JP2019168958A - Application execution authority management device, method, and program - Google Patents

Abstract

To provide an application execution authority management device that allows users to appropriately manage the execution authority of cooperative applications.SOLUTION: An application authority analysis unit 81 detects an API to be used by an activated application and analyzes an application authority that is an authority required for the application alone. A cooperative application detection unit 82 detects a cooperative application being an application that cooperates with the activated application, based on the detected API. An execution authority determination unit 83 determines an execution authority of the activated application based on the application authority of the activated application and the application authority of the cooperative application. A notification unit 84 notifies a user of the determined execution authority.SELECTED DRAWING: Figure 8

Description

  The present invention relates to an application execution authority management apparatus, an application execution authority management method, and an application execution authority management program that manage application execution authority.

  There are many security incidents where confidential information is stolen and leaked out or destroyed by viruses (targeted attacks, ransomware, etc.). In the “Information Security 10 Major Threats 2016” announced by the Information Processing Promotion Organization, “No. 2 information leaks due to targeted attacks” and “No. 3 fraud / depression using ransomware” were selected. It is obvious.

  Even if a virus invades a computer, damage can be prevented if the virus operation can be restricted. However, in practice, the virus performs processing without being restricted in operation. This is because the authority of the process to be executed by an application such as a virus cannot be managed, and the process (file access, network access, etc.) unintended by the user is performed. Therefore, it is necessary to perform authority management that allows the application to execute so that the application running on the computer can perform only the process intended by the user.

  One method of managing the execution authority of an application is a method of managing at an OS (operation system) level. Specifically, the application developer is forced to declare usage rights in advance. Then, the user selects permission or prohibition by notifying the user at the timing when the application actually requests authority.

  In addition, as a method for managing the execution authority of the application, a method of controlling the authority of the application alone is known. For example, Patent Document 1 describes a method for stably managing the operation of an application in a system. In the method described in Patent Document 1, an API (Application Programming Interface) function required at the time of starting an application is hooked, and the contents of a call stack corresponding to the API function are output. Then, the contents of the output call stack are searched and confirmed in a stack database storing the call stack contents of various API functions.

  Note that Patent Document 2 describes a method of restricting resource operations for a user without access authority. In the method described in Patent Document 2, a process request for a computer resource or an operation request from an OS is captured before accessing the computer resource, and whether or not there is an access right to the computer resource specified by the captured operation request. judge.

Special table 2010-509654 JP 2003-044297 A

  However, the management method at the OS level has a problem that it cannot be realized by an OS for which no countermeasure is taken. On the other hand, when the execution authority is controlled by a single application, there is no problem with the OS described above. However, when execution authority is controlled by an application alone, there is a problem in that it is not possible to appropriately control operations performed in cooperation with a plurality of applications.

  Hereinafter, the above problem will be described using specific examples. FIG. 9 is an explanatory diagram illustrating an example in which two applications operate in cooperation. For example, the application AP-A1 illustrated in FIG. 9 performs file access, and the application AP-B1 performs network access. In this case, the user can only determine that “application AP-A1 is an application that performs file access” and “application AP-B1 is an application that performs network access”. Therefore, for example, the user may determine that permission is given only for file access and permission is granted only for network access, and may give authority to the application AP-A1 and the application AP-B1.

  However, it is assumed that the application AP-A1 is an application that performs unauthorized processing. At this time, if authority is given to both applications, there is a possibility that processing for transmitting data illegally acquired by the application AP-A1 to the outside in cooperation with the application AP-B1 may be performed. .

  FIG. 10 is an explanatory diagram illustrating an example in which a plurality of applications operate in cooperation. In the example illustrated in FIG. 10, it is assumed that the application AP-A2 and the application AP-B2 perform file access, and the application AP-C performs network access. The application AP-A2 and the application AP-B2 are both linked to the application AP-C. The application AP-A2 is an application that performs correct processing, and the application AP-B2 is an application that performs unauthorized processing.

