JP2014137699A - Information resource protection program and information resource protection method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To protect an information resource such as data or a program.SOLUTION: An information resource protection system for protecting an information resource by using a computer includes: a decryption execution part to be executed when a decryption execution program is executed by a first computer; and a monitoring part to be operated by a second computer. The decryption execution part includes: a decryption part for decrypting the encrypted information resource; a first communication part for communicating with the monitoring part; and an erasure/function restriction part for performing the erasure or function restriction of at least a part of the decryption execution program on the basis of the state of communication or a command from the monitoring part. The monitoring part includes: a second communication part for performing communication; and a commanding part for transmitting the command on the basis of the state of communication.

Description

  The present invention relates to protection of information resources such as data or programs.

  In recent years, technologies such as cloud computing have been developed in which data is stored in a server device that is not under the control of a user, such as a data center, and this data is used from a remote location. In such an environment, data or programs to be protected such as confidential information or programs (information resources) are stored and used in a data center or the like. In such a case, encryption technology is mainly used to protect information resources. In order to use the encrypted data or the encrypted program, a decryption program using a key for decryption can be used.

  The encryption key is usually used as a pair of a public key and a secret key. Of the encryption keys, the secret key is considered not to be used by a malicious person. Therefore, it is necessary for a malicious person to take sufficient measures so that a decryption program containing a secret key is not illegally used.

  Conventionally, by comparing the used function information indicating the function used by the program with the actual program operation, it is detected that the actual program has been tampered with, and a determination is made to detect a function that should not be used. There is technology to do. If it is determined from this determination result that the execution of the program is inappropriate, the execution of the program by the execution means is stopped (for example, see Patent Document 1).

  In addition, when a mobile phone terminal is connected to the personal computer, an application program is introduced into the personal computer, and the personal computer monitors the operating state of the personal computer by executing the monitoring program. As for the monitoring program, there is a technology that has a function of decrypting and executing an encrypted file of an application program stored in a storage unit, and a function of deleting an application program that has finished its operation and data used therein. (For example, refer to Patent Document 2).

JP 2002-41170 A JP 2011-141816 A

  In the conventional technology, for example, in a computer that is not under its own management such as a data center, there is a high risk that a third party illegally executes its program. It is assumed that a malicious person duplicates a program for decrypting encrypted data stored in the data center and operates illegally on a computer that is not under the control of the data center or the like. If a malicious person operates the program illegally, there will be security vulnerabilities such as decrypting the encrypted data and acquiring the decrypted data.

  Also, it is very difficult for the program itself to recognize whether it is being used illegally or to deal with this illegal use when it is used illegally. Alternatively, it is also very difficult for the program itself to detect that the risk of unauthorized use is high and to take countermeasures in advance.

  Therefore, in view of such problems, an object of one aspect of the present invention is to protect information resources from threats caused by unauthorized use of a program that decrypts information resources such as encrypted data or programs.

  According to an aspect of the present invention, there is provided a system for protecting information resources using a computer, wherein the first computer executes a decryption execution program and is operated by the second computer. Based on the state of the communication, or a decryption unit that decrypts the encrypted information resource, a first communication unit that communicates with the monitoring unit, or And an erasure / function restriction unit for erasing at least a part of the decoding execution program or restricting functions based on a command from the monitoring unit, wherein the monitoring unit is a second communication unit that performs the communication And a command unit that transmits the command based on the communication state.

  According to the embodiment, the protection level of information resources such as data or programs can be increased.

It is a figure which shows the example of arrangement | positioning of the program of one Embodiment. FIG. 3 illustrates a method of an embodiment. It is a figure which shows the apparatus of one Embodiment. It is a figure which shows the example of the flowchart of the monitoring program for preventing the unauthorized use of a decoding performance program. It is a figure which shows the example of the flowchart of the decoding performance program for preventing the unauthorized use of a decoding performance program. It is a figure which shows the example which operates a decoding performance program with the data center side apparatus. It is a figure which shows the example which produces encryption data. It is a figure which shows the hardware constitutions of one Embodiment.

