JP2007316780A - Computer system, computer and file operation limiting method to be used therefor, and its program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a computer system for setting access authority to a file with no access authority set in advance under control of a manager. <P>SOLUTION: A management server 1 is provided with a permission template 11 as the list of files whose execution by clients (#1 to #N) is preliminarily permitted and a rejection template 12 as the list of files whose execution is not permitted, and uses those templates 11 to automatically prepare a permission file list 11 of each of the clients (#1 to #N) 2-1 to 2-N. As for the installation of an application with legitimate signatures permitted by a system manager, the execution of an installer and the execution of software added by the execution are approved. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a computer system, a computer, a file operation limiting method used therefor, and a program therefor, and more particularly to a method for limiting software execution by a user.

  Conventionally, as a means for restricting the execution of software by a user, there is an operating system function, and access rights of individual files and folders are managed by computer users and user groups.

  As this type of technology, an access control system has been proposed that can suppress the access even if an intruder from the network attempts to read or write an illegal file using any user authority (for example, Patent Document 1).

  This access control system uses a policy that permits access to a specific file only when a specific user uses a specific program. Also, in this access control system, the policy is registered in the policy file, and the access information hooked by the file I / O (Input / Output) hook program is transmitted to the security OS via the OS (Operating System) inter-communication processing unit. To the access control program and control based on the policy.

JP 2001-337864 A

  In the conventional access control method described above, a user having administrator authority of each computer has access authority to all files and folders, and is not limited to a user having administrator authority of the computer. In this case, a user having administrator authority has authority, but if an operation error or a computer administrator authority is taken, damage such as falsification and deletion may occur.

  Some software can only be installed by users with administrator privileges, and in some environments it is necessary to give the computer administrator privileges to the user. It is difficult to install such software without giving.

  In the conventional access control method, when setting the software execution control, file access rights must be set on each computer. In a large-scale environment, the time required for setting becomes enormous, and each computer administrator It is not realistic to leave management to one person and to set access rights for all computers by one administrator. This is because there is no mechanism for the administrator to set access rights in a lump.

  In conventional access control methods, there are files that you want to prevent from changing or tampering with, such as configuration files and shared content referenced on the Web. There is a risk of tampering and erasure due to the takeover. This is because a user having administrator authority can easily perform operations on all files.

  With the access control function that comes with the operating system, if the computer user has administrator privileges for the computer, all files can be freely read, written, and executed. There is a risk of manipulation mistakes and tampering and deletion by crackers.

  In addition, software on Ream Bubble Media and files brought in by the user from outside the Internet can be freely executed by the brought-in user, and unauthorized use software brought by the user or software that is not recommended for installation due to management policies In some cases, execution of a file containing a computer virus attached by e-mail or the like is permitted.

  Although there is a secure OS in which authority is set separately for each software, as in the technique described in Patent Document 1 above, there is a drawback in that setting is complicated and difficult.

  Accordingly, an object of the present invention is to solve the above-described problems and to set access rights for a file that has been executed under the management of an administrator even for a file for which file access rights have not been set in advance. An object of the present invention is to provide a computer system, a computer, a file operation limiting method used therefor, and a program thereof.

A computer system according to the present invention is a computer system comprising a plurality of computers,
On the management computer, a file list that indicates the file that is specified by the system administrator for the file operation call by the operating system, and a file that is specified by the system administrator for the file operation call is rejected. A file list, and update means for automatically updating the allowed file list,
Hook means for interrupting the file operation call to each managed computer and supplementing the file operation call not approved by the system administrator, and the file operation on the file on the reject file list And a means for prohibiting the file operation call for a file not included in the permitted file list.

  In the computer according to the present invention, a file operation call target by the operating system is a permitted file list indicating a file specified by the system administrator, and a file operation call target is a rejection indicating the file specified by the system administrator. A file list; update means for automatically updating the permitted file list; hook means for interrupting the file operation call and supplementing the file operation call not approved by the system administrator; and the reject file list Means for prohibiting the call of the file operation for the file listed in the file, and means for prohibiting the call of the file operation for the file not listed in the permitted file list.

