JP4794331B2 - Information takeout control method to external storage device by arbitrary application - Google Patents

Description

  The present invention relates to a method for controlling information takeout to an external storage device by an arbitrary application.

In recent years, leakage of personal information such as customer information has become a social problem. Information leakage is often performed by storing information in an external storage device and taking it out, and there is a growing need for a technology that prohibits information from being taken out to an external storage device. On the other hand, there is a need for an authorized user to take information to an external storage device for the purpose of backing up important information.
From these backgrounds, there is an increasing interest in a technique for controlling the export of information to an external storage device.

The following patent document 1 can be cited as a known technical document related to take-out control. In the technique disclosed in Patent Document 1, information take-out control is realized based on application authentication.
FIG. 10 is a configuration diagram of the application authentication module disclosed in Patent Document 1, where 1001 represents an application authentication module, and 1002 represents a hash management table.
The application authentication module 1001 has a hash management table 1002 inside, and application authentication is performed by comparing the hash value of the activated application or the filter module inserted in the application with the hash value registered in the hash management table 902. Done. By taking out information by the application when the hash values are equal, and by prohibiting the taking out when the hash values are different, take-out control by an unauthorized application is realized.

JP 2003-108253 A

However, like the technique disclosed in Patent Document 1, in the information take-out control based only on application authentication, it is necessary to previously register the authentication information of the application to be monitored in the authentication information table. For this reason, there is a problem that an unknown application cannot be controlled.
However, in many cases, the object to be controlled is not the application unit but the control of the external storage device type regardless of whether the application is known or unknown. For example, when considering writing to a CD, it is often desirable to control the export of information from an arbitrary application in units of an external storage device called a CD, rather than controlling the export to a CD for a specific application. With the technique shown in FIG. 1, it is impossible to realize a take-out control request in units of external storage devices such as CDs and FDs regardless of the type of application.

  An object of the present invention is to provide an information takeout control method capable of controlling the takeout of information in units of external storage devices by an arbitrary application regardless of whether the application is known or unknown.

In order to achieve the above object, an information take-out control method to an external storage device by an arbitrary application according to the present invention,
When the connection of the external storage device is monitored by the monitoring module and the connection of the external connection device is detected, the input / output request from the arbitrary application to the external connection device is monitored, and the information takeout availability information is set. A first step of generating one input / output request monitoring unit and a second input / output request monitoring unit configured to monitor the input / output request unique to the arbitrary application and set information take-out availability information;
The first and second input / output request monitoring means captures an input / output request from an arbitrary application to the connected external storage device, refers to the information takeout availability information set for each, and the information takeout availability information And a second step of permitting or prohibiting the input / output request to the external storage device.

  According to the present invention, it is possible to control take-out in units of external storage devices such as CDs and FDs by any application regardless of whether the application is known and unknown, or authenticated or not authenticated.

Hereinafter, an embodiment for carrying out the present invention will be specifically described with reference to the drawings.
FIG. 1 is a functional block diagram showing an embodiment of a computer system to which the present invention is applied.
The client computer 1 includes a keyboard 2, a mouse 3, a display 4, a CPU 5, an external storage device 6 such as a floppy disk device, and a memory 7. The memory 7 includes a business application 101 used for various business operations, and an I / O control unit 103. An operating system (OS) 102, an I / O monitoring module 104, and a communication module 105 are stored.

FIG. 2 is a functional block diagram illustrating detailed configurations of the I / 0 control unit 103, the I / O monitoring module 104, and the communication module 105.
In FIG. 2, reference numeral 101 denotes an arbitrary business application for taking out information, and reference numeral 103 denotes an I / O control unit of the operating system 102.
Reference numeral 1031 denotes an external storage device addition monitoring unit that monitors the connection of the external storage device 6 and has a function of detecting that the external storage device 6 is connected, and monitors the input / output of the external storage device 6. Of all the modules in the control unit 103, the connection notification that the external storage device 6 is connected is set to be received latest.
Reference numeral 1032 denotes a standard I / O processing unit of the operating system 102, which normally corresponds to a device driver. For example, in the case of Windows (registered trademark of Microsoft Corporation), a CD-ROM class driver or the like corresponds.
1033 is a business application specific I / O processing unit, which may or may not exist depending on the business application, and independently issues I / O to the external storage device 6 without using the operating system standard I / O. It exists in the case of an application.
Reference numeral 1034 denotes a general-purpose I / O monitoring unit that is set to receive the connection notification of the external storage device 6 earliest among all the modules in the I / O control unit 103 that manages the I / O of the external storage device 6. It controls permission / prohibition of standard I / O of the operating system 102.
A monitoring unit 1035 monitors business application unique I / O, and 1036 is a business application unique I / O receiving unit. The receiving unit 1036 is a part that directly receives a request from the business application 101 and is generated by the business application 101. It may not be generated depending on the business application.

