JP2011040044A - Device, system, program and method for integrating virtual thin client - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a virtual thin client integration device for temporarily restricting access to a peripheral device in a specific case without making it necessary to perform the log-in or reactivation of an activated computer. <P>SOLUTION: The virtual thin client integration device includes: a hook means for, when the calling processing of an API(Application Program Interface) is performed by an AP(Application Program) and the API performs file access, hooking the calling processing; an access destination determination means for, when the hook processing is performed, determining whether access destination by the API is access destination as the object of access non-permission; and an access destination changing means for, when the access destination by the API is the access destination as the object of non-permission, rewriting the access destination with different access destination. When the pertinent access destination is not the access destination as the object of non-permission, the hook means permits the calling processing of the API, and when the pertinent access destination is the access destination as the object of non-permission, the hook means rewrites the access destination with different access destination, and calls the API, and makes the different access destination store the file, and outputs information indicating that the processing has been normally performed to the AP. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to security technology for preventing information leakage, and more particularly to technology for converting a general-purpose personal computer into a thin client.

2. Description of the Related Art In recent years, thin client devices have been widely used in enterprises in which client computers used by general employees have a minimum function, and server computers manage resources such as application software and files.
This thin client device uses a dedicated computer that has only minimum functions such as display and input. By centrally managing resources such as application software on the server side, the operating cost and management cost of the information system are reduced. Reduction is achieved.

Moreover, even if the thin client device is not equipped with a hard disk or is physically equipped with a hard disk, there is a restriction that applications and files cannot be stored.
For this reason, the thin client device is attracting attention as an effective means for preventing information leakage.

  There are various thin client technologies, and one that is widely used is a screen transfer type. In the screen transfer type thin client technology, a screen related to an application program displayed on the client device is actually processed by the server device and transmitted to the client device. In the client device, only processing related to screen display is performed, and an important file or the like is not stored in the client device.

Examples of the prior art related to such a thin client include the following.
First, in the thin client technology described in Patent Document 1, virtual hardware is provided in a client device, and an OS program included in image data transmitted from a server device is executed on the virtual hardware, and the OS is executed on this OS. The application program included in the image data transmitted from the server device is executed to perform various processes. Then, after the process is completed, the thin client system is realized by deleting the image data stored in the client device.

Further, in the thin client technology described in Patent Document 2, the server device stores the restriction data related to the access permission to the management target data, and transmits the restriction data to the client device in response to the access from the client device. Based on this restriction data, the system shifts to a predetermined state relating to whether or not access is permitted.
As a result, the output enable / disable state of the external output means of the client device is automatically shifted, and only when the function of the external output means is limited, the client device can execute information processing related to the management target data.

  Furthermore, in the thin client technology described in Patent Document 3, it is possible to automatically switch the work environment of a computer to a stand-alone or a thin client according to a network connection state.

JP 2009-26031 A JP 2007-310822 A JP 2007-133713 A

However, such conventional thin client technology requires that the client device be connected to the network, and it is not considered to realize the thin client device in the offline state.
Originally, with thin client technology, processing related to application software, files, and the like is performed on a server device, and display and input are performed on the thin client device side. For this reason, the idea of turning an offline computer into a thin client has not been seen so far.
However, even in the offline state, in certain cases, it may be desirable to put the computer into a state like a thin client device from the viewpoint of preventing information leakage.

  For example, when using a general personal computer (sometimes referred to as a rich client or fat client) in an enterprise, when a specific important file is accessed while usually enabling all functions. However, there are cases where it is desired to prevent information leakage by limiting the functions of the external output means.

Here, as means for preventing information leakage from the file, for example, there is a method of setting restrictions on reading and writing in the file itself. However, in the case of a file that has been given access to a specific user, the user of the file must be careful about the handling of the file, and even if the user does not intend to send the file to the network by mistake. There is a risk that the contents of important files will be leaked.
In addition, the filter driver function can be set in the operating system to restrict access to important files. However, special user authority is required for setting to such an operating system, and the function cannot be activated unless the operating system is restarted after setting.

  Therefore, the present inventor has intensively studied, and when an API (application program interface) is called from an AP (application program), interrupt processing is performed in order to execute other processing before processing by the API is performed. (This is called an API hook), it is determined whether the access destination of the API is an access destination to which access is not permitted, and execution of processing by the API is permitted only when the access destination is not an access prohibition target. As a result, the computer was successfully made into a pseudo thin client only in a specific case, and the present invention was completed.

The present invention has been considered in view of the above circumstances, and temporarily does not require a login or restart to a running computer, and in a specific case, temporarily to a peripheral device such as a hard disk of a computer. A virtual thin client device, a virtual thin client system, a virtual thin client program, and a virtual thin client method capable of limiting read / write access and software that can be activated and making a pseudo thin client device For the purpose of provision.
The concept of virtualizing a computer that is usually used as a general rich computer into a virtual thin client in some cases has not existed so far.

  In order to achieve the above object, a virtual thin client device of the present invention includes a virtual thin client including an AP execution unit that executes a predetermined application program, an API execution unit that executes a predetermined application program interface, and a peripheral device. When the virtual thin client device is called by the AP execution unit and calls the API execution unit without providing the filter driver in the operating system of the virtual thin client device, the API execution unit If access is to be made, API hook means for performing hook processing for executing other processing before processing by the API execution means is performed, and when the hook processing is performed, the access destination by the API execution means is accessed. The object to be disallowed An access destination that rewrites the access destination to an access destination that is different from the access destination when the access destination by the API execution means is an access destination to be denied access. And when the access destination by the API execution means is not the access destination that is not permitted to be accessed, the API execution means is allowed to call the API execution means and the access destination by the API execution means is not accessible. If the access destination is a target to be permitted, the access destination changing means rewrites the access destination to an access destination different from the access destination, calls the API execution means, allows the API execution means to access a different access destination, and AP Processing by the API execution means is normally performed for the execution means. It is constituted to output information indicating that.

