JP4925109B2 - Electronic device, program, and recording medium - Google Patents

Description

  The present invention relates to an electronic system and an electronic apparatus that are designed to prevent data leakage. The present invention also relates to a program for causing a computer to function as the electronic apparatus and a recording medium on which the program is recorded.

  Taking a data file (hereinafter referred to as a confidential file) that records confidential information from a PC (Personal Computer) on the internal network where security is maintained to a personal computer for processing at home or on the go There are many. Although such confidential files are protected by personal responsibility, information leakage due to inadvertent information such as infection with computer viruses (hereinafter referred to as viruses) or misconfiguration of P2P (Peer to Peer) software will be delayed. There is no end.

The following methods have been proposed as existing methods for preventing information leakage. For example, in Patent Document 1, an electronic signature is assigned to an internal confidential file, and transmission of the file with the electronic signature is suppressed at the gateway when the file is transmitted from the internal network to the external network. A method is described.
JP 2005-100123 A

  However, in the method described in Patent Document 1, when a confidential file is transmitted by end-to-end encrypted communication, the gateway cannot check the contents of the file. Therefore, information leakage cannot be prevented. Further, when a confidential file is taken out of a medium such as a USB (Universal Serial Bus) memory without going through a network, information leakage cannot be prevented.

  The present invention has been made in view of the above-described problems, and an object thereof is to provide an electronic system, an electronic device, a program, and a recording medium that can prevent information leakage.

  The present invention has been made to solve the above-described problem, and an electronic device including a first electronic device (corresponding to the terminal 2 in FIG. 1) and a second electronic device (corresponding to the terminal 3 in FIG. 1). In the system, the first electronic device includes data storage means for storing data, first virus pattern storage means for storing a virus pattern used for detection of a computer virus, and an embedding pattern embedded in the data. Pattern selection means for selecting from among the virus patterns; and pattern embedding means for embedding the selected embedding pattern in the data; and the second electronic device includes data input means for inputting data; Second virus pattern storage means for storing the virus pattern, and data input by the data input means, If the same pattern as the virus pattern whose serial virus pattern storage means for storing is embedded an electronic system; and a data deleting means for deleting the data.

  In addition, the present invention provides an electronic system including a first electronic device (corresponding to the virus pattern management terminal 1 in FIG. 1) and a second electronic device (corresponding to the terminal 2 in FIG. 1). The device includes virus pattern storage means for storing a virus pattern used for detection of a computer virus, pattern selection means for selecting an embedding pattern embedded in data from the virus pattern, and the selected embedding pattern. Transmitting means for transmitting to the second electronic device, wherein the second electronic device stores storage means for storing data, and receiving means for receiving the embedding pattern from the first electronic device; An electronic system comprising pattern embedding means for embedding the received embedding pattern in the data.

  According to the present invention, a data storage means for storing data, a virus pattern storage means for storing a virus pattern used for computer virus detection, and an embedding pattern embedded in the data are selected from the virus patterns. An electronic apparatus comprising pattern selection means and pattern embedding means for embedding the selected embedding pattern in the data.

  In the electronic device of the present invention, the same pattern as the virus pattern stored in the virus pattern storage unit is embedded in the data input unit for inputting data and the data input by the data input unit. In this case, the apparatus further includes data deleting means for deleting the data.

  Further, the electronic device of the present invention is the same as the embedding pattern storage means for storing the embedding pattern and the embedding pattern storage means stored in the embedding pattern storage means, which is the same as the virus pattern stored in the virus pattern storage means. Data deletion means for deleting the data when a pattern different from the pattern is embedded in the data is further provided.

  In the electronic device according to the present invention, the embedding pattern storage unit stores data identification information for identifying data in which the embedding pattern is embedded and the embedding pattern in association with each other, and the embedding pattern storage unit stores the embedding pattern. Data deletion means for deleting the data when the same pattern as the embedding pattern stored in the embedding pattern storage means is embedded in data different from the data indicated by the data identification information It is further provided with a feature.

  The electronic device according to the present invention includes a receiving unit that receives data from another electronic device, and the same pattern as the virus pattern stored in the virus pattern storage unit is embedded in the data received by the receiving unit. Data identification information for identifying the data and transmission source identification information for identifying the transmission source of the data, and information indicating that the data is infected with a computer virus. Infection notification information generating means for generating infection notification information including: and transmission means for transmitting the infection notification information to another electronic device.

  In the electronic device of the present invention, the pattern selection means randomly selects the embedding pattern from the virus pattern.

  In the electronic device of the present invention, the virus pattern storage means stores the virus pattern in association with software identification information that identifies the virus pattern and anti-virus software used for detection of the computer virus, and selects the pattern. The means selects a plurality of the virus patterns associated with the different software identification information as the embedding pattern.

  In the electronic device of the present invention, the virus pattern storage means stores the virus pattern in association with software identification information that identifies the virus pattern and anti-virus software used for detection of the computer virus, and selects the pattern. The means is characterized in that the same virus pattern associated with the different software identification information is selected as the embedding pattern.

