JP2010097550A - Virus prevention program, storage device detachable from computer, and virus prevention method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent the diffusion of a virus in the case of exchanging a file by connecting a USB memory, etc. to a computer that is not subjected to anti-virus measures. <P>SOLUTION: A detachable storage device is connected to the computer to start a virus prevention program, and the computer is made to operate as: an inputting means for inputting a file of a processing object by an API executing means when control is transferred from a hooking means; a detecting means for detecting whether or not the processing object file is infected with a virus; a determining means for outputting, to the AP executing means, the fact that processing by the API executing means fails when infected with the virus, and outputting the processing object file to an encrypting/decrypting means when not infected with the virus; a means for inputting the processing object file and encrypting or decrypting the processing object file; and an outputting means for inputting the encrypted or decrypted processing object file and outputting the encrypted or decrypted processing object file to the API executing means. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a technique for protecting information stored in a storage device such as a USB memory.

  In recent years, software called computer viruses has become widespread and has become a social problem. This software technology embeds program code that allows a virus creator to perform an operation in an executable program file or a file that contains a description of how to operate a computer called a macro. An operation that is not intended by the user is performed without permission.

Conventionally, as a technique for detecting such a computer virus, there are mainly the following two methods.
First, as a first method, as in the invention described in Patent Document 1, there is a method of searching for whether a computer virus is embedded in all files stored in a computer.
However, with this method, for example, if there are 1 million files in the computer, all 1 million files are checked, so that it takes a lot of time and CPU capacity to detect the presence or absence of a virus. was there.

As a second method, a program called a filter driver is embedded in advance in a file system that performs file access in an operating system (hereinafter sometimes referred to as OS), and file access operations of all programs are monitored. Then, there was a method of checking whether or not an operation on a file infected with a virus was performed.
This method does not check all files as in the first method, but only checks when a file is accessed, so that the file is not infected. Time is fast.

  However, in the case of a Windows (registered trademark) OS, monitoring of such file access operations must be realized by a driver in the kernel mode. However, operations in the kernel mode may be performed only by a person with administrator authority. Can not. For this reason, the second method has a problem that such a driver has to be installed in a computer in advance by a person with administrator authority of the OS, which is not convenient.

On the other hand, recently, files stored in a computer are frequently copied to a storage device such as a USB memory.
In such duplication, if the virus check function of the computer is weak and the file is infected with a virus, the infected file is stored in the USB memory. When this USB memory is connected to another computer and an infected file is used, there is a problem that the infection spreads to the other computer.

Here, as a virus prevention technique related to a storage device such as a USB memory, for example, a virus prevention apparatus described in Patent Document 2 can be cited.
In this technology, a virus prevention program is stored in a storage device such as a USB memory, and when the USB memory is connected to a computer, the virus prevention program is transmitted to the computer and activated.
As a result, the virus prevention program can be driven independently of the OS, and the influence of the virus at the time of introduction into the computer can be minimized.

JP 2006-522960 A JP 2008-519369 A Japanese Patent Laid-Open No. 11-119991

  However, although the virus prevention apparatus described in Patent Document 2 can execute a virus prevention program on a computer, a file infected with a virus is written from a computer to a USB memory or read from a USB memory to a computer. However, it does not prevent these.

  Therefore, the present inventor has intensively studied, and when a computer performs writing or reading of a USB memory, a file to be processed immediately before these processes are executed using an API (application program interface) hook technology. Confirm that the computer is not infected with the virus, and if it is not infected, the processing can be continued to prevent the virus-infected file from spreading between the computer and the USB memory, and administrator rights are required. The present invention has been completed by finding that the virus can be prevented without spreading.

Here, the API hook refers to an application program (hereinafter sometimes referred to as AP) that calls an application program interface (hereinafter also referred to as API) before processing by the API. After receiving control and enabling various processes, control is returned to the API.
In the present invention, this API hook technology is used when writing to the USB memory or reading from the USB memory is performed, and virus detection is performed on the file to be processed, thereby ensuring high safety of the data in the USB memory. At the same time, this can be realized without the need for administrator authority.

That is, as described above, in the method of installing a virus detection program in the file system and checking whether or not the file written to the USB memory is infected with the virus, administrator authority is required. There was a problem that the convenience was bad.
On the other hand, in the present invention using the API hook, it is possible to check whether or not the processing target file is infected with a virus without requiring administrator authority, and it is possible to improve convenience. It has become.

