JP3266021B2 - Security method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to program protection, and more particularly, to security in a workflow.

[0002]

2. Description of the Related Art Generally, as a technique relating to security of a program or the like, for example, a technique described in Japanese Patent Application Laid-Open No. Hei 3-276337 (hereinafter referred to as Conventional Technique 1) is known. Here, when the CPU writes and reads the user program, it checks whether or not the program code of the user program is appropriate (checks at the time of execution of the program). To prevent the destruction and falsification of programs and data as much as possible.

Further, Japanese Patent Laid-Open Publication No. Hei 4-259036 (hereinafter referred to as Conventional Technique 2) discloses a method of adding a checksum or a code obtained by encrypting a checksum to a program to prevent unauthorized tampering, and executing the program. In such a case, the security of the program and the like is ensured by checking whether there is any unauthorized tampering.

Japanese Patent Application Laid-Open No. 4-86939 (hereinafter referred to as "prior art 3") is designed to prevent unauthorized execution of a program by a program that presumes falsification processing.

[0005]

In the above-mentioned prior art 1, a check must be performed at the time of execution of the program, and as a result, the program execution speed is reduced.

In prior art 2, a checksum must be added in advance, while in prior art 3, it is difficult to protect users from unspecified programs.

In a workflow, there is an opportunity to receive a document from an unspecified person as in the case of a conventional e-mail, and in a workflow, the direction of automation is higher than that of an e-mail. Is required to work with external applications.
Further, the external application may have the user right of the recipient when accessing the file or the like. In consideration of this, when an executable object is sent in a format attached to a document or the like in a workflow, a part including an invalid instruction on the transmission path and at the generation source exists in the object, and the illegal The information of the workflow user may be stolen or destroyed illegally by such a command.

[0008] In addition, for a document from an untrusted party or an instruction for which the range of influence is not known, if the user does not want to execute the executable object due to the danger, but does not execute it depending on the type of the document, an unrelated data portion May not be accessible.

An object of the present invention is to provide a security scheme in a workflow in which an illegal instruction is deleted or an instruction sequence for guarding an illegal instruction is added to prevent theft and destruction of information.

Another object of the present invention is to provide a security method in a workflow in which an instruction whose influence range is unknown for an executable portion can be deleted and only a document excluding the executable portion can be accessed.

[0011]

According to the present invention, there is provided a registration unit for registering an object format including an executable part according to the type of an object attached to a document about a work instruction sent in a workflow, and A detection unit that determines whether an executable object is included in the object content in the format and detects an executable portion;
Possess a rewriting unit for rewriting the detected executable portion for deleting or instruction sequence rewritten to perform safety process original executable portion, the rewriting unit, the safety process, the detection execution
The instruction to be checked included in the
If the instruction is an instruction to be deleted, delete it and the instruction is
If not, execute the instruction before executing the instruction.
A command for allowing the user to select whether or not the security is provided is obtained. For example, at the time of rewriting, an instruction such as access to a file or activation of another process is targeted.

[0012] By such rewriting, illegal access to the file that could occur in the original instruction sequence is prevented. In other words, by rewriting the executable part to a safe one, the workflow user is protected from the destruction of information or the unauthorized acquisition of information by the executable object in the attached document accessing the user's file illegally. I do.

As described above, according to the present invention, when an executable object is sent in a form attached to a document or the like in a workflow, there is a portion including an invalid instruction on a route to be sent or on a generation source, and the illegal If there is a risk that the information of the workflow user may be stolen or destroyed by such instructions, the stealing or destruction of the information may be performed by deleting the instructions or adding an instruction sequence that guards the illegal instructions. Elimination of the possibility.

Further, according to the present invention, since an instruction whose influence area is not known for an executable portion is deleted, it is possible to access only the document excluding the executable portion.

[0015]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the drawings.

Referring to FIG. 1, the illustrated processing system comprises:
The selecting device 4 includes a selecting device 4, a dividing device 5, and a converting device 8. The selecting device 4 determines the type of the data 1 and transmits the data 1 to the dividing device 5 and the converting device 8 as type information. The dividing device 5 divides the data 1 into a macro part 6 and a data part 7. Then, the conversion device 8 converts the macro part 6 into a secured macro part 9 and generates conversion information 10.

Here, the operation of the selection device 4 will be specifically described with reference to FIG.

The selecting device 4 reads the data 1 (step 101) and compares the type of the data 1 with the registered type to determine (step 102). Then, the selecting device 4 generates the type information according to the determination result, and
And the conversion device 8 are notified of the type information (step 10).
3), end the process.

Next, the operation of the dividing device 5 will be specifically described with reference to FIGS.

The dividing device 5 switches the processing according to the notification from the selecting device 4, that is, the type information (step 2).
01). That is, the dividing device 5 selects the processing corresponding to the data 1. Next, the dividing device 5 reads the macro part 3 from the data 1 as the macro part 6 (step 202). Then, the dividing device 5 reads the data part 2 from the data 1 as the data part 7 (step 2).
03), end the processing.

With reference to FIGS. 1 and 4, the operation of the conversion device 8 will be specifically described.

The conversion device 8 switches the processing according to the notification from the selection device 4, that is, the type information (step 3).
01). That is, the conversion device 8 selects the process corresponding to the data 1 and reads the macro part 6. The converter 8 searches the macro part to the end (step 3).
02), the analysis process of the macro part is called, and the analysis with the macro par is performed (step 303).

In the macro part analysis processing, first, one macro instruction is read (step 310), and it is determined whether the read macro instruction is an instruction to be checked (step 311). If the read macro instruction is the instruction to be checked, the process proceeds to step 312. If the read macro instruction is not the instruction to be checked, the process proceeds to the exit of the macro part analysis process.