  In various embodiments of the present invention, encrypted data (including programs and the like, hereinafter referred to as encrypted data) is placed on a computer such as a server device that is not under the control of the user such as a data center, and the user stores the encrypted data The explanation will be given on the assumption that it will be used. Needless to say, even in a system using a server device under the management of a user, security can be enhanced by using the embodiment of the present invention.

  Note that the encrypted data itself and various contents included in the encrypted data may be collectively referred to as “information resources” in this specification. In the drawings, the same reference numerals may be given to a plurality of drawings for the same configuration.

  FIG. 1 shows an example of the arrangement of programs used in one embodiment.

  In the data center side device 110 placed in the data center, encrypted data 120 stored in a disk or the like, a memory 125, decrypted data 140 stored in the disk or the like, a processor 118, and an interface 119 can be placed. These are connected by a bus 117. It is assumed that the decryption execution program 130 stored in the memory 125 is used in order to use the encrypted data 120 by the data center apparatus 110 and provide various services to the user or the like. This decryption execution program 130 may include a secret key. The decryption execution program 130 can decrypt the encrypted data 120 by using the secret key to obtain the decrypted data 140. The data center apparatus 110 can provide services to users and the like using the decrypted data 140.

  Note that the data center device 110 does not have to be a single computer physically included in one housing. That is, the data center device 110 may be an aggregate of a plurality of servers, storages, and the like. In addition, these aggregates may be concentrated in a specific place or may be geographically dispersed. Further, the data center side device 110 may be under the management of the user. Here, the data center apparatus 110 is an example of a first computer.

  The user side device 150 may include a memory 152, plaintext data and encrypted data 170 stored in a disk or the like, a processor 158, and an interface 159. These are connected by a bus 17. Note that the user-side device 150 is preferably placed under user management. The user side device 150 is an example of a second computer.

  In this case, it is desirable that the secret key used by the decryption execution program 130 is subjected to a concealing process such as scrambled in advance by the user so that it cannot be stolen by a malicious person. By performing the concealment process, it is possible to effectively prevent a malicious person from stealing the secret key from the decryption execution program 130.

  However, it is also assumed that a malicious person duplicates and uses the decryption execution program 130 itself. When a copy of the decryption execution program 130 is activated under the control of a malicious person, the malicious person may be able to decrypt the encrypted data 120 and obtain the decrypted data 140. is assumed.

  For this reason, in the present embodiment, the decryption execution program 130 itself takes effective measures for preventing the decryption execution program 130 from being used by a malicious person as much as possible. . Specific details of this measure will be described later.

  In the embodiment shown in FIG. 1, it is desirable that the decryption execution program 130 continues the mutual communication 160 via the network 180 with the monitoring program 155 operating on the user side device 150 placed under the user's management. The monitoring program 155 is preferably stored in the memory 152 of the user device 150. The user side device 150 may be any device placed under the user's management. For example, a personal computer, a server, a mobile terminal, a mobile phone, and the like can be mentioned, but the invention is not limited to these.

  The decryption execution program 130 may include, for example, a program that causes the data center apparatus 110 to execute the decryption process 132, the communication process 134, and the erasure / function restriction process 136.

  The monitoring program 155 that operates on the user device 150 may include, for example, a program that causes the user device 150 to execute the communication process 154 and the command control process 156.

  The operation of the decryption execution program 130 will be described below.

  For example, the decryption process 132 decrypts the encrypted data 120 and outputs the decrypted data 140. In decryption, a secret key may be used as described above. The secret key is preferably placed in the decryption execution program 130. The secret key is desirably placed in the decryption execution program 130 in a concealed form using a scramble process or the like so that it is extremely difficult for a malicious person to steal.

  The communication process 134 performs the mutual communication 160 with the communication process 154 existing in the monitoring program 155 existing in the user side device 150, for example. From the communication process 134, for example, survival information indicating that the decryption execution program 130 exists in the data center apparatus 110 may be transmitted to the monitoring program 155 at predetermined intervals.

  Further, the communication process 134 may receive a predetermined signal at a predetermined interval from the monitoring program 155 in order to confirm that the mutual communication 160 is not disconnected. The communication process 134 may determine that the mutual communication 160 has been disconnected when a predetermined signal has never been received at a predetermined time. Alternatively, the connection state of the lower layer of the communication protocol (for example, the second layer (data link layer) in the OSI definition) may be checked. When the communication process 134 recognizes the disconnection of the mutual communication 160, it may be transmitted to the erasure / function restriction process 136.