The API hook technique itself is a known technique, and Patent Document 3 describes a computer virus automatic detection system using a hook method.
According to this computer virus automatic detection system, by intercepting the file reception command by the file transfer program, it is confirmed whether the computer virus is infected to the file transferred to the computer system via the network. If not, the file is sent to the file transfer program and transferred to the storage device.

However, even if such a system is used, when a file infected with a virus is written from a computer to a USB memory or read from a USB memory to a computer, these cannot be prevented.
In addition, in this system, there is a problem that when the file transfer program itself is already infected with a virus, the spread of the virus cannot be prevented.

  The present invention is considered in view of the above circumstances, and performs virus detection and encryption of a file to be processed using an API hook when a storage device such as a USB memory is written or read. An object of the present invention is to provide a virus prevention program capable of ensuring the safety of data stored in a USB memory or data read from a USB memory, a storage device removable from a computer, and a virus prevention method.

  In order to achieve the above object, the virus prevention program of the present invention includes an AP execution unit that executes a predetermined application program, an API execution unit that executes a predetermined application program interface, and the AP execution unit that calls the API execution unit. An anti-virus program stored in a computer detachable storage device having hook means for exercising control of other processing before processing by the API execution means, the computer storing the storage device When connected, the computer starts the virus prevention program, and when the computer receives control from the hook means, the file input means for inputting the file to be processed by the API execution means, the processing object input by the file input means The file is If the virus detection means that detects whether or not the virus is infected and the file to be processed is infected with a virus, the fact that the processing by the API execution means has failed is output to the AP execution means, and the virus is infected. If not, a determination unit that outputs the processing target file to the encryption / decryption unit, and when the processing target file is input from the determination unit, an encryption / decryption unit that encrypts or decrypts the processing target file, In addition, when an encrypted or decrypted file to be processed is input from the encryption / decryption means, the file to be processed functions as a file output means for outputting to the API execution means.

  In addition, a storage device that can be attached to and detached from the computer of the present invention and has a virus prevention function is configured to store the above virus prevention program. Further, the biometric authentication function is provided.

  In addition, the virus prevention method of the present invention includes an AP execution means for executing a predetermined application program, an API execution means for executing a predetermined application program interface, and when the AP execution means calls the API execution means, the API execution means Before processing is performed, a removable storage device is connected to a computer having hook means for controlling the execution of other processing, and the computer starts an anti-virus program stored in the storage device. When the virus prevention program execution means generates control, the virus prevention program execution means receives the control from the hook means, inputs the file to be processed by the API execution means, and the input file to be processed is infected with a computer virus. If it is infected, A Outputs of the processing by the I execution means fails to AP execution means, if uninfected, certain processing target file as a method to encrypt or decrypt, and outputs the API execution unit.

According to the present invention, it is possible to write a virus-infected file to a storage device such as a USB memory or to read from the storage device without requiring installation or maintenance of a virus prevention program in advance on the computer. It becomes possible to prevent.
In addition, when an uninfected file is written to the USB memory, it is encrypted and written, so that the information stored in the storage device can be protected more safely.

Hereinafter, preferred embodiments of a virus prevention program, a computer detachable storage device, and a virus prevention method of the present invention will be described with reference to the drawings.
In addition, when the storage device removable from the computer of the present invention shown in the following embodiment is connected to the computer, the virus prevention program of the present invention stored in the storage device is started, and this virus prevention program is It is executed by a computer. The CPU of the computer sends a command to each component of the computer based on the virus prevention program, and predetermined processing necessary for the operation of the computer, for example, file input processing, virus detection processing, virus infection presence / absence determination processing, Encrypt / decrypt processing, file output processing, and the like are performed. Thus, each process and operation in the computer connected to the storage device detachable from the computer of the present invention can be realized by specific means in which the virus prevention program of the present invention and the computer cooperate.

[First embodiment]
First, the structure of 1st embodiment of this invention is demonstrated with reference to FIG.1 and FIG.2. FIG. 1 is a block diagram showing a configuration formed in a computer in which a removable storage device storing the virus prevention program of the present embodiment is connected to the computer, and shows a flow of writing a file in the storage device. is there. FIG. 2 is a block diagram showing a configuration formed in a computer in which a removable storage device storing the virus prevention program according to the present embodiment is connected to the computer, and shows a flow of reading a file from the storage device. is there.