Reference numeral 104 denotes an I / O monitoring module, which includes an external storage device connection monitoring processing unit 1041, an application specific I / O monitoring processing unit 1042, and a general purpose I / O monitoring processing unit 1043.
The external storage device connection monitoring processor 1041 is a routine group that actually operates when the external storage device 6 is connected.
The application unique I / O monitoring processor 1042 is a routine group that captures and processes application unique I / O.
The general-purpose I / O monitoring processing unit 1043 is a routine group that captures and processes I / O for the external storage device 6.
Reference numeral 105 denotes a communication module, which is a part that communicates information about whether or not to carry out with a management computer outside the client computer 1.
Reference numeral 1051 denotes a memory representation of carry-out availability information. Has a status of either “permitted” or “prohibited”.
The monitoring units 1031, 1034, and 1035 are generated when the OS 102 detects the connection of the external storage device 6 as will be described later.
The I / O monitoring module 104 is realized using an I / O monitoring function provided by the operating system 102. For example, in the case of a Windows (registered trademark of Microsoft Corporation) system, it is realized by an I / O monitoring function of a filter driver.

Hereinafter, processing when the external storage device is connected and processing of each I / O monitoring unit 1031, 1034, 1035 will be described.
FIG. 3 is a schematic operation diagram of the OS 102 when the external storage device 6 is connected.
When the external storage device 6 is connected, a connection notification is transmitted from the OS 102 to the general-purpose I / O monitoring processing unit 1043 and the external storage device connection monitoring processing unit 1041, and the general-purpose I / O monitoring processing unit 1043 responds accordingly. The I / O monitoring unit 1034 is generated, and the external storage device connection monitoring processing unit 1041 generates the external storage device connection monitoring unit 1031 and the application specific I / O monitoring unit 1035 in the I / O control unit 103 of the operating system 102. Is done.

FIG. 4 is a processing sequence for realizing the operation of FIG.
First, as a preliminary preparation for connection of a new external storage device 6 that is not recognized by the OS 102, the I / O monitoring module 104 sends a connection notification of the new external storage device to the application-specific I / O. / O processing unit 1033 is set so as to be received before (step 401). For example, in the case of a Windows (registered trademark of Microsoft Corporation) system, the setting for receiving a connection notification can be made by setting the AddDevice routine of the device driver.
The setting for receiving the connection notification prior to the application-specific I / O processing unit 1033 is that the module name is set in the LowerFilters registry of the CD-ROM class driver when the CD-ROM device is taken as an example in the Windows (registered trademark of Microsoft Corporation) system. Is possible.

Next, the external storage device addition monitoring processing unit 1041 is set to receive a new external storage device connection notification after the standard I / O processing unit 1032 of the operating system 102 (step 402).
The setting for receiving the connection notification to be received after the standard I / O processing unit 1032 of the operating system 102 is, as an example of a CD-ROM device in a Windows (registered trademark of Microsoft Corporation) system, an UpperFilters registry of a CD-ROM class driver. This is possible by setting the module name of the external storage device addition monitoring processor 1041 of this system.

Next, the I / O monitoring module 104 waits for reception until connection of a new external storage device 6 occurs (step 403).
When the addition of a new external storage device 6 occurs and is detected by the OS 102, the general purpose I / O monitoring processing unit 1043 notifies the OS 102 of the addition prior to the external storage device addition monitoring processing unit 1041 according to the setting in step 401. Receive (step 404).

Next, the general-purpose I / O monitoring processing unit 1043 is based on information such as a data structure (information on the driver being controlled, type of the device, etc.) that is included in the connection notification and manages the additional external storage device. The general-purpose I / O monitoring unit 1034 of the connected apparatus is generated and added to the I / O control unit 103 of the operating system 102 (step 405).
In the case of a Windows (registered trademark of Microsoft Corporation) system, the monitoring unit 1034 is generated by a filter driver to generate a data structure (device generation) of the monitoring unit 1034 and add a filter to the external storage device 6 (device (Attach to stack).

Next, according to the setting in step 402, the external storage device addition monitoring processor 1041 receives a connection notification of the external storage device 6 (step 406).
Next, the external storage device addition monitoring processing unit 1041 generates and adds the external storage device addition monitoring unit 1031 in the I / O control unit 103 of the operating system using the same mechanism as in step 405 (step 407). ).