  Further, the virtual thin client system of the present invention includes an AP execution means for executing a predetermined application program, an API execution means for executing a predetermined application program interface, and a peripheral device, and a detachable attachment to the computer. In a virtual thin client system having a storage device that can be connected to the removable storage device, when the API execution means calls the API execution means by the AP execution means, the API execution means performs file access. API hook means for performing hook processing for executing other processes before processing by the API execution means, and access destinations to be accessed by the access destination by the API execution means when the hook processing is performed. Access destination judging means for judging whether or not In the case where the access destination by the API execution means is an access destination to be denied access, access destination changing means for rewriting the access destination to an access destination different from the access destination is provided, and a filter driver is provided in the computer operating system. If the access destination by the API execution means is not the access destination that is not permitted to be accessed, the API hook means is permitted to call the API execution means and the access destination by the API execution means is not permitted to access. If the access destination is an access destination, the access destination is changed to an access destination different from the access destination by the access destination changing means, the API execution means is called, and the API execution means is made to access a different access destination. API execution means According processing is configured so as to output the information indicating the success of the process.

  The virtual thin client program of the present invention converts a computer including an AP execution means for executing a predetermined application program, an API execution means for executing a predetermined application program interface, and a peripheral device into a virtual thin client. When the API execution means is called by the AP execution means without providing the filter driver function in the computer operating system, the API execution means accesses the file. If the API execution means is an API hook means for performing hook processing for executing other processes before the processing by the API execution means is performed, the access destination by the API execution means is not accessible. The access destination is different from the access destination when the access destination by the access destination determination unit that determines whether or not the access destination is to be permitted and the access destination by the API execution unit is the access destination that is not permitted to access. It functions as an access destination changing means for rewriting to an access destination, and when the access destination by the API execution means is not an access destination to be denied access, the API execution means is permitted to call the API execution means, and the API execution means When the access destination is an access destination to be denied access, the access destination changing unit rewrites the access destination to an access destination different from the access destination, calls the API execution unit, and the access destination varies depending on the API execution unit. API access to AP execution means Processing by stages is a configuration for outputting information indicating the success of the process.

  The virtual thin client method of the present invention converts a computer including an AP execution means for executing a predetermined application program, an API execution means for executing a predetermined application program interface, and a peripheral device into a virtual thin client. When the API execution means calls the API execution means by the AP execution means without providing the filter driver function in the computer operating system, the API execution means performs file access. If it is, the hook processing for executing other processing is performed before the processing by the API execution means is performed. When the access destination determination means in the computer performs the hook processing, the access by the API execution means is performed. If the API hook means is not the access destination of the access disallowed by the API execution means, the API execution means is called. If the access destination by the API execution means is an access destination to be denied access, the access destination change means in the computer rewrites the access destination to an access destination different from the access destination, and calls the API execution means. In this method, different access destinations are accessed by the API execution unit, and information indicating that the processing by the API execution unit has been normally performed is output to the AP execution unit.

  According to the present invention, the computer can be simulated by restricting the read / write access to peripheral devices such as the hard disk of the computer and the software that can be started without requiring login or restart to the computer being started. Can be made into a thin client. In particular, the computer can be temporarily made into a virtual thin client in a predetermined case such as the moment when an important file is opened. Further, even if the computer is not connected to the network, it can be made into a virtual thin client.

In the block diagram which shows the structure of the virtual thin client apparatus of 1st embodiment of this invention, it is a figure which shows the flow of a process at the time of access permission. In the block diagram which shows the structure of the virtual thin client apparatus of 1st embodiment of this invention, it is a figure which shows the flow of a process at the time of access non-permission. It is a flowchart which shows the process sequence of the virtual thin client apparatus of 1st embodiment of this invention. In the block diagram which shows the structure of the virtual thin client apparatus of 2nd embodiment of this invention, it is a figure which shows the flow of a process at the time of access non-permission. It is a flowchart which shows the process sequence of the virtual thin client apparatus of 2nd embodiment of this invention. It is a block diagram which shows the structure of the virtual thin client apparatus of 3rd embodiment of this invention. It is a block diagram which shows the structure of the virtual thin client apparatus of 4th embodiment of this invention. In the block diagram which shows the structure of the virtual thin client system of 5th embodiment of this invention, it is a figure which shows the flow of a process at the time of access permission. In the block diagram which shows the structure of the virtual thin client-ized system of 5th embodiment of this invention, it is a figure which shows the flow of a process at the time of access non-permission. In the block diagram which shows the structure of the virtual thin client system of 6th embodiment of this invention, it is a figure which shows the flow of a process at the time of access permission. In the block diagram which shows the structure of the virtual thin client system of 7th embodiment of this invention, it is a figure which shows the flow of a process at the time of access non-permission. It is a flowchart which shows the process sequence of the virtual thin client system of 7th embodiment of this invention. In the block diagram which shows the structure of the virtual thin client system of 8th embodiment of this invention, it is a figure which shows the flow of a process at the time of access non-permission. It is a block diagram which shows the structure of the virtual thin client system of 9th embodiment of this invention. It is a block diagram which shows the structure of the virtual thin client system of 10th embodiment of this invention. It is a block diagram which shows the structure of the virtual thin client system of 11th embodiment of this invention.

Preferred embodiments of the virtual thin client device, virtual thin client system, virtual thin client program, and virtual thin client method of the present invention will be described below with reference to the drawings.
The virtual thin client device of the present invention shown in the following embodiments can be realized using a computer controlled by the virtual thin client program of the present invention. The CPU of the computer sends a command to each component of the computer based on the virtual thin client program, and performs predetermined processing necessary for the operation of the virtual thin client device, for example, API hook processing, call destination determination processing, call The destination change process, the encryption process, etc. are performed. Thus, each process and operation in the virtual thin client device of the present invention can be realized by specific means in which the program and the computer cooperate.

The program is stored in advance in a recording medium such as a ROM and a RAM, and is executed by causing the computer to read the program from a recording medium mounted on the computer. For example, the program may be read by the computer via a communication line.
Further, the recording medium for storing the program can be constituted by, for example, a semiconductor memory, a magnetic disk, an optical disk, or any other recording means that can be read by any computer.