  Moreover, this invention is a program for functioning a computer as said electronic device.

  The present invention is a computer-readable recording medium on which the above program is recorded.

  In the above description, the description in parentheses is for the purpose of associating the embodiment of the present invention described later with the components of the present invention for convenience, and the contents of the present invention are not limited by this description. Absent.

  According to the present invention, even when the embedded data of the embedding pattern leaks to the outside, if another external electronic device capable of detecting the virus pattern by the function of the anti-virus software acquires the data, In the electronic device, an embedding pattern is detected. As a result, data embedded with the embedding pattern is determined to be infected with a computer virus and deleted, so that information leakage can be prevented.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. First, technical ideas common to the following embodiments will be described. In each of the following embodiments, even if a data file including confidential information leaks for some reason, the computer that has acquired the data file automatically deletes the data file. AV (Anti Virus System) is a tool for inspecting patterns contained in data files and detecting the presence or absence of patterns found in viruses. In the following embodiments, this AV function is used.

  First, a security administrator of a company or a university embeds a pseudo virus pattern in a data file containing confidential information for which leakage is to be suppressed. The pseudo virus pattern is the same as a characteristic pattern included in an actual virus, and is generated from a virus pattern recorded in a data file used for virus detection.

  It is assumed that the data file in which the pseudo virus pattern is embedded is taken out for some reason and stored in an external PC. When a software misconfiguration is made using the P2P network, the data file leaks to another PC. When AV is introduced into the leakage destination PC, the AV detects a pseudo virus pattern embedded in the data file, and the data file is deleted. In this way, data file leakage is prevented.

(First embodiment)
Next, a first embodiment of the present invention will be described. FIG. 1 shows the configuration of the electronic system according to the present embodiment. The electronic system includes a virus pattern management terminal 1, a terminal 2, and a terminal 3 that are electronic devices, and these are connected by a network 4. It is assumed that a terminal (not shown) is also connected to the network 4.

  The virus pattern management terminal 1 is a terminal (such as a PC or a server) that generates and manages an AV virus pattern for detecting a genuine virus. Terminals 2 and 3 are terminals (PC or the like) possessed by the user. The network is a network as an aggregate of a small network such as a wired or wireless LAN (Local Area Network) and a backbone network that connects the small networks.

  FIG. 2 shows the main functional configuration of the virus pattern management terminal 1. The data communication unit 10 performs data communication with the terminals 2 and 3 via the network 4. The virus pattern management unit 11 manages virus patterns used for detecting viruses.

  In the virus pattern management unit 11, the virus pattern generation unit 11a generates a predetermined virus pattern and stores it in the storage unit 12 as a black list. The virus pattern distribution unit 11 b reads the black list from the storage unit 12 and outputs it to the data communication unit 10 in order to distribute the black list to the terminals 2 and 3. When the black list is output from the virus pattern distribution unit 11 b, the data communication unit 10 transmits the black list to the terminals 2 and 3 via the network 4.

  The storage unit 12 includes a hard disk drive (HDD), a semiconductor memory, and the like, and stores various data as files. In particular, in the present embodiment, the storage unit 12 stores the black list.

  FIG. 3 shows the main configuration of the terminal 2. The data communication unit 20 performs data communication with the virus pattern management terminal 1 and the terminal 3 via the network 4. The virus pattern management unit 21 manages virus patterns and pseudo virus patterns generated based on the virus patterns.

  In the virus pattern management unit 21, the virus pattern acquisition unit 21 a receives the black list received by the data communication unit 20 from the data communication unit 20 when the black list is transmitted from the virus pattern management terminal 1, and the storage unit 24. To store. The pseudo virus pattern generation unit 21b generates a pseudo virus pattern based on the black list. The generated pseudo virus pattern is stored in the storage unit 24 as a white list. The pseudo virus pattern embedding unit 21c embeds the generated pseudo virus pattern in the data file.

  The AV function unit 22 operates when an anti-virus software program having an AV function is executed, and checks the presence or absence of a virus in the data file. In the AV function unit 22, the file inspection unit 22a inspects whether the data file is infected with a virus.

  At the time of this inspection, the file inspection unit 22a compares the virus pattern included in the black list with the data file, and determines whether or not a pattern matching the virus pattern is included in the data file. Further, the file inspection unit 22a compares the pseudo virus pattern included in the white list with the data file, and determines whether or not a pattern matching the pseudo virus pattern is included in the data file. Further, the file inspection unit 22a determines whether or not the data file is infected with a virus based on the determination result based on the black list and the white list.

  When the file checking unit 22a determines that the data file is infected with a virus, the file deleting unit 22b deletes the data file.

  The recording medium interface unit 23 reads data from the recording medium 50 and writes data to the recording medium 50. The storage unit 24 includes a hard disk drive, a semiconductor memory, and the like, and stores various data. Particularly in the present embodiment, the storage unit 24 stores data files such as a black list, a white list, and a confidential file. The recording medium 50 is a recording medium such as a hard disk drive, USB memory, or CD-ROM that can be attached to and detached from the terminal 2.