  It is desirable that the mutual communication 160 uses secure communication such as a virtual private network (VPN). By using the VPN, unnecessary attacks (DOS: Denial Of Service) on the mutual communication 160, unauthorized interception of the mutual communication 160, spoofing communication, and the like can be dramatically reduced.

  Further, the communication processing 134 may receive a predetermined command from the command control processing 156 existing in the monitoring program 155. The command may include a command to delete at least a part of the decryption execution program 130, and a command to restrict the operation of the decryption performance program 130 or disable the operation. When receiving this command, the decryption execution program 130 may transmit this command to the erasure / function restriction process 136. Instead of erasing, another code may be overwritten on a predetermined address range.

  The communication process 134 may check a communication establishment request from the communication process 154 existing in the monitoring program 155. In the present embodiment, it is assumed that the mutual communication 160 is maintained. Therefore, when a communication establishment request is received from the monitoring program 155, there is a possibility that it is a communication establishment request from a different entity pretending to be the monitoring program 155.

  Therefore, in order to detect such impersonation, a communication establishment request from the monitoring program 155 may be checked, and the check result may be transmitted to the erasure / function restriction process 136. In this specification, “entity” is used as a general term for “thing that transmits and receives information”.

  In addition, the communication process 134 sends various information such as the process ID of the decryption execution program 130, the device ID of the apparatus in which the decryption execution program 130 is operating, and the sequence number incremented each time it is transmitted to the monitoring program 155 in a predetermined manner. It may be transmitted at intervals.

  For example, when the decryption execution program 130 is copied as a memory image to another device by a malicious person and the copy is operated on a device under the control of the malicious person, the original decryption execution program 130 is used. When operating as a different entity, these pieces of information may be used in detecting that the entity is a replicated entity.

  In other words, the decryption execution program 130 copied to a malicious person may send various information such as a process ID, a device ID, or a sequence number to the monitoring program 155, which is different from the legitimate decryption execution program 130. The nature is very high.

  Therefore, the monitoring program 155 can detect that, for example, the decoding execution program 130 is copied for each memory image and is impersonated by checking these pieces of information. In addition, you may use these various information as survival information.

  Further, the communication process 134 may receive various information from the monitoring program 155 such as the process ID of the monitoring program 155, the device ID of the device in which the decryption execution program 130 is operating, and the sequence number that is incremented each time it is transmitted. . As a result, the decryption execution program 130 can check in the same manner that a malicious person is impersonating the monitoring program 155.

  The decryption execution program 130 and the monitoring program 155 can exchange various information with each other as described above.

  The erasure / function restriction process 136 erases at least a part of the decryption execution program or restricts the operation of the decryption execution program when receiving a notification from the communication process 134 that the mutual communication 160 has been disconnected. Alternatively, a process for making it impossible may be executed.

  When the mutual communication 160 is disconnected, the monitoring program 155 is not managed by the decryption execution program 130. Therefore, it is desirable to perform such processing. With this process, it is possible to sufficiently reduce the possibility that a malicious person uses the decryption execution program 130 in a state where the monitoring program 155 is not monitored.

  When the communication establishment request is received from the communication process 154 of the monitoring program 155 is transmitted via the communication process 134, the erasure / function restriction process 136 similarly applies at least a part of the decryption execution program. A process of deleting or restricting or disabling the operation of the decryption execution program may be executed.

  Further, when a predetermined command is received from the command control processing 156 of the monitoring program 155, the erasure / function restriction processing 136 may execute the command. This command may include a command to delete at least a part of the decryption execution program 130, and a command to restrict the operation of the decryption performance program 130 or disable the operation.

  In addition, when the erasure / function restriction process 136 receives from the communication process 134 a message indicating that the monitoring program 155 has been impersonated (that is, from an entity different from the monitoring program 155), You may perform the process which erase | eliminates at least one part of a performance program, or restrict | limits or disables the operation | movement of a decoding performance program.