[First embodiment]
First, the structure of 1st embodiment of this invention is demonstrated with reference to FIG.1 and FIG.2. FIG. 1 is a block diagram showing the configuration of the virtual thin client device of this embodiment, and FIG. 2 is a diagram showing a processing flow when access is permitted, and FIG. 2 is a diagram showing a processing flow when access is not permitted.

In FIG. 1, a PC 10 represents the virtual thin client device of this embodiment. The PC 10 operates as a rich client having multiple functions during normal use, and can be made into a pseudo thin client in a specific case.
The PC 10 includes an AP (application program) 11, an API (application program interface) 12, a file system 13, a hard disk 14, an API hook unit 15, and an access destination determination unit 16.

  The AP 11 is a means for executing an application program. The application program includes, for example, a general application program such as a word, and a program constituting a part of the OS such as an explorer.

  The API 12 is a means for executing programs such as various functions called by the AP 11, and is called by the AP 11 to execute each process. There are various APIs 12. In the present embodiment, an API that performs file access such as file reading and writing, printing, and external output is to be hooked by the API hook unit 21. In the example of FIG. 1, only one API 12 is shown, but a plurality of APIs 12 may be called.

The file system 13 manages data recording in peripheral devices such as the hard disk 14.
The hard disk 14 is data storage means in the PC 10. In the present embodiment, the access destination of the API 12 is the hard disk 14, but is not limited to this, and other peripheral devices such as an auxiliary storage device such as a DVD drive and an output device such as a printer may be used. it can.

  The API hook unit 15 hooks a calling process of a predetermined API 12 specified in advance as a hook target among the APIs 12 called by the AP 11. That is, the API hook unit 15 can perform separate processing before the processing by the API 12 called from the AP 11 is performed. The predetermined API 12 can be stored in advance in the API hook means 15 or other storage means. The predetermined API 12 can be any API that performs file access such as reading and writing to the hard disk 14 and other external storage devices, output to a printing device, and transmission to a network.

  When the API hook unit 15 hooks a calling process of a predetermined API 12, the control is transferred to the access destination determination unit 16, and the access destination by the API 12 is specified in advance as a target to be denied access under the virtual thin client state. The access destination determination unit 16 determines whether the file is a file or the like. Note that “predetermined files etc. specified as a target to be denied access” are important files that are subject to information leakage prevention, and are identified by either the directory name or the file name where the file is located. Can do. This directory name or file name can be stored in advance in the access destination determination means 16 or other storage means and used for the determination processing.

The API hook can be performed by the following two methods.
First, as a first hook method, there is a method using an OS-provided API hook. In this method, a call to the API 12 is hooked by using hook means incorporated in an OS such as Windows (registered trademark).
However, in this method, since it may be hooked to a process that is not desired to be hooked, when it is necessary to accurately hook only the target one, the following second hook method is used.
The second hook method hooks a call to a predetermined API 12 by DLL injection. In this method, the code that calls the API on the memory is rewritten to enable execution of other processes instead of the API.

When configuring the API hook means 15, consider all APIs 12 that may be used in advance by the AP 11, select all the APIs 12 whose file names are arguments, and which APIs 12 are to be hooked. Must be stored in the API hook means 15.
Examples of the API 12 to be hooked include the following.

<Reading and writing files> NTCreateFile NTOpenFile NTCloseFile
<Print> OPenPrinterA OpenPrinterW StartDocPrinterA StartDocPrinterW EndPagePrinter EndDocPrinter
<Send file to network> NTCreateFile NTOpenFile NTCloseFile InternetConnectA InternetConnectW InternetOpenUrlA InternetOpenUrlW
<Restricted software that can be started> NTOpenFile
<Registry access> NtOpenKey NtCreateKey
<File sharing> NtShareAdd NTShareDel

The access destination determination unit 16 determines whether or not the access destination of the API 12 called from the AP 11 is a predetermined file or the like that is specified in advance as a target for which access is not permitted in the virtual thin client state. The result is returned to the API hook means 15.
As a result of the determination, if the access destination of the API 12 is not the predetermined file or the like, the PC 10 is not made into a virtual thin client. Therefore, as shown in FIG. 1, the API hook unit 15 executes the API 12 that the AP 11 was trying to execute. Called to cause the API 12 to execute file access processing. At this time, the API hook unit 15 receives the execution result from the API 12 and outputs information indicating that the process by the API 12 is normally performed to the AP 11 when the file access process by the API 12 is normally performed. On the other hand, if the file access process by the API 12 is not normally performed, error information is output to the AP 11.

On the other hand, as a result of the determination, if the access destination of the API 12 is the predetermined file or the like, the API hook means 15 outputs error information to the AP 11 as shown in FIG.
As a result, when viewed from the user or the AP 11 side, it becomes impossible to access a predetermined file such as an important document without logging in or restarting or setting file access authority, and the PC 10 is simulated. It is possible to make it thin client.

Next, a processing procedure (virtual thin client method) of the virtual thin client device of the present embodiment will be described with reference to the flowchart shown in FIG.
First, when the AP 11 performs a calling process of various APIs 12 that perform file access (step 10), the API hooking means 15 hooks the calling process before the process by the API 12 is executed (step 11).
At this time, the API hook means 15 acquires the API 12 call request information from the AP 11. The call request information includes information for specifying the API 12 to be called and file access destination information to be accessed.
Next, the API hook unit 15 passes control to the call destination determination unit 16.

The call destination determination unit 16 determines whether or not the access destination of the API 12 to be called is a predetermined file or the like specified as a target for which access is not permitted in the virtual thin client state (step 12).
In this access destination determination process, the “access destination of the API 12 to be called” is acquired from the “call request information of the API 12”, and as described above, this is stored in the “access destination determination means 16 or the like” This can be done by determining whether or not it is included in a “predetermined file or the like specified as an object to be prohibited”.

  In the access destination determination process, the file name to be accessed by the API 12 is analyzed to determine whether or not the file is a predetermined file, and the hardware of the access destination can be specified. Since the file name naming rules differ depending on the OS, the file name analysis is performed according to the naming rules of each OS.