The file operation limiting method according to the present invention is a file operation limiting method used in a computer system composed of a plurality of computers,
The management computer allows the operating system to call a file operation that is permitted by the system administrator and lists the permitted files. The file operation is called by the system administrator and designates a file that is rejected by the system administrator. File list and automatically update the allowed file list,
Each of the computers to be managed interrupts the file operation call to supplement the file operation call that is not allowed by the system administrator, and calls the file operation call for the file on the reject file list. The file operation is prohibited from being called for a file that is prohibited and is not on the permitted file list.

In another file operation limiting method according to the present invention, the computer includes a permission file list indicating a file that is called by a system administrator for a file operation call by an operating system, and the file operation call target is a system administrator. Maintains a reject file list indicating the files specified
An update process in which the computer automatically updates the permitted file list; a hook process for interrupting the file operation call and supplementing a file operation call that is not permitted by the system administrator; and the reject file list The process for prohibiting the file operation call for the file listed in the file and the process for prohibiting the file operation call for the file not listed in the permitted file list are executed.

The program according to the present invention includes a permission file list indicating a file specified by a system administrator as a target of a file operation call by the operating system, and a rejection indicating a file specified as a rejection by the system administrator as a target of the file operation call. In the computer that holds the file list,
An update process for automatically updating the allowed file list;
A hook process for interrupting the file operation call and supplementing the file operation call not allowed by the system administrator;
A process for prohibiting the file operation from being called for a file on the reject file list;
And a process for prohibiting the calling of the file operation on a file not on the permitted file list.

  That is, the computer system of the present invention interrupts when writing, deleting, moving, renaming, creating a process, reading a library separately from the operating system access authority setting, and is set in advance by the system administrator on the management server side. By allowing operations such as execution, writing, moving, deleting, renaming, etc. only for files, even if the file operation is authorized by the client user, it is not permitted by the system administrator for each file or folder. The operation is disabled.

  In the computer system of the present invention, as a management method, the management computer has a list of files that are allowed to be executed on the client in advance and files that are not allowed to be used. Created automatically or with minimal effort.

  Furthermore, in the computer system of the present invention, regarding the installation of an application with a legitimate signature authorized by the system administrator, the execution of the installer and the execution of the software added thereby are permitted, so that the system is added at the time of additional installation of the software. The administrator has reduced the work of updating the list of allowed files for each client.

  More specifically, the computer system of the present invention interrupts file operation calls such as file write, move, delete, rename, process creation, library read, etc. by the operating system, and does not allow the system administrator. A hook method that supplements the operation call and returns processing other than the original result such as a warning message is provided.

  By using this hook method, in the computer system of the present invention, even if the client has administrator authority, it is not desired to change the web contents and setting files on the client that the system administrator has specified to reject. Tampering such as moving, deleting, renaming, writing, etc. is prohibited for folders and files.

  The computer system of the present invention hooks (captures) process creation and library loading, and checks whether the file that creates the process is on the permitted file list, thereby executing a file that is not in the permitted file list. Prohibits the execution and loading of files brought in or altered.

  Furthermore, in the computer system according to the present invention, a list of executable files and libraries that are allowed to be executed by a system administrator (permission template) and a list of executable files and libraries that are rejected to be executed (rejected templates) on the client in advance. A list of files that are permitted to be executed on the client by comparing all the executable files and library information on the client that are stored in the management server and sent from the client with those templates (permitted file list) The setting is simplified by providing a means to distribute the permitted file list to the client by reducing the time and effort of creation.

  Furthermore, the computer system of the present invention also provides a means for updating a permission template and a rejection template for a new file so that it is not necessary to set a new permission file once again. Yes.

  As described above, in the computer system of the present invention, software installed from a file with a signature approved by the system administrator can be executed on the client even if the permitted file list is not issued again to the system administrator. . In the computer system according to the present invention, a file installed by a signed file approved by the system administrator is recorded and added to the permitted file list, so that a list of management at the time of software installation signed by the system administrator is obtained. Eliminates the hassle of reissuing.

  Further, in the computer system of the present invention, when a file that is not described in the permission template and the rejection template that the system administrator has on the management server is found on the client, the system administrator creates a newly discovered file. By adding the execution permission made to the permission template and the denial template, it is not necessary to set the same file again thereafter, leading to a reduction in work. In this case, in the computer system of the present invention, by automatically setting the work to add execution permission to the permission template or the rejection template, it is not necessary for the system administrator to manually set, and the setting can be automated. It becomes.