In step 312, it is determined whether or not the read macro instruction belongs to the instruction to be deleted. If the read macro instruction is an instruction to be deleted, the process proceeds to step 314; Process 313
Proceed to.

In step 313, a security instruction (security instruction) for the macro instruction is added to the secured macro part 9. Here, the security instruction is, for example, whether or not to execute the instruction before executing an instruction having a side effect that may cause a problem, such as the file deletion instruction a shown in FIG. This is an instruction sequence b for selection.

In step 314, the macro instruction is deleted from the secured macro part 9. The instruction to be deleted is, for example, an instruction whose influence range is unknown, such as a declaration for calling the DLL shown in FIG.

When steps 313 and 314 are completed, step 315 is executed. In step 315, the changed content in step 313 or step 314 is added to the conversion information 10.

As described above, when the macro part analysis process is performed and the macro part reaches the end of the part in step 302, the process proceeds to step 304.

In step 304, the changed macro part is written as the secured macro part 9 to the macro part of the data 11. Thereafter, the conversion device 8 writes the checklist, that is, the conversion information 10 to a file or the like (step 305), and the process is completed.

Referring to FIGS. 7 and 8 together with FIG. 1, FIG. 7 shows an example of an input macro part, and FIG. 8 shows an example of a secured macro part. Have been.

As described above, the selecting device 4 reads the data 1 and compares the type of the data 1 with the registered type to determine. Then, the selecting device 4 notifies the dividing device 5 and the converting device 8 of the type information.

Next, the dividing device 5 selects a process for reading the macro part of the format shown in FIG. 7 corresponding to the data 1 and converts the macro part 3 of the format shown in FIG. Read. Further, the dividing device 5
Reads data part 2 from data 1 as data part 7.

Finally, the conversion device 8 selects the process of reading the macro part of the format shown in FIG. 7, and reads the macro part of the format shown in FIG. At this time, since the macro part exists, the macro part is analyzed. In the macro part analysis process, one macro instruction is read, and at this time, an intermediate code corresponding to “Sub Main” is read. As described above, it is determined whether the read macro instruction belongs to the instruction to be checked. In this case, the process proceeds to the exit of the macro part analysis process. Since the macro part still exists, the macro part is analyzed again. In the conversion device 8, "File Find"
Is read, the instruction becomes an instruction to be checked, so it is determined whether or not to delete the instruction. Since this command is not a command to be deleted, a safety command is added. That is, the security instruction indicated by “a” in FIG. 8 is added. The instruction of “size =...” Is processed as not to be checked. Similarly, the instruction of “if...” Is processed as not to be checked.
The instruction “out...” is processed as not to be checked, and the “kill...” instruction is added with the security instruction indicated by “b” in FIG.
The instruction of “ext” is processed without being checked, the instruction of “End If” is processed as being not checked, and the instruction of “End Sub” is also processed as not being checked.

Thus, when the macro part ends,
In the conversion device 8, the secured macro part shown in FIG. 8 is written out to the macro part of the data 11 as the secured macro part 9. Then, the conversion device 8 converts the conversion information 10
To a file etc.

[0035]

As described above, according to the present invention, for an instruction having a certain range of influence, such as a file operation, a safe operation code is added by notifying a user of an instruction to be executed. There is an effect that the executable object can be safely executed without affecting the application, and the attached document can be used.

Further, according to the present invention, there is an effect that at least the document portion can be used while ensuring security by deleting an instruction whose influence range is unknown, such as activation of an external process.

[Brief description of the drawings]

FIG. 1 is a diagram showing an example of a processing device using a security securing system according to the present invention.

FIG. 2 is a flowchart for explaining the operation of the selection device shown in FIG. 1;

FIG. 3 is a flowchart for explaining the operation of the dividing device shown in FIG. 1;

FIG. 4 is a flowchart for explaining the operation of the conversion device shown in FIG. 1;

FIG. 5 is a diagram showing an example of instruction sequence rewriting according to the present invention.

FIG. 6 is a diagram showing another example of the instruction sequence rewriting according to the present invention.

FIG. 7 is a diagram showing a macro part.

FIG. 8 is a diagram showing a stabilized macro part.

[Explanation of symbols]

 Reference Signs List 1 data 2 data part 3 macro part 4 selection device 5 division device 6 macro part 7 data part 8 conversion device 9 macro part (secured) 10 conversion information 11 data 12 data part 13 macro part (secured)

Continuation of the front page (56) References JP-A-7-287688 (JP, A) JP-A-8-123744 (JP, A) International Publication No. 94/18620 (WO, A1) "Information Processing Society of Japan" Vol. 96, No. 96 (1996-10) (96-GW-20-5) P. 25- “Information Processing Society of Japan Research Report” Vol. 60 (94-GW-55-10) (Jul. 1994) 67- “Communications week” no. 608 (1996-4) p. 31 (58) Field surveyed (Int.Cl. ⁷ , DB name) G06F 9/06 G06F 12/14

Claims (2)

(57) [Claims] 1. A security securing method for preventing destruction and unauthorized use of information by an executable object sent via a workflow, wherein an object format including an executable part according to the type of the object is used. A registration unit for registering as a registration object format;
A detection unit that detects an executable part of the object as a detection executable part according to the registered object format, and performs a security process on the detection executable part to generate a safety-processed part and perform the detection execution moiety and replacing said safing processed portion have a rewriting portion, before
The rewriting unit can execute the detection as the safety processing.
For the instruction to be checked included in the part,
If it is an instruction to be deleted, delete it.
If not, whether to execute the instruction before executing the instruction
A security assurance method characterized by adding an instruction for allowing a user to select whether or not to perform the above operation . 2. The security assurance system according to claim 1, wherein the detection unit sets an instruction sequence for accessing a file or starting another process as the detection executable part. Characteristic security method.