  Since the main configuration of the terminal 3 is the same as that of the terminal 2, the description thereof is omitted. However, the configuration of both is not necessarily the same. For example, while the terminal 3 has the AV function unit 22, the terminal 2 may not have the AV function unit 22. Further, while the terminal 2 includes the pseudo virus pattern generation unit 21b and the pseudo virus pattern embedding unit 21c, the terminal 3 may not include the pseudo virus pattern generation unit 21b and the pseudo virus pattern embedding unit 21c. Hereinafter, the operation of the terminals 2 and 3 will be described focusing on the operation of the terminal 2.

Next, a pseudo virus pattern generation method and an embedding method will be described. The following shows an example of a virus pattern generated by the virus pattern generation unit 11a of the virus pattern management terminal 1. In each row, “Antinny.xx” or the like in the first column indicates the virus name, and the second and subsequent columns indicate the virus pattern.
Antinny.xx, mov% eax% ebx and movl $ 0xffff% eax
Worm.yy, asm addl% ebx% eax
Spyware.yy, mov al byte ptr foo
...

  FIG. 4 shows an example of the black list generated by the virus pattern generation unit 11a of the virus pattern management terminal 1. In the black list, for each virus pattern, information 401 indicating the file type (word processor software file, spreadsheet software file, HTML file, etc.) and virus pattern information 402 are associated with each other. That is, virus patterns are managed in units of file types by the black list.

  Hereinafter, a specific method for generating and embedding a pseudo virus pattern by the terminal 2 will be described with reference to FIG. When a user designates a data file to be embedded with a pseudo virus pattern by operating an operation unit (not shown) and instructs to start embedding processing of the pseudo virus pattern, the pseudo virus pattern for the specified data file is specified. The embedding process is started.

  The pseudo virus pattern embedding unit 21c of the terminal 2 reads out the data file designated by the user from the storage unit 24 (step S100). Further, the pseudo virus pattern embedding unit 21c identifies the file type of the read data file, and notifies the pseudo virus pattern generation unit 21b of the information (step S101).

  The pseudo virus pattern generation unit 21b reads the black list from the storage unit 24, and selects one of the virus patterns associated with the file type notified from the pseudo virus pattern embedding unit 21c (step S102). . The selected virus pattern becomes a pseudo virus pattern.

  If the virus pattern embedded in the data file is always the same, the owner of the terminal 3 to which the data file has leaked may guess that the acquired data file contains confidential information. Therefore, it is more desirable to embed a different pseudo virus pattern for each data file instead of always embedding the same pseudo virus pattern in the data file. In step S102, the pseudo virus pattern generation unit 21b selects a virus pattern, for example, randomly from virus patterns associated with the same file type.

  Subsequently, the pseudo virus pattern generation unit 21b notifies the pseudo virus pattern embedding unit 21c of the selected virus pattern (step S103). The pseudo virus pattern embedding unit 21c embeds the pseudo virus pattern notified from the pseudo virus pattern generation unit 21b in the data file read in step S100 (step S104).

  There are several ways to embed a pseudo virus pattern in a data file. It is possible to embed a pseudo virus pattern as a macro virus in a file of specific word processing software or spreadsheet software. A macro is a function that automates the operation of word processing software or spreadsheet software. By storing the macro in association with a file, the macro is detected by anti-virus software.

  Also, in the HTML file, a pseudo virus pattern file can be embedded after </ HTML> which is a tag indicating the end of a sentence. It is also possible to embed a virus pattern character string having the same color as the background or to embed a virus pattern with a display size of 0 cm × 0 cm so that the user cannot visually perceive the virus pattern.

  For other files, changing the file name to a file name used by a virus may have the same meaning as embedding a virus pattern. For example, the Antinny virus inserts a long space after lzh and adds the original extension after the file name including the extension lzh indicating that it is a compressed file. Specifically, the file name is, for example, “xxxxxx.lzh.doc”. In this case, a blank pattern is registered in the black list.

  Subsequent to step S103, the pseudo virus pattern embedding unit 21c stores the data file in which the pseudo virus pattern is embedded in the storage unit 24, and notifies the pseudo virus pattern generation unit 21b of the end of embedding (step S105).

  Upon receipt of the notification, the pseudo virus pattern generation unit 21b reads the white list from the storage unit 24, and adds the information of the pseudo virus pattern embedded in the data file to the white list. As a result, the pseudo virus pattern embedded in the data file is registered in the white list. The pseudo virus pattern generation unit 21b stores, in the storage unit 24, the white list to which new pseudo virus pattern information has been added (step S106).