  Also in the example shown in FIG. 10, it is assumed that authority management is performed in units of applications. If an attempt is made to control a network from an unknown application and a setting is made to prohibit network access by the application AP-C, processing from the application AP-A2 that performs correct processing cannot be executed. On the other hand, if setting is made to permit network access by the application AP-C, processing from the application AP-B2 that performs unauthorized processing is permitted.

  Accordingly, an object of the present invention is to provide an application execution authority management apparatus, an application execution authority management method, and an application execution authority management program that allow a user to appropriately manage the execution authority of a linked application.

  The application execution authority management apparatus according to the present invention detects an API used by a started application, analyzes an application authority that is an authority required for the application alone, and based on the detected API. Based on the linked application detection unit that detects the linked application that is linked to the started application, the application authority of the started application, and the application permission of the linked application, the execution permission of the started application is set. An execution authority determination unit for determining and a notification unit for notifying the user of the determined execution authority are provided.

  The application execution authority management method according to the present invention detects an API used by an activated application, analyzes an application authority that is necessary for the application alone, and is activated based on the detected API. Detect the linked application that is linked with the application, determine the execution authority of the launched application based on the application authority of the started application and the application authority of the linked application, and give the determined execution authority to the user It is characterized by notifying.

  An application execution authority management program according to the present invention detects an API used by a started application on a computer and analyzes an application authority, which is an authority required for the application alone, and a detected API. Based on the above, a linked application detection process that detects a linked application that is linked to the launched application, the application authority of the launched application, and the execution of the launched application based on the application authority of the linked application An execution authority determining process for determining authority and a notification process for notifying the user of the determined execution authority are executed.

  According to the present invention, the user can appropriately manage the execution authority of the linked application.

It is a block diagram which shows the structural example of one Embodiment of the application execution authority management apparatus by this invention. It is explanatory drawing which shows the operation example of an application execution authority management apparatus. It is explanatory drawing which shows the example of an application management table. It is explanatory drawing which shows the example of a cooperation application management table. It is explanatory drawing which shows the example of an execution authority management table. It is a flowchart which shows the operation example of an application execution authority management apparatus. It is a flowchart which shows the operation example of an application execution authority management apparatus. It is a block diagram which shows the outline | summary of the application execution authority management apparatus by this invention. It is explanatory drawing which shows the example in case an application cooperates and operate | moves. It is explanatory drawing which shows the example in case a some application cooperates and operate | moves.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. The present invention proposes a technique for correctly managing authority and notifying a user including not only a single application but also linked applications. In order to realize this method, a mechanism for managing the execution authority of a single application and a mechanism for detecting a linked application are combined. That is, the execution authority of the application alone and the execution authority of the linked application are collectively managed as the application execution authority.

  In the following description, the notation is described separately in order to distinguish between “execution authority of an application alone” and “authority combining the execution authority of an application alone and the execution authority of a linked application”. Specifically, “application execution authority” is expressed as “application authority”, and “application authority combined with execution authority of linked application” is expressed as “application execution authority”.

  FIG. 1 is a block diagram showing a configuration example of an embodiment of an application execution authority management apparatus according to the present invention. The application execution authority management apparatus 100 according to the present embodiment cooperates with a simple application analysis unit 1, a simple analysis result storage unit 2, an application analysis unit 3, an application information acquisition unit 4, and an analysis / acquisition result storage unit 5. An application detection unit 6, a linked application storage unit 7, an application authority determination unit 8, an execution authority notification unit 9, an execution authority storage unit 10, an execution authority control unit 11, and a storage unit 12 are provided.

  The application execution authority management apparatus 100 operates by intervening in the process between the OS and the application by the API hook. In the application execution authority management apparatus 100 according to the present embodiment, the process of the simple application analysis unit 1 is started with the activation of the application as a trigger. In addition, the processing of the application analysis unit 3 is started with each API call from the application as a trigger.

  FIG. 2 is an explanatory diagram illustrating an operation example of the application execution authority management apparatus 100 according to the present embodiment. As illustrated in FIG. 2, the application AP-A and the application AP-B cooperate to execute processing.