  The communication process 154 in the monitoring program 155 communicates with the communication process 134 existing in the decryption execution program 130. Further, the communication process 154 checks, for example, whether or not the mutual communication 160 is disconnected. In this check, it may be checked whether or not the survival information transmitted at a predetermined interval is received from the decryption execution program 130. Alternatively, various information such as the process ID of the decryption execution program 130 sent from the communication process 134, the device ID of the apparatus in which the decryption execution program 130 is operating, and the sequence number that is incremented every time transmission is checked at predetermined intervals. May be. Alternatively, the connection state of the lower layer of the communication protocol may be checked.

  When the communication process 154 recognizes the disconnection of the mutual communication 160, the command control process 156 may transmit a predetermined command to the decoding execution program 130 via the communication process 154. As described above, the command may include a command for erasing at least a part of the decryption execution program 130, and a command for restricting or disabling the operation of the decryption performance program 130.

  Further, the communication process 154 of the monitoring program 155 may check various information such as the process ID of the decryption execution program 130, the device ID of the apparatus in which the decryption execution program 130 is operating, and the sequence number that is incremented each time it is transmitted. Good. For example, when the process ID of the decryption execution program 130 changes, it can be detected that there is a high possibility that a copy of the decryption execution program 130 is operating.

  Further, when the device ID of the device on which the decryption execution program 130 is operating has changed, the decryption execution program 130 may be copied and operated in another device environment (for example, the device environment of a malicious person). Can be detected. Further, when the sequence numbers are duplicated or an unexpected sequence number is sent, it can be detected that there is a high possibility that the copy of the decryption execution program 130 is operating.

  In such a case, it is desirable that the communication processing 154 sends the above-described command to the decoding execution program 130 and / or a copy of the decoding execution program 130 under the control of the command control processing 156.

  Further, the communication processing 154 of the monitoring program 155 includes various information such as the process ID of the monitoring program 155 itself, the device ID of the device in which the monitoring program 155 is operating, and the sequence number that is incremented each time it is transmitted. May be sent to The decoding execution program 130 can check the spoofing of the monitoring program 155 by checking the information sent from the monitoring program 155 by the decoding execution program 130.

  Further, the communication processing 154 of the monitoring program 155 may check a communication establishment request from the decryption execution program 130. In the present embodiment, it is assumed that the mutual communication 160 is maintained. Therefore, when a communication establishment request is received from the decryption execution program 130, there is a possibility that the communication establishment request is from a different entity that impersonates the decryption execution program 130. Also in this case, it is desirable that the command control process 156 sends the above command to the decoding execution program 130 under the control of the command control process 156.

  By sending this command, it is possible to drastically reduce the possibility of a malicious person using the decryption execution program 130 illegally and effectively increase the security level.

  FIG. 2 illustrates the method of one embodiment.

  In FIG. 2B, the decoding execution program 130 can execute a method including at least the steps 232, 234, and 236.

  Further, as shown in FIG. 2A, in the user-side device 150, a method including steps 254 and 256 can be executed.

  In step 232 of FIG. 2B, decryption of the encrypted data is performed.

  In step 234, communication with the monitoring program 155 of the user side device 150 is executed. It is desirable that communication be performed at predetermined intervals.

  In step 236, erasure of at least a part of the decoding execution program 130 or execution of function restriction is controlled based on the communication status or a command from the monitoring program 155.

  These processes are desirably executed repeatedly. If there is no need to decrypt the encrypted data, the step 232 may not be executed. In addition, the execution order of each stage may be different.

  In step 254 of FIG. 2A, communication with the decryption execution program 130 is executed. It is desirable that communication be performed at predetermined intervals.

  In step 256, transmission of a command to the decoding execution program is controlled. Since the contents of the command have been described in detail in the description related to FIG.

  FIG. 3 shows an apparatus according to one embodiment. The data center apparatus 110 includes a decryption execution unit 330. The decryption execution unit 330 further includes a decryption unit 332, a communication unit 334, and an erasure / function restriction unit 336.

  The user side device 150 includes a monitoring unit 355. The monitoring unit 355 includes a communication unit 354 and a command control unit 356.