  FIG. 6 shows an example of the contents of the white list. As shown in FIG. 6, in the white list, information 601 indicating the file type, virus pattern information 602, and data file information 603 in which the virus pattern is embedded are associated with each other. The data file information 603 includes the date and time when the data file embedded with the pseudo virus pattern was saved in the storage unit 24, the size of the data file, the location where the pseudo virus pattern was embedded, the file name, the file type (file extension, etc.) ), Information such as the hash value of the data file is included. This data file information 603 is used later when a pseudo virus pattern is deleted from the data file.

  Next, a specific method for inspecting a data file based on a black list and a white list will be described. First, a file inspection method performed periodically will be described. The file inspection unit 22a of the terminal 2 periodically inspects whether or not the data file stored in the storage unit 24 is infected with a virus.

  Hereinafter, the procedure of this inspection will be described with reference to FIG. After the inspection is started, the file inspection unit 22a reads the black list and the data file from the storage unit 24 (step S200). Subsequently, the file inspection unit 22a compares each virus pattern included in the black list with the data file (step S201), and based on the comparison result, a pattern that matches one of the virus patterns is included in the data file. It is determined whether or not (step S202).

  As a result of the inspection based on the black list, if it is determined that no pattern matching the virus pattern is included in the data file, the file inspection unit 22a determines that the data file is not infected with a virus. (Step S203), and the inspection of the data file read in Step S200 is terminated.

  If it is determined that the data file contains a pattern that matches one of the virus patterns, the normal anti-virus software determines that the data file is infected with a virus. In the embodiment, an inspection based on a white list is further performed. First, the file inspection unit 22a reads the white list from the storage unit 24 (step S204). Subsequently, the file inspection unit 22a compares the virus pattern that matches the pattern in the data file with each pseudo virus pattern in the white list (step S205), and based on the comparison result, the virus pattern is any pseudo virus. It is determined whether or not the pattern matches (step S206).

  As a result of the inspection based on the white list, if it is determined that the virus pattern matches any of the pseudo virus patterns in the white list, the file inspection unit 22a determines that the data file is not infected with a virus. (Step S203), the inspection of the data file read in Step S200 is terminated.

  If it is determined that the virus pattern does not match any pseudo virus pattern in the white list, the file inspection unit 22a determines that the data file is infected with a virus (step S207), and the file deletion unit 22b is instructed to delete the corresponding data file (step S208). Receiving the instruction, the file deletion unit 22b deletes the data file determined to be infected with the virus from the storage unit 24 (step S209).

  Processing similar to the processing described above is also performed at the terminal 3. According to this process, even if the virus pattern included in the black list matches the pattern in the data file, the data file is not deleted if the virus pattern matches the pseudo virus pattern. Therefore, in the terminal 2, the data file in which the pseudo virus pattern is embedded is determined to be infected with the virus and is not deleted.

  Various modifications can be made to the processing described above. For example, the order of the file inspection based on the white list and the file inspection based on the black list may be reversed. Regardless of the file inspection order, if the data file contains a pattern that is the same as the virus pattern included in the black list and different from the pseudo virus pattern included in the white list, the data file is deleted. In this case, the data file should not be deleted.

  In step S209, the data file determined to be infected with a virus may be temporarily isolated in a folder for isolation, and the data file may be deleted when an instruction is received from the user. . Furthermore, for the deleted data file, a proxy file having no contents in which the word “virus infection” is inserted in the file name may be stored in the storage unit 24.

  If the pattern in the data file matches the pseudo virus pattern in the white list (YES in step S206), it is determined that the data file is not infected with a virus. If the pattern is a genuine virus pattern that matches the pseudo virus pattern, the data file must be deleted. Therefore, it is more desirable to do the following.

  If it is determined in step S206 that the virus pattern matches any one of the pseudo virus patterns in the white list, the file inspection unit 22a further sets the file name of the data file associated with the pseudo virus pattern that matches the virus pattern. Reference is made (data file information 603 in FIG. 6). The file inspection unit 22a compares this file name with the file name of the data file to be inspected.

  If the two match, it is understood that the virus pattern in the data file is a pseudo virus pattern embedded by the pseudo virus pattern embedding unit 21c of the terminal 2 itself. In this case, the file inspection unit 22a determines that the data file is not infected with a virus (step S203). If they do not match, the virus pattern in the data file is known to be a genuine virus pattern. In this case, the file inspection unit 22a determines that the data file is infected with a virus (step S207).

  Next, an inspection method performed when receiving a data file will be described. When a new data file is received, the file checking unit 22a of the terminal 2 checks whether the data file is infected with a virus. Hereinafter, the procedure of this inspection will be described with reference to FIG.

  The data communication unit 20 receives the data file via the network 4 and outputs the data file to the AV function unit 22 (step S300). The file inspection unit 22a of the AV function unit 22 to which the data file has been input reads the black list from the storage unit 24 (step S301). The file inspection unit 22a compares each virus pattern included in the black list with the data file (step S302), and based on the comparison result, whether or not a pattern that matches any of the virus patterns is included in the data file. Is determined (step S303).

