JP4918334B2 - Information processing apparatus, system monitoring method, and program for causing computer to execute system monitoring method - Google Patents

Description

  The present invention relates to an information processing apparatus, a system monitoring method, and a program for causing a computer to execute the system monitoring method, and is for improving system security.

  Many software products take various measures to protect their software from malicious users. For example, you can build a system to monitor files so that files that are essential to the software are not deleted, and prevent changes by detecting registry changes so that registry values that are important to the functioning of software products are not changed. In addition, a system for monitoring the termination of necessary processes, threads, events, services, etc., and restarting the terminated processes is constructed.

  In addition, many security products have a function of changing the strength of security in accordance with the situation such as a difference in logged-in users.

  FIG. 8 is an example of a schematic configuration diagram of a conventional software protection system for the software product described above. This software protection system includes a monitoring system 801 that monitors and protects the termination of various PC control systems constituting the system, a security policy 802 that plays a role of determining the degree of control of the various PC control systems in the system, the PC A control system 803 and an apparatus 804 such as a PC to be controlled by the PC control system.

In the software system having such a configuration, the PC control system 803 controls a device 804 such as a PC in accordance with the security policy 802 to realize the function of the software system. In order to protect the PC control system 803 that realizes these functions, the monitoring system 801 monitors files, monitors the completion of necessary processes, threads, events, services, etc. Or reboot. In addition, there exists the following patent document 1 as a well-known technical document relevant to this invention.
JP-A-9-305440

  However, even if the protection of the monitored object is taken into account and guaranteed by the above system, if the means for preventing the monitoring system from being terminated is not taken, the monitoring process is malicious (unauthorized) If the monitoring system 801 is specified and illegally terminated by an intentional user, it becomes impossible to monitor and protect important systems.

  In fact, this vulnerability can be fully present. Even in Patent Document 1, since the system on the side of detecting abnormal termination of a process is not protected at all, a malicious user deletes a registry value associated with a device driver that detects abnormal termination. If the OS is restarted, the function of restarting the process disappears.

  The present invention has been made in view of such a situation, and protects an important system in an information processing apparatus such as a computer terminal apparatus from being attacked by a malicious user, and the vulnerability of the system. To deal with.

  In order to solve the above problems, the present invention protects not only the monitored system but also the monitored system. In other words, the present invention mutually monitors the end of the system, and when the end of the system is detected, restarts the system that the other system that has not ended is restarted to monitor not only the target system to be monitored The mutual monitoring function that counters the threat that a malicious user can stop the monitoring function by guaranteeing the start-up of the system on the other side, and this system when restarting the monitored system The security policy setting, which plays a role in determining the degree of control of various PC control systems, is changed so that each system has strict control over security, thereby strengthening the security of the entire system. , Provided with a security enhancement function.

  More specifically, the information processing apparatus according to the present invention includes at least two monitoring units for monitoring the end of the monitoring target system included in the apparatus, and the at least two monitoring units monitor each other, When one monitoring unit is terminated, another monitoring unit determines whether the termination is normal termination. When the monitored system is terminated, at least one of the two monitoring units restarts the terminated monitored system. Further, when any one monitoring unit is terminated, another monitoring unit restarts the terminated monitoring unit.

  Furthermore, when restarting the system to be monitored, the monitoring unit changes the setting of the security policy that plays the role of determining the degree of control of the various PC control systems in the information processing apparatus to a strict security level.

  Whether or not the monitoring unit is normally terminated is determined by another monitoring unit detecting a monitoring termination notification.

  Another information processing apparatus according to the present invention includes a first monitoring unit, a second monitoring unit, a control system to be monitored, and a security management unit that manages a security policy indicating a security level of the control system. The first monitoring unit monitors the end of the entire system including the second monitoring unit and the control system to be monitored, the second monitoring unit monitors the end of the first monitoring unit, and When any one of the second monitoring units is terminated, the other monitoring units determine whether the termination is normal termination.

