JP3049749B2 - File access restriction processing device - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Summary] The present invention relates to an apparatus for preventing execution of harmful processing of a harmful program that may enter a computer file through a communication line. A file access restriction processing device for automatically restricting access to a file, connected to a communication line, provided in a computer that holds the file, having a transfer source identification unit and an access control unit, First and second flags are provided in the management information of each of the files, and the transfer source identification unit identifies a transfer source of the data when new data is stored in the file. When the transfer source is a communication line, the first flag is set to a predetermined value in the file, a program is loaded from the file and executed, and the file access is performed from the program. When a request is issued, the access control unit determines whether the file access request can be executed based on the value of the first flag of the file of the program and the value of the second flag of the file specified by the request. Configure to determine.

[Industrial applications]

The present invention relates to a file access restriction processing device for preventing harmful processing of a harmful program that may enter a computer file through a communication line.

As is well known, there is a program called a so-called computer virus, which performs harmful processing such as file destruction, but when such a harmful processing function enters,
First, it is necessary to prevent execution of a process that causes actual harm, but such a harmful function is often implemented in a program which is transferred to a computer and filed via a communication line.

[Conventional technology]

FIG. 3 is a block diagram showing a configuration example of a computer system. The computer is connected to a remote computer or the like via a communication line 2 by a communication control unit 1 and various input / output devices connected by an input / output control unit 3. I have four.

In addition, the file management unit 5 creates and deletes files from a large number of files 6 stored in the external storage device in response to requests from various programs 7 executed by the computer, and performs reference / update operations. Manage access.

In order for each program 7 to be executed by the computer, the file 6 storing the specified program is read out by the file management unit 5 in response to a request input from the input / output device 4 or the communication line 2, for example. It is configured to be activated by being loaded into a predetermined main storage area, and to start execution.

For example, when the data storage processing unit 8 is activated in such a manner, a process of receiving data input from the specified input / output device 4 or the communication line 2 and storing the data in the specified file 6 is executed. That is, the file management unit 5 requests the file management unit 5 to create the specified file, if necessary, and puts the data in a controllable state in which data can be written. Each time a required amount of data is stored in the buffer, the data is transferred to the file management unit 5 and written to the file 6.

In this way, the contents of the data stored in the file 6 may be general information or a program in an executable state. By requesting execution, it can be loaded and activated as described above.

[Problems to be Solved by the Invention] A known so-called computer virus or the like is a program that intentionally implements a function of performing harmful processing such as file destruction, and such a program is sent from the outside. In many cases, invasion is often made from outside via a communication line via the route stored in the file as described above. Therefore, there is a possibility that harmful processing can be prevented beforehand if attention is paid to the program input from the communication line.

An object of the present invention is to provide a file access restriction processing device that automatically restricts access to a file of a program input from a communication line.

[Means for solving the problem]

 FIG. 1 is a block diagram showing the configuration of the present invention.

The figure shows the configuration of the file access restriction processing device.
A computer connected to the communication line 2 and holding the file 11 includes a transfer source identification unit 12 and an access control unit 13, and the management information of each file 11 includes a first and a second flag 14. , 15 columns, and the transfer source identification unit 12
When new data is stored in 11, the transfer source of the data is identified, and when the transfer source is a communication line,
11, a first flag is set to a predetermined value, a program is loaded from the file 11 and executed, and when a file access request is generated from the program, the access control unit 13
Determines whether the file access request can be executed based on the values of the first flag 14 of the file of the program and the second flag 15 of the file specified by the request.

(Operation)

According to the present invention, a file is provided with two types of flags in the management information. By the file access restriction processing device,
It becomes possible to monitor the execution of the program input from the communication line and stored in the file, and when a request to access the file is issued from the program, the flag is inspected, and the flag is input by the first flag. If it is determined that the program is a program, the second flag of the specified file is checked, and if the flag is not set to a predetermined value, the file access is not executed. End with the appropriate response shown. Therefore, even if the program attempts to perform harmful processing, it is possible to prevent access to necessary files from being performed.

If the first flag is reset when the security of the program is separately confirmed, the access restriction can be removed. As for the second flag, it is assumed that a certain flag value is set in a file which allows access to a program input from a communication line at another occasion, for example.

〔Example〕

In the computer system shown in FIG. 1, the data storage processing unit 8 is provided with the designated input / output device 4 in the same manner as in the conventional case.
Alternatively, in order to execute a process of receiving data input from the communication line 2 and storing the data in the specified file 6,
A request is made to the file management unit 16 to set the designated file in a data write control state. In this case, according to the present invention, a transfer request from the data storage processing unit 8 to the file management unit 16 is received by the transfer source identification unit 12 of the file access restriction processing device 10 and relayed to the file management unit 16.

At this time, the transfer source identification unit 12 checks the control information of the system regarding the execution of the data storage processing unit 8 of the request source, and determines whether the data input source is the communication control unit 1 or another input / output control unit 3 or the like. The communication control unit 1 performs the following processing, and otherwise, simply requests the file management unit 16
Relay to

That is, when the input source is the communication control unit 1, it is determined that the input is from the communication line, and in that case, the first flag 14 of the data storage destination file 11 is set to a predetermined value indicating the communication line input. , And relay the storage request to the file management unit 16.