  As a result of the inspection based on the black list, if it is determined that a pattern that matches any of the virus patterns is included in the data file, the file inspection unit 22a is infected with the virus. (Step S304), the file deletion unit 22b is instructed to delete the corresponding data file (step S305). Receiving the instruction, the file deleting unit 22b deletes the data file determined to be infected with the virus (step S306).

  If it is determined that a pattern that matches each virus pattern is not included in the data file, the file inspection unit 22a determines that the data file is not infected with a virus (step S307), and the data The file is stored in the storage unit 24 (step S308).

  Processing similar to the processing described above is also performed at the terminal 3. According to this process, when the received data file includes a pattern that matches the virus pattern included in the black list, the data file is deleted. Therefore, even when a data file in which a pseudo virus pattern is embedded in the terminal 2 is received by the terminal 3, if the pseudo virus pattern matches the virus pattern in the black list, the data file is deleted and information leakage is prevented. Is done.

  Also, when a data file is input from the recording medium 50 into the terminal 2, the same processing as described above is performed. That is, the recording medium interface unit 23 outputs the data file to the AV function unit 22 when the data file is read from the recording medium 50 and input to the terminal 2. The operation of the AV function unit 22 to which the data file has been input is as described above. Since the same processing is performed at the terminal 3, even if the data file in which the pseudo virus pattern is embedded in the terminal 2 is stored in the recording medium 50 and taken out and input to the terminal 3, the pseudo virus pattern is displayed in the black list. When the virus pattern matches, the data file is deleted and information leakage is prevented.

  As described above, according to the present embodiment, even when a data file in which a pseudo virus pattern is embedded leaks from the terminal 2 to, for example, the terminal 3, the terminal 3 uses the function of the anti-virus software (AV function unit 22). A pseudo virus pattern is detected. As a result, the data file in which the pseudo virus pattern is embedded is determined to be infected with a computer virus and deleted. Thereby, information leakage from the terminal 2 can be prevented.

  In addition, as described with reference to FIG. 7, when a pattern that is the same as the virus pattern in the black list and different from the pseudo virus pattern in the white list is embedded in the data file, the data file is deleted. . Furthermore, when the same pattern as the virus pattern in the black list and the same pattern as the pseudo virus pattern in the white list are embedded in the data file, the data file is not deleted. Therefore, it is possible to prevent the data file in which the pseudo virus pattern is embedded in the terminal 2 from being deleted in the same terminal 2.

  In addition, as described with reference to FIG. 7, when the same pattern as the pseudo virus pattern in the white list is embedded in the data file having a file name different from the file name in the white list, The data file is deleted. That is, if the pattern in the data file is a genuine virus pattern that matches the pseudo virus pattern, the data file is deleted. Thereby, virus infection can be prevented.

  Further, by randomly selecting a pseudo virus pattern to be embedded in the data file from the black list, even if the data file leaks from the terminal 2 to the terminal 3, it is confirmed that the data file contains confidential information. 3 owners can be difficult to guess.

  Further, according to the present embodiment, even when a data file in which a pseudo virus pattern is embedded leaks onto a P2P network that forms an encrypted communication path, a terminal that receives the data file decrypts the data file, Since the data file is deleted by the function of the anti-virus software, information leakage is prevented. Further, even if the data file is relayed to another terminal in the middle, there is no problem because the information in the data file cannot be read unless the data file can be decrypted by the terminal.

(Second Embodiment)
Next, a second embodiment of the present invention will be described. When a data file is input to a terminal that does not have the AV function unit 22 described in the first embodiment (in other words, a terminal that does not have antivirus software installed), a pseudo virus pattern is embedded in the data file. Data files are not deleted. For this reason, the data file may be leaked through a terminal that does not have the AV function unit 22. In the present embodiment, a method for suppressing such information leakage will be described.

  Also in this embodiment, since the configuration of the terminal 3 is the same as that of the terminal 2, the configuration of the terminal 2 will be described as a representative, and the description of the configuration of the terminal 3 will be omitted. FIG. 9 shows the configuration of the terminal 2 according to the present embodiment. In the present embodiment, the AV function unit 22 is provided with an infected file management unit 22c that manages information on a data file determined to be infected with a virus. Information on the data file determined to be infected with a virus is stored in the storage unit 24 as an infected file list.

  When the file checking unit 22a determines that the data file received by the data communication unit 20 is infected with a virus (in other words, when the data file is to be deleted by the file deleting unit 22b). The data file information is notified to the infected file management unit 22c. The information of the data file includes a file name, identification information of the terminal of the data file transmission source (IP address of the terminal, etc.), and information on an infected virus (virus name, etc.). Information indicating that the virus is infected may simply include information indicating that the virus is infected. The infected file management unit 22c reads the infected file list from the storage unit 24, adds information on the data file notified from the file checking unit 22a to the infected file list, and stores the infected file list in the storage unit 24.