  The present invention has the configuration and operation as described above, so that the access right can be set for a file that has been executed under the management of the administrator even for a file for which the file access right has not been set in advance. The effect of being able to be obtained.

  Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a computer system according to an embodiment of the present invention. 1, a computer system according to an embodiment of the present invention includes a management computer (management server 1) and a computer group [clients (# 1 to #N) 2-1 to 2-N to be controlled for access control. ].

  The management server 1 includes a permission template 11 that holds information that can uniquely identify executable files and library files that are permitted in all clients (# 1 to #N) 2-1 to 2-N, and execution that does not allow execution. A rejection template 12 that stores information that can uniquely identify a file and a library file is stored.

  The clients (# 1 to #N) 2-1 to 2-N have the same configuration, but the client (#T) 2-T will be described below. The client (#T) 2-T has a hook method 22 by a file system filter driver or system rewriting. Further, the client (#T) 2-T has a permitted file list 24 in which files and folders are specified by a full path name, and a reject folder / file list 25.

  When the process call source 21 of the client (#T) 2 -T attempts to call the system 23 [for example, OS (Operating System) etc.], the call is interrupted by the hook method 22, and the permitted file list 24 is rejected. A check is made to see if the process is a call that conforms to the conditions specified in the folder / file list 25.

  The process call permitted by the check reaches the system 23, but the call not permitted is supplemented by the hook method 22 and does not reach the system 23. The result of the check is displayed as a warning message to the user and recorded in the log. To do.

  FIG. 2 is a block diagram showing a configuration example of the management server 1 of FIG. In FIG. 2, the management server 1 includes a CPU (central processing unit) 13, a main memory 14 holding a control program 14a executed by the CPU 13, and information (for example, a permission template) used when the CPU 13 executes the control program 14a. 11 and rejection template 12) and an IF (interface) unit 16 for exchanging information with clients (# 1 to #N) 2-1 to 2-N. Yes. Further, the CPU 13, the main memory 14, the storage unit 15, and the IF unit 16 are each connected to the internal bus 110, and can exchange data with each other.

  FIG. 3 is a block diagram showing a configuration example of the clients (# 1 to #N) 2-1 to 2-N in FIG. In FIG. 3, the client 2 includes a CPU 26, a main memory 27 holding a control program 27a executed by the CPU 26, and information used when the CPU 26 executes the control program 27a (for example, the hook method tool 22, the permitted file list). 24, a reject folder / file list 25, etc.) and an IF unit 29 for exchanging information with the management server 1 and other clients. The CPU 26, the main memory 27, the storage unit 28, and the IF unit 29 are connected to the internal bus 210, respectively, and can exchange data with each other. The clients (# 1 to #N) 2-1 to 2-N have the same configuration as the client 2 described above. The storage unit 28 may store a system 23 other than the OS (control program 27a).

  4 is a flowchart showing the operation of the client (#T) 2-T in FIG. 1, FIG. 5 is a diagram showing the configuration of all execution files and library identification lists in one embodiment of the present invention, and FIG. 7 is a flowchart showing the operation of the management server 1 in FIG. 1, FIGS. 7 and 8 are flowcharts showing the creation processing of the permitted file list 24 in FIG. 1, and FIG. 9 is the client (#T) 2-T in FIG. FIG. 10 is a flowchart showing the operation of file operation on the client (#T) 2-T of FIG. 1.

  The operation of the computer system according to an embodiment of the present invention will be described with reference to FIGS. The processing shown in FIGS. 6 to 8 is realized by the CPU 13 of the management server 1 executing the control program 14a, and the processing shown in FIGS. 4, 9, and 10 is performed by the client (#T) 2-T. This is realized by the CPU 26 executing the control program 27a. Other clients other than the client (#T) 2-T perform the same operation as the client (#T) 2-T, but the description thereof is omitted.

  First, the initial setting of the client (#T) 2-T will be described. The client (#T) 2-T creates a folder with a path and a reject folder / file list 25 in which the file names are not allowed to be written, moved, deleted, renamed, etc. (FIG. 4). Step S1). The reject folder / file list 25 has a folder name with a path to be rejected, or a file name with a path, and a file name with a path of zero or more specially permitted files for those folders and files.

  In this embodiment, the setting file storage folder for software that restricts the file operation by the hook method 22 (the storage destination of the permitted file list 24 and the reject folder / file list 25) is also protected from the falsification folder / This is described in the file list 25.

