JP2015176278A - Information processing apparatus and information processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processing apparatus configured to generate a white list, which is a list of programs permitted, without manual effort.SOLUTION: An execution determination section determines whether a program to be started by an operating system (hereinafter referred to as OS) has been registered on a white list, which is a list of programs permitted, on the basis of a file name of the program, and determines whether to add the program to the white list, on the basis of an operation mode set for the operation of the OS.

Description

  The present invention relates to an information processing apparatus that creates a white list that is a list of programs that are permitted to be executed.

  Computer systems that monitor and control equipment such as factories and plants are generally used in a closed network configuration without being connected to the Internet. Therefore, it is difficult to use anti-virus software that is connected to the Internet and downloads and uses the latest virus pattern file, which is used on a general PC (Personal Computer). However, even in a closed network, there is a risk that a computer virus may be brought in via a PC or recording medium brought in from the outside.

  In order to deal with such a problem, in the product of Non-Patent Document 1, a list of programs permitted to be executed in advance (hereinafter referred to as a white list) is created, and those not registered in this list are not executed. Prevents unauthorized programs from entering the system. A program or the like registered in the white list registers a hash value of a file in advance, and confirms that it has not been rewritten illegally depending on whether or not this has changed. When the program is updated, it is updated by the update program under the monitoring by the antivirus program, and the information registered in the white list is updated.

  Further, Patent Document 1 proposes a method of issuing a warning to the user by paying attention to the regularity of the virus file name and registering what is determined to be safe by the user in the white list.

JP 2007-148805 A

Trend Micro, “Trend Micro Safe Lock (TM) Administrator Guide”, Trend Micro, published in June 2013, p. 12-14, p. 20-22, p. 30-34

  However, in Non-Patent Document 1 and Patent Document 1, it is necessary to create a white list in advance by hand. Further, in Patent Document 1, when starting a program that has a risk of starting for the first time, it is necessary to manually determine whether it is possible and register it in a white list. In a computer system that monitors and controls equipment such as factories and plants, there are various programs started from the application system, such as those provided by the application itself, those provided by other applications, and those provided by the OS (Operating System). . In a large-scale system, it is difficult to grasp all the programs to be used in advance. In addition, since the program is started from another program without human intervention, and it is necessary to complete the processing within a limited time, it is not possible to leave the determination as to whether or not to start each time manually. Therefore, Non-Patent Document 1 and Patent Document 1 have a problem that a white list cannot be created without human intervention.

  The present invention has been made to solve the above-described problems, and an object of the present invention is to obtain an information processing apparatus that creates a white list without human intervention.

  A program started by an operating system (hereinafter referred to as an OS) is determined based on the file name of the program to determine whether or not a program that is permitted to be executed is registered in a white list, and the operation of the OS is set. An executable determination unit is provided that determines whether to add a program to the white list based on the operation mode.

  According to the present invention, a white list can be created without human intervention.

2 is a block diagram illustrating a configuration of an information processing device according to Embodiment 1. FIG. FIG. 3 is a diagram showing a white list held by the OS of the information processing apparatus according to the first embodiment. 5 is a flowchart showing a flow of processing of an execution availability determination unit according to the first embodiment. 5 is a flowchart showing a processing flow of a library load availability determination unit according to the first embodiment. 5 is a flowchart showing a flow of processing of a file open permission determination unit according to the first embodiment. 2 is a block diagram illustrating a configuration of an information processing device according to Embodiment 1. FIG. 6 is a flowchart showing a process flow of a mapping availability determination unit according to the first embodiment.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing the configuration of the information processing apparatus 100 according to the first embodiment. The OS 101 of the information processing apparatus 100 includes a program activation processing unit 102, a library load processing unit 103, a file open processing unit 104, an execution availability determination unit 105, a library load availability determination unit 106, and a file open availability determination unit 107. . The program activation processing unit 102, the library load processing unit 103, and the file open processing unit 104 are components provided by an existing OS. The OS 101 holds the operation mode.

  In the information processing apparatus 100, an operation mode setting process 111 and processes 112a to 112c operate. The operation mode setting process 111 sets one of a normal operation mode, a maintenance mode, and a white list creation mode as the operation mode of the OS 101. The normal operation mode is a mode in which the information processing apparatus 100 performs a normal operation. The maintenance mode is a mode for performing maintenance of the information processing apparatus 100. The white list creation mode is a mode for creating a white list in a safe environment. Before the information processing apparatus 100 is operated in an actual system or after the operation is started, when a program, library, or file is changed or added, and the whitelist needs to be updated, the whitelist creation mode is set. .