  The infected file management unit 22c reads the infected file list from the storage unit 24 periodically or whenever the infected file list is updated as described above, and includes a file (data file information indicated by the infected file list) ( Infection notification file). This infection notification file is a file (such as a text file) for notifying other terminals that the received data file is infected with a virus. In addition, the infection notification file may be generated by deleting the contents of the data file determined to be infected with a virus and adding characters such as “virus infection” to the file name.

  The infected file management unit 22c outputs the generated infection notification file to the data communication unit 20. The data communication unit 20 transmits the infection notification file via the network 4 to another terminal (terminal 3 or the like) that can communicate with the terminal 2. When the terminal receives the infection notification file and displays the contents of the infection notification file based on the user's instruction, the file name, the terminal of the data file transmission source, the information on the infected virus, and the like are displayed.

  When such information is displayed, it can be expected that users do not want to acquire a data file infected with a virus or want to destroy the data file even if the data file is acquired. . With such a psychological effect, it is possible to prevent a data file infected with a virus from propagating on the network. In particular, it is possible to suppress the spread of an infected file via a terminal that does not have the AV function unit 22.

  As described above, when the data file in which the pseudo virus pattern is embedded leaks to the network for some reason and is received by the terminal 2, the data file is infected by the file inspection unit 22a. It is determined. Therefore, since the infection notification file related to the data file is transmitted to another terminal by the function of the above-described infected file management unit 22c, it is possible to suppress the propagation of the data file including confidential information.

  The information included in the infection notification file need not include both the file name information and the data file transmission source terminal information, and may include only one of them. If at least the file name information is included, the propagation of data files having the same file name is suppressed. Further, if at least information on the terminal of the data file transmission source is included, propagation of the data file leaking from the terminal is suppressed.

  Although the above-described method is a more general method, a specific method will be described below using P2P software (for example, Winny) as an example. The following method focuses on the file search function of P2P software and leaks confidential information by letting a user who owns a terminal without anti-virus software to download data files containing confidential information. It is a method to increase the deterrent effect against

  A large number of files are uploaded on the P2P network, and when the user of the P2P software obtains summary information of a file called a “key”, the file can be downloaded. A terminal in which P2P software is installed regularly exchanges keys with surrounding terminals, and each terminal always stores thousands to tens of thousands of keys. The user selects the key of the file he wants to obtain from the large number of keys, and downloads the file. That is, the user needs to search for a key of a file to be obtained from keys stored in advance in the terminal. Therefore, when the user performs a key search for a file, a mechanism that makes the user hesitate to download the file is adopted.

  Specifically, the function of the anti-virus software is expanded, and if it is determined that the file with the file name “A” downloaded by the terminal by the P2P software function is infected with a virus, the file is quarantined / deleted At the same time, a function for uploading a warning file having a file name such as “A is a virus.txt” to the P2P network is added. For example, assume that a file “Confidential.pdf” containing confidential information has leaked onto the P2P network. Here, it is assumed that a pseudo virus pattern is embedded in the file “Confidential.pdf” in advance in the administrator's terminal in the organization.

  When a user's terminal using anti-virus software with the above functions added downloads the file `` Confidential.pdf '', the file `` Confidential.pdf '' is deleted from the user's terminal and `` A warning file "Confidential.pdf is a virus.txt" is uploaded to the P2P network. As a result, not only the key of the file “Confidential.pdf” but also the key of the file “Confidential.pdf is a virus.txt” spreads in the P2P network.

  That is, thereafter, two keys “Confidential.pdf” and “Confidential.pdf is a virus.txt” are stored together in the terminals of the users participating in the P2P network. Therefore, when the user searches for the file name “Confidential.pdf” from the keys in his terminal, and then searches for the file name “Confidential.pdf”, along with the file “Confidential.pdf” You will also find a warning file called ".txt".

  Of course, a device with anti-virus software installed with the above functions will not upload a warning file only when a confidential file is found, but will also upload a warning file when a genuine virus file is found. To do. Since there are many malicious files on the P2P network, the warning file "Confidential.pdf is a virus.txt" was found by key search. The file "Confidential.pdf" It is likely that the file is infected with a real virus. For this reason, if a warning file is found by key search, many users will hesitate to download the file “Confidential.pdf”.

  By operating the mechanism described above, if many users participating in the P2P network use anti-virus software, users who do not use anti-virus software can download the leaked confidential files. It is expected to be able to.

(Third embodiment)
Next, a third embodiment of the present invention will be described. FIG. 10 shows the configuration of the virus pattern management terminal 1 according to the present embodiment. In this embodiment, the virus pattern management unit 11 includes a pseudo virus pattern generation unit 11c. The pseudo virus pattern generation unit 11 c generates a pseudo virus pattern based on the black list stored in the storage unit 12. Further, the storage unit 12 stores the pseudo virus patterns generated by the pseudo virus pattern generation unit 11c as a white list.

  The virus pattern management terminal 1 according to the present embodiment operates as follows. The virus pattern generation unit 11a of the virus pattern management unit 11 generates a predetermined virus pattern and stores it in the storage unit 12 as a black list. The pseudo virus pattern generation unit 11c generates a pseudo virus pattern based on the black list and stores it in the storage unit 12 as a white list.