  Furthermore, the present invention also provides a system monitoring method for monitoring the information processing apparatus and a program for causing a computer to execute the system monitoring method.

  Further features of the present invention will become apparent from the best mode for carrying out the present invention and the accompanying drawings.

  According to the present invention, even if the monitoring source system is terminated, the system can be restarted. Therefore, monitoring of the monitoring target can be continued, so that forced termination of a process or the like by a malicious user (unfair intention) is more robust. Can be prevented.

  In addition, according to the present invention, when the system is restarted, each system is changed so as to have strict control over security. It is possible to protect the entire system from users who have (injustice intention).

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, it should be noted that this embodiment is merely an example for realizing the present invention and does not limit the present invention.

  FIG. 1 is a system configuration diagram showing an embodiment of the present invention. The server / client management system according to this embodiment has security policy 3 (information defining a security level, for example, information indicating whether printing is permitted or not, or information indicating that printing can be performed only by a specific printer. ) Based on software that constructs a system for controlling the client PC 6. In order to protect the system, a system that mutually monitors the system is implemented in the client PC by the overall monitoring system 1 that monitors the PC control system 4 and the overall monitoring system 2 that monitors only the overall monitoring system. ing. That is, the overall monitoring system 1 monitors the entire client PC (including the overall monitoring system 2), and the overall monitoring system 2 monitors only the overall monitoring system 1. The security policy 3 may be determined for each client PC. When one client PC is shared by a plurality of users, each user is managed with a password and each user's login is stored in the server 5. The security policy 3 may be set for each user. According to the latter, the security level can be made variable for each user.

  Further, when the monitored system (PC control system 4) is terminated (= end other than the client PC being turned off is detected as an abnormal situation), the security policy 3 and the PC control system 4 are strict in terms of security. Change the setting to control, and generate the monitored system again. The security policy 3 is also updated from the server 5, but when the setting change is made so that the monitoring system performs strict control in terms of security, priority is given to the security control set by the monitoring system. That is, the once raised security level is maintained even if the user of the client PC has changed and an attempt is made to set the security level lower from the server 5. For example, when user A is using a client PC, the security level increases due to the occurrence of an abnormal condition, user A logs out, and then user B (whose user-specific security level is set low) logs in. However, once the security level is raised, it is maintained.

  FIG. 2 is a diagram showing the internal configuration of the mutual monitoring system. The overall monitoring system 1 and the overall monitoring monitoring system 2 in the client PC internally hold management tables 11 and 12 for storing data relating to the monitoring target system. Register. The overall monitoring system 1 monitors the entire system including the overall monitoring system 2, and the overall monitoring system 2 monitors only the overall monitoring system 1. Although the overall monitoring system 1 and the overall monitoring monitoring system 2 have different monitoring targets registered in the management tables 11 and 12, when the system registered in the management tables 11 and 12 is terminated, the security policy 2 is controlled by the PC. The system 2 has the same function of changing the setting so that security-strict control is performed and restarting the terminated system.

  FIG. 3 is an outline of the management table 11 of the overall monitoring system 1. The overall monitoring system 1 holds a monitoring target name 111 and a function 113 for acquiring monitoring target identification information in advance, and when the function 113 is called, acquires the monitoring target identification information 112 as a return value, and sequentially manages them. Are stored in the column of the monitoring target identification information 112. If there is no return value (indicating that the monitored system has not started), the system retries several times. If there is still no return value, the security level can be increased.

  Then, the overall monitoring system 1 uses the acquired monitoring target identification information 112 to monitor the end of the monitoring target system. That is, an OS (operation system) (not shown) of the client PC manages that the system corresponding to each monitoring target identification information 112 has been terminated, and notifies the entire monitoring system 1 of the termination when there is a termination. Therefore, the overall monitoring system 1 can monitor the end of the system to be monitored by receiving this end notification. The function for acquiring the monitoring target identification information has a function of restarting the monitoring target when the monitoring target does not exist, and a function 113 for acquiring the monitoring target identification information when the end of the monitoring target is detected. Called to restart the monitoring target and acquire the monitoring target identification information 112.