  The operation mode is set via a system call to the OS 101 or a driver interface. It is advisable to take measures such as limiting this setting to users with the right to execute or protecting the setting operation with a password. The process 112a starts up the program 113 on the OS 101 and operates by loading a plurality of libraries 114a-n.

  The operation mode setting process 111 is activated when the OS 101 is activated. The operation mode setting process 111 inquires of the operation mode to the administrator, and sets the normal operation mode when there is no response to the operation mode. The administrator may activate the operation mode setting process 111 after the OS 101 is activated to change the operation mode. These usages may be changed by specifying an argument when the operation mode setting process 111 is activated.

  FIG. 2 is a diagram showing white lists 21 to 22 held by the OS 101 of the information processing apparatus 100 according to the first embodiment. The white list 21 includes program A, program B,. The white list 22 includes library a, library b,.

  When the creation of the white list is completed, the operation mode setting process 111 stores the contents of the white lists 21 to 22 in a file on the disk. The file should not be illegally rewritten by setting access rights or encryption.

Next, the operation will be described.
First, an operation when the process 112 starts a program will be described. When the process 112 starts the program, the OS 101 executes the program start processing unit 102. The program activation processing unit 102 calls the execution feasibility determination unit 105 before performing the program activation processing in order to determine whether the program can be activated.

  FIG. 3 is a flowchart showing a process flow of the execution feasibility determination unit 105 according to the first embodiment. A case where the process 112 starts the program A 113 will be described as an example.

  Executability determination unit 105 starts processing when called from program activation processing unit 102. The executability determination unit 105 searches whether the file name of the program A 113 to be activated exists in the white list 21 (S31). The executability determination unit 105 determines whether the program A 113 exists in the white list 21 (S32). When the program A113 exists in the white list 21, the execution determination unit 105 outputs to the program activation processing unit 102 that the program can be activated (S33).

  When the program A 113 has not been registered in the white list 21, the execution determination unit 105 refers to the operation mode (S34). When the operation mode is the white list creation mode, the execution determination unit 105 registers the program A 113 in the white list 21 (S35), and outputs to the program activation processing unit 102 that the program can be activated (S33). When the operation mode is the normal operation mode or the maintenance mode, the execution availability determination unit 105 outputs that the program cannot be started to the program start processing unit 102 (S36), and ends the process.

  The program activation processing unit 102 activates the program A 113 and executes the processing when the program activation possibility is input from the execution possibility determination unit 105. In addition, when the program start processing unit 102 receives an input from the execution determination unit 105 indicating that the program cannot be started, the program start processing unit 102 ends the process without starting the program A 113.

  Next, an operation when the process 112 loads a library will be described. When the process 112 loads a library, the OS 101 executes the library load processing unit 103. The library load processing unit 103 calls the library load availability determination unit 106 before loading a library in order to determine whether the library can be loaded.

  FIG. 4 is a flowchart showing a processing flow of the library load availability determination unit 106 according to the first embodiment. A case where the process 112a loads the library 114a will be described as an example.

  The library load availability determination unit 106 starts processing when called from the library load processing unit 103. The library load availability determination unit 106 searches whether the file name of the library 114a to be loaded exists in the white list 22 (S41). The library load availability determination unit 106 determines whether the library 114a exists in the white list 22 (S42). If the library 114a exists in the white list 22, the library load availability determination unit 106 outputs that it can be loaded to the program activation processing unit 102 (S43).

  When the library 114a is not registered in the white list 22, the library load availability determination unit 106 refers to the operation mode (S44). When the operation mode is the white list creation mode, the library load availability determination unit 106 registers the library 114a in the white list 22 (S45), and outputs to the library load processing unit 103 that the program can be started (S43). When the operation mode is the normal operation mode or the maintenance mode, the library load availability determination unit 106 outputs that the program cannot be started to the library load processing unit 103 (S46), and ends the process.

  The library load processing unit 103 loads the library 114a when the library load availability determination unit 106 receives information indicating that library loading is possible, and executes the processing. Further, when the library load availability determination unit 106 receives an input indicating that library loading is not possible, the library load processing unit 103 ends the process without loading the library 114a.