  Next, the client (#T) 2-T creates all executable files and library identification lists having file names with paths and information that can uniquely identify the files of all the executable files and libraries in the own terminal. (FIG. 4, step S2).

  As shown in FIG. 5, for example, all executable files and the library identification list have at least a file name with a path, information that can uniquely identify the file, and a permission flag (null / allow / deny) (the initial value is Null). . Here, the information that can uniquely identify the execution file and the library file includes, for example, a unique file such as hash information such as MD5 (Message Digest algorithm 5) or SHA-1 (Secure Hash Algorithm-1) of the file. Means that can be identified.

  In FIG. 5, the full path file name “C: \ Program File \ allow1 \ app1.exe” is associated with information “6f9e8d46c4e5afa1ee5a881114ee3b9e”, the permission flag “Null”, and other information that uniquely specify the file. ing. The full path file name “C: \ Program File \ allow1 \ app2.exe” is associated with information “8a5e7f9da6421cfae085d7f8aab673365” that uniquely identifies the file, a permission flag “Null2,” and other information.

  The full path file name “C: \ Program File \ deny1 \ app3.exe” is associated with information “a6421cfe08d7f8ab633add89f32bcead” that uniquely identifies the file, permission flag “Null”, and other information. The full path file name “C: \ Program File \ allow1 \ app4.exe” is associated with information “78ace31985acbd35d6a8abae90e3” uniquely identifying the file, permission flag “Null”, and other information. The full path file name “C: \ Program File \ other \ app.exe” is associated with the permission flag “Null” and other information.

  The client (#T) 2 -T obtains the file name with the path obtained in step S 2 regarding the specially accessible file for each folder and file item in the reject folder / file list 25 described in the process of step S 1 above. Is added (step S3 in FIG. 4). The client (#T) 2-T also adds file information used for updating the setting file on the management server 1 to the setting file storage folder. This is because, when this information is not added, it is impossible to change the setting file such as an allow list, a reject file, and a folder update.

  The client (#T) 2-T sends the reject folder / file list 25, all executable files, and library identification list information to the management server 1 (step S4 in FIG. 4). Further, the client (#T) 2-T obtains the permitted file list 24 and the reject folder / file list 25 approved by the system administrator from the management server 1 (step S5 in FIG. 4). These lists are stored in the setting file storage folder described in the reject folder / file list 25 created in the process of step S1.

  After executing these processes, the client (#T) 2-T activates the access restriction and starts the access restriction (step S6 in FIG. 4).

  Next, the initial setting of the management server 1 will be described. The management server 1 uses the permission template 11 for information that can uniquely identify the executable file and the library file that are permitted in all the clients (# 1 to #N) 2-1 to 2-N, and the executable file that is not permitted to be executed. And the information for uniquely identifying the library file are held in the reject template 12 respectively. The permission template 11 and the rejection template 12 may be only information that can uniquely identify the file, but may have arbitrary names corresponding to the information that can uniquely identify the file for the convenience of later editing. good.

  The management server 1 receives all the executable files and the library identification list from the client (#T) 2-T (step S11 in FIG. 6). The management server 1 creates the permitted file list 24 from the file information of all the executable files and the library identification list by the method of steps S21 to S24 described below (step S12 in FIG. 6).

  That is, the management server 1 confirms whether or not the information that can uniquely identify all executable files and library identification list files received from the client (#T) 2-T is described in the reject template 12 (FIG. 7 step S21). When there is information that can uniquely identify the file described in the reject template 12 on the all execution file / library identification list, the management server 1 receives all the execution files received from the client (#T) 2-T, “Deny” is entered in the permission flag of the library identification list (step S22 in FIG. 7).

  When the information that can uniquely specify a file on the rejection template 12 does not match, the management server 1 creates a permission list that describes files that are allowed to be executed and loaded by the client (#T) 2-T. It is determined whether the setting is to manually select a permission flag for a file that is not included in the refusal template 12 or the refusal template 12 or to be set to select automatically without entering the administrator's hand (step S24 in FIG. 7). ). The manual and automatic settings are made in advance by the system administrator on the management server 1.