  The storage device that can be attached to and detached from the computer according to the present embodiment is the USB memory 10 shown in FIGS. 1 and 2. The USB memory 10 stores a virus prevention program 11, a virus detection program 12, and an encryption / decryption program 13. Has been. Note that the storage device detachable from the computer of the present invention is not limited to the USB memory, and other storage devices such as a removable hard disk may be used.

In these drawings, the USB memory 10 is connected to the PC 20.
The PC 20 is an information processing apparatus such as a general-purpose personal computer or server in which an OS having an API hook function such as Windows (registered trademark) is installed.

  When the USB memory 10 is connected to the PC 20, the virus prevention program 11 is started by the PC 20, and the virus prevention program execution means 21 is formed in the PC 20 by the CPU and the memory of the PC 20. Similarly, when the virus detection program 12 is activated, virus detection program execution means 21b-1 is formed in the PC 20, and when the encryption / decryption program 13 is activated, encryption / decryption is performed in the PC 20. Program execution means 21d-1 is formed.

  The virus prevention program execution unit 21 includes a file input unit 21a, a virus detection unit 21b, a determination unit 21c, an encryption / decryption unit 21d, and a file output unit 21e.

The file input unit 21 a inputs a processing target file and outputs the processing target file to a corresponding unit based on the type of API input from the API hook 24.
That is, when the API type indicates writing, the file input unit 21a inputs the processing target file from the file storage unit 22 in the PC 20 and outputs it to the virus detection unit 21b as shown in FIG.
If the API type indicates reading, the file input means 21a inputs the processing target file from the USB memory 10 (file storage means 14) as shown in FIG. 2, and encrypts / decrypts means. To 21d.

  The virus detection unit 21b causes the virus detection program execution unit 21b-1 to detect whether the processing target file is infected with a virus. In addition, arbitrary things can be used for the virus detection program execution means 21b-1.

When the virus detection program execution unit 21b-1 detects a virus in the processing target file, the determination unit 21c determines that the file is infected with the virus and is contaminated. Then, the AP 23 is notified of information indicating that the API 25 processing has failed.
On the other hand, when no virus is detected in the processing target file, the determination unit 21c determines that the file is not infected with the virus and is not contaminated. Then, the file to be processed is output to the encryption / decryption means 21d.

The encryption / decryption means 21d causes the encryption / decryption program execution means 21d-1 to perform encryption or decryption processing of the processing target file.
That is, when the API type indicates writing, the encryption / decryption means 21d inputs the processing target file from the determination means 21c as shown in FIG. 1, and the encryption / decryption program execution means 21d- 1 and outputs the encrypted processing target file to the file output means 21e.

After confirming that the processing target file is not infected with a virus in this way, the processing target file is further encrypted, so that the file is taken out from the USB memory 10 by a third party, and is replaced by a file exchange software or the like. Even if it is spread to other computers, the information in the file to be processed is not known.
For this reason, when protecting the information stored in the USB memory 10, the safety can be further improved.

If the API type indicates reading, the encryption / decryption means 21d inputs the processing target file from the file input means 21a as shown in FIG. 2, and the processing target file is encrypted. It is determined whether it is a thing.
If it is encrypted, it is decrypted by the encryption / decryption program execution means 21d-1, and the decrypted processing target file is output to the virus detection means 21b.
Note that any encryption / decryption program execution means 21d-1 can be used.

The file output unit 21e outputs the input processing target file to a corresponding unit based on the type of API input from the API hook 24.
That is, when the API type indicates writing, the file output means 21e inputs the processing target file encrypted from the encryption / decryption means 21d as shown in FIG. 1 and outputs it to the API 25 in the PC 20. To do. The processing target file is written into the USB memory 10 (the file storage unit 14 in the USB memory 10) by the API 25.

  If the API type indicates reading, the file output means 21e inputs the processing target file from the determination means 21c and outputs it to the API 25 as shown in FIG. The processing target file is stored in the file storage unit 22 in the PC 20 by the API 25.