Next, the external storage device addition monitoring processing unit 1031 generates a list of modules that process I / O of the connected external storage device 6 (step 408).
These lists can be obtained by inquiring the operating system 102. In the case of a Windows (registered trademark of Microsoft Corporation) system, it is possible to trace each part upwards by 1034, 1033, 1032, 1031 and confirm the DriverObject field of the data structure (device object) of each part. .
By generating the module list, it is possible to check all modules that may issue an I / O to the external rule device 6. As a result, the presence / absence of the application-specific I / O receiving unit can be confirmed, and the monitoring unit can be generated when it exists.

Next, the processing after step 410 is repeated for the generated modules (modules that manage the external storage device addition monitoring 1031 to the general-purpose I / O monitoring unit 1034) (step 409).
First, whether or not the generated module is a module of this system, that is, whether or not the module is generated by the I / O monitoring module 104 is confirmed by checking whether the DriverObject matches the address of the I / O monitoring module 104.
The purpose of the processing here is to identify the application-specific I / O receiving unit 1036. Since the module of this system does not require I / O monitoring, the next module is processed.
If it is not a module of this system, it is confirmed whether I / O monitoring is necessary (step 410). Here, if it is determined by DriverObject that it is not a module of this system, it is treated as a monitoring target.

Next, it is confirmed whether or not an application-specific I / O monitoring unit 1035 has already been generated for the module to be monitored (step 411). In the case of a Windows (registered trademark of Microsoft Corporation) system, the list set in the AttachedDevice field of the data structure (device object) generated by the module to be confirmed is traced, and the data structure generated by this system exists ahead of it. It can be confirmed by confirming.
Here, if it has already been generated, no further I / O monitoring is necessary, so the next module is processed. If not generated, an application-specific I / O monitoring unit 1035 is added using the same mechanism as in step 405 (step 412).
An example of an application that is not a module of the present system is CD writing software and the like, and I / O is processed independently by the application, so it is necessary to monitor it.

When the repetition is completed for all modules, the process returns to step 4301.
Here, according to the settings in steps 401 and 402, it is possible to control the I / O from the start to the end of the addition notification by the present system. In addition, since it is set to receive the addition notification at the end in step 402, all the modules that perform processing of this apparatus can be known at the stage of step 408. Therefore, by referring to the list in step 408, it is possible to know all modules that perform I / O to the new external storage device 6.

FIG. 5 is a processing sequence for I / O to the general-purpose I / O monitoring unit 1034.
The general purpose I / O monitoring unit 1034 waits for an I / O request (step 501).
When an I / O request is generated in the general-purpose I / O monitoring unit 1034 (step 502), the take-out permission / inhibition information 1051 is referred to (step 503).
Next, it is confirmed whether the value of the take-out permission / inhibition information 1051 is “permitted” (step 504). If it is “permitted”, an I / O request is transmitted to the external storage device 6 (step 505). In that case, I / O of the external storage device 6 is performed, and the process returns to step 501. If the value of the carry-out permission / inhibition information is not “permitted”, the I / O request is rejected (step 506), and the process returns to step 501 without performing the I / O.

FIG. 6 is a processing sequence for I / O to the application-specific I / O monitoring unit 1035.
The application specific I / O monitoring unit 1035 waits for an I / O request (step 601).
When an I / O request is generated in the application unique I / O monitoring unit 1035 (step 602), the take-out permission / inhibition information 1051 is referred to (step 603).
Next, it is confirmed whether or not the value of the take-out permission / inhibition information 1051 is “permitted” (step 604). If it is “permitted”, an I / O request is transmitted to the application specific I / O receiving unit 1036 (step 605). In that case, I / O to the external storage device 6 is performed via the general-purpose I / O monitoring unit 1034, and the process returns to step 601.
If the value of the carry-out permission / inhibition information is not “permitted”, the I / O request is rejected (step 606), and the process returns to step 601 without performing the I / O.

The take-out availability information 1051 in FIG. 2 is a value that can be changed by an instruction from a management computer (not shown) by the communication module 105 at an arbitrary timing. Thereby, permission / prohibition of take-out can be controlled.
The communication module 105 has a role of acquiring take-out permission / prohibition information (take-out permission information) from a management computer outside the system. The carry-out permission / inhibition information 1051 may be held as a file on the same computer, or may be held in another computer on the network and received via the network. The communication module 105 may be linked with other applications. For example, it can cooperate with the application which authenticates by patent document 1. As a result, takeout control can be performed while maintaining security.

FIG. 7 shows an example of a system that cooperates with the communication module 105.
Reference numeral 701 denotes a login application that cooperates with the present system. Here, it is assumed that the application 701 has an authentication function using a technique such as Patent Document 1.
Reference numeral 702 denotes a login processing module of the login application 701.
Reference numeral 703 denotes a file storing take-out control information for each user.
Reference numeral 704 denotes an application authentication module. A technique such as Patent Document 1 is used.
Reference numeral 705 denotes a hash management table used for authentication. Here, it is assumed that the management information of the login application 701 is registered, and settings other than the login application 701 are not permitted to permit I / O to the communication module 105. Reference numeral 1051 denotes take-out availability information. Assume that “reject” is set as an initial value.