  For example, when the OS is Windows, there are a plurality of naming rules. One of them is a naming rule for defining a file name by an alphabet called a drive name and a name following it. For example, if there are two file names C: \ test and D: \ test, C: \ and D: \ are drive names, and the subsequent test is the file name. The drive name represents the type of hardware connected to the PC. For example, in a certain PC, c: \ represents a hard disk and d: \ represents a USB memory drive. In this PC, if the access destination of the API 12 is “c: \ test”, it indicates access to a file in the hard disk, and if “d: \ test”, it means access to a file in the USB memory. I understand.

  The specific contents of the access destination determination process can be various. For example, writing of important files to the hard disk 14 is prohibited, but the USB memory 20 can be allowed, or both can be prohibited. In addition, an important file is permitted if it is read by the API, but can be prohibited if it is written, or both can be prohibited.

Next, as a result of the access destination determination process, if the access destination is a predetermined file or the like specified as a target for which access is not permitted (YES in step 13), the API hook unit 15 returns an error to the AP 11. (Step 14). As a result, the AP 11 cannot access the predetermined file or the like, and the PC 10 becomes a pseudo thin client.
That is, according to this virtual thin client method, a predetermined API is hooked and the access destination of the file is determined, so that reading and writing of the file to the hard disk 14, output to the printing apparatus, and output to the network are performed. Transmission or the like can be prohibited for each processing, and the PC 10 can be put into a pseudo thin client state.

  On the other hand, as a result of the determination of the access destination, if the access destination is not a predetermined file or the like specified as a target for which access is not permitted (NO in step 13), the API hook means 15 calls the API 12 (step 15), The file access by the API 12 is executed (step 16).

At this time, when the API hook unit 15 receives the execution result from the API 12 and the file access process by the API 12 is normally performed (YES in Step 17), the information indicating that the process by the API 12 is normally performed. Is returned to AP11 (step 18).
On the other hand, if the file access process by the API 12 is not normally performed, an error is returned to the AP 11 (NO in step 17).

  As described above, the access destination of the API 12 to be called can be acquired from the API 12 call request information, and whether the target file exists on the hard disk, the file server on the network, or the like. It can be obtained according to the rules of names.

As described above, the virtual thin client of the PC 10 in the present embodiment is temporarily performed at the time of the specific processing by the AP 11, and is released simultaneously with the end of the processing, so that the PC 10 returns to the normal state. become.
This makes it possible to restrict access to hard disks and peripheral devices for important files and the like without requiring login or restart to the running computer, and the virtual thin client of this embodiment It can be said that the computerization simply puts the computer into a thin client state.

  As described above, according to the virtual thin client device, the virtual thin client program, and the virtual thin client method according to the present embodiment, a normal computer usually has a moment when a user tries to access a predetermined file. In addition, it becomes possible to make a pseudo thin client.

[Second Embodiment]
Next, the configuration of the second embodiment of the present invention will be described with reference to FIG. This figure is a block diagram showing the configuration of the virtual thin client device of this embodiment, showing the flow of processing when access is not permitted.
The virtual thin client device of the present embodiment includes an access destination changing unit 17 and an encryption unit 18 in addition to the configuration in the first embodiment.

  Depending on the type of the AP 11, there may be a case where access to the file is simply disallowed, and an error is not returned to the AP 11 in response to the API 12 calling process, and the application does not operate normally. In the present embodiment, when a predetermined API 12 is called from such an AP 11 and access is made to a file or the like specified in advance as a target for which access is not permitted, virtual thin client implementation is realized. About another point, it can be set as the thing similar to 1st embodiment.

The access destination changing unit 17 performs a file replacement process by changing the file name of the access destination of the API 12.
As a result, the API 12 called from the AP 11 is made to access the replaced file. At this time, by making the storage location of the replaced file difficult for the user to see, it is temporarily stored in the hard disk without causing the AP 11 to recognize it and not appearing to be stored in the hard disk. To do.

However, since only such a file replacement process cannot sufficiently prevent leakage of information from the file, the file is encrypted by the encryption unit 18 in the present embodiment.
At this time, the file encrypted by the encryption unit 18 is sent from the API hook unit 15 to the API 12 and stored in the hard disk 14 via the file system 13.

When the API 12 for reading the encrypted file is called from the AP 11 and it is determined that the access destination is the access permission target and the decryption is performed, the encrypted file is transferred from the API hook unit 15 to the encryption unit 18. The data is sent and decrypted by the encryption means 18. The decrypted file is sent to the AP 11 via the API hook means 15.
In order to perform such decryption processing, it is preferable to add information for identifying that the file has been encrypted at the beginning of the file when the encryption unit 18 performs encryption. In this way, when the call destination determination means 16 inputs a file from the API 12, it can automatically determine whether or not the file should be decrypted.

Next, a processing procedure (virtual thin client method) of the virtual thin client device of the present embodiment will be described with reference to a flowchart shown in FIG.
First, the process of determining whether the access destination is an access-denied target from the API 12 calling process by the AP 11 (steps 30 to 33) and the API 12 calling process by the API hook unit 15 are normally performed. The operation up to the process of returning information indicating that to the AP 11 (step 40 to step 43) is the same as the operation (step 10 to step 13, step 15 to step 18) in the first embodiment. However, in the present embodiment, it is assumed that the API 12 that performs writing processing on a certain file is called by the AP 11.

In this embodiment, when the access destination of the API 12 is a target for which access is not permitted in the virtual thin client state (YES in step 33), and the API 12 is for writing a file (YES in step 34), the access is made. The destination changing unit 17 changes the access destination of the API 12 by changing the file name (step 35).
The encryption means 18 inputs the file written by the AP 11 via the API hook means 15 and encrypts the file (step 36).

Then, the API 12 is called by the API hook unit 15, the encrypted file is transferred from the API hook unit 15 to the API 12 (step 37), and stored in the hard disk 14 by the API 12 (step 38).
When the encrypted file storing process is normally performed (YES in step 42), the API hook unit 15 returns information indicating that the process by the API 12 is normally performed to the AP 11 (step 43).

