JP5573216B2 - File quarantine apparatus and file quarantine method - Google Patents

Description

  The present invention relates to a file quarantine apparatus that performs a file quarantine process.

  A quarantine network is known as a technique for preventing a computer virus existing in a terminal brought from outside from entering a specific network. For example, in a quarantine network, when a terminal brought in from the outside accesses an in-house system, the file recorded on the terminal is quarantined to see if it is infected with a virus. Admit. Thereby, the network connection of the virus infected terminal can be prevented and the in-house system can be operated safely (for example, refer to Patent Document 1). In addition, when virus infection is recognized after quarantine, a method is also known in which a clean OS (operating system) that is not infected with a virus is started up to remove the virus (for example, Patent Document 2).

  However, when performing the quarantine as described above, there is a problem that it becomes impossible to use the terminal during the quarantine because virus scanning takes time. In response to such a problem, exemption from virus scanning of a terminal that has not performed an action with virus infection (for example, refer to Patent Document 3), or the type of terminal (for example, desktop PC). It is known to exempt virus scanning (see, for example, Patent Document 4).

JP 2005-216253 A JP-A-11-85503 JP 2008-71210 A JP 2008-225595 A

  Another way to reduce virus scanning time is to create a file that was created or updated during external use based on information such as the file update date, rather than scanning all files on the device for viruses. It is conceivable to scan for viruses only. However, since information such as the file update date may be illegally rewritten by a virus or the like, it is not preferable to determine the target file for virus scanning based on information such as the file update date. .

  FIG. 1 is a diagram illustrating an example of a method for analyzing a use history of an OS system call and specifying a file in which writing has actually occurred. In this method, a system call monitoring interface (I / F) unit 11 is realized by modifying an OS kernel or a library that implements an input / output API (Application Program Interface). Get history. In the OS, resources such as files and networks are manipulated via system calls, so that an updated file can be extracted by acquiring a history of system calls. That is, the system call management function unit 12 analyzes the acquired system call history, and can identify a file that has been rewritten from the use of the system call related to the file operation.

  The outing determination function unit 13 in FIG. 1 determines whether the terminal is connected to the intranet or is out of the office, and based on the determination result, the client software of the quarantine network is activated or the specified operation for rewriting the file has occurred. Control. For example, in the quarantine upon returning from the home, a file that has been rewritten while going out (a file with a name in the new / changed file table) is scanned with a virus program.

  As described above, in the method of FIG. 1, the history of system calls for files is collected by software on the OS used by the user, and the file in which rewriting has occurred is specified. However, in this method, since the program that identifies the rewritten file and the virus program are executed in the same OS area, if the file update history is altered by an attack such as data alteration, the virus is infected. Files may be excluded from virus scanning. For this reason, it is impossible to accurately specify a file to be quarantined.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a file quarantine apparatus capable of accurately identifying a file to be quarantined and ending the quarantine process in a short time. And

  In order to achieve the above object, a file quarantine apparatus disclosed below accesses a physical data area by accepting a request from a user virtual machine that executes processing based on a user operation and the user virtual machine In the virtual machine management unit, based on the output of the file monitoring unit, a file monitoring unit that monitors a file requested to be updated from the user virtual machine to the virtual machine management unit, An update file list creation unit that creates an update file list indicating which files are updated for the user virtual machine, and a computer virus quarantine process for the files indicated in the update file list A quarantine processing unit for executing

  According to the disclosure of the specification of the present application, it is possible to provide a file quarantine apparatus that can accurately specify a file to be quarantined and finish the quarantine process in a short time.

It is a figure which shows an example of the method of analyzing the utilization log | history of the system call of OS, and specifying the file in which writing actually occurred. It is a figure which shows the structural example of the file quarantine apparatus. It is a figure which shows an example of the hardware constitution which implement | achieved the file quarantine apparatus 1 shown in FIG. 2 using CPU. It is a figure which shows an example of the flowchart at the time of starting of the file quarantine apparatus. FIG. 4 is a diagram illustrating an example of a flowchart of processing in a control virtual machine 3. It is a figure which shows an example of the flowchart of a network connection judgment process. 6 is a diagram illustrating an example of a flowchart of processing in a virtual machine management unit 2. FIG. It is a figure which shows the example which produces an update file list based on the command received from the user virtual machine. It is a figure which shows an example of the data structure of the command notified to the virtual machine management part 4 from the virtual machine 4 for users. It is a figure which shows an example of an update file list. It is a figure which shows an example of the flowchart of an update file list creation process. 4 is a diagram showing an example of a disk area allocated in a disk storage 5 for a user virtual machine 4. FIG. 3 is a diagram illustrating an example of a FAT area 102. FIG. 3 is a diagram illustrating an example of a root directory 103. FIG. 3 is a diagram illustrating an example of a data area 104. FIG. It is a figure which shows an example of the flowchart of a quarantine process. It is a figure which shows an example of the flowchart of a quarantine client process. It is a figure which shows the structural example of the quarantine client 1301 performed in the quarantine process part 33. FIG. It is a figure which shows the structural example of the file quarantine apparatus. It is a figure which shows the structural example of the file quarantine apparatus. It is a figure which shows the structural example of the file quarantine apparatus. It is a figure which shows the structural example of the file quarantine apparatus. FIG. 4 is a diagram illustrating an example of a flowchart of processing in a control virtual machine 3. It is a figure which shows the structural example of the file quarantine apparatus. It is a figure which shows the structural example of the file quarantine apparatus. It is a figure which shows the structural example of the file quarantine apparatus. 4 is a diagram illustrating an example of a correspondence relationship holding unit 25. FIG. It is a figure which shows the structural example of the file quarantine apparatus. It is a figure which shows the structural example of the file quarantine apparatus.