  A monitoring end notification system 114 is also registered in the management table 11. When the overall monitoring system 1 detects the monitoring end notification system 114, a method for ending the monitoring when the mutual monitoring system must be properly terminated, such as software uninstallation, by terminating the system monitoring. Implement it. If the monitoring system is terminated by this method, it is difficult for a malicious user to create a monitoring termination notification system and forcibly terminate the monitoring system, and it is quite safe in terms of security.

  FIG. 4 is an outline of the management table 21 of the system 2 that monitors the overall monitoring system. Similar to the management table 11 of the overall monitoring system, the function 213 for acquiring the monitoring target name 211 and the monitoring target identification information is held in advance by the system 2 that monitors the overall monitoring system, and is based on such information. The identification information 212 is acquired and stored in the management table 21. The method for obtaining the monitoring target identification information 212 is the same as that for the monitoring target identification information 112. Then, using the acquired monitoring target identification information 212, the end of the monitoring target system is detected.

  Only the overall monitoring system and the monitoring end notification system are registered in the management table 21 of the monitoring system for overall monitoring.

  Since both the monitoring systems 1 and 2 are terminated by the monitoring termination notification, the degree of security can be further increased (the hurdle for successfully terminating the two monitoring systems is increased). If both monitoring systems can be normally terminated only by notifying the termination of the monitoring system, a malicious user will create two monitoring termination notifications in order to terminate the two monitoring systems all at once. Because it is difficult.

  FIG. 5 is a flowchart showing processing of the overall monitoring system 1 / overall monitoring system 2. In step S501, it is determined whether the monitored system is activated for the first time. If it is not the first activation, that is, if it is terminated at least once for some reason, a setting change is added to the security policy in step S502 so that strict security control is performed. Thereafter, in step S503, a process for initializing the management table is executed, and in step S504, a monitoring target end monitoring process registered in the management table is executed. Details of these two processes will be described in detail with reference to FIG. 6 (about step S503) and FIG. 7 (about step S504).

  FIG. 6 is a flowchart showing the management table initialization process (step S503). In the management tables 11 and 21, the monitoring target identification information 112 and 212 does not exist at first. Therefore, first, in step S601, the monitoring target system is entered in the management table 11 or 21. In step S602, the function 113 or 213 for acquiring the monitoring target identification information is called for each monitored monitoring target system, the return value is acquired as the monitoring target identification information 112 or 212, and these are stored in the management tables 11 and 21. Register with.

  In step S603, it is determined whether the identification information has been successfully acquired. If successful, the process proceeds to step S604, and the identification information is registered in the management table 11 or 21. Basically, it is desirable that the monitoring target identification information 112 and 212 can be acquired without retrying. However, if the construction of the monitoring target system continues to fail, some trouble occurs in the OS. Therefore, after retrying for a certain period of time, the setting is changed in the security policy so as to perform strict control in terms of security, and the process is terminated (steps S605 and S606).

  Steps S602 to S606 are repeated until all entries are completed (steps S601 and S607).

  FIG. 7 is a flowchart showing the management table entry end monitoring process (step S504). In step S702, the OS of the client PC notifies the monitoring systems 1 and 2 of the end of the monitoring target system, and the monitoring systems 1 and 2 detect the end of the monitoring target system. In addition, when the monitoring system 1 or the monitoring system 2 of the monitoring system detects the monitoring end notification 114 or 214, the normal end by uninstalling the monitoring system 1 or 2 is executed. It is determined to be an illegal end.

  In step S703, it is determined whether or not the end of the system (including the monitoring systems 1 and 2) has occurred due to a cause other than the monitoring end notification. In the case where the monitoring system is terminated by the monitoring termination notification 114 or 214, the processing is terminated as normal termination. In the case of termination other than the monitoring termination notification, that is, when the monitoring system is terminated by other than the monitoring termination notification or the termination of the monitoring target system is detected, in step S704, security is strictly controlled so as to perform strict control. A configuration change is made to the policy. This is because there is a high possibility that there was an attack on the system in these cases. Regarding security policy setting change, the security level of all PC control systems may be raised, but only the security policy related to a specific PC control system may be changed. For example, the security level setting can be changed for each of printing, file copying, file taking out, burning to a CDR, and the like.