  The file storage means 22 is a storage device such as a memory or a hard disk in the PC 20 that stores files used by the AP 23, and may be externally connected to the PC 20. The file used by the AP 23 stored in the file storage unit 22 is a file to be processed by the API 25.

  The AP 23 is an execution unit that executes an application program executed on the PC 20. This application program is used as a program including a part of an OS such as an explorer in the claims and the specification in addition to a general application program such as a word.

As the API hook 24, hook means incorporated in an OS such as Windows can be used. The API hook 24 enables a separate process to be performed before the process by the API 25 called from the AP 23 is performed. When this separate processing is performed, the API hook 24 passes control to the API 25, and processing by the API 25 is executed.
The API 25 is an execution unit that executes programs (application program interfaces) such as various functions called by the AP 23. When the API 25 is called by the AP 23, the API 25 executes a corresponding predetermined process.

  Next, the processing procedure of the PC 20 executed based on the virus prevention program 11 of the present embodiment will be described with reference to FIGS. FIG. 3 is a flowchart showing a processing procedure from when the removable storage device storing the virus prevention program according to this embodiment is connected to a computer until an API hook is performed. FIG. 4 is a flowchart showing a processing procedure from when a removable storage device storing the virus prevention program according to the present embodiment is connected to a computer, after an API hook is performed, until a file is written to the storage device. It is. FIG. 5 is a flowchart showing a processing procedure from when a removable storage device storing the virus prevention program according to the present embodiment is connected to a computer, after an API hook is performed, until a file is read from the storage device. It is.

First, when the USB memory 10 is connected to the PC 20 (step 10), the virus prevention program 11 stored in the USB memory 10 is started by the PC 20 (step 11).
Next, processing by the API hook 24 is started (step 12), and when the API 25 is called from the AP 23 (step 13), it is determined whether or not the API is a hook target API (step 14).

When the API 25 is an API for writing a file, the file writing API 25 is hooked (step 15), and control is transferred to the virus prevention program execution means 21 by the API hook 24.
If the API 25 is an API for reading a file, the file reading API 25 is hooked (step 16), and control is transferred to the virus prevention program execution means 21 by the API hook 24.

Next, when the API 25 is an API for writing a file, the file to be processed is input from the file storage unit 22 of the PC 20 to the virus prevention program execution unit 21 (step 30).
Then, it is detected whether or not the processing target file is infected with a virus (step 31).

When a virus is detected in the file to be processed and it is determined that the file is infected (YES in step 32), the virus prevention program execution means 21 notifies the AP 23 of information indicating that the API 25 processing has failed. (Step 33).
This allows the API 23 to recognize that the API 25 has failed for some reason (for example, lack of access rights), and only prevents writing a file containing a virus without terminating the AP 23. Is possible.

When it is determined that no virus is detected in the file to be processed and the virus is not infected (NO in step 32), the virus prevention program executing means 21 encrypts the file to be processed by the encryption / decryption program executing means 21d-1. (Step 34), and outputs the encrypted processing target file to the API 25 (step 35).
Then, the API 25 writes the processing target file to the USB memory 10 (step 36).

Next, if the API 25 is an API for reading a file, the file to be processed is input from the file storage unit 14 of the USB memory 10 to the virus prevention program execution unit 21 (step 50).
Then, it is determined whether or not the processing target file is encrypted (step 51).

If it is encrypted (YES in step 52), a decryption process is performed (step 53).
Next, it is detected whether the decrypted process target file or the unencrypted process target file is infected with a virus (step 54).

  When a virus is detected in the file to be processed and it is determined that the file is infected (YES in step 55), the virus prevention program execution means 21 notifies the AP 23 of information indicating that the API 25 processing has failed. (Step 56).

  When it is determined that no virus is detected in the processing target file and the virus is not infected (NO in step 55), the virus prevention program execution means 21 outputs the processing target file to the API 25 (step 57). The file is stored in the file storage means 22 of the PC 20 (step 58).

Note that it is preferable that the processing target file stored in the file storage unit 22 of the PC 20 is automatically deleted at a predetermined timing, for example, when the opened file is closed. It is also preferable to save the processing target file not in the file storage unit 22 of the PC 20 but in the file storage unit 14 in the USB memory 10.
In this way, the decrypted file to be processed does not remain on the PC 20 after use, and the risk of information leakage from the USB memory 10 to the PC 20 can be reduced.