On the other hand, if the API 12 does not write the file (NO in step 34), an error indicating that access to the file by the API 12 is prohibited from the API hook means 15 to the AP 11 as in the first embodiment. Return (step 39).
If the encrypted file storage process is not normally performed (NO in step 42), an error indicating that the process by the API 12 is not normally performed is returned to the AP 11 from the API hook unit 15 to the AP 11. (Step 39).

  As described above, in the present embodiment, the file is actually accessed and written by the API 12. However, since the user of the PC 10 has not performed writing to the original file, it is recognized that the writing has not been performed. Since the accessed file is encrypted, even if the file leaks, information leakage is prevented. For this reason, the PC 10 can be said to be a pseudo thin client.

  As described above, according to the virtual thin client device, the virtual thin client program, and the virtual thin client method of the present embodiment, a specific AP 11 that does not operate normally only by prohibiting file access can be obtained. Even when it is used, the virtual thin client of the PC 10 can be realized.

[Third embodiment]
Next, the structure of 3rd embodiment of this invention is demonstrated with reference to FIG. This figure is a block diagram showing the configuration of the virtual thin client device of this embodiment.
The virtual thin client device of the present embodiment includes an erasing unit 19 in addition to the configuration in the second embodiment.

This embodiment is different from the second embodiment in that an encrypted file stored in the hard disk 14 is deleted at a predetermined timing. Other points are the same as in the second embodiment.
Also in the second embodiment, the file stored in the hard disk 14 by the API 12 exists at an address different from the storage destination recognized by the AP 11 and is encrypted, so that information leakage does not occur. . However, if this encrypted file is deleted at a predetermined timing, the information leakage prevention effect can be further improved. Therefore, in the present embodiment, the erasure unit 19 erases the encrypted file on the hard disk 14.

  Note that, depending on the type of the AP 11, there is one that automatically deletes the file generated on the hard disk 14 at the end of the AP 11. However, even if there is an AP 11 that does not perform such an operation, or even if the above automatic erasure is not successful, the erasure unit is included in the virtual thin client device of the present embodiment so that the encrypted file can be erased. 19 is provided.

The erasing unit 19 calls an API for performing a file erasing process, and erases the encrypted file in the hard disk 14 via the file system 13.
As the files to be erased, not only all encrypted files but also specific names or only specific files input from the encryption means 18 can be targeted. Whether or not the file is an encrypted file can be determined by providing the file with identification information as to whether or not the file is encrypted when the encryption unit 18 encrypts the file.
The erasure timing can be, for example, when the encrypted file is closed, when the application by the AP 11 is terminated, when the browser is terminated, or when the USB memory 20 is connected to the PC 10 and when it is disconnected.

  As described above, according to the virtual thin client device, the virtual thin client program, and the virtual thin client method of the present embodiment, the PC 10 is converted into a virtual thin client, and an encrypted file is generated on the hard disk 14. In this case, the encrypted file can be deleted when the virtual thin client is released. For this reason, it becomes possible to further reduce the risk of information leakage from the PC 10.

[Fourth embodiment]
Next, the structure of 4th embodiment of this invention is demonstrated with reference to FIG. This figure is a block diagram showing the configuration of the virtual thin client device of this embodiment.
The virtual thin client computer of this embodiment includes a virtual thin client computer program 10a in addition to the configuration of the first embodiment.
This embodiment is different from the first embodiment in that the virtual thin client program 10a installed in advance in the PC 10 is activated to generate the API hook means 15 and the access destination determination means 16 in the PC 10. Other points are the same as in the first embodiment.

  It is also possible to generate each component in the PC 10 in the second embodiment or the third embodiment by the virtual thin client program 10a. That is, the virtual thin clientization program 10a is executed to generate the API hook unit 15, the access destination determination unit 16, the access destination changing unit 17, and the encryption unit 18, or in addition to these, the deletion unit 19 is generated. It is good also as a structure to do.

[Fifth embodiment]
Next, the structure of 5th embodiment of this invention is demonstrated with reference to FIG.8 and FIG.9. FIG. 8 is a block diagram showing the configuration of the virtual thin client system of this embodiment, and FIG. 9 is a diagram showing the flow of processing when access is permitted, and FIG. 9 is the flow of processing when access is not permitted.
The virtual thin client system of the present embodiment includes the PC 10 and a USB memory 20 that can be attached to and detached from the PC 10, and the first embodiment is different from the first embodiment in that the PC 10 is converted to a virtual thin client by the USB memory 20. Is different. Other points are the same as in the first embodiment. The virtual thin client method performed in the virtual thin client system can be performed in the same procedure as the flowchart of FIG.

The PC 10 is a device that is a virtual thin client in this embodiment, and is an information processing device such as a general-purpose personal computer that normally operates as a general rich client.
In this embodiment, the USB memory 20 has a configuration for making the PC 10 a virtual thin client, and when the USB memory 20 is connected to the PC 10, an important file is accessed, for example, under certain conditions. Thus, the PC 10 can be made into a pseudo thin client.
As shown in FIG. 8, the PC 10 includes an AP 11, an API 12, a file system 13, and a hard disk 14. These can be the same as those in the first embodiment.

The USB memory 20 is a removable disk that can be attached to and detached from the PC 10. In this embodiment, the USB memory is used. However, the present invention is not limited to this, and other various media can be used.
As shown in FIG. 8, the USB memory 20 includes an API hook unit 21 and an access destination determination unit 22. These have the same functions as the API hook unit 15 and the access destination determination unit 16 in the PC 10 of the first embodiment, respectively.

That is, in the present embodiment, the API hook unit 21 hooks a calling process of a predetermined API 12 specified as a hook target in advance among the APIs 12 called by the AP 11. As this predetermined API 12, all APIs that perform file access can be targeted.
Then, the API hook unit 21 causes the access destination determination unit 22 to determine whether or not the access destination of the API 12 is a predetermined file or the like specified in advance as a target for which access is not permitted in the virtual thin client state.

As a result of the determination, if the access destination of the API 12 is not the predetermined file or the like, the API hook unit 21 calls the API 12 and executes the file access process as shown in FIG.
As a result of the determination, if the access destination of the API 12 is the predetermined file or the like, the API hook unit 21 returns an error to the AP 11 as shown in FIG.

