JP5531541B2 - Log information generator - Google Patents

Description

  The present invention relates to a technique for improving the quality of log information generated by a log recording application by passing authentication information acquired by an authentication application to a linked log recording application.

  Conventionally, in a log recording application that generates operation information of a terminal such as a computer as log information, the user who performed the operation is specified by an OS-ID managed by the OS. In addition, techniques for improving security without greatly changing the system environment have been developed (see, for example, Patent Documents 1 and 2).

JP 2007-310686 A JP 2008-176506 A

When identifying a user who has performed an operation based on an OS-ID managed by the OS, a user who knows the OS-ID and the password of the OS-ID can use the computer by impersonation. It is impossible to determine exactly who operated the computer. To solve this problem, it is necessary to link the log with the IC card authentication system that proves the identity. However, the authentication application that authenticates the IC card that proves the identity and the log recording application that records the log are not linked. It takes a lot of work to create a linked program.
In the above conventional technique, since the application is executed using a so-called thin client, the application is executed on the server side, and the log remains in the server. However, there is a demand for recording the log on the server side, but the application is not limited to the server that keeps the log, but is desired to be executed in an arbitrary environment. In this case, it is necessary to cooperate with the application to be executed and the server that stores the log, but there is a problem that it takes a load to create the cooperated program.

  Accordingly, an object of the present invention is to provide a log information generation device capable of improving the quality of generated log information without performing development in consideration of cooperation between an authentication application and a log recording application in advance. To do.

In order to solve the above problems, the present invention stores an authentication application that is an application program for performing authentication, and stores a plurality of log recording applications that are application programs for recording logs, A log information generation device that generates log information by executing a log recording application, having a transfer destination list in which transfer destination information corresponding to the log recording application is recorded, and the authentication application includes an authentication module, An authentication information storage module and a notification module, and the log recording application includes an application ID for identifying itself, a storage destination acquisition module, an authentication information acquisition module, and a log generation module; Stage, the by performing an authentication application, after saving the authentication information has been successfully authenticated to the destination specified by the storage destination address recorded in the delivery destination information, a plurality of said logging application The log recording application with the specified application ID is started, the storage location of the authentication information obtained by executing the authentication application is recognized, the authentication information is obtained from the storage location, and the log corresponding to the authentication information Provided is a log information generation device that generates information.

  According to the present invention, the authentication application includes an authentication information storage module and a notification module in addition to the authentication module, and the log recording application includes an application ID, a storage location acquisition module, and an authentication in addition to the log generation module. Since the log information is generated by executing these applications with the configuration having the information acquisition module, not only the ID corresponding to the OS but also the log information corresponding to the other authentication information such as the card ID. Therefore, it is possible to generate without performing the development in consideration of the cooperation between the authentication application and the log recording application in advance.

  According to the present invention, it is possible to improve the quality of generated log information without developing in advance the cooperation between the authentication application and the log recording application.

It is a block diagram which shows one Embodiment of the log information generation apparatus which concerns on this invention. It is a figure which shows the structure of an application program. It is a flowchart which shows the processing operation of the log information generation apparatus which concerns on this invention. It is a figure which shows the log information produced | generated by the log information production | generation apparatus which concerns on this invention, and the log information produced | generated by the conventional method.

(1. Device configuration)
DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments of the invention will be described in detail with reference to the drawings. FIG. 1 is a configuration diagram showing an embodiment of a log information generating apparatus according to the present invention. In FIG. 1, 10 is a CPU, 20 is a program storage unit, 30 is a card R / W, 40 is an IC card, and 50 is a log information storage unit.

The program storage unit 20 stores an application program that can be executed by the CPU 10, and is realized by a storage device such as a hard disk. The log information storage unit 50 stores a log generated by a log recording application, and is realized by a storage device such as a hard disk. The program storage unit 20 and the log information storage unit 50 may be physically provided on one hard disk, or may be provided on two or more hard disks. Eventually, the log information generating apparatus shown in FIG. 1 is realized by a general-purpose computer to which a card R / W is connected in hardware.

  The log information generation apparatus according to the present invention is characterized by an authentication application and a log recording application, and an effective effect is obtained by the CPU 10 reading and executing these applications. The authentication application is an application program for performing authentication using authentication information such as a card ID acquired by the card R / W from the IC card 40. The authentication processing part is the same as that of the conventional authentication application, but after authentication, A feature is that a module for passing authentication information to the log recording application is added. The log recording application is the same as the conventional log recording application in that the event that occurs together with the OS-ID authenticated by the OS is recorded as a log. At that time, the authentication information received from the authentication application is added. The point to record is a feature. In the present embodiment, only one authentication application is stored in the program storage unit 20, but a plurality of log recording applications are stored. Each log recording application generates and records log information about the event that has occurred.