As described above, according to the virus prevention program, the storage device removable from the computer, and the virus prevention method of the present embodiment, it is not necessary to install the virus prevention program in the computer in advance or to maintain it. It is possible to prevent writing of a file infected with a virus to a storage device such as a USB memory or reading from a storage device.
For this reason, if a virus-infected file exists on a computer that does not have an anti-virus program installed, even if you connect the storage device of the present invention and try to write this infected file to the storage device, Can be prevented.
In addition, when an uninfected file is written to a USB memory, it is encrypted and written, so that information stored in the storage device can be protected more safely.

[Second Embodiment]
Next, the structure of 2nd embodiment of this invention is demonstrated with reference to FIG.6 and FIG.7. FIG. 6 is a block diagram showing a configuration formed in a computer in which a removable storage device storing the virus prevention program according to the present embodiment is connected to the computer, and shows a flow of writing a file to the storage device. is there. FIG. 7 is a block diagram showing a configuration formed in a computer in which a removable storage device storing the virus prevention program of the present embodiment is connected to the computer, and shows a flow of reading a file from the storage device. is there.

  This embodiment is different from the first embodiment in that when the virus prevention program 11 is executed by the PC 20, the user authentication means 21 f is configured in the virus prevention program execution means 21 generated in the PC 20. About another point, it is the same as that of 1st embodiment.

  The user authentication unit 21f executes user authentication processing based on the ID and password input by the user and biometric authentication information. Then, only when the authentication is successful, each process according to the other configuration in the virus prevention program execution means 21 can be executed. When the authentication fails, the USB memory 10 is disabled and information is written or read. None of these processes are executed.

For this user authentication process, a conventionally known method can be used. For example, when the USB memory 10 is connected to the PC 20, an ID and password input screen is displayed on the display unit of the PC 20, and the input information is stored in the USB memory 10. This can be done by determining whether or not the ID and password stored in advance in FIG.
Further, for example, by using the USB memory 10 having various biometric authentication functions such as fingerprint authentication, it is determined whether or not the input biometric information of the user matches the biometric information stored in the USB memory 10 in advance. Can also be performed.

  Next, the processing procedure of the PC 20 executed based on the virus prevention program 11 of this embodiment will be described with reference to FIG. FIG. 8 is a flowchart showing a processing procedure from when the removable storage device storing the virus prevention program according to this embodiment is connected to a computer until an API hook is performed.

First, when the USB memory 10 is connected to the PC 20 (step 70), the virus prevention program 11 stored in the USB memory 10 is started by the PC 20 (step 71).
Next, when the user authentication is executed (step 72) and the authentication fails (NO in step 73), the processing by the other configuration in the virus prevention program execution means 21 is not executed, and the USB memory 10 is read / written. I can't. The virus prevention program execution means 21, virus detection program execution means 21b-1, and encryption / decryption program execution means 21d-1 configured in the PC 20 are deleted from the PC 20 at a predetermined timing.

  If the authentication is successful (YES in step 73), then processing by the API hook 24 is started (step 74), and thereafter, processing similar to that in the first embodiment is executed.

  Next, referring to FIG. 9 and FIG. 10, when the USB memory 10 without the user authentication function of the first embodiment is used and when the USB memory 10 with the user authentication function of the second embodiment is used. Next, virus prevention in file writing and reading will be described.

  First, as shown in FIG. 9, when the USB memory 10 does not have a user authentication function, the virus prevention program of the present invention is activated when attempting to move or copy a virus-infected file from the PC 20 to the USB memory 10. If not, the infected file is written in the USB memory 10.

On the other hand, if the virus prevention program of the present invention is activated, the infected file can be prevented from being written to the USB memory 10.
Further, a normal file not infected with a virus is normally written after being encrypted in the USB memory 10 even if the virus prevention program of the present invention is activated.

Similarly, when moving or copying a virus-infected file from the USB memory 10 to the PC 20 and trying to read it, the infected file is stored in the PC 20 unless the virus prevention program of the present invention is activated. .
On the other hand, if the virus prevention program of the present invention is activated, the infected file can be prevented from being stored in the PC 20.
Further, a normal file not infected with a virus is decrypted if it is encrypted, and stored in the PC 20 as it is if it is not encrypted.