  Subsequently, in step S705, the monitoring target identification information registered in the management table up to now is discarded. This is because it is meaningless to register the monitoring target identification information of the terminated system. In step S706, the monitoring target system whose end has been detected is restarted, and monitoring target identification information reacquisition processing is executed.

  In step S707, it is determined whether or not the reacquisition is successful. If successful, the new monitoring target identification information is re-registered in the management table in step S708. On the other hand, if re-acquisition fails, it is desirable to implement monitoring target identification information acquisition without retry, as with the management table initialization process. If it continues, it is possible that some kind of trouble has occurred in the OS. Therefore, after retrying for a certain period of time, the setting is changed in the security policy so that security is strictly controlled, and the process is terminated (step S709). . Then, the processes in steps S702 to S709 are repeatedly executed (steps S701 and S710).

<Summary>
As described above, the information processing apparatus (client PC) according to the present embodiment includes an overall monitoring system, an overall monitoring system, a plurality of PC control systems to be monitored, and a security indicating the security level of each PC control system. Has memory to manage policies. The overall monitoring system monitors the end of the entire client PC including the overall monitoring monitoring system and a plurality of PC control systems to be monitored, and the overall monitoring monitoring system monitors the end of only the overall monitoring system. When one of the monitoring systems is terminated, the other monitoring system determines whether the termination is normal termination. In this way, it is possible to execute appropriate processing even when one monitoring system is attacked and terminated by a malicious user.

  In the embodiment, an example in which only two monitoring systems for mutual monitoring are provided has been described. However, the number of monitoring systems is not limited to two and may be more than that. In this case, it is only necessary to determine in advance which of the plurality of monitoring systems will be restarted when a certain monitoring system is terminated. In this embodiment, the monitoring system for overall monitoring is described as monitoring only the overall monitoring system. However, the present invention is not limited to this, and the entire system is monitored as long as the monitoring systems monitor each other. A plurality of monitoring systems may be provided.

  In this embodiment, when the monitored PC control system is abnormally terminated, the overall monitoring system restarts the terminated monitored PC control system. Therefore, even if the PC control system is attacked by a malicious user, the function can be protected. Furthermore, when the PC control system is abnormally terminated, the security level related to the PC control system is raised and restarted, so that the security of the entire system can be strengthened.

  Further, when any one of the monitoring systems ends abnormally, another monitoring system restarts the ended monitoring system. As a result, the system can be protected from a threat that the monitoring function is stopped by a malicious user. Note that whether or not the monitoring system is normally terminated is determined by another monitoring system detecting a monitoring termination notification. As a result, it is possible to easily distinguish between normal termination such as uninstallation and termination by a malicious (unauthorized) user.

  If the mutual monitoring is no longer necessary under certain conditions such as the normal termination of the entire system, the monitoring function of all the monitoring systems may be stopped by a normal monitoring termination notification. In this case, if another monitoring system has already stopped the monitoring function due to the monitoring end notification, the other monitoring system does not detect the end of the monitoring system, and as a result, the monitoring system is not restarted.

  The present invention can also be realized by software program codes that implement the functions of the embodiments. In this case, a storage medium in which the program code is recorded is provided to the system or apparatus, and the computer (or CPU or MPU) of the system or apparatus reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing the program code constitute the present invention. As a storage medium for supplying such program code, for example, floppy (registered trademark) disk, CD-ROM, DVD-ROM, hard disk, optical disk, magneto-optical disk, CD-R, magnetic tape, non-volatile A memory card, ROM, or the like is used.

  Also, based on the instruction of the program code, an OS (operating system) running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing. May be. Further, after the program code read from the storage medium is written in the memory on the computer, the computer CPU or the like performs part or all of the actual processing based on the instruction of the program code. Thus, the functions of the above-described embodiments may be realized.