  If the management server 1 is set not to be manually set (automatically select a file to be allowed), files that are not described in either the allow template 11 or the reject template 12 are prevented from loading problems such as drivers. Therefore, permission for execution and loading (permission flag ← allow) is set (step S27 in FIG. 7). As a result, it is not necessary for the system administrator to manually set the permission, and it is possible to automate the processes of steps S27, S24, and S13 to S15 even without the administrator.

  When setting manually, the management server 1 checks whether there is a target file in the permission template 11 (step S25 in FIG. 7), and if it is in the permission template 11, sets “allow” in the permission flag (FIG. 7). Step S26).

  When there is no target file in the permission template 11, the management server 1 selects whether to permit execution and loading of the target file (step S28 in FIG. 8), and when permitting, sets “allow” in the permission flag (FIG. 8). 8 step S29). Subsequently, the management server 1 selects whether or not to add this setting to the permission template 11 (step S30 in FIG. 8). When adding, information that can uniquely identify the file of this file is added to the permission template 11. (FIG. 8, step S31).

  If the execution or load is not permitted, the management server 1 sets “deny” in the permission flag for this file (step S32 in FIG. 8). Subsequently, the management server 1 selects whether or not to add this file to the reject template 12 (step S33 in FIG. 8), and when adding, adds a file name with a path and information that can uniquely identify the file. It adds to the refusal template 12 (step S34 of FIG. 8).

  Through the processes in steps S31 and S34, the permission template 11 and the rejection template 12 are updated, and it becomes possible to set permission of more files without the system administrator having to set manually.

  The management server 1 assigns the file name with the path of the file with the permission flag “allow” to the client (#T) 2 -T for distribution to the client (#T) 2 -T in the above steps S 21, S 22, S 24 to S 34. The data is written in the list 24 (step S23 in FIG. 7). Only the files described in this file can be executed and loaded on the client (#T) 2-T.

  The management server 1 determines whether or not to edit the reject folder / file list 25 sent from the client (#T) 2-T as necessary (step S13 in FIG. 6). When the management server 1 edits the refusal folder / file list 25, the refusal folder and the refusal file that prohibit the change of the file on the client (#T) 2-T, and exceptionally the file change to the folder or file. A special permission file that can be operated is determined (step S14 in FIG. 6). The special permission file is selected from the files described in the permission file list 24.

  When the system administrator trusts the reject folder / file list 25 transmitted from the client (#T) 2-T, the management server 1 is set not to edit the reject folder / file list 25 on the management server 1 in advance. By doing so, the editing process is skipped and the process is automated.

  The management server 1 transmits the permitted file list 24 and the reject folder / file list 25 edited by the above processing to the client (#T) 2-T (step S15 in FIG. 6).

  Next, a description will be given of file execution and library loading on the client (#T) 2-T. The client (#T) 2-T hooks (captures) these calls using the hook technique 22 when making a process creation call and a library load call by executing a file (step S41 in FIG. 9).

  When the client (#T) 2-T is a call by a file described in the permitted file list 24 (step S42 in FIG. 9), the client (#T) 2-T creates a process and loads a library (step S43 in FIG. 9).

  If the client (#T) 2-T is a call by a file not listed in the permitted file list 24 (step S42 in FIG. 9), the client (#T) 2-T determines whether the file has a legitimate signature approved by the system administrator. Determination is made (step S44 in FIG. 9).

  If the client (#T) 2-T confirms that it has a legitimate signature, it accepts the creation of the process (step S45 in FIG. 9), and adds the executable file and library path added by the process. The file name is added to the permitted file list 24 (step S46 in FIG. 9). This also allows the execution of additional files installed by legitimate signed installers approved by the system administrator.

  If the client (#T) 2-T does not call from an approved file if the legitimate signature has not been made, the user (#T) 2-T has executed a file that is not allowed by means such as a dialog or the like that can be readily understood by the user. A warning message is displayed together with the file information and recorded in the log (step S47 in FIG. 9).

  Furthermore, an operation when performing a file operation on the client (#T) 2-T will be described. The client (#T) 2-T uses the hook method 22 to hook (capture) a call to the system 23 for file operations such as file writing / moving / deleting / renaming in the client (#T) 2-T. (FIG. 10, step S51).

  The client (#T) 2-T checks whether the operation target file is described in the reject folder / file list 25 and the permitted file list 24 sent from the management server 1 in advance (step S52 in FIG. 10). For a file that has not been processed, an operation of executing file writing / moving / deleting / renaming is permitted (step S56 in FIG. 10). The permission file list 24 is also checked in order to prohibit file operations other than execution and loading of the files described in the permission file list 24.