  In FIG. 3, the decryption execution unit 330, the decryption unit 332, the communication unit 334, the erasure / function restriction unit 336, the monitoring unit 355, the communication unit 354, and the command control unit 356, respectively, This corresponds to the processing 132, the communication processing 134, the erasure / function restriction processing 136, the monitoring program 155, the communication processing 154, and the command control processing 156. Since the operation of each part is the same as in FIG. 1, the description thereof is omitted to avoid duplication.

  FIG. 4 shows an example of a flowchart of the monitoring program 155 for preventing unauthorized use of the decryption execution program. This flow starts at step 402. For example, step 402 may be initiated by a timer interrupt.

  In step 404, the monitoring program 155 checks whether the mutual communication 160 has been interrupted. As a method for checking whether or not mutual communication has been interrupted, it may be determined that communication has been interrupted (disconnected) when information transfer is not performed for a predetermined time. For example, the survival information that is to be sent from the decryption execution program 130 at a predetermined interval, the process ID of the decryption execution program 130, the device ID of the device on which the decryption execution program 130 is operating, and increments with each transmission When a state where various information such as a sequence number to be transmitted is not transmitted continues for a predetermined period, it may be determined that the mutual communication 160 has been interrupted. Alternatively, it may be checked whether to respond to a command such as PING. Note that the present invention is not limited to these methods. If this determination is “Yes”, the process proceeds to Step 408. If this determination is “NO”, the process proceeds to step 406.

  In step 406, the monitoring program 155 checks whether communication from an entity different from the decryption execution program 130 has been received. As described above, the “different entity” is used as “information transmitting / receiving” that collectively refers to a program or hardware different from the original “decoding execution program 130”. Specifically, a copy of the decryption execution program 130, another program that disguises the communication operation of the decryption execution program, and the like can be mentioned. It is desirable that the mutual communication 160 uses a secure connection such as VPN. It is considered that communication from such different entities is excluded by the basic functions of VPN and reaches the monitoring program 155. However, it is desirable to consider spoofed communications that have passed the VPN security function. By detecting various information such as the process ID of the decryption execution program 130, the device ID of the device in which the decryption execution program 130 is operating, and the sequence number that is incremented every time it is transmitted, spoofed communication can be detected with a high probability. Can do. Alternatively, the MAC address check may be used together. Further, when a fixed IP address is used, an IP address check may be used together. When hardware-dependent information such as a device ID is to be checked, the decryption execution program 130 is prohibited from moving between devices by live migration or moved between devices as a mobile agent. It is desirable to prohibit In addition, this invention is not limited to the above-mentioned illustration, and it cannot be overemphasized that the other function which discovers the impersonation communication may be used. If this determination is “Yes”, the process proceeds to Step 408. If this determination is “NO”, the process may move to step 410 and return.

  In step 408, the monitoring program 155 may, for example, delete at least a part of the decryption execution program, or restrict or disable the operation of the decryption execution program. The present invention is not limited to this.

  FIG. 5 shows an example of a flowchart of the decryption execution program 130 for preventing unauthorized use of the decryption execution program. This flow starts from step 502. For example, step 502 may be initiated by a timer interrupt.

  In step 504, the decryption execution program 130 checks whether or not the mutual communication 160 has been interrupted. As a method for checking whether or not mutual communication has been interrupted, it may be determined that communication has been interrupted (disconnected) when information transfer is not performed for a predetermined time. For example, the survival information that is to be sent from the monitoring program 155 at a predetermined interval, the process ID of the decryption execution program 130, the device ID of the device on which the decryption execution program 130 is operating, and increments with each transmission. When a state where various information such as a sequence number is not sent continues for a predetermined period, it may be determined that the mutual communication 160 has been interrupted. Alternatively, it may be checked whether to respond to a command such as PING. Note that the present invention is not limited to these methods. If this determination is “Yes”, the process proceeds to Step 508. If this determination is “NO”, the process proceeds to step 506.

  In step 506, the monitoring program 155 may check whether a communication from an entity different from the decryption execution program 130 has been received. For this step, a check method similar to the check method described in step 406 can be used. If this determination is “Yes”, the process proceeds to Step 508. If this determination is “NO”, the process may move to step 510 and return.

