latest version component by exchanging information between the clients, and distributes the components to each other.
Further, a representative client is automatically determined by negotiation between clients, and only the representative client obtains an update component from the server 7. These functions can be realized at low cost as client software and do not require an additional server or gateway device.
In addition, since the configuration / role of the client in the sub-network is automatically determined, setting work for each client is unnecessary, and installation / installation is easy.
As for mutual distribution of each client, distribution can be received from a client having the latest version regardless of clients other than the representative client. As a result, the load at the time of update is distributed.

Embodiment 1 FIG.
FIG. 1 is a block diagram for implementing an aspect of a computer virus countermeasure software update method according to Embodiment 1 of the present invention. In FIG. 1, clients 1 to 3 are clients that receive distribution of computer antivirus software update components. Here, clients 1 to 3 belong to the same subnetwork 4.

The subnetwork 4 is connected to the network 6 by the router 5 and further connected to the server 7 via the network 6. The server 7 distributes update components in response to requests from the clients 1 to 3. As long as the clients 1 to 3 are configured to be able to access the server 7, the router 5 may be a firewall, a proxy server, or the like.
Each of the clients 1 to 3 has a function of receiving distribution of components from the server 7 as in the conventional case, and the clients 1 to 3 redistribute components already obtained from the server 7 in the same subnetwork 4. It has a function.

The operation of the present invention will be described below.
(Procedure for mutual distribution of components between clients)
A procedure in which the clients 1 to 3 distribute the obtained components to each other will be described with reference to FIGS. FIG. 2 is an explanatory diagram of a procedure for clients to distribute components to each other.
Each of the clients 1 to 3 periodically broadcasts the configuration information of the components obtained by the client 1 to the subnetwork 4 (FIG. 2A).
As shown in the example of FIG. 3, the configuration information to be broadcast includes identification information of the client, the type and version number of the component acquired by the client.
Each client determines the latest version number in the sub-network 4 corresponding to the type of component, that is, the client having the latest version, based on the configuration of the component that the client has and the configuration information notified by the broadcast. A recorded table (hereinafter referred to as the latest version component location table) is created (FIG. 2B). This table should be updated each time notification of configuration information is received.

When the configuration information shown in the example of FIG. 3 is exchanged, the latest version component location table created by the client 1 is as shown in FIG. As shown in FIG. 4, the recording of other clients can be omitted for the component for which the latest version is available.
The client can know the location of the latest version in the sub-network 4 for each component type by referring to the latest version component location table. The client selects a client having the latest version of the component from any one of the clients 1 to 3 for a component for which the client does not have the latest version, makes a download request, and obtains the latest version (FIG. 2C). ).

(Representative client selection procedure)
Next, the procedure for selecting a representative client is described.
In the present embodiment, for the purpose of reducing the load on the server 7, clients that receive distribution from the server 7 on behalf of the subnetwork 4 (hereinafter referred to as representative clients or masters) are referred to as clients 1 to 3. Based on the candidacy from the client, the clients select each other, and clients other than the selected client refrain from obtaining the updated version from the server 7.

This method will be described with reference to FIG. The candidate client broadcasts to other clients in the sub-network 4 that he / she will stand as a representative client in the sub-network 4, and the other client has its representative client (master) as the sending client Is recognized (FIG. 5A). This notification is hereinafter referred to as master notification. Other clients that receive the master notification suppress themselves from becoming masters.
If the timing of the master notification conflicts with other clients, each client that has received the notification determines that the one with the highest priority is the master in accordance with the priorities determined in advance by the system (FIG. 5 ( b)). As the priority, for example, the size of the IP address or MAC (Media Access Control) address of the client can be used, or a random number can be presented in the master notification and the size can be determined.

The client that becomes the master periodically broadcasts a master notification to re-notify other clients of the subnetwork 4 and continuously notifies that it is the master (FIG. 5C).
When the notification is not observed for a certain period or more, the other client determines that the master has stopped operating, and newly creates a representative client as a candidate (FIG. 5D).

According to the method of this embodiment described above, each client automatically determines which client in the sub-network 4 has the latest version component by exchanging information between the clients, and sets the components to each other. To distribute. Further, a representative client is automatically determined by negotiation between clients, and only the representative client obtains an update component from the server 7.
The above procedure is automatically performed between the clients 1 to 3 and does not require an additional server or gateway device, and can be realized at low cost as client software.

In addition, since the configuration / role of the client in the sub-network 4 is automatically determined, setting work for each client is unnecessary, and installation and installation are easy.
Further, in a mobile terminal of a notebook computer, even when a client is moved to another subnetwork, no resetting is required.
In addition, mutual distribution of each client can be received from a client having the latest version regardless of the representative client. As a result, the load during updating is distributed. Also, when an update component is brought into the subnetwork from another route, such as a mobile computer or portable media, it is updated in the subnetwork without any special settings. Components can be distributed automatically.

Embodiment 2. FIG.
This embodiment is the same as that in the first embodiment, except that the client receiving distribution from the server 7 adds a procedure for suppressing component redistribution in the same subnetwork.
FIG. 6 is an explanatory diagram showing the procedure. The client periodically broadcasts a component redistribution suppression notice within the sub-network during the period of receiving distribution from the server ((a)). The content of this redistribution suppression notification includes the type of component being obtained from the server as shown in FIG.
The other clients that have received the notification refrain from distributing components among the clients for the notified component type while the periodic broadcast of the suppression notification continues ((b)).