  As described above, in this embodiment, the application execution authority management apparatus 100 intervenes between the OS and the application, and analyzes the API used by the application. The application authority (file access, network access, etc.) of the application is confirmed from the analysis result. Further, the application execution authority management apparatus 100 detects the application AP-B that cooperates with the application AP-A, and “application authority of the application AP-A alone” and “the application of the application AP-B that cooperates with the application AP-A”. "Authority" is combined, and the combined authority is stored as "Execution authority of application AP-A" (step S101 in FIG. 2).

  Thereafter, the application execution authority management apparatus 100 notifies the user of the execution authority of the generated application AP-A and accepts selection of permission or prohibition by the user. If the execution authority is changed, the application execution authority management apparatus 100 notifies the user again. When the user selects “permitted”, the application execution authority management apparatus 100 continues the process, and when “prohibited” is selected, the process is not performed (step S102 in FIG. 2).

  Hereinafter, the operation of each component included in the application execution authority management apparatus 100 will be described.

  The storage unit 12 stores various information necessary for the application execution authority management apparatus 100 to perform processing. The contents stored in the storage unit 12 will be described later. The storage unit 12 is realized by, for example, a magnetic disk.

  The simple application analysis unit 1 determines application authority required by the application. Specifically, when the application simple analysis unit 1 detects activation of an application, it creates a list of APIs loaded by the application. Then, the simple application analysis unit 1 determines an application authority necessary for the activated application from the created API list based on a predetermined rule.

  As a predetermined rule, for example, there is a rule that “if the socket API is used, it has an application authority for network communication”. However, the content of the determined rule is not limited to this content. The authority defined in the execution environment (for example, OS) may be associated with the content of the API.

  The simple analysis result storage unit 2 stores the application authority determined by the simple application analysis unit 1 in the application management table of the storage unit 12 in association with the application.

  The application analysis unit 3 determines application authority required by the application. Specifically, the application analysis unit 3 determines application authority required by the application from the executed API based on a predetermined rule.

  As a predetermined rule, for example, there is a rule that “if READ access is performed using the CreateFile API, the application authority for reading a file is possessed”. However, the content of the determined rule is not limited to this content. The authority defined in the execution environment (for example, OS) may be associated with the content of the API.

  Further, the application analysis unit 3 determines whether the executed API is an API for operating the shared memory or NamedPipe. When the executed API is an API for operating the shared memory or NamedPipe, processing by the application information acquisition unit 4 is further performed.

  As an API for operating the shared memory, for example, “CreateFile Mapping API” can be cited. Further, examples of APIs that operate NamedPipe include “CreateNamedPipe API” and “CreateFile API”.

  The application information acquisition unit 4 acquires information regarding the name and direction (that is, reading or writing) of the shared memory or NamedPipe from the executed API. For example, the application information acquisition unit 4 may acquire the name and direction of NamedPipe from API information (API name, argument value, etc.) called by the application.

  The analysis / acquisition result storage unit 5 registers the application authority determined by the application analysis unit 3 in the application management table. Further, the analysis / acquisition result storage unit 5 registers the information acquired by the application information acquisition unit 4 together with the application authority determined by the application analysis unit 3 in the application management table.

  FIG. 3 is an explanatory diagram illustrating an example of the application management table. In the example shown in FIG. 3, the application name and application authority of the activated application, the shared memory used by the application and its direction, and the Named Pipe name and its direction are associated and stored in the application management table. Show.

  The cooperative application detection unit 6 detects an application (hereinafter referred to as a cooperative application) that cooperates with the activated application, based on rules determined in advance from the information in the application management table and the executed API. Specifically, the cooperative application detection unit 6 includes at least one of an application that exists in the same folder as the activated application, an application that is called by the activated application, and an application that communicates with the activated application. Are detected as linked applications. In the following description, communication performed between applications is referred to as interprocess communication. In addition, the following rules are illustrated as a predetermined rule.