  In step 508, the decoding execution program may, for example, erase at least a part of the decoding execution program itself, or restrict or disable the operation of the decoding execution program. The present invention is not limited to this.

  FIG. 6 shows an example in which the decryption execution program is operated on the data center side device. In the following description, an example using live migration in a virtual machine will be described.

  First, the decryption execution program 630 is activated in the user side device 150. Then, the decryption execution program 630 establishes and maintains the mutual communication 660 with the monitoring program 155. The monitoring program 155 and the decryption execution program 630 are preferably operated on different virtual machines. Then, the virtual machine on which the decryption execution program 630 is operating is moved to the data center apparatus 110 by live migration (670). In this movement, it is desirable that the intercommunication 660 remains intact. A decryption execution program 130 after live migration and an intercommunication 160 are shown.

  In the mutual communication 160 immediately after the live migration, information depending on hardware such as a device ID sent from the decryption execution program 130 or a source IP address may change. Therefore, it is desirable for the monitoring program 155 to accept such changes in information only immediately after live migration. These pieces of information can then be used to check for the possibility of spoofing.

  In this way, the mutual communication 660 is established in the user side device 150, and the decryption execution program 130 is moved to the data center side device 110 while the mutual communication 660 is maintained. It can be ensured that it is activated below and its operation is maintained.

  Note that the present invention is not limited to the live migration described above. Other techniques that can move between devices while maintaining communication may be used. For example, another example of such a technique is a mobile agent. A mobile agent is one of distributed processing technologies via a network. Processing can be performed while a program called an agent moves between computers connected to the network. Note that the present invention is not limited to these examples.

  An example of encryption will be described with reference to FIG. FIG. 7 shows an example in which the encrypted data 120 is generated using the encryption algorithm 706 for the raw data 702. The encryption of the raw data 702 is preferably executed in the user side device 150 placed under the user's management. By encrypting the raw data 702 in the user side device 150 under the management of the user, the security of the raw data 702 is sufficiently secured.

An encryption key may be used for encryption. An RSA encryption key 704 having a public key and a secret key is illustrated. The public key {e, n} may be used for encrypting the raw data 702. To encrypt m of the raw data 702, for example,
c = m ^ e mod n
The encrypted data c of m can be obtained by calculating. Here, “^” means power and mod means modulo calculation. For example, in order to decrypt this encrypted data c, the secret key {d, n} is used,
m = c ^ d mod n
Can be obtained by calculating. Note that the present invention is not limited to this encryption algorithm.

  The encrypted data 120 can be placed in a device that is not under the management of the user, such as a data center. Using the encrypted data 120 placed in the data center, a user or the like can receive a necessary service. In general, it is extremely difficult for a malicious person to decrypt and use the encrypted data 120, and security of various contents included in the encrypted data 120 is ensured. The encrypted data 120 may include a program or the like in addition to pure data.

  FIG. 8 is a diagram illustrating a hardware configuration example according to an embodiment. The hardware may include a processor 802, a memory 804, a display control unit 806, a display device 808, an input / output device 810, a communication control unit 812, a drive device 814, and a hard disk 818. Each device is connected by a bus 820. The drive device 814 can read and write the portable recording medium 816. The communication control unit 812 can be connected to a network (not shown). The hard disk 818 and / or the memory 804 may store management information such as a program source and a generation related to the source.

  A part or all of the program in the embodiment may be stored in the memory 804, the hard disk 818, or the like and operated by the processor 802.

  Note that all or part of the present embodiment can be implemented by a program. This program can be stored in the portable recording medium 816. The portable recording medium 816 refers to one or more non-transitory storage media having a structure. Illustrative examples of the portable recording medium 816 include a magnetic recording medium, an optical disk, a magneto-optical recording medium, and a nonvolatile memory. Magnetic recording media include HDDs, flexible disks (FD), magnetic tapes (MT) and the like. Examples of the optical disk include a DVD (Digital Versatile Disc), a DVD-RAM, a CD-ROM (Compact Disc-Read Only Memory), and a CD-R (Recordable) / RW (ReWriteable). Magneto-optical recording media include MO (Magneto-Optical disk). All or a part of the embodiments of the present invention can be implemented by reading a program stored in a portable recording medium and executing it by a processor.