  According to the virtual thin client system, the virtual thin client program, and the virtual thin client method of the present embodiment, a configuration for converting the PC 10 into a virtual thin client on a removable disk such as the USB memory 20 is provided. It becomes possible to make an arbitrary PC 10 a pseudo thin client easily.

[Sixth embodiment]
Next, the structure of 6th embodiment of this invention is demonstrated with reference to FIG. This figure shows the flow of processing at the time of access permission in the block diagram showing the configuration of the virtual thin client system of this embodiment.
In the virtual thin client system of the present embodiment, when the AP 11 uses the API 12 to access a file in the storage unit 23 of the USB memory 20, the fifth aspect is that the access is permitted without making the PC 10 a virtual thin client. Different from the embodiment. Other points are the same as in the fifth embodiment. The virtual thin client method performed in the virtual thin client system can be performed in the same procedure as the flowchart of FIG.

  That is, in the virtual thin client system of this embodiment, when a predetermined API 12 is called from the AP 11, the USB memory 20 hooks the calling process by the API hook unit 21, and the access destination determination unit 22 accesses the API 12. It is determined whether or not the destination is a target for which access is not permitted in the virtual thin client state.

If the access destination of the API 12 is the storage means 23 in the USB memory 20 as a result of the determination, the API hook means 21 determines that the access destination is not a target for disallowing access in the virtual thin client state. API 12 is called to permit file access.
At this time, the API 12 accesses the storage unit 23 of the USB memory 20 via the file system 13. The storage unit 23 can be accessed by the API 12 without going through the file system 13.

[Seventh embodiment]
Next, the structure of 7th Embodiment of this invention is demonstrated with reference to FIG. This figure shows the flow of processing when access is not permitted in the block diagram showing the configuration of the virtual thin client system of this embodiment.
This embodiment is a variation system for realizing a virtual thin client when the API 12 is called from the AP 11 as in the second embodiment. In other words, depending on the type of the AP 11, there may be a case where access to the file is simply not permitted and an error is not returned to the AP 11 in response to the API 12 calling process, and the AP 11 does not operate normally.

  When the API 12 is called from such an AP 11, in the second embodiment, the access destination is changed, the file is encrypted and stored in the hard disk 14 by the API 12, and the AP 11 is normally processed. Returning information indicating that the virtual thin client of the PC 10 is realized. In other words, in the second embodiment, when there is no storage device other than the hard disk 14, by encrypting the file, a thin client is realized so that the user or a third party cannot access the file. Yes.

On the other hand, in the present embodiment, when another storage unit called the USB memory 20 is provided, the access destination changing unit 17 changes the storage location of the file to another storage unit, and the AP 11 stores the hard disk 14 in the storage unit. By making it recognize that it is accessing, the PC 10 is realized as a thin client.
That is, if a file in the hard disk 14 to be accessed by the AP 11 already exists, the entire file is copied to the storage means 23, and the API 12 is made to access this copy, as if the AP 11 is in the hard disk 14 It appears to be accessing that file. When the AP 11 tries to write to the file in the hard disk 14, the access destination is changed instead of writing to the file in the hard disk 14, and the API 12 writes to the file in the storage unit 23. . If the file exists on the hard disk 14 before starting writing, the file contents are copied to the storage means 23 and then written to the file, but the file does not exist on the hard disk 14. In this case, writing to the storage means 23 is performed immediately. About another point, it can be set as the thing similar to 6th embodiment.

In the virtual thin client system of this embodiment, as shown in FIG. 11, the API hook means 21 hooks the API 12-2 calling process by the AP 11, and the access destination determination means 22 determines the access destination of the API 12-2. It is determined whether or not the file is a specific file or the like which is a target to be denied access in the virtual thin client state.
As a result of the determination, if the access destination is a specific file or the like that is to be denied access, and the file is stored in the hard disk 14, the access destination changing unit 24 calls the API 12-3. The API 12-3 copies the file stored in the hard disk 14 through the file system 13 to the storage means 23 in the USB memory 20.

Then, the API hook unit 21 calls the API 12 to access the copied file in the storage unit 23 and returns information indicating normal termination to the AP 11.
As a result, the PC 10 is pseudo thin client.

  In this embodiment, as in the second embodiment, the file is actually accessed by the API 12, but the user of the PC 10 can recognize that the file access has not been performed properly. it can. The accessed file is not stored in the PC 10. Therefore, it can be said that the PC 10 is made into a pseudo thin client.

Next, a processing procedure (virtual thin client conversion method) of the virtual thin client conversion system of this embodiment will be described with reference to the flowchart shown in FIG.
In the figure, operations other than the operation of copying the access destination file in the hard disk to the USB memory (step 55) can be the same as the operation in FIG. 5 described in the second embodiment. However, in the present embodiment, API hook processing, access destination determination processing, and access destination change processing are performed by the API hook means 21, access destination determination means 22, and access destination change means 24 in the USB memory 20, respectively. This is different from the second embodiment.

That is, in this embodiment, when the API 12-2 is for writing a file, the access destination changing unit 24 calls the API 12-3 to copy the file to be accessed in the hard disk 14 to the storage unit 23. The access destination of the API 12-2 is changed to this duplicate file.
For example, when the name “c: \ TEST” is input as the API 12-2 writing destination from the API hook unit 21, the access destination changing unit 24 searches the hard disk 14 of the PC 10 and acquires the file. The file is copied and stored in the storage means 23 of the USB memory 20 with the file name changed to “d: \ TEST.TEMP”.

Further, by providing an encryption unit in the USB memory 20, the file can be encrypted as in the second embodiment.
Further, in the present embodiment, the API hook unit 15 calls not the API 12-2 itself that the AP 11 is trying to call, but a separate API 12 and copies the file copied to the storage unit 23 by the API 12. A writing process is in progress.