FIG. 8 is a processing sequence during login.
The login application 701 waits for a user login request (step 801).
When a login request is generated, the request reaches the login application 701 (step 802).
Next, a value corresponding to the logged-in user is referred to from the carry-out permission / inhibition information 703 (step 803).
Next, the login application 701 issues an authentication request to the authentication module 704 (step 804).
The authentication request is confirmed by the authentication module 704 to be successful or unsuccessful (step 805).
When the authentication is successful, a request for updating take-out permission / prohibition information is issued to the communication module 105 (step 806), and the request is successful (step 807). If the user's take-out permission setting is “permitted”, take-out is permitted, and if it is “prohibited”, take-out is prohibited.
When the authentication fails, if the request is issued (step 808), the request is rejected (step 809). Returning to step 801 without changing the take-out permission / inhibition setting.

FIG. 9 shows a processing sequence during logout.
The login application 701 waits for a user logout request (step 901).
When a logout request is generated, the request reaches the login application 701 (step 902).
Next, the default takeout availability information is referred to from the takeout availability information 703 (step 903).
Next, the login application 701 issues an authentication request to the authentication module 704 (step 904).
In the authentication request, the authentication module 704 confirms the success or failure of the authentication (step 905).
When the authentication is successful, a request for updating take-out permission / prohibition information is issued to the communication module 105 (step 906), and the request is successful (step 907). If the default takeout permission / inhibition setting is “permitted”, takeout is permitted, and if “prohibited”, takeout is prohibited. The logout is successful and the process returns to step 801 in FIG. 8 (step 910).
When the authentication fails, if the request is issued (step 908), the request is rejected (step 909). Returning to step 901, the take-out permission / inhibition setting remains unchanged.

  As is apparent from the above description, according to the present invention, when an external storage device is connected, an input / output request to the external storage device is once captured, information take-out permission setting information is referred to, information A module that enables input / output to / from an external storage device is automatically incorporated into the I / O control unit of the operating system only when take-out permission is set, so that the application is known and unknown, or authenticated. It is possible to control taking-out in units of external storage devices such as CDs and FDs regardless of whether or not they have been authenticated.

It is a figure which shows the structure of the system to which this invention is applied. It is a figure which shows the detail of the I / O control part and I / O monitoring module of the operating system in this invention. It is an operation | movement schematic diagram at the time of external storage apparatus addition. It is a processing sequence figure at the time of external storage device addition. It is an I / O process sequence diagram to a general purpose I / O monitoring part. It is an I / O processing sequence diagram to an application specific I / O monitoring unit. It is a figure which shows the structural example of the login application which cooperates with a communication module. It is a processing sequence figure at the time of login. It is a processing sequence figure at the time of logout. It is a figure which shows the example of the conventional application authentication module.

Explanation of symbols

101 Business Application 102 Operating System 103 I / O Control Unit of Operating System 104 I / O Monitoring Module 105 Communication Module 1031 External Storage Device Addition Monitoring Unit 1034 General Purpose I / O Monitoring Unit 1035 Application Specific I / O Monitoring Unit

Claims (2)

General-purpose I / O monitoring that monitors the connection of the external storage device by the first I / O monitoring module and monitors the input / output request from any application to the external connection device when the connection of the external storage device is detected A first step of generating means in the I / O controller of the operating system;
The connection of the external connection device monitored by the second I / O monitoring module, when detecting the connection of the external storage device, the application unique I / O monitoring means for monitoring the arbitrary application unique output request A second step of generating in the I / O controller of the operating system;
The general-purpose I / O monitoring unit captures an input / output request to the external storage device, the general-purpose I / O monitoring unit refers to information take-out availability information by the external storage device, and stores externally according to the information take-out availability information A third step of permitting or prohibiting I / O requests to the device;
The input / output request unique to the arbitrary application is monitored by the application specific I / O monitoring means, and when an input / output request unique to the arbitrary application is generated, the information take-out availability information by the arbitrary application is referred to, and the information take-out availability is determined. And a fourth step of permitting or prohibiting an input / output request by the arbitrary application to the external storage device according to the information. The first I / O monitoring module receives an external storage device connection notification prior to the second I / O monitoring module, and the general-purpose I / O monitoring means precedes the application-specific I / O monitoring means. 2. The method for controlling information take-out to an external storage device by an arbitrary application according to claim 1, wherein the information is generated in an I / O control unit of the operating system.

Images