  The embodiments of the present invention have been described in detail with reference to the drawings. It should be noted that the above-described embodiments are for understanding the invention and are not intended to limit the scope of the present invention. Further, the plurality of embodiments described above are not mutually exclusive. Therefore, it should be noted that the elements of different embodiments are also intended to be combined unless a contradiction arises. Further, in the invention according to the method and the program described in the claims, the processing order may be changed or skipped as long as there is no contradiction. Alternatively, a plurality of processes may be executed simultaneously. It goes without saying that these embodiments are also included in the technical scope of the invention described in the claims.

  Further, by executing the program code read by the computer, not only the functions of the above-described embodiments are realized, but also an OS, a virtual machine monitor VMM, Needless to say, the present invention also includes a case in which a program such as firmware or BIOS performs part or all of the actual processing and the functions of the embodiments are realized by the processing.

  In addition, each component of the various embodiments of the present invention may be realized by a plurality of physically separated hardware. Moreover, each component of the various embodiments of the present invention may be realized by operating on one or more servers. Further, there may be a plurality of CPUs that execute the program according to the present invention, and each CPU may include a plurality of cores.

The following notes are disclosed regarding the above embodiment.
(Appendix 1)
A system for protecting information resources using a computer,
A decoding execution unit realized by executing a decoding execution program by the first computer, and a monitoring unit operating on the second computer,
The decoding execution unit
A decryption unit for decrypting the encrypted information resource;
A first communication unit that communicates with the monitoring unit;
Based on the state of communication or based on a command from the monitoring unit, an erasure / function restriction unit that performs erasure or function restriction of at least a part of the decoding execution program;
Have
The monitoring unit
A second communication unit for performing the communication;
Based on the communication state, a command unit that transmits the command;
An information resource protection system.
(Appendix 2)
The command unit transmits the command when the communication is interrupted for a predetermined period, or when communication from an entity different from the decoding execution unit is received,
The information resource protection system according to appendix 1.
(Appendix 3)
The erasure / function restriction unit performs the erasure or function restriction when the communication is interrupted for a predetermined period or when communication from an entity different from the monitoring unit is received.
Appendix 1 or 2 information resource protection system.
(Appendix 4)
The decoding execution unit and the monitoring unit establish the communication when the decoding execution program exists in the second computer,
Moving the decoding execution program from the second computer to the first computer in a state where the first computer and the second computer maintain the communication;
The information resource protection system according to any one of supplementary notes 1 to 3.
(Appendix 5)
The total amount of the information resource that can be decoded and / or the address for accessing the information resource are limited by the decoding execution program.
The information resource protection system according to any one of supplementary notes 1 to 4.
(Appendix 6)
A method of protecting information resources using a computer,
A first processor of a first computer decrypting the information resource encrypted by a decryption execution program;
The first processor communicating with a monitoring program running on a second computer by the decoding execution program;
The first processor erases or restricts at least a part of the decoding execution program based on the communication state or based on a command from the monitoring program by the decoding execution program;
A step in which a second processor of the second computer transmits the command based on the communication state;
A method for protecting information resources.
(Appendix 7)
The step of transmitting the command transmits the command when the communication is interrupted for a predetermined period or when a communication from an entity different from the decoding execution program is received.
The information resource protection method according to appendix 6.
(Appendix 8)
The function limiting step performs the erasure or the function limitation when the communication is interrupted for a predetermined period or when a communication from an entity different from the monitoring program is received.
The information resource protection method according to appendix 6 or 7.
(Appendix 9)
When the decoding execution program is present in the second computer, the first processor and the second processor establish the communication;
Moving the decoding execution program from the second computer to the first computer while the first processor and the second processor maintain the communication;
Further having
The information resource protection method according to any one of appendices 6 to 8.
(Appendix 10)
The decoding execution program limits the total amount of the information resource that can be decoded and / or limits the address for accessing the information resource.
The information resource protection method according to any one of appendices 6 to 9.
(Appendix 11)
A monitoring program operating on a second computer for protecting information resources decrypted by a decryption execution program operating on the first computer,
Communicate with the decryption execution program;
Based on the state of the communication, transmitting a command for causing the decoding execution program to erase or restrict at least part of the decoding execution program.
A monitoring program that causes a computer to execute processing.
(Appendix 12)
The process of transmitting the command is to transmit the command when the communication is interrupted for a predetermined period or when a communication from an entity different from the decoding execution program is received.
The monitoring program according to appendix 11.
(Appendix 13)
A decryption execution program operating on a first computer for decrypting an encrypted information resource,
Decrypting the encrypted information resource;
Communicate with a monitoring program running on a second computer;
Based on the state of the communication or based on a command of the monitoring program, at least a part of the decoding execution program is erased or functionally limited,
Causing the first computer to execute processing;
Decryption execution program.
(Appendix 14)
The process of erasing or limiting the function performs the erasing or limiting function when the communication is interrupted for a predetermined period or when communication from an entity different from the monitoring program is received.
14. The decryption execution program according to appendix 13, including processing.
(Appendix 15)
When the decryption execution program is present in the first computer, the first computer is further caused to execute processing for establishing the communication,
Moving from the first computer to the second computer while maintaining the communication;
15. The decryption execution program according to any one of supplementary notes 13 and 14.
(Appendix 16)
Limiting the total amount of the information resource that can be decrypted and / or limiting the address for accessing the information resource;
16. The decryption execution program according to any one of supplementary notes 13 to 15, further causing the first computer to execute processing.