  Regarding the described file, it is determined whether or not the operation is from a special permission file approved by the system administrator in comparison with the reject folder / file list 25 (step S53 in FIG. 10). If the call is from a file, the file write / move / delete / rename execution operation is permitted (step S56 in FIG. 10).

  If the call is not made from the special permission file, the client (#T) 2-T checks whether the calling process is a legitimate signed file approved by the system administrator (step S54 in FIG. 10). If the legitimate signature is confirmed, the file write / move / delete / name change execution operation is permitted (step S56 in FIG. 10).

  If the legitimate signature cannot be confirmed, the client (#T) 2-T displays a warning message together with the file information to the user that a file that cannot be recognized by means such as a dialog is recognized. At the same time, the result of the call is recorded in the log (step S55 in FIG. 10).

  As described above, in the present embodiment, the user has authority by detecting an invocation of an executable file or library that is not in the permitted file list 24, issuing a warning message, and collecting a log, but the system administrator does not recognize it. Since the execution and loading of the file can be prevented, it is possible to prevent the client (#T) 2-T from executing other than the application approved by the system administrator.

  Further, in this embodiment, a file installed by a signed file approved by the system administrator is recorded and added to the permitted file list 24, so that the management at the time of installing the signed software approved by the system administrator can be performed. Since the trouble of reissuing the list can be eliminated, the client (#T) 2-T requests the system administrator to issue the permitted file list again for the software installed from the file with the signature approved by the system administrator. Can be done without.

  Furthermore, in this embodiment, a file operation call is hooked (captured), and if it is an operation related to a specified folder or file, the operation is not permitted, a warning message is issued to the user, and a log is collected. Can prevent falsification, so even a user with administrator authority of client (#T) 2-T can write, move, delete, and name the file in the folder specified by the system administrator and the directly specified file. It is possible to disable operations other than reading, such as changing the password. However, in the case of a change from a process created by a specific file approved by the system administrator or a file operation with a legitimate signature approved by the system administrator, the operation is permitted.

  Furthermore, in this embodiment, when a file that is not described in the permission template 11 and the rejection template 12 that the system administrator has on the management server 1 is found on the client (#T) 2-T, By adding execution permission for the newly discovered file to the permitted template 11 and rejected template 12, the administrator does not need to set the same file again, thereby reducing work. Connected. In addition, by setting the automatic setting in the process of step S23, it is not necessary for the system administrator to set manually, and the setting can be automated.

  In the description of the operation of the computer system according to this embodiment, the operation in the client (#T) 2-T has been described. However, other clients can be operated in the same manner as the client (#T) 2-T. The same effect as in the case of the client (#T) 2-T can be obtained.

  FIG. 11 is a block diagram showing the configuration of a computer system according to another embodiment of the present invention. In FIG. 11, another embodiment of the present invention differs from the above-described embodiment of the present invention in that operation with only the computer 3 is possible and there is no management computer (management server).

  In FIG. 11, the computer 3 is different from the above-described embodiment of the present invention in that a management tool 34 is added to the client (#T) 2-T in the above-described embodiment of the present invention. That is, the computer 3 has a storage unit 35 that holds a process call source 31, a hook method 32, a system 33, a management tool 34, a permitted file list 36, and a reject folder / file list 37. The management tool 34 includes the function of the management server 1 in the above-described embodiment of the present invention.

  FIG. 12 is a block diagram showing a configuration example of the computer 3 in FIG. In FIG. 12, the computer 3 includes a CPU 38, a main memory 39 holding a control program 39a executed by the CPU 38, and information used when the CPU 38 executes the control program 39a (for example, a hook method tool 32, a management tool 34). , A permitted file list 36, a reject folder / file list 37, etc.) and an IF unit 40 for exchanging information with the management server 1 and other clients. The CPU 38, the main memory 39, the storage unit 35, and the IF unit 40 are connected to the internal bus 310, respectively, and can exchange data with each other. The storage unit 35 may store a system 33 other than the OS (control program 39a).