  As an example of the first rule, “whether or not the application is stored in the same folder” is cited. In response to this rule, the cooperative application detection unit 6 may acquire an execution folder of the application, enumerate all the exe files under the folder, and detect it as a cooperative application.

  As an example of the second rule, “whether or not another process is activated from the process” is cited. In response to this rule, the cooperative application detection unit 6 may enumerate corresponding exe files from the CreateProcess API and detect them as cooperative applications.

  As an example of the third rule, “whether or not inter-process communication is performed regarding a window message” is cited. In response to this rule, the cooperative application detection unit 6 may enumerate exe files having corresponding window handles from the SendMessage API and detect them as cooperative applications.

  As an example of the fourth rule, “whether or not inter-process communication is performed regarding the shared memory” can be cited. In response to this rule, the cooperative application detection unit 6 may enumerate exe files that use matching shared memory names from the application management table and detect them as cooperative applications. In this case, in consideration of the direction of use of the shared memory, the cooperative application detection unit 6 may determine as a cooperative source application when writing is performed, and may determine as a cooperative destination application when only reading is performed. .

  As an example of the fifth rule, “whether or not inter-process communication is performed regarding a named pipe” is given. In response to this rule, the cooperative application detection unit 6 may enumerate exe files that use matching NamePipe names from the application management table and detect them as cooperative applications. In this case, considering the usage direction of NamedPipe, the cooperation application detection unit 6 may determine that the application is a cooperation source application when writing is performed, and may determine that the application is a cooperation destination application when only reading is performed.

  As an example of the sixth rule, “whether or not inter-process communication is performed regarding COM (Component Object Model)” is cited. In response to this rule, the cooperative application detection unit 6 may enumerate exe files having the corresponding CLSID from the CoCreateInstance API and detect them as cooperative applications.

  In addition, the above rule is an illustration and is not limited to these contents. Other rules regarding application communication, calling, and storage location may be determined.

  The linked application storage unit 7 registers the linked application detected by the linked application detection unit 6 in the linked application management table of the storage unit 12. FIG. 4 is an explanatory diagram illustrating an example of the cooperative application management table. The cooperation application management table illustrated in FIG. 4 indicates that the cooperation source application and the cooperation destination application are stored in association with each other.

  The application authority determining unit 8 acquires a cooperative application from data stored in the cooperative application management table, and acquires application authority of each application from the application management table. Then, the application authority determining unit 8 determines the execution authority of the activated application based on the application authority of the activated application and the application authority of the cooperative application. Specifically, the application authority determining unit 8 determines the authority obtained by adding the application authority of the cooperative application to the application authority originally possessed by the activated application as the execution authority of the activated application.

  The execution authority notifying unit 9 notifies the user of the execution authority determined by the application authority determining unit 8 and receives a reply about permission or prohibition of the execution authority. Specifically, the execution authority notifying unit 9 sets the authority determined by the application authority determining unit 8 as the execution authority required by the application, and notifies the user of “application information” and “execution authority”. Then, the execution authority notifying unit 9 obtains an answer about permission or prohibition of execution authority from the user. The information on the application to be notified is, for example, the contents of the cooperation source application and the cooperation destination application.

  For example, it is assumed that the cooperation source application name is “AP1.exe”, and the application itself has an application authority for file access. On the other hand, it is assumed that the cooperation destination application (AP2) has an application authority for network access and is a cooperation application of AP1. In this case, the execution authority notifying unit 9 may notify the user of the execution authority of the AP 1 alone and the execution authority combined with the cooperative application AP2, and may receive a reply about permission or prohibition of the execution authority.

  The execution authority storage unit 10 registers an answer about permission or prohibition of the execution authority acquired from the user in the execution authority management table of the storage unit 12. FIG. 5 is an explanatory diagram of an example of the execution authority management table. The execution authority management table illustrated in FIG. 5 indicates that, with regard to the execution authority described above, the execution authority for AP1 alone is permitted, and the execution authority combined with the cooperative application AP2 is prohibited.