  As described above, when the USB memory 10 not having the user authentication function is used, if the virus prevention program of the present invention is not activated, it is possible to exchange a file infected with a virus. Therefore, it is desirable to keep the program running while the PC 20 is running without stopping or ending the program.

  Next, as shown in FIG. 10, in the case where the USB memory 10 is provided with a user authentication function, when the user authentication is successful, the virus prevention program of the present invention is already started, and the virus prevention program execution means 21 is started on the PC 20. Virus detection program execution means 21b-1 and encryption / decryption program execution means 21d-1 are configured.

For this reason, the virus-infected file is determined as being infected by the virus prevention program execution means 21 and is not written to the USB memory 10.
In addition, a normal file that is not infected with a virus is encrypted and written normally to the USB memory 10.

Similarly, when a file infected with a virus is transferred or copied from the USB memory 10 to the PC 20 and read, similarly, when the authentication is successful, the virus prevention program of the present invention has already been started. Saving to the PC 20 can be prevented.
A normal file not infected with a virus is decrypted by the virus prevention program of the present invention if it is encrypted, and is stored in the PC 20 as it is if it is not encrypted.

  As described above, when the USB memory 10 having the user authentication function is used, the USB memory 10 memory cannot be used unless the virus prevention program of the present invention is activated. It is not necessary to keep it running for as long as the PC 20 needs to access the USB memory 10 from the PC 20.

[Third embodiment]
Next, the structure of 3rd embodiment of this invention is demonstrated with reference to FIG. FIG. 11 is a block diagram showing a configuration formed in a computer in which a removable storage device storing the virus prevention program of the present embodiment is connected to the computer, and is a diagram showing a flow of reading a file from the storage device. is there.

  In the present embodiment, when the file to be processed is encrypted, it is determined whether or not the AP 23 that called the API 25 is a predetermined one before performing decryption by the encryption / decryption program 23. This is different from the second embodiment. About another point, it is the same as that of 2nd embodiment.

That is, in the present embodiment, when the USB memory 10 is connected to the PC 20 and the virus prevention program 11 is activated, the virus prevention program execution means 21 including the application confirmation means 21g is generated in the PC 20.
When it is determined by the encryption / decryption unit 21d that the processing target file is encrypted, the application confirmation unit 21g is called by the encryption / decryption unit 21d and the type of the AP 23 input from the API hook 24 The AP 23 determines whether or not the AP 23 is to execute a predetermined application program designated in advance, and returns the determination result to the encryption / decryption means 21d.

  The encryption / decryption unit 21d decrypts the processing target file when the AP 23 executes a predetermined application program specified in advance as a result of the determination by the application confirmation unit 21g. If the predetermined application program is not indicated, the process ends without decoding the processing target file.

  Next, the processing procedure of the PC 20 executed based on the virus prevention program 11 of the present embodiment will be described with reference to FIG. FIG. 12 is a flowchart showing a processing procedure from when a removable storage device storing the virus prevention program according to the present embodiment is connected to a computer, after an API hook is performed, until a file is read from the storage device. It is.

  First, when a processing target file is input from the file storage unit 14 of the USB memory 10 to the virus prevention program execution unit 21 (step 90), it is determined whether or not the processing target file is encrypted (step 91). .

If it is encrypted (YES in step 92), it is determined whether or not the AP 23 that has called the API 25 is to execute a predetermined application program (step 93).
Whether or not the AP 23 is a predetermined application program specified in advance can be determined based on information indicating the type of the AP 23 input from the API hook 24.

  If the result of the determination is that the AP 23 is a predetermined application program designated in advance (YES in step 94), the processing target file is decrypted (step 95), and the AP 23 is designated in advance. If it is not an application program (NO in step 94), the process ends. Other processing procedures can be the same as those in the second embodiment.

  As described above, according to the virus prevention program, the storage device removable from the computer, and the virus prevention method according to the present embodiment, the processing target file is decrypted only when the API 25 is called from a certain application program. This makes it possible to prevent a third party from decrypting the processing target file using a special program.

It goes without saying that the present invention is not limited to the above embodiment, and that various modifications can be made within the scope of the present invention.
For example, the application confirmation unit 21g may be added to the configuration of the first embodiment as appropriate.