  FIG. 13 is a flowchart showing the operation of the computer 3 of FIG. The operation of the computer 3 will be described with reference to FIGS. In this embodiment, steps S61 to S66 in FIG. 139 are used instead of steps S1 to S6 and S11 to S15 in the above-described embodiment of the present invention. The processing shown in FIG. 13 and the processing described below are realized by the CPU 38 of the computer 3 executing the control program 39a.

  The management tool 34 is restricted in use by a password or the like, and the computer 3 makes the management tool 34 usable by the administrator (step S61 in FIG. 13). The computer 3 searches for all execution files and libraries on its own terminal, and creates all execution files and library identification lists (step S62 in FIG. 6).

  The computer 3 creates the permitted file list 36 by using the processing of steps S21 to S34 in the embodiment of the present invention described above (step S63 in FIG. 13), selects the reject folder and file, and rejects the folder / file list 37. Is created (step S64 in FIG. 13).

  The computer 3 adds the file name with the path of the special permission file to the reject folder / file list 37 created in the process of step S64 (step S65 in FIG. 13), enables the access restriction (step S66 in FIG. 13), Finish the setting.

  The operation procedure when executing a file on the computer 3 and loading a library is the same as the processing in steps S41 to S47 in the embodiment of the present invention described above, and the operation when performing a file operation on the computer 3 The procedure is the same as the processing in steps S51 to S56 in the above-described embodiment of the present invention.

  As described above, in this embodiment, by providing the management tool 34 containing the function of the management server 1 in the computer 3, the same effect as in the above-described embodiment of the present invention can be obtained even with the computer 3 alone. Can do.

It is a block diagram which shows the structure of the computer system by one Example of this invention. It is a block diagram which shows the structural example of the management server of FIG. It is a block diagram which shows the structural example of the client of FIG. It is a flowchart which shows operation | movement of the client (#T) of FIG. It is a figure which shows the structure of all the execution files in one Example of this invention, and a library identification list. It is a flowchart which shows operation | movement of the management server of FIG. It is a flowchart which shows the preparation process of the permission file list | wrist of FIG. It is a flowchart which shows the preparation process of the permission file list | wrist of FIG. 6 is a flowchart showing operations when executing a file and loading a library on the client (#T) in FIG. 1. 7 is a flowchart showing file operation operations on the client (#T) in FIG. 1. It is a block diagram which shows the structure of the computer system by the other Example of this invention. It is a block diagram which shows the structural example of the computer of FIG. It is a flowchart which shows operation | movement of the computer of FIG.

Explanation of symbols

1 management server
2-1 to 2-N clients (# 1 to #N)
3 Calculator
11 Authorization templates
12 Rejected Template 13, 26, 38 CPU
14, 27, 39 Main memory 14a, 27a, 39a Control program 15, 28, 35 Storage unit 16, 29, 40 IF unit
21 Process caller
22 Hook method
23 System
24 Allowed file list
25 Rejected folder / file list 110, 210, 310 Internal bus

Claims (29)