  The information processing apparatus 100 can create a white list without human intervention by executing the application system with the operation mode set to the white list creation mode. In the normal operation mode, the program registered in the white list can be activated, but the program not registered in the white list cannot be activated. That is, when trying to rewrite a program file or library registered in the white list in the normal operation mode, it is determined that they are illegal rewriting and cannot be opened. Also, in the maintenance mode, as in the normal operation mode, activation of programs not registered in the white list and library loading are not permitted.

  Next, an operation when the process 112 opens a file will be described. When the process 112 opens a file, the OS 101 executes the file open processing unit 104. The file open processing unit 104 calls the file open availability determination unit 107 before opening a file in order to determine whether the file can be opened.

  FIG. 5 is a flowchart showing a flow of processing of the file open permission determination unit 107 according to the first embodiment.

  When called from the file open processing unit 104, the file open permission determination unit 107 starts processing. The file open permission determination unit 107 refers to the operation mode held by the OS 101 (S51). When the operation mode is the white list creation mode or the maintenance mode, the file open availability determination unit 107 outputs openability to the file open processing unit 104 (S55), and ends the process. In other words, in the whitelist creation mode, the file open availability determination unit 107 always outputs “openable”.

  When the operation mode is the normal operation mode, the file open availability determination unit 107 determines whether to open the file in the write mode (S52). If it is not in the write mode, the file open availability determination unit 107 outputs the open possibility to the file open processing unit 104 (S55), and ends the process.

  When opening a file in the write mode, the file open permission determination unit 107 searches whether the file names to be opened exist in the white lists 21 to 22 (S53). The file open permission determination unit 107 determines whether or not the file name to be opened exists in the white lists 21 to 22 (S54). If the name of the file to be opened is not registered in the white lists 21 to 22, the file open availability determination unit 107 outputs an open possibility to the file open processing unit 104 (S55). This is because the data file needs to be openable so that it can be opened and used by the program. Even if the program is rewritten, it is not executed unless the program is registered in the white list 21, so that it can be opened.

  If the name of the file to be opened is registered in the white lists 21 to 22, the file open availability determination unit 107 outputs an unopenable message to the file open processing unit 104 (S56), and the process ends. That is, when trying to rewrite a program file or library registered in the white list in the normal operation mode, it is determined that they are illegal rewriting and cannot be opened.

  The file open processing unit 104 opens the file and executes processing when the file open possibility determination unit 107 inputs that the file can be opened. In addition, when the file open processing determination unit 107 inputs that the file cannot be opened, the file open processing unit 104 ends the process without opening the file.

  In maintenance mode, it is possible to write to a program or library, and to replace it with an improved or bug-fixed program or library.

  Therefore, in this embodiment, it is determined whether or not a program started by the OS is registered in a white list that is a list of programs that are permitted to be executed, and the operation of the OS is set. Since the execution determination unit for determining whether or not to add the program to the white list based on the operation mode is provided, the white list can be created without human intervention.

  In addition, when the program is registered in the white list or when the operation mode is the white list creation mode, the execution determination unit outputs that the program can be started to the program start processing unit that starts the program. Therefore, it is possible to determine whether or not the program can be executed according to the white list.

  In addition, the execution determination unit outputs the program start processing unit to the program start processing unit when the program is not registered in the white list and the operation mode is not the white list creation mode. It is possible to prevent the program from being rewritten.

  Further, whether or not a library loaded by the OS is registered in the white list is determined based on the file name of the library, and whether or not the library is loaded is determined based on the operation mode. Because it has a section, it is possible to create a white list without human intervention.

  Further, the library load availability determination unit determines that the library can be loaded into the library load processing unit that loads the library when the library is registered in the white list or when the operation mode is the white list creation mode. Since the data is output, it is possible to determine whether the library can be loaded according to the white list.

  In addition, if the library is not registered in the white list and the operation mode is not the white list creation mode, the library load availability determination unit outputs to the library load processing unit that the library cannot be loaded. Can be prevented from being rewritten.

  In addition, when the operation mode is the white list creation mode or the maintenance mode in which maintenance is performed, the file open processing unit that opens the file includes a file open availability determination unit that outputs that the file can be opened. Whether the file can be opened can be determined according to the list.

  In addition, the file openability determination unit outputs the fact that the file can be opened to the file open processing unit when the operation mode is the normal operation mode in which the normal operation is performed and the file is not written. The file can be opened based on whether the file is written.