  The execution authority notifying unit 9 does not need to refer to the execution authority management table and notify the user again of the execution authority that has already been notified of permission or prohibition. Specifically, the execution authority notification unit 9 may determine whether or not the execution authority has already been notified by combining information on the cooperation destination application.

  The execution authority control unit 11 controls whether API processing is executed or stopped based on information in the execution authority management table. For example, when the process of the activated application is prohibited, the execution authority control unit 11 may prohibit the execution by returning an error without executing the original API within the hooked API. Further, when the process of the cooperation process (cooperation application) is prohibited, the execution authority control unit 11 may prohibit the activation of the cooperation process or the inter-process communication. Also in this case, the execution authority control unit 11 may be realized in the same manner as described above by performing an API hook, or may be controlled by hooking an API of a cooperation destination process.

  Simple application analysis unit 1, simple analysis result storage unit 2, application analysis unit 3, application information acquisition unit 4, analysis / acquisition result storage unit 5, cooperative application detection unit 6, and cooperative application storage unit 7 The application authority determination unit 8, the execution authority notification unit 9, the execution authority storage unit 10, and the execution authority control unit 11 are realized by a CPU of a computer that operates according to a program (application execution authority management program).

  For example, the program is stored in the storage unit 12 of the application execution authority management apparatus 100, and the CPU reads the program, and according to the program, the application simple analysis unit 1, the simple analysis result storage unit 2, the application analysis unit 3, and the application information It operates as an acquisition unit 4, an analysis / acquisition result storage unit 5, a linked application detection unit 6, a linked application storage unit 7, an application authority determination unit 8, an execution authority notification unit 9, an execution authority storage unit 10, and an execution authority control unit 11. May be.

  Also, a simple application analysis unit 1, a simple analysis result storage unit 2, an application analysis unit 3, an application information acquisition unit 4, an analysis / acquisition result storage unit 5, a cooperative application detection unit 6, and a cooperative application storage unit 7, the application authority determination unit 8, the execution authority notification unit 9, the execution authority storage unit 10, and the execution authority control unit 11 may each be realized by dedicated hardware.

  Next, the operation of the application execution authority management apparatus 100 according to this embodiment will be described. 6 and 7 are flowcharts showing an operation example of the application execution authority management apparatus 100 according to this embodiment.

  The application execution authority management apparatus 100 starts the process illustrated in FIG. 6 with the activation of the application as a trigger. Further, the application execution authority management apparatus 100 starts the processing illustrated in FIG. 7 triggered by each API being called from the application.

  The simple application analysis unit 1 acquires the application authority of the single application (step S1 in FIG. 6). Specifically, the application simple analysis unit 1 creates a list of APIs loaded by the application, and determines application authority required by the application based on a predetermined rule.

  The simple analysis result storage unit 2 stores the application authority of the single application (step S2). Specifically, the simple analysis result storage unit 2 stores the determined application authority information in the application management table, and ends the process. Note that after the application is started, the processing illustrated in FIG. 7 is triggered by the execution of each API hooked API.

  The application analysis unit 3 acquires the application authority of the single application (step S3). Specifically, the application analysis unit 3 uses the API information (API name and argument value) called by the application, and determines the application authority required by the application based on a predetermined rule.

  In addition, the application analysis unit 3 determines whether the executed API is an API for operating the shared memory or NamedPipe (Step Sp1). When the executed API is an API that operates the shared memory or NamedPipe (Yes in Step Sp1), the application information acquisition unit 4 acquires application information (Step S4). Specifically, the application information acquisition unit 4 acquires information on the name and direction (read / write) of the shared memory or NamedPipe using API information (API name or argument value) called by the application. On the other hand, if the executed API is not an API for operating the shared memory or NamedPipe (No in step Sp1), the process proceeds to step S5.

  The analysis / acquisition result storage unit 5 stores the application authority and information of the single application (step S5). Specifically, the analysis / acquisition result storage unit 5 stores the determined application authority and information in the application management table.