  By adding the above procedure, when any of the clients in the sub-network 4 receives distribution from the server 7 and tries to obtain the latest version of a specific type of component, it is useless in the sub-network 4. Redistribution is suppressed and redistribution efficiency is improved.

Embodiment 3 FIG.
In this embodiment, in a sub-network in which clients with different required components and models are mixed, each client can maintain a version of another component other than its operating platform and redistribute it to other clients. The purpose of the client is to collect various models and necessary component configurations existing in the sub-network and receive component distribution from the server on behalf of the sub-network. The above object is realized by changing the procedure.

(1) The “acquired component configuration information” that the clients notify each other includes, in addition to the information shown in the first embodiment, the identification of the operating platform for each component.
FIG. 7 is an example showing the contents of “acquired component configuration information” that the clients 1 to 3 notify each other in this embodiment.

(2) The "latest version component location table" created and updated by each client in response to the notification of "acquired component configuration information" is the latest version number for the combination of component type and operating platform, and the acquired client. Record.
FIG. 8 shows a “latest version component location table” created by the client 1 in response to the notification of FIG.
Each client identifies the client that has the latest version for its operating platform and required component type according to this “latest version component location table”, and obtains the component therefrom.

(3) The client also periodically notifies other clients in the sub-network 4 of “component configuration information required by itself” by broadcasting. This configuration information includes information that identifies the type of component required and the operating platform of this component type.
FIG. 9 is an example showing the content of “component configuration information required by itself” that clients 1 to 3 notify each other.

(4) At least the current representative client among the clients collects the notification of “component configuration information required by itself” and collects all combinations of component types and operating platforms required in the subnetwork 4. Calculate and hold the table shown. This table is hereinafter referred to as “request component type table”.
FIG. 10 shows a “request component type table” calculated based on “component configuration information required by itself” shown in FIG.

(5) When the representative client receives the component distribution from the server 7, the representative client acquires an update from the server 7 for the combination of the component type and the operating platform described in the “request component type table”. At this time, if the “latest version component location table” shown in FIG. 8 is used, it can be determined whether or not the latest version of the component distributed from the server 7 is already present in the sub-network 4. The acquisition from the server 7 may be omitted.

  According to the above configuration, even in the case where the type of component required and the operating platform of the component differ depending on the model and usage purpose of each client, the client can efficiently distribute components in cooperation with each other.

  It can be applied in the form of embedded in the secure gate device of cyber terrorism countermeasure system and the agent software that manages the client and can contribute to network security.

It is a block diagram which implements the method in Embodiment 1 of this invention. FIG. 6 is an explanatory diagram of a mutual distribution procedure of components in the first embodiment. FIG. 3 is an explanatory diagram of contents of configuration information of acquired components in the first embodiment. FIG. 4 is a content explanatory diagram of a latest version component location table in the first embodiment. FIG. 10 is an explanatory diagram of a representative client selection procedure in the first embodiment. It is a block diagram which implements the method in Embodiment 2. FIG. 20 is an explanatory diagram of the contents of configuration information of acquired components in the third embodiment. FIG. 11 is a content explanatory diagram of a latest version component location table in the third embodiment. FIG. 10 is a content explanatory diagram of component configuration information required by itself in Embodiment 3. FIG. 10 is a content explanatory diagram of a requested component type table in the third embodiment.

Explanation of symbols

  1-3: client, 4: subnetwork, 5: router, 6: network, 7: server.

Claims (3)

A plurality of clients connected to the sub-network and the plurality of clients in the network system in which the sub-network is connected to the network to which the server is connected via a router receive update distribution of computer antivirus software from the server A computer antivirus software update method comprising:
Any one of a plurality of clients connected to the sub-network represents the network, runs as a representative client who receives distribution of the updated component from the server, and notifies the other clients through the sub-network The process of
When the other client receives the notification and can be approved as the representative client, the step of notifying that the candidate client has been approved as the representative client;
The process of selecting a representative client with
The plurality of clients performing broadcast communication with the clients in the sub-network, thereby exchanging component configuration information including the type and version number of the components already obtained by each client and client identification information;
Each client comprises a component mutual distribution step between clients, which includes a step of identifying a client that has already obtained a desired component based on the exchanged configuration information and receiving a component distribution from the client. To update computer anti-virus software. When a representative client receives component distribution from the server, it notifies the client connected to the subnetwork that the component is being distributed from the server by broadcast communication, including the type of component being received from the server. And a process of
The method according to claim 1, wherein the client in the sub-network that has received the notification includes a step of suppressing the exchange of the component between the sub-networks. The component configuration information to be exchanged in the component configuration information exchange process includes the identification of the operating platform of the component in the configuration information of the acquired component, and each client needs to constantly update with its own operating platform. Component types, and
3. The computer anti-virus software according to claim 1, wherein the representative client has a function of obtaining from the server a component corresponding to the operating platform and component type exchanged in the component configuration information exchanging step. Update method.

Images