  The file openability determination unit is a case where the operation mode is the normal operation mode in which the normal operation is performed and the file is written to the file, and the file is opened when the file is registered in the white list. Since the fact that the file cannot be opened is output to the processing unit, it is possible to prevent these files from being rewritten illegally.

Embodiment 2. FIG.
In the first embodiment described above, it is determined whether the program can be started or loaded using the file name of the program or library. In the present embodiment, the address space of the calling process is called in the library. An embodiment for determining whether or not mapping is possible when mapping and executing is performed.

  In an OS such as Windows (registered trademark), since a file name is specified when a library is loaded, whether or not loading is possible can be determined based on the file name. However, if the file name is not specified when the library is loaded, it cannot be determined whether or not the file can be loaded based on the file name. In UNIX (registered trademark) and Linux (registered trademark), when a library is loaded, the library file is first opened and mapped to the address space. This technique is called mmap. In mmap, the contents of a file are mapped to the address space of the process, and when the process reads the memory of the address space, the corresponding data in the file associated with the address is read. The process is an operating program.

  By mmapping the library file, the instruction codes of the computers in the library file are mapped to the address space, and the instruction codes can be executed. The file name is specified when the file is opened. At that time, it cannot be determined whether the library is used for normal reading or writing or for mmap. In addition, since the file name is not specified for mmap, it cannot be determined whether the library is registered in the white list. In this embodiment, a solution for such a case is presented.

  FIG. 6 is a block diagram showing the configuration of the information processing apparatus 600 according to the first embodiment. The difference from the information processing apparatus 100 in FIG. 1 is that the OS 101 includes a mapping processing unit 601 and a mapping availability determining unit 602 instead of the library loading processing unit 103 and the library loading availability determining unit 106. Other than the mapping processing unit 601 and the mapping availability determination unit 602 are the same as those in the first embodiment, and thus description thereof is omitted.

  The mapping processing unit 601 receives from the OS 101, as arguments, management information for an already opened file, a map destination address, an access right to the address space, and the like. As the access right to the address space, read permission, write permission, and instruction execution permission are set. The mapping processing unit 601 passes the management information for the file and the parameter of the access right to the address space to the mapping availability determining unit 602, and the mapping availability determining unit 602 determines whether the mapping can be used.

  Next, the operation will be described. When the process 112 uses the library file mapped in the address space, the OS 101 executes the mapping processing unit 601. The mapping processing unit 601 calls the mapping availability determining unit 602 before using the library file in order to determine the availability of mapping of the library file.

  FIG. 7 is a flowchart showing the flow of processing of the mapping availability determination unit 602 according to the first embodiment. A case where the process 112a uses the mapped library 114a will be described as an example.

  The mapping availability determination unit 602 starts processing when called from the mapping processing unit 601. The mapping possibility determination unit 602 determines whether or not an instruction execution right is attached to the access right of the library 114a (S71). If the instruction execution right is not attached to the access right of the library 114a, the mapping availability determination unit 602 outputs that it can be used to the mapping processing unit 601 (S74). When the execution right is not attached, it is simply for reading and writing data, not for executing the instruction code of the computer of the library 114a, so that the mapped library can be used.

  When the instruction execution right is attached to the access right of the library 114a, the mapping permission / inhibition determination unit 602 refers to the management data in the OS 101 from the file management information and checks the file name to be used (S72). The mapping availability determination unit 602 determines whether the searched file name has been registered in the white list (S73). If the file name is already registered in the white list, the mapping availability determination unit 602 outputs that it can be used to the mapping processing unit 601 (S74).

  If the library 114a has not been registered in the white list 22, the mapping availability determination unit 602 refers to the operation mode (S75). When the operation mode is the white list creation mode, the mapping availability determination unit 602 registers the library 114a in the white list 22 (S76), and outputs that it can be used to the mapping processing unit 601 (S74). When the operation mode is the normal operation mode or the maintenance mode, the mapping availability determination unit 602 outputs information indicating that it cannot be used to the mapping processing unit 601 (S77), and ends the processing.

  When the availability is input from the mapping availability determination unit 602, the mapping processing unit 601 executes processing using the library 114a. In addition, when “unusable” is input from the mapping availability determination unit 602, the mapping processing unit 601 ends the process without using the library 114a.