110 Data Center Side Device 120 Encrypted Data 130 Decryption Execution Program 132 Decryption Processing 134 Communication Processing 136 Deletion / Function Restriction Processing 140 Decryption Data 150 User Side Device 155 Monitoring Program 156 Control Processing 160 Mutual Communication

Claims (8)

A system for protecting information resources using a computer,
A decoding execution unit realized by executing a decoding execution program by the first computer, and a monitoring unit operating on the second computer,
The decoding execution unit
A decryption unit for decrypting the encrypted information resource;
A first communication unit that communicates with the monitoring unit;
Based on the state of communication or based on a command from the monitoring unit, an erasure / function restriction unit that performs erasure or function restriction of at least a part of the decoding execution program;
Have
The monitoring unit
A second communication unit for performing the communication;
Based on the communication state, a command unit that transmits the command;
An information resource protection system. The command unit transmits the command when the communication is interrupted for a predetermined period, or when communication from an entity different from the decoding execution unit is received,
The information resource protection system according to claim 1. The erasure / function restriction unit performs the erasure or function restriction when the communication is interrupted for a predetermined period or when communication from an entity different from the monitoring unit is received.
The information resource protection system according to claim 1 or 2. The decoding execution unit and the monitoring unit establish the communication when the decoding execution program exists in the second computer,
Moving the decoding execution program from the second computer to the first computer in a state where the first computer and the second computer maintain the communication;
The information resource protection system according to any one of claims 1 to 3. The total amount of the information resource that can be decoded and / or the address for accessing the information resource are limited by the decoding execution program.
The information resource protection system according to any one of claims 1 to 4. A method of protecting information resources using a computer,
A first processor of a first computer decrypting the information resource encrypted by a decryption execution program;
The first processor communicating with a monitoring program running on a second computer by the decoding execution program;
The first processor erases or restricts at least a part of the decoding execution program based on the communication state or based on a command from the monitoring program by the decoding execution program;
A step in which a second processor of the second computer transmits the command based on the communication state;
A method for protecting information resources. A monitoring program operating on a second computer for protecting information resources decrypted by a decryption execution program operating on the first computer,
Communicate with the decryption execution program;
Based on the state of the communication, transmitting a command for causing the decoding execution program to erase or restrict at least part of the decoding execution program.
A monitoring program that causes a computer to execute processing. A decryption execution program operating on a first computer for decrypting an encrypted information resource,
Decrypting the encrypted information resource;
Communicate with a monitoring program running on a second computer;
Based on the state of the communication or based on a command of the monitoring program, at least a part of the decoding execution program is erased or functionally limited,
Let the computer execute the process,
Decryption execution program.

Images