  The present invention can prevent the spread of viruses when the USB memory 10 is connected to a computer or the like that has not been subjected to virus countermeasures to exchange files, and can be suitably used.

The block diagram which shows the structure formed in the said computer which connected the removable storage apparatus which stored the virus prevention program of 1st embodiment of this invention to the computer, The figure which showed the flow which writes a file in a storage apparatus is there. The figure which showed the flow which reads the file from a memory | storage device in the block diagram which shows the structure formed in the said computer which connected the computer with the removable storage device which stored the virus prevention program of 1st embodiment of this invention. is there. It is a flowchart which shows the process sequence after connecting the removable storage apparatus which stored the virus prevention program of 1st embodiment of this invention to a computer, and performing an API hook. The flowchart which shows the process sequence after writing the file to a memory | storage device after connecting the removable memory | storage device which stored the virus prevention program of 1st embodiment of this invention to a computer, and performing API hook. It is. The flowchart which shows the process sequence after reading the file from a memory | storage device after connecting the removable memory | storage device which stored the virus prevention program of 1st embodiment of this invention to a computer, API hooking was performed. It is. In the block diagram which shows the structure formed in the said computer which connected the removable storage device which stored the virus prevention program of 2nd embodiment of this invention to the computer, it is the figure which showed the flow which writes a file in a storage device. is there. The figure which showed the flow which reads the file from a memory | storage device in the block diagram which shows the structure formed in the said computer which connected the removable storage device which stored the virus prevention program of 2nd embodiment of this invention to the computer. is there. It is a flowchart which shows the process sequence after connecting the removable memory | storage device which stored the virus prevention program of 2nd embodiment of this invention to a computer, and performing an API hook. It is a conceptual diagram which shows the virus prevention in the writing of the file to a memory | storage device, and the reading of the file from a memory | storage device when the removable memory | storage device of 1st embodiment of this invention is connected to a computer. It is a conceptual diagram which shows the virus prevention in the writing of the file to a memory | storage device, and the reading of the file from a memory | storage device when the removable memory | storage device of 2nd embodiment of this invention is connected to a computer. The figure which showed the flow which reads the file from a memory | storage device in the block diagram which shows the structure formed in the said computer which connected the computer with the removable storage device which stored the virus prevention program of 3rd embodiment of this invention. is there. The flowchart which shows the process sequence after reading the file from a memory | storage device after connecting the removable memory | storage device which stored the virus prevention program of 3rd embodiment of this invention to a computer, and an API hook was performed. It is.

Explanation of symbols

10 USB memory (storage device)
DESCRIPTION OF SYMBOLS 11 Virus prevention program 12 Virus detection program 13 Encryption / decryption program 14 File storage means 20 PC (computer)
21 virus prevention program execution means 21a file input means 21b virus detection means 21b-1 virus detection program execution means 21c determination means 21d encryption / decryption means 21d-1 encryption / decryption program execution means 21e file output means 21f user authentication Means 21g Application confirmation means 22 File storage means 23 AP (application program)
24 API hook 25 API (application program interface)

Claims (12)