  It is desirable that the pseudo virus pattern can be detected by various anti-virus software so that the data file in which the pseudo virus pattern is embedded is more reliably deleted at the leakage destination terminal. Therefore, the pseudo virus pattern generation unit 11c of the present embodiment operates as follows.

  In the black list stored in the storage unit 12, as shown in FIG. 4, for each virus pattern, information 401 indicating the file type and virus pattern information 402 are associated with each other. The virus pattern information 402 includes information indicating the type of anti-virus software that uses the virus pattern for virus detection.

  The pseudo virus pattern generation unit 11c reads the black list from the storage unit 12, and selects a plurality of virus patterns of different types of anti-virus software from the virus patterns in the black list. For example, the pseudo virus pattern generation unit 11c selects a virus pattern a used in the anti-virus software A, a virus pattern b used in the anti-virus software B, and a virus pattern c used in the anti-virus software C.

  Subsequently, the pseudo virus pattern generation unit 11c combines the plurality of selected virus patterns into one pseudo virus pattern. The data file in which the pseudo virus pattern is embedded is detected as a virus-infected file by a plurality of anti-virus software.

  Further, a pseudo virus pattern may be generated as follows. The pseudo virus pattern generation unit 11c reads the black list from the storage unit 12, and selects the same virus pattern associated with different types of anti-virus software from the virus patterns in the black list. For example, when the virus pattern d is a virus pattern used in any of the anti-virus software A, B, and C, the pseudo virus pattern generation unit 11c selects the virus pattern d as a pseudo virus pattern. A data file in which the pseudo virus pattern is embedded is also detected as a virus-infected file by a plurality of anti-virus software.

  Following the generation of the pseudo virus pattern, the virus pattern distribution unit 11 b reads the white list from the storage unit 12 and outputs it to the data communication unit 10 in order to distribute the white list to the terminal 2. When the white list is output from the virus pattern distribution unit 11 b, the data communication unit 10 transmits the white list to the terminal 2 via the network 4. Similarly, the black list is also transmitted to the terminal 2 as appropriate. It is more desirable to transmit the white list by encrypted communication.

  FIG. 11 shows the configuration of the terminal 2 according to the present embodiment. The virus pattern management unit 21 of this embodiment does not have a pseudo virus pattern generation function. This terminal 2 operates as follows. When a white list or black list is transmitted from the virus pattern management terminal 1, the virus pattern acquisition unit 21 a receives the white list or black list received by the data communication unit 20 from the data communication unit 20 and stores it in the storage unit 24. Store.

  When the start of the pseudo virus pattern embedding process is instructed, the pseudo virus pattern embedding unit 21 c reads the white list from the storage unit 24. The pseudo virus pattern embedding unit 21c selects a pseudo virus pattern associated with the file type notified from the pseudo virus pattern embedding unit 21c from the pseudo virus patterns in the white list, and uses the pseudo virus pattern as a data file. Embed in. The operation of the AV function unit 22 is the same as that in the first embodiment.

  The pseudo virus pattern of the present embodiment is a pattern that can be detected by a plurality of types of anti-virus software. Therefore, when the data file in which the pseudo virus pattern is embedded flows out from the terminal 2 to, for example, the terminal 3, the pseudo virus pattern is more reliably detected in the terminal 3 by the function of the anti-virus software (AV function unit 22). It becomes like this. That is, information leakage from the terminal 2 can be prevented more reliably.

  In this embodiment, it is assumed that the virus pattern management terminal 1 and the terminal 2 belong to the same organization such as a company. However, a plurality of terminals exist in the organization, and a data file including confidential information is stored. When the terminals can be used at those terminals, the white list is distributed from the virus pattern management terminal 1 to these terminals. Further, the terminal 2 may have the function of the pseudo virus pattern generation unit 11c of this embodiment (function of generating a pseudo virus pattern that can be detected by various anti-virus software) instead of the virus pattern management terminal 1.

  As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the above-described embodiments, and includes design changes and the like without departing from the gist of the present invention. . For example, the individual elements appearing in each of the above embodiments may be appropriately combined and implemented.

  In addition, the present invention may be applied to a gateway, and by providing a function for the gateway to terminate encrypted communication, it is possible to monitor transmission / reception of a data file in which a pseudo virus pattern is embedded. To achieve this, prepare a communication policy that does not establish an end-to-end encrypted communication path between a terminal inside the network and a terminal outside the network, and the gateway has a VPN (Virtual Private Network) function. You can do it.

  Further, a program for realizing the operations and functions of the virus pattern management terminal 1 and the terminals 2 and 3 according to the above-described embodiments is recorded on a computer-readable recording medium, and the program recorded on the recording medium is recorded on the computer. May be read and executed.