  Therefore, whether or not the library loaded by the OS is registered in the white list is determined based on the correspondence between the address to which the contents of the library file are mapped and the file name of the library file, and the instruction is executed to the library. Since it has mapping enable / disable judging section that decides whether to add the library to the white list based on whether or not the right is granted and the operation mode, the library file is opened first when loading the library. Even if the URL is mapped to the address space, the white list can be created without human intervention.

  Also, when the instruction execution right is not granted to the library, when the instruction execution right is granted to the library and registered in the white list, or when the instruction execution right is granted to the library If it is not registered in the white list and the operation mode is the white list creation mode, the fact that the library can be used is output to the mapping processing unit that uses the library. Can do.

  In addition, when the instruction execution right is given to the library and it is not registered in the white list, and the operation mode is the normal operation mode or the maintenance mode, it is output to the mapping processing section that the library cannot be used. It is possible to prevent these libraries from being rewritten illegally.

21, 22 White list 100, 600 Information processing apparatus 101 OS
DESCRIPTION OF SYMBOLS 102 Program start process part 103 Library load process part 104 File open process part 105 Execution possibility judgment part 106 Library load feasibility judgment part 107 File open possibility judgment part 111 Operation mode setting process 112a-c Process 113 Program 114a-n Library 601 Mapping process Unit 602 Mapping determination unit

Claims (13)

  Whether a program started by an operating system (hereinafter referred to as an OS) is registered in a white list, which is a list of programs allowed to be executed, is determined based on the file name of the program, and the operation of the OS is determined. An information processing apparatus comprising: an execution availability determination unit that determines whether to add the program to the white list based on an operation mode to be set.   When the program is registered in the white list, or when the operation mode is the white list creation mode, the execution determination unit can start the program in a program start processing unit that starts the program The information processing apparatus according to claim 1, wherein:   The execution permission determination unit outputs that the program cannot be started to the program start processing unit when the program is not registered in the white list and the operation mode is not the white list creation mode. The information processing apparatus according to claim 1, wherein:   It is determined whether the library loaded by the OS is registered in the white list based on the file name of the library, and determines whether to add the library to the white list based on the operation mode. The information processing apparatus according to any one of claims 1 to 3, further comprising a library load availability determination unit.   When the library is registered in the white list or when the operation mode is the white list creation mode, the library load availability determination unit loads the library into a library load processing unit that loads the library. The information processing apparatus according to claim 4, wherein the information indicating that it is possible is output.   The library load availability determination unit outputs that the library cannot be loaded to the library load processing unit when the library is not registered in the white list and the operation mode is not the white list creation mode. The information processing apparatus according to claim 4, wherein the information processing apparatus is an information processing apparatus.   When the operation mode is the whitelist creation mode or the maintenance mode for performing maintenance, a file open availability determination unit that outputs that the file can be opened is provided in a file open processing unit that opens the file. The information processing apparatus according to any one of claims 1 to 6.   The file open availability determination unit is a normal operation mode in which the operation mode performs a normal operation, and when the file is not written to, the file open processing unit can open the file. The information processing apparatus according to claim 7, wherein:   The file open / close determination unit is a case where the operation mode is a normal operation mode in which a normal operation is performed, and writing to the file is performed, and further, the file is registered in the white list The information processing apparatus according to claim 7, wherein the file open processing unit outputs that the file cannot be opened.   Whether the library loaded by the OS is registered in the white list is determined based on the correspondence between the address to which the contents of the library file are mapped and the file name of the library file. 4. The mapping availability determination unit for determining whether to add the library to the white list based on whether or not an instruction execution right is given and the operation mode. The information processing apparatus according to any one of claims.   If the instruction execution right is not granted to the library, the instruction execution right is granted to the library and is registered in the white list, or the instruction execution right is granted to the library And when the operation mode is the white list creation mode, the fact that the library is available is output to a mapping processing unit that uses the library. Item 11. The information processing apparatus according to Item 10.   If the library is granted instruction execution rights and is not registered in the white list, and the operation mode is the normal operation mode or the maintenance mode, the library cannot be used in the mapping processing unit. The information processing apparatus according to claim 10 or 11, wherein:   Whether the program started by the OS is registered in the white list, which is a list of programs allowed to be executed, is determined by the file name of the program, and based on the operation mode for setting the operation of the OS An information processing method comprising an execution determination step for determining whether to add a program to the white list.

Images