  According to the virtual thin client system, the virtual thin client program, and the virtual thin client method of the present embodiment, the type of the AP 11 simply does not permit access to the file, and the API call processing is performed to the AP 11. If it does not operate normally only by returning an error, it is possible to make the PC 10 pseudo thin client by allowing the API to access a file copied in the storage means 23 of the USB memory 20. Yes.

[Eighth embodiment]
Next, the configuration of the eighth embodiment of the present invention will be described with reference to FIG. FIG. 2 is a block diagram showing the configuration of the virtual thin client system of this embodiment.
The virtual thin client system of this embodiment differs from the second embodiment in that the same processing as that of the virtual thin client apparatus of the second embodiment is realized by the USB memory 20. Other points are the same as in the second embodiment, and the virtual thin client method of this embodiment can be the same as in the second embodiment.

  That is, the virtual thin client system of this embodiment is configured to perform the same processing as the API hook unit 15, the access destination determination unit 16, the access destination change unit 17, and the encryption unit 18 in the PC 10 of the second embodiment. As shown in FIG. 13, the USB memory 20 is configured as an API hook means 21, an access destination determination means 22, an access destination change means 24, and an encryption means 25, respectively.

When the AP 11 is of a special type that simply does not permit access to the file and does not operate normally only by returning an error to the API 11 in response to the API 12 call processing, the original access destination in the hard disk 14 Create an encrypted file in a separate location.
In this way, the AP 11 is notified that the processing by the API 12 has been performed normally, while the user is recognized as not being able to write to the file. As a result, the PC 10 is realized as a virtual thin client when the special AP 11 is used.

[Ninth embodiment]
Next, the structure of 9th embodiment of this invention is demonstrated with reference to FIG. FIG. 2 is a block diagram showing the configuration of the virtual thin client system of this embodiment.
The virtual thin client system of this embodiment differs from the third embodiment in that the same processing as that of the virtual thin client apparatus of the third embodiment is realized by the USB memory 20. The other points are the same as in the third embodiment, and the virtual thin client method of this embodiment can be the same as in the third embodiment.

That is, according to the present embodiment, the erasing unit 26 is provided in the USB memory 20, thereby erasing the encrypted file in the hard disk 14 at a predetermined timing such as when the file is closed or the application program is terminated.
As a result, the information leakage prevention effect can be further improved.

[Tenth embodiment]
Next, the configuration of the tenth embodiment of the present invention will be described with reference to FIG. FIG. 2 is a block diagram showing the configuration of the virtual thin client system of this embodiment.
The virtual thin client system of this embodiment has a virtual thin client program 27 in the USB memory 20 and executes this when the USB memory 20 is connected to the PC 10, and has the same functions as in the fifth embodiment. The API hook unit 21 and the access destination determination unit 22 are generated in the USB memory 20. The other points are the same as in the fifth embodiment, and the virtual thin client method of this embodiment can be the same as in the fifth embodiment.
Further, by executing the virtual thin client program 27, it is possible to generate the same configuration as that of the USB memory 20 of any of the sixth to ninth embodiments, and to realize the same functions as the respective embodiments. is there.

[Eleventh embodiment]
Next, the configuration of the eleventh embodiment of the present invention will be described with reference to FIG. FIG. 2 is a block diagram showing the configuration of the virtual thin client system of this embodiment.
The virtual thin client system of this embodiment has a virtual thin client program 27 in the USB memory 20 and executes it when the USB memory 20 is connected to the PC 10, and has the same functions as in the first embodiment. The API hook unit 15 and the access destination determination unit 16 are generated in the PC 10. About another point, it is the same as that of 1st embodiment, The virtual thin client-izing method of this embodiment can also be made the same as that of 1st embodiment.
Further, by executing the virtual thin client program 27, it is possible to generate the same configuration as the PC 10 of the second embodiment to the fourth embodiment, and to realize the same function as each embodiment.

It goes without saying that the present invention is not limited to the above embodiment, and that various modifications can be made within the scope of the present invention.
For example, after the API hook means 15 hooks the API 12 to be called by the AP 11, not the API 12 but another AP 1 is called, or the encrypted file is not created in the hard disk 14, but the memory or RAM disk in the PC 10. It is possible to make appropriate changes such as creating above. Files on memory and RAM disks are deleted when the power is turned off or reset. Therefore, if a PC user turns off the power and carries the PC when the work is finished, the PC should be removed. Even if it is lost, the risk of information leakage can be reduced.

  The present invention can be suitably used in a company or the like using a general computer, when it is desired to easily make a thin client without connecting these computers to a network.

10 PC (computer)
11 AP (application program)
12 API (Application Program Interface)
DESCRIPTION OF SYMBOLS 13 File system 14 Hard disk 15 API hook means 16 Access destination judgment means 17 Access destination change means 18 Encryption means 19 Deletion means 10a Virtual thin client program 20 USB memory 21 API hook means 22 Access destination judgment means 23 Storage means 24 Access destination Changing means 25 Encryption means 26 Erasing means 27 Virtual thin client program

Claims (16)