AP execution means for executing a predetermined application program, API execution means for executing a predetermined application program interface, and when the AP execution means calls the API execution means, before the processing by the API execution means is performed, A virus prevention program stored in a computer detachable storage device having hook means for controlling other processes in an executable manner,
When the storage device is connected to the computer, the computer starts the virus prevention program,
The computer,
A file input means for inputting a file to be processed by the API execution means when control is passed from the hook means;
Virus detection means for detecting whether or not the processing target file input by the file input means is infected with a computer virus;
If the file to be processed is infected with a virus, the fact that the process by the API executing unit has failed is output to the AP executing unit, and if the file to be processed is not infected, the file to be processed is encrypted. Determining means for outputting to the decoding means;
When the file to be processed is input from the determination unit, the encryption / decryption unit that encrypts or decrypts the file to be processed, and
A virus prevention program for functioning as a file output unit that outputs a file to be processed to the API execution unit when the file to be processed that has been encrypted or decrypted is input from the encryption / decryption unit. When the file to be processed is stored in a file storage unit in the computer, and the application program interface executed by the API execution unit performs a file writing process,
The file to be processed is input from the file storage unit by the file input unit,
The virus detection means detects whether the processing target file is infected with a computer virus,
When it is determined by the determination unit that the file is infected, it is output to the AP execution unit that the process by the API execution unit has failed. When it is determined that the file is not infected, the file to be processed is Output to the encryption / decryption means,
The file to be processed is encrypted by the encryption / decryption means,
The file output means outputs the encrypted processing target file to the API execution means,
The virus prevention program according to claim 1, wherein the encrypted file to be processed is written into the storage device by the API execution unit. When the file to be processed is stored in the storage device, and the application program interface executed by the API execution unit performs a file reading process,
The file to be processed is input from the storage device by the file input means,
The encryption / decryption means confirms whether or not the file to be processed is encrypted, and if encrypted, it is decrypted,
The virus detection means detects whether the processing target file is infected with a computer virus,
If it is determined by the determination means that the file is infected, it is output to the AP execution means that the processing by the API execution means has failed. If it is determined that the file is not infected, the file to be processed is Output to the file output means,
The file output means outputs the processing target file to the API execution means,
The virus prevention program according to claim 1, wherein the API execution unit stores the file to be processed in a file storage unit in the computer. The computer,
Only when the authentication process is performed based on the inputted predetermined identification information and the authentication is successful, each of the file input means, the virus detection means, the determination means, the encryption / decryption means, and the file output means The virus prevention program according to any one of claims 1 to 3, for functioning as an authentication means for enabling the function. The computer,
The encryption / decryption means confirms whether or not the file to be processed is encrypted. If the file is encrypted, the AP execution means that called the API execution means executes a predetermined application program. It is determined whether or not to execute, function as an application confirmation unit that outputs the determination result to the encryption / decryption unit,
Claims for causing the encryption / decryption means to decrypt the file to be processed only when the AP execution means is to execute a predetermined application program as a result of the determination. The virus prevention program according to 3.   A storage device detachable from a computer, storing the virus prevention program according to claim 1.   A storage device that stores the virus prevention program according to claim 1 and has a biometric authentication function, and is detachable from a computer. AP execution means for executing a predetermined application program, API execution means for executing a predetermined application program interface, and when the AP execution means calls the API execution means, before the processing by the API execution means is performed, A removable storage device is connected to a computer having hook means for controlling execution of other processing,
The computer starts an anti-virus program stored in the storage device, and generates anti-virus program execution means,
The virus prevention program execution means is
When control is passed from the hook unit, a file to be processed by the API execution unit is input,
Detects whether the input file to be processed is infected with a computer virus,
When infected, the fact that processing by the API executing means has failed is output to the AP executing means, and when not infected, the file to be processed is encrypted or decrypted and output to the API executing means A virus prevention method characterized by: When the file to be processed is stored in file storage means in the computer, and the application program interface executed by the API execution means performs file writing processing,
The virus prevention program execution means is
Input the file to be processed from the file storage means, detect whether the file to be processed is infected with a computer virus,
If infected, the fact that processing by the API executing means has failed is output to the AP executing means, and if not infected, the file to be processed is encrypted and output to the API executing means,
The virus prevention method according to claim 8, wherein the API execution unit writes the encrypted file to be processed into the storage device. When the file to be processed is stored in the storage device, and the application program interface executed by the API execution unit performs a file reading process,
The virus prevention program execution means is
Input the file to be processed from the storage device,
Detecting whether or not the processing target file is encrypted, and if it is encrypted, decrypting the processing target file,
Detecting whether the processing target file is infected with a computer virus,
If infected, the fact that the processing by the API executing means has failed is output to the AP executing means, and if not infected, the processing target file is output to the API executing means,
The virus prevention method according to claim 8, wherein the API execution unit stores the file to be processed in a file storage unit in the computer. When the storage device is connected to the computer and the computer starts the virus prevention program,
The virus prevention program execution means is
The authentication process is executed based on the inputted predetermined identification information, and the process after the input of the file to be processed is executed only when the authentication is successful. The virus prevention method as described. The virus prevention program execution means is
When the file to be processed is encrypted, the AP execution unit that called the API execution unit determines whether or not to execute a predetermined application program, and executes the predetermined application program. The virus prevention method according to claim 10, wherein the file to be processed is decrypted only in a certain case.

Images