Thereafter, the data storage processing unit 8 receives the input data in the buffer and transfers the data to the file management unit 16 and writes the data to the file 11 every time a required amount of data is stored in the buffer, as in the related art. . File management unit 16
Has exactly the same functions as the above-mentioned conventional file management unit 5 except as described here. Each file 11 is the same as the conventional file 6 except that the management information has first and second flags 14 and 15.

As in the prior art, when an access request is issued to the file 11 of a required program in order to load and execute the required program 7 from the file 11, the access request is sent to the access control of the file access restriction processing device 10 according to the present invention. Part 13 receives.

When the access control unit 13 identifies that the request is an access for loading a program, the access control unit 13 requests the file management unit 16 to read the first flag 14 of the file 11, and the first flag 14 If the input value is a predetermined value indicating the input, the name of the program to be loaded is stored as monitoring information, and the access request is passed to the file management unit 16 to be executed.

When an access request to a certain file 11 is issued from the program 7 which has started execution, the access control unit 13 receives the access request again according to the present invention, and monitors the program name of the request source program 7 as described above. Checks the program name stored as information, and if there is a match with the monitoring information, the file management unit 16
Request reading of the 11 second flag 15.

As a result of the reading, if the second flag 15 is a predetermined value indicating that the program of the communication line input is permitted to be accessed, the access request is passed to the file management unit 16 for execution. If the value is not the predetermined value, the access request is discarded, and a response indicating that the request cannot be executed is returned to the requesting program 7.

FIG. 2 is a diagram showing an example of the flow of processing of the file access restriction processing device 10. When an access request to the file 11 is issued, a processing step 20 uses a program name held as monitoring information as described later. The request source program is checked, and if the program is not a communication line input program, the access is identified as a storage request in processing step 21. If not, the access request is relayed to the file management unit 16 in processing step 25.

If the request is a storage request, information for identifying the data input source from which the requester is receiving data is obtained as described above in processing step 22, and the data input source is identified in processing step 23. In step 25, the access request is relayed to the file management unit 16 as it is. If it is determined that the data input source is a communication line, a request for setting a first flag is given to the file management unit 16 in processing step 24, and the processing proceeds to processing step 25 to end the processing.

If it is determined in the processing step 20 that the access request source is the program of the communication line input, a request is made to the file management unit 16 in the processing step 26 to read the second flag,
In a processing step 27, it is identified whether the second flag indicates a value indicating that the program of the communication line input is permitted to be accessed. If the access is permitted, the access request is relayed to the file management unit 16 in a processing step 25 as it is. If the access is not permitted, the requesting source of the access is replied to the requesting source in a processing step 28 to terminate the processing.

The program name used as the monitoring information is prepared as follows. That is, when there is a program load request, a request is made to the file management unit 16 in processing step 30 to read the first flag of the specified file, and the processing step 31
Identifies whether the flag indicates a communication line input. If the input is not a communication line input, the process is terminated. If the input is a communication line input, the program name of the program to be loaded is stored as monitoring information in processing step 32. This storage is deleted upon receiving a notification from the program execution control function of the system at the end of the execution of the program.

〔The invention's effect〕

As is apparent from the above description, according to the present invention, in order to prevent the execution of harmful processing of a harmful program that may enter a computer file through a communication line, a program input from the communication line is prevented. Since the access to the file can be automatically restricted, there is a remarkable industrial effect of increasing the security of the computer system.

[Brief description of the drawings]

 FIG. 1 is a block diagram showing the configuration of the present invention, FIG. 2 is a flowchart of the process of the present invention, and FIG. 3 is a block diagram showing a conventional configuration example. In the figure, 1 is a communication control unit, 2 is a communication line, 3 is an input / output control unit, 4 is an input / output device, 5, 16 is a file management unit, 6, 11 are files, 7 is a program, and 8 is data storage processing. Unit, 10 is a file access restriction processing device, 12 is a transfer source identification unit, 13 is an access control unit, 14 is a first flag, 15 is a second flag, and 20 to 28 and 30 to 32 indicate processing steps.

──────────────────────────────────────────────────続 き Continued on the front page (58) Fields surveyed (Int. Cl. ⁷ , DB name) G06F 15/00 330 G06F 9/06 550 G06F 12/00 537 JICST file (JOIS) WPI (DIALOG)

Claims (1)

(57) [Claims] A file (11) connected to a communication line (2).
Is provided in a computer that holds
An access control unit (13), and the management information of each file (11) includes first and second
The transfer source identification unit (12) identifies the transfer source of the data when new data is stored in the file (11). In the case of a communication line, a first flag (14) is set to a predetermined value in the file, a program is loaded from the file (11) and executed,
When a file access request is issued from the program, the access control unit (13) sets the first flag (14) of the file of the program and the second flag (15) of the file specified by the request. The file access restriction processing device is configured to determine whether the file access request can be executed based on the value of (1).