A virtual thin client device comprising an AP execution means for executing a predetermined application program, an API execution means for executing a predetermined application program interface, and a peripheral device,
Without providing a filter driver in the operating system of the virtual thin client device, the virtual thin client device is
When the API execution means calls the API execution means by the AP execution means, when the API execution means performs file access, the other processes are executed before the processing by the API execution means is executed. API hook means for performing hook processing;
When the hook process is performed, an access destination determination unit that determines whether or not the access destination by the API execution unit is an access destination to be denied access;
An access destination changing means for rewriting the access destination to an access destination different from the access destination when the access destination by the API execution means is an access destination to be denied access;
The API hook means
If the access destination by the API execution means is not the access destination to be denied access, the API execution means call processing is permitted,
When the access destination by the API execution means is an access destination to be denied access, the access destination change means rewrites the access destination to an access destination different from the access destination, and calls the API execution means. A virtual thin client device characterized in that the API execution means accesses the different access destinations and outputs information indicating that the processing by the API execution means has been normally performed to the AP execution means. . When the API execution means performs a file writing process, the API execution means includes an encryption means for inputting and encrypting the file from the API hook means,
The virtual thin client device according to claim 1, wherein the encrypted file by the API execution unit is stored in the different access destination. When the access destination changing unit is an access destination to which access is prohibited by the API execution unit, and the API execution unit performs file access, the access destination Duplicate files
3. The virtual thin client device according to claim 1, wherein the API hook unit calls the API execution unit and causes the API execution unit to access the copied file. 4. A removable storage device is connected to the virtual thin client device according to claim 1,
The access destination determination unit determines that the access destination by the API execution unit is not an access destination to be denied access when the access destination in the removable storage device is present in the storage area;
The virtual thin client device, wherein the API hook means calls the API execution means and causes the API execution means to access the access destination in the removable storage device. When the access destination changing unit is an access destination to which access is prohibited by the API execution unit, and the API execution unit performs file access, the access destination The file from the peripheral device to the removable storage device,
5. The virtual thin client device according to claim 4, wherein the API hook means calls the API execution means, and causes the API execution means to access the copied file. A virtual thin client system comprising a computer having an AP execution means for executing a predetermined application program, an API execution means for executing a predetermined application program interface, and peripheral devices, and a storage device detachable from the computer There,
The removable storage device is
When the API execution means calls the API execution means by the AP execution means, when the API execution means performs file access, the other processes are executed before the processing by the API execution means is executed. API hook means for performing hook processing;
When the hook process is performed, an access destination determination unit that determines whether or not the access destination by the API execution unit is an access destination to be denied access;
An access destination changing means for rewriting the access destination to an access destination different from the access destination when the access destination by the API execution means is an access destination to be denied access;
Without providing a filter driver in the operating system of the computer,
The API hook means
If the access destination by the API execution means is not the access destination to be denied access, the API execution means call processing is permitted,
When the access destination by the API execution means is an access destination to be denied access, the access destination change means rewrites the access destination to an access destination different from the access destination, and calls the API execution means. A virtual thin client system characterized in that the API execution means accesses the different access destinations and outputs information indicating that the processing by the API execution means has been normally performed to the AP execution means. . The removable storage device is
When the API execution means performs a file writing process, the API execution means includes an encryption means for inputting and encrypting the file from the API hook means,
The virtual thin client system according to claim 6, wherein the encrypted file is stored in the different access destination by the API execution unit. When the access destination changing unit is an access destination to which access is prohibited by the API execution unit, and the API execution unit performs file access, the access destination Duplicate files
The virtual thin client system according to claim 6 or 7, wherein the API hook means calls the API execution means, and causes the API execution means to access the copied file. The access destination determination unit determines that the access destination by the API execution unit is not an access destination to be denied access when the access destination in the removable storage device is present in the storage area;
9. The virtual thin according to claim 6, wherein the API hook unit calls the API execution unit and causes the API execution unit to access the access destination in the removable storage device. Clientized system. When the access destination changing unit is an access destination to which access is prohibited by the API execution unit, and the API execution unit performs file access, the access destination The file from the peripheral device to the removable storage device,
The virtual thin client system according to any one of claims 6 to 9, wherein the API hook means calls an API execution means and causes the API execution means to access the copied file. . A virtual thin client conversion program for converting a computer including an AP execution unit for executing a predetermined application program, an API execution unit for executing a predetermined application program interface, and a peripheral device into a virtual thin client,
Without providing the filter driver function in the operating system of the computer, the computer
When the API execution means calls the API execution means, and the API execution means performs file access, the other processes are executed before the processing by the API execution means is performed. API hook means for performing hook processing of
When the hook process is performed, an access destination determination unit that determines whether or not the access destination by the API execution unit is an access destination to be denied access; and
If the access destination by the API execution means is an access destination to be denied access, function as an access destination changing means for rewriting the access destination to an access destination different from the access destination,
In the API hook means,
If the access destination by the API execution means is not the access destination to be denied access, allow the API execution means to call processing,
If the access destination by the API execution means is an access destination to be denied access, the access destination change means rewrites the access destination to an access destination different from the access destination, and calls the API execution means And making the API execution means access the different access destinations and causing the AP execution means to output information indicating that the processing by the API execution means has been normally performed. program. Without providing the filter driver function in the operating system of the computer, the computer
When the API execution means performs a file writing process, the API execution means functions as an encryption means for inputting and encrypting the file from the API hook means,
12. The virtual thin client program according to claim 11, wherein the API execution unit stores the encrypted file in the different access destination. When the access destination by the API execution unit is an access destination to be denied access to the access destination changing unit, and the API execution unit performs file access, the access destination Duplicate files
13. The virtual thin client program according to claim 11, wherein the API hook unit is caused to call an API execution unit to access the copied file by the API execution unit. A removable storage device is connected to the computer,
If the access destination by the API execution unit is present in a storage area of the removable storage device, the access destination determination unit determines that the access destination is not an access destination to be denied access;
The virtual machine according to claim 11, wherein the API hook unit is caused to call the API execution unit, and the API execution unit accesses the access destination in the removable storage device. Thin client program. When the access destination by the API execution unit is an access destination to be denied access to the access destination changing unit, and the API execution unit performs file access, the access destination Files from the peripheral device to the removable storage device,
15. The virtual thin client program according to claim 14, wherein the API hook means is caused to call an API execution means to access the copied file by the API execution means. A method for virtualizing a computer comprising an AP execution means for executing a predetermined application program, an API execution means for executing a predetermined application program interface, and peripheral devices,
Without providing the filter driver function in the operating system of the computer,
When the API execution means calls the API execution means by the AP execution means, and the API execution means performs file access, the API hook means in the computer before the processing by the API execution means is performed. Perform hook processing to execute other processing,
The access destination determination means in the computer determines whether the access destination by the API execution means is an access destination to be denied access when the hook processing is performed,
The API hook means
If the access destination by the API execution means is not the access destination to be denied access, the API execution means call processing is permitted,
If the access destination by the API execution means is an access destination to be denied access, the access destination change means in the computer rewrites the access destination to an access destination different from the access destination, and the API execution means Calling and accessing the different access destination by the API execution means, and outputting information indicating that the processing by the API execution means has been normally performed to the AP execution means Method.

Images