  Here, the “computer” includes a homepage providing environment (or display environment) if the WWW system is used. The “computer-readable recording medium” refers to a storage device such as a portable medium such as a flexible disk, a magneto-optical disk, a ROM, and a CD-ROM, and a hard disk built in the computer. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program described above may be transmitted from a computer storing the program in a storage device or the like to another computer via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the above-described program may be for realizing a part of the above-described function. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer, what is called a difference file (difference program) may be sufficient.

1 is a block diagram showing a configuration of an electronic system according to a first embodiment of the present invention. It is a block diagram which shows the main function structures of the virus pattern management terminal by the 1st Embodiment of this invention. It is a block diagram which shows the main function structures of the terminal by the 1st Embodiment of this invention. It is a reference figure which shows the content of the black list in the 1st Embodiment of this invention. It is a flowchart which shows the procedure of the operation | movement (generation and embedding of a pseudo virus pattern) of the terminal by the 1st Embodiment of this invention. It is a reference figure which shows the content of the white list in the 1st Embodiment of this invention. It is a flowchart which shows the procedure of the operation | movement (periodic file inspection) of the terminal by the 1st Embodiment of this invention. It is a flowchart which shows the procedure of the operation | movement (inspection at the time of reception of a data file) of the terminal by the 1st Embodiment of this invention. It is a block diagram which shows the main function structures of the terminal by the 2nd Embodiment of this invention. It is a block diagram which shows the main function structures of the virus pattern management terminal by the 3rd Embodiment of this invention. It is a block diagram which shows the main function structures of the terminal by the 3rd Embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Virus pattern management terminal, 2, 3 ... Terminal, 10, 20 ... Data communication part (data input means, receiving means, transmission means), 12, 24 ... Storage part (data storage means) , Virus pattern storage means, embedding pattern storage means), 11c, 21b... Pseudo virus pattern generation section (pattern selection means), 21c... Pseudo virus pattern embedding section (pattern embedding means), 23. Medium interface unit (data input unit), 22b... File deletion unit (data deletion unit), 22c... Infected file management unit (infection notification information generation unit)

Claims (7)

Data storage means for storing data;
Virus pattern storage means for storing a virus pattern used for detecting a computer virus;
Pattern selecting means for selecting an embedding pattern embedded in the data from the virus pattern;
Pattern embedding means for embedding the selected embedding pattern in the data;
An embedding pattern storage means for storing the embedding pattern;
Data deletion means for deleting the data when the same pattern as the virus pattern stored in the virus pattern storage means and different from the embedding pattern stored in the embedding pattern storage means is embedded in the data When,
An electronic device characterized by comprising: Data storage means for storing data;
Virus pattern storage means for storing a virus pattern used for detecting a computer virus;
Pattern selecting means for selecting an embedding pattern embedded in the data from the virus pattern;
Pattern embedding means for embedding the selected embedding pattern in the data;
Embedding pattern storage means for associating and storing data identification information for identifying data in which the embedding pattern is embedded and the embedding pattern;
When the same pattern as the embedding pattern stored by the embedding pattern storage unit is embedded in data different from the data indicated by the data identification information stored by the embedding pattern storage unit, the data Data deletion means for deleting
An electronic device characterized by comprising: Data storage means for storing data;
Virus pattern storage means for storing a virus pattern used for detecting a computer virus;
Pattern selecting means for selecting an embedding pattern embedded in the data from the virus pattern;
Pattern embedding means for embedding the selected embedding pattern in the data;
Receiving means for receiving data from other electronic devices;
When the same pattern as the virus pattern stored in the virus pattern storage unit is embedded in the data received by the receiving unit, the data identification information for identifying the data and the transmission source of the data are Infection notification information generating means for generating infection notification information including at least one piece of information of the sender identification information to be identified and information indicating that the data is infected with a computer virus;
Transmitting means for transmitting the infection notification information to another electronic device;
An electronic device characterized by comprising: Data storage means for storing data;
Virus pattern storage means for storing a virus pattern used for detecting a computer virus;
Pattern selecting means for selecting an embedding pattern embedded in the data from the virus pattern;
Pattern embedding means for embedding the selected embedding pattern in the data;
With
The virus pattern storage means stores the virus pattern in association with software identification information for identifying the anti-virus software used for detecting the computer virus.
The electronic device characterized in that the pattern selection means selects a plurality of the virus patterns associated with different soft identification information as the embedding pattern. Data storage means for storing data;
Virus pattern storage means for storing a virus pattern used for detecting a computer virus;
Pattern selecting means for selecting an embedding pattern embedded in the data from the virus pattern;
Pattern embedding means for embedding the selected embedding pattern in the data;
With
The virus pattern storage means stores the virus pattern in association with software identification information for identifying the anti-virus software used for detecting the computer virus.
The electronic device characterized in that the pattern selection means selects the same virus pattern associated with different software identification information as the embedding pattern. Program for causing a computer to function as an electronic device according to any one of claims 1 to 5. A computer-readable recording medium on which the program according to claim 6 is recorded.

Images