  In addition, the program code of the software that realizes the functions of the embodiment is distributed via a network, so that it is stored in a storage means such as a hard disk or memory of a system or apparatus or a storage medium such as a CD-RW or CD-R. It may also be achieved by the computer (or CPU or MPU) of the system or apparatus reading and executing the program code stored in the storage means or the storage medium.

1 is a system configuration diagram illustrating an embodiment of the present invention. It is an internal block diagram of a mutual monitoring system. It is the outline of the management table of the whole monitoring system. It is the outline of the management table of the system which monitors a whole monitoring system. It is a flowchart which shows the process of the monitoring system of a whole monitoring system / whole monitoring. It is a flowchart which shows the initialization process of a management table. It is a flowchart which shows the completion | finish monitoring process of a management table entry. It is a schematic block diagram of the conventional software protection system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Overall monitoring system, 2 ... Overall monitoring system, 3 ... Security policy, 4 ... PC control system, 5 ... Server, 6 ... Client PC, 801 ... Overall monitoring system, 802 ... Security policy, 803 ... PC control system 804: A device such as a PC.

Claims (3)

A monitored control system;
A first monitoring unit that monitors the end of the entire system including the control system to be monitored;
A second monitoring unit for monitoring the end of the first monitoring unit;
A security management unit that manages a security policy indicating a security level of the control system,
The first monitoring unit further monitors the end of the second monitoring unit,
The first monitoring unit manages a plurality of monitoring target information in the entire system and first monitoring end notification information which means that monitoring of the entire system is ended,
The second monitoring unit manages the information of the first monitoring unit and second monitoring end notification information which means to end the monitoring for the first monitoring unit,
The first monitoring unit individually sets a security level for each of the plurality of monitoring targets;
When any one of the plurality of monitoring targets of the entire system ends, the first monitoring unit sets the security level of the corresponding monitoring target more strictly, restarts the monitoring target,
The first monitoring unit determines whether or not the second monitoring unit has ended normally depending on whether or not the second monitoring end notification information has been detected, and the second monitoring unit has ended abnormally In this case, the security level of the second monitoring unit is set more strictly, the second monitoring unit is restarted,
The second monitoring unit determines whether or not the first monitoring unit has ended normally depending on whether or not the first monitoring end notification information has been detected, and the first monitoring unit has ended abnormally In this case, the information processing apparatus is characterized in that the security level of the first monitoring unit is set more strictly and the first monitoring unit is restarted. A monitoring target control system, a first monitoring unit that monitors the end of the entire system including the monitoring target control system, a second monitoring unit that monitors the end of the first monitoring unit, and a monitoring target and a control system, a security management unit that manages a security policy that indicates the security level of the control system, wherein the first monitoring unit is further monitors the second monitoring unit, the system monitoring method in an information processing apparatus There,
The first monitoring unit managing a plurality of monitoring target information in the entire system and first monitoring end notification information meaning that monitoring of the entire system is terminated;
The second monitoring unit managing the information of the first monitoring unit and the second monitoring end notification information which means to end the monitoring of the first monitoring unit;
The first monitoring unit individually setting a security level for each of the plurality of monitoring targets;
The first monitoring unit, when any of the plurality of monitoring targets of the entire system is terminated, setting the security level of the corresponding monitoring target more strictly and restarting the monitoring target; ,
The first monitoring unit determines whether or not the second monitoring unit has ended normally depending on whether or not the second monitoring end notification information has been detected, and the second monitoring unit has ended abnormally In the case, the step of setting the security level of the second monitoring unit more strictly and restarting the second monitoring unit;
The second monitoring unit determines whether or not the first monitoring unit has ended normally depending on whether or not the first monitoring end notification information has been detected, and the first monitoring unit has ended abnormally In the case, the step of setting the security level of the first monitoring unit more strictly and restarting the first monitoring unit;
A system monitoring method comprising:   A program for causing a computer to execute the system monitoring method according to claim 2.

Images