  The cooperative application detection unit 6 detects a cooperative application (step S6). Specifically, the cooperative application detection unit 6 detects a cooperative application based on rules determined in advance from the information of the application management table and the information of the executed API (API name and argument value).

  The cooperative application storage unit 7 stores information on the cooperative application (step S7). Specifically, the cooperative application storage unit 7 stores information on the detected cooperative application in the cooperative application management table.

  The application authority determining unit 8 determines the application execution authority (step S8). Specifically, the application authority determining unit 8 acquires an application authority of a single application from the data stored in the application management table as the first application authority. In addition, the application authority determining unit 8 acquires a cooperative application from data stored in the cooperative application management table, and acquires the application authority of each cooperative application from the application management table as a second application authority. Then, the application authority determining unit 8 determines an application execution authority from the first application authority and the second application authority.

  The execution authority notification unit 9 determines whether there is an unconfirmed authority (step Sp2). Specifically, the execution authority notifying unit 9 acquires the permission status of the application execution authority from the execution authority management table, and notifies the user by comparing the acquired data with the execution authority of the application determined in step S8. It is determined whether there is an execution authority that has not been executed. If there is an unconfirmed authority (Yes in Step Sp2), the execution authority notifying unit 9 displays a confirmation screen (Step S9) and accepts the user's answer. On the other hand, if there is no unconfirmed authority (No in step Sp2), the process proceeds to step S11.

  The execution authority storage unit 10 stores the confirmation result (step S10). Specifically, the execution authority storage unit 10 stores the permission or prohibition result selected by the user in the execution authority management table.

  The execution authority control unit 11 controls the operation of the application (step S11). Specifically, the execution authority control unit 11 acquires the permission status of the application execution authority from the execution authority management table. Then, based on the acquired data, the execution authority control unit 11 continues the process execution of the application if permitted, and sets the error in the process of the application if prohibited.

  As described above, in this embodiment, the application analysis unit 3 detects the API used by the activated application and analyzes the application authority of the application. Further, the cooperative application detection unit 6 detects a cooperative application of the activated application based on the detected API. Then, the application authority determining unit 8 determines the execution authority of the activated application based on the application authority of the activated application and the application authority of the cooperative application, and the execution authority notifying unit 9 determines the determined execution authority. To the user. Therefore, the user can appropriately manage the execution authority of the linked application.

  That is, by using the application execution authority management apparatus 100 of the present embodiment, it is possible to accurately grasp and control the operation including not only the application alone but also the linked application. Therefore, it is possible to protect the user from malicious operations not intended by the user and enhance security.

  For example, in the case of the example illustrated in FIG. 9, by using the application execution authority management apparatus 100 according to the present embodiment, the user may determine that “application AP-A1 is an application that performs file access and network access”. It becomes possible. Therefore, for example, it is possible to appropriately manage the authority as an application that may access the file and transmit data to the outside by the application AP-A1.

  Further, for example, in the case of the example illustrated in FIG. 10, by using the application execution authority management apparatus 100 of the present embodiment, the user permits the communication of the application AP-C when the application AP-A2 cooperates. Communication of application AP-C when AP-B2 cooperates can be prohibited.

  Next, the outline of the present invention will be described. FIG. 8 is a block diagram showing an outline of the application execution authority management apparatus according to the present invention. The application execution authority management apparatus 80 (for example, the application execution authority management apparatus 100) according to the present invention detects an API used by a started application and analyzes an application authority that is an authority required for the application alone. Based on the authority analysis unit 81 (for example, the application analysis unit 3) and the detected API, a linked application detection unit 82 (for example, the linked application detection unit 6) that detects a linked application that is linked with the activated application. ), The execution authority determining unit 83 (for example, the application authority determining unit 8) that determines the execution authority of the activated application based on the application authority of the activated application and the application authority of the cooperative application. Notification unit 84 for notifying the determined execute permission to the user (e.g., execute permission notifying section 9) and a.

  With such a configuration, the user can appropriately manage the execution authority of the linked application.