A computer system comprising a plurality of computers,
On the management computer, a file list that indicates the file that is specified by the system administrator for the file operation call by the operating system, and a file that is specified by the system administrator for the file operation call is rejected. A file list, and update means for automatically updating the allowed file list,
Hook means for interrupting the file operation call to each managed computer and supplementing the file operation call not approved by the system administrator, and the file operation on the file on the reject file list A computer system, and means for prohibiting the file operation call for a file not on the permitted file list.   2. The computer system according to claim 1, wherein the file operation call includes at least file writing, moving, deleting, renaming, process generation, and library reading.   3. The computer system according to claim 1, wherein the hook unit returns a process other than a result of the file operation call including at least a warning message.   The computer system according to any one of claims 1 to 3, wherein the hook unit can be installed without permission to execute a file with a legitimate signature approved by the system administrator.   5. The computer system according to claim 4, wherein the updating unit automatically adds an executable file and a library installed by an installer with a legitimate signature approved by the system administrator to the permitted file list. .   6. The management computer according to claim 1, wherein the management computer automatically sets the file execution permission of each of the management target computers based on the permission file list and the reject file list. Computer system.   The update means sequentially updates the permitted file list and the rejected file list when setting the permission of a file not described in the permitted file list and the rejected file list. The computer system according to claim 6.   The permitted file list that indicates a file specified by the system administrator as a target of file operation invocation by the operating system, the denied file list that indicates a file specified by the system administrator as a target of the file operation call, and the permission Update means for automatically updating the file list, hook means for interrupting the file operation call and supplementing the file operation call not approved by the system administrator, and for the files on the reject file list A computer comprising: means for prohibiting file operation invocation; and means for prohibiting invocation of the file operation on a file not on the permitted file list.   9. The computer according to claim 8, wherein the file operation call includes at least file write, move, delete, rename, process creation, and library read.   10. The computer according to claim 8, wherein the hook means returns a process other than a result of the file operation call including at least a warning message.   The computer according to any one of claims 8 to 10, wherein the hook means can be installed without permission to execute a file with a legitimate signature approved by the system administrator.   12. The computer according to claim 11, wherein the updating unit automatically adds an executable file and a library installed by an installer with a legitimate signature approved by the system administrator to the permitted file list.   13. The computer according to claim 8, wherein execution permission of the file is automatically set based on the permitted file list and the reject file list.   9. The update means sequentially updates the allowed file list and the reject file list when setting the permission of a file that is not described in the allowed file list and the reject file list. The computer according to claim 13. A file operation limiting method used in a computer system composed of a plurality of computers,
The management computer allows the operating system to call a file operation that is permitted by the system administrator, and lists the permitted files that the file specified by the system administrator. File list and automatically update the allowed file list,
Each of the computers to be managed interrupts the file operation call to supplement the file operation call that is not permitted by the system administrator, and calls the file operation call for the file on the reject file list. A file operation limiting method for prohibiting and prohibiting calling of the file operation for a file not on the permitted file list.   16. The file operation limiting method according to claim 15, wherein the file operation call includes at least file write, move, delete, rename, process creation, and library read.   The file operation limiting method according to claim 15 or 16, wherein when supplementing the file operation call, a process other than the result of the file operation call including at least a warning message is returned.   18. The installation according to claim 15, wherein when the file operation call is supplemented, a file with a legitimate signature approved by the system administrator can be installed without permission to execute the file operation. File operation limitation method.   When automatically updating the permitted file list, executable files and libraries installed by an installer with a legitimate signature approved by the system administrator are automatically added to the permitted file list. Item 18. The file operation limiting method according to Item 18.   20. The management computer automatically sets file execution permission of each of the management target computers based on the permitted file list and the reject file list. File operation limited method.   When the permission file list is automatically updated, the permission file list and the rejection file list are sequentially updated when permission settings for files not described in the permission file list and the rejection file list are performed. 21. The file operation limiting method according to any one of claims 15 to 20, wherein the file operation is limited. The computer includes a permission file list indicating that the file operation call target by the operating system is specified by the system administrator, and a file rejection list indicating the file operation call target specified by the system administrator. Hold
An update process in which the computer automatically updates the permitted file list; a hook process for interrupting the file operation call and supplementing a file operation call that is not permitted by the system administrator; and the reject file list A file operation limiting method, comprising: executing a process for prohibiting a call to the file operation for a file included in the file and a process for prohibiting a call to the file operation for a file not included in the permitted file list.   23. The file operation limiting method according to claim 22, wherein the file operation call includes at least file write, move, delete, rename, process creation, and library read.   24. The file operation limiting method according to claim 22, wherein in the hook process, a process other than a result of the file operation call including at least a warning message is returned.   25. The file operation limitation according to any one of claims 22 to 24, wherein, in the hook processing, the file can be installed without executing permission for a file with a legitimate signature approved by the system administrator. Method.   26. The file operation according to claim 25, wherein, in the update process, an executable file and a library installed by an installer with a legitimate signature approved by the system administrator are automatically added to the permitted file list. Limited method.   27. The file operation limiting method according to claim 22, wherein the computer automatically sets execution permission of the file based on the permitted file list and the rejected file list.   23. In the update process, the permission file list and the rejection file list are sequentially updated when permission settings are made for a file that is not described in the permission file list and the rejection file list. The file operation limiting method according to claim 27. It holds a permitted file list indicating a file specified by the system administrator as a target of the file operation call by the operating system, and a reject file list indicating a file specified as a reject by the system administrator as the target of the file operation call. In the calculator,
An update process for automatically updating the allowed file list;
A hook process for interrupting the file operation call and supplementing the file operation call not allowed by the system administrator;
A process for prohibiting the calling of the file operation on a file in the reject file list;
A program for executing a process for prohibiting the call of the file operation for a file not on the permitted file list.

Images