  FIG. 2 shows the configuration of the application program. 2A shows an authentication application, and FIG. 2B shows a log recording application. As shown in FIG. 2A, the authentication application has an authentication module, an authentication storage module, and a notification module as main components. Among these, the authentication module is a module that is also incorporated in a conventional authentication application. Both the authentication storage module and the notification module are realized by using a general-purpose DLL (dynamic link library). As shown in FIG. 2B, the log recording application has an application ID, a storage location acquisition module, an authentication information acquisition module, and a log generation module as main components. Among these, the log generation module is a module that is also incorporated in a conventional log recording application. The application ID is newly assigned. Both the storage location acquisition module and the authentication information acquisition module are modules realized by using a general-purpose DLL that already exists.

(2. Processing operation)
Next, the processing operation of the apparatus shown in FIG. 1 will be described. When the computer is activated, the CPU 10 reads the authentication application from the program storage unit 20 and waits for input of authentication information from the card R / W. When using a computer, the user first sets his / her IC card 40 in the card R / W 30. When the card R / W 30 detects that the IC card 40 is set, the card R / W 30 acquires authentication information (for example, a card ID) recorded on the IC card 40. Thereafter, the CPU 10 executes the authentication application in accordance with an instruction from the OS. In the authentication application, first, an authentication module is executed. By executing the authentication module, the CPU 10 checks whether the authentication information registered in advance matches the authentication information acquired from the IC card 40 (S10).

When the authentication by the authentication module is successful, the CPU 10 executes the authentication information storage module. By executing the authentication information storage module, the CPU 10 acquires a delivery destination list stored in the log information storage unit 50 (S11). In the delivery destination list, one or more delivery destination information corresponding to the log recording application on a one-to-one basis is recorded. Subsequently, the CPU 10 formats the authentication information into a format according to the delivery destination in accordance with each delivery destination information recorded in the obtained delivery destination list according to the authentication information storage module (S12).

Subsequently, the CPU 10 encrypts the authentication information according to the authentication information storage module (S13). Then, the CPU 10 stores the authentication information in the storage destination specified by the storage destination address (predetermined address in the log information storage unit 50) recorded in the delivery destination information (S14). This storage destination may be different for each log recording application that is a delivery destination, or may be the same.

  When the authentication information has been stored, the CPU 10 then executes a notification module to notify the log recording application that the authentication information has been stored and the storage address of the authentication information (S15). Specifically, the application ID is specified from the authentication application notification module, and the OS is requested to call the application. Then, the OS that has received the request calls the log recording application. Then, the CPU 10 executes a storage location acquisition module of the log recording application. The CPU 10 acquires the storage destination address from the OS by executing the storage destination acquisition module (S21).

Next, the CPU 10 executes an authentication information acquisition module, accesses a predetermined area in the log information storage unit 50 specified by the acquired storage destination address, and acquires encrypted authentication information (S22). Subsequently, the CPU 10 decrypts the encrypted authentication information according to the authentication information acquisition module (S23). When the authentication information is decrypted, the CPU 10 executes the log generation module, and stores the acquired event information in the log information storage unit 50 in association with the acquired authentication information together with the OS-ID (S24).

  An example of log information generated by the log information generating apparatus according to the present invention is shown in FIG. As shown in FIG. 4A, since the card ID which is the authentication information is recorded as a part of the log information, even when different users use the same OS-ID, the user is identified by the card ID. It becomes possible to specify. As shown in FIG. 4B, the log information generated by the conventional method only records an OS-ID and an event. Therefore, when different users use the same OS-ID, the log information is generated in units of users. Cannot be distinguished.

  The present invention can be used in industries related to information processing. In particular, it is effective in improving the quality of log information using an authentication application and a log recording application.

10 ... CPU
20 ... Program storage unit 30 ... Card R / W
40 ... IC card 50 ... Log information storage unit

Claims (1)

An authentication application that is an application program for performing authentication is stored, a plurality of log recording applications that are application programs for recording a log are stored, and log information is stored by executing the authentication application and the log recording application. A log information generating device to generate,
A delivery destination list in which delivery destination information corresponding to the log recording application is recorded;
The authentication application includes an authentication module, an authentication information storage module, and a notification module,
The log recording application has an application ID for identifying itself, a storage destination acquisition module, an authentication information acquisition module, and a log generation module,
The processing means stores the authentication information that has been successfully authenticated in the storage destination specified by the storage destination address recorded in the delivery destination information by executing the authentication application, and then the plurality of log recording applications. The log recording application with the specified application ID is started, the storage location of the authentication information obtained by executing the authentication application is recognized, the authentication information is acquired from the storage location, and the authentication information is supported. A log information generation device that generates log information.

Images