  Further, the execution authority determining unit 83 may determine the authority obtained by adding the application authority of the cooperative application to the application authority of the activated application as the execution authority of the activated application.

  In addition, when the executed API is an API that operates the shared memory or NamedPipe, the application authority analysis unit 81 acquires information on the shared memory or NamedPipe name and direction from the executed API, and the cooperative application detection unit 82 You may detect a cooperation application using the acquired information. With such a configuration, it is possible to detect a linked application more appropriately.

  The linked application detection unit 82 links at least one of an application that exists in the same folder as the activated application, an application that is called by the activated application, and an application that communicates with the activated application. You may detect as an application.

  Further, the application execution authority management device 80 may include a control unit (for example, the execution authority control unit 11) that controls processing of the detected API. Then, the notification unit 84 may receive a response from the user with respect to the notified execution authority, and the control unit may control API processing according to the received response.

  Moreover, the notification part 84 may suppress notification of the execution authority, when the determined execution authority is the execution authority already notified to the user. According to such a configuration, the user's burden of confirmation can be reduced.

  Specifically, the notification unit 84 stores it in the storage unit in association with the execution authority that notified the received response from the user, and determines whether the user has been notified based on the content stored in the storage unit. May be.

DESCRIPTION OF SYMBOLS 1 Application simple analysis part 2 Simple analysis result preservation | save part 3 Application analysis part 4 Application information acquisition part 5 Analysis / acquisition result preservation part 6 Cooperation application detection part 7 Cooperation application preservation part 8 Application authority determination part 9 Execution authority notification part 10 Execution authority Storage unit 11 Execution authority control unit 12 Storage unit 100 Application execution authority management device

Claims (9)

An application authority analysis unit that detects an API used by the activated application and analyzes an application authority that is an authority necessary for the application alone;
A cooperative application detection unit that detects a cooperative application that is an application that cooperates with the activated application, based on the detected API;
An execution authority determining unit that determines the execution authority of the activated application based on the application authority of the activated application and the application authority of the cooperative application;
An application execution authority management device comprising: a notification unit that notifies a user of the determined execution authority. The application execution authority management apparatus according to claim 1, wherein the execution authority determining unit determines an authority obtained by adding the application authority of the cooperative application to the application authority of the activated application as the execution authority of the activated application. When the executed API is an API that operates the shared memory or NamedPipe, the application authority analysis unit acquires information on the shared memory or NamedPipe name and direction from the executed API,
The application execution authority management apparatus according to claim 1, wherein the cooperation application detection unit detects a cooperation application using the acquired information. The linked application detection unit detects at least one of an application existing in the same folder as the started application, a destination application called by the started application, and an application that communicates with the started application as a linked application. The application execution authority management device according to any one of claims 1 to 3. A control unit that controls processing of the detected API;
The notification unit receives an answer from the user for the notified execution authority,
The application execution authority management device according to any one of claims 1 to 4, wherein the control unit controls processing of the API according to a received answer. 6. The application execution according to claim 1, wherein the notification unit suppresses the notification of the execution authority when the determined execution authority is the execution authority already notified to the user. Authority management device. The notifying unit stores it in the storage unit in association with the execution authority that has received the received answer from the user, and determines whether the user has been notified based on the content stored in the storage unit. Application execution authority management device. Detect the API used by the launched application, analyze the application authority that is the authority required for the application alone,
Based on the detected API, a linked application that is linked with the activated application is detected,
Based on the application authority of the activated application and the application authority of the cooperative application, the execution authority of the activated application is determined,
An application execution authority management method characterized by notifying a user of a determined execution authority. On the computer,
An application authority analysis process for detecting an API used by a started application and analyzing an application authority that is an authority required for the application alone;
Based on the detected API, a cooperative application detection process for detecting a cooperative application that is an application that cooperates with the activated application;
An execution authority determination process for determining an execution authority of the activated application based on the application authority of the activated application and the application authority of the cooperative application; and
An application execution authority management program for executing notification processing that notifies the user of the determined execution authority.

Images