  Hereinafter, embodiments of the present invention will be specifically described with reference to the drawings.

[1. First Embodiment]
The file quarantine apparatus according to the present embodiment is configured by a computer apparatus including a CPU. For example, a personal computer, a smartphone, a mobile phone, or the like corresponds to this computer apparatus. In the following, a case will be described in which a notebook personal computer that can be connected to a public LAN or the like when away from home and can be connected to an in-house network as an example is used as an example of a file quarantine apparatus according to the present embodiment. . In the present embodiment, a virtual machine refers to one computer device that operates in a pseudo manner on one or more computer devices.

  The file quarantine apparatus according to the present embodiment includes a user virtual machine that executes processing based on a user operation, a virtual machine management unit that receives a request from the user virtual machine and accesses a physical data area, and the user For the user virtual machine in the virtual machine management unit based on the output of the file monitoring unit and a file monitoring unit that monitors the file requested to be updated from the virtual machine management unit to the virtual machine management unit An update file list creation unit that creates an update file list indicating which file has been updated, and a quarantine process unit that executes a computer virus quarantine process on the files indicated in the update file list. Prepare. As described above, since the file quarantine apparatus according to the present embodiment performs quarantine based on the updated file list created and managed independently from the user virtual machine, there is almost no possibility of falsification, and the file to be quarantined. Can be accurately identified, and the quarantine process can be completed in a short time.

  The file quarantine apparatus according to the present embodiment further includes a network connection determination unit that determines whether or not the file quarantine apparatus is connected to a predetermined network, and the update file list creation unit includes the file quarantine apparatus in the network connection determination unit. Is determined not to be connected to the predetermined network, the update file list is created. For this reason, it is possible to extract only files that are suspected of being infected with a virus and efficiently perform a quarantine process.

  In addition, the file quarantine apparatus according to the present embodiment stops the operation of the user virtual machine while the quarantine process is being executed. For this reason, even if the user virtual machine is infected with a virus, the spread of the virus can be prevented and the damage can be minimized. Further, it is possible to safely execute the file quarantine process while avoiding a disk storage conflict between the user virtual machine and the control virtual machine.

[1-1. System configuration]
FIG. 2 is a diagram illustrating a configuration example of the file quarantine apparatus. The file quarantine apparatus 1 is configured to be able to operate a virtual machine management unit 2, a control virtual machine 3, and a user virtual machine 4, and includes a network interface 9 and a disk storage 5. The virtual machine management unit 2, the control virtual machine 3, and the user virtual machine 4 can communicate with each other. The disk storage 5 is a physical data area that can be directly accessed only by the virtual machine management unit 2. The control virtual machine 3 and the user virtual machine 4 can indirectly access the disk storage 5 via the virtual machine management unit 2. In FIG. 2, only one control virtual machine 3 and one user virtual machine 4 are shown, but there may be two or more.

  The user virtual machine 4 operated by the file quarantine apparatus 1 illustrated in FIG. 2 includes an application 41 and an OS (operating system) 42. The control virtual machine 3 includes a network connection determination unit 31, an operation management unit 32, and a quarantine processing unit 33. Further, the virtual machine management unit 2 includes a file monitoring unit 21 and an update file list creation unit 22.

  The network interface 9 is for connecting to an in-house network or a public LAN. The application 41 and the OS 42 are for executing processing based on user operations.

  The network connection determining unit 31 of the control virtual machine 3 is for determining whether the network interface 9 of the user virtual machine 4 is connected to a predetermined network. The operation management unit 32 is for stopping or canceling the operation of the user virtual machine 4 while the quarantine processing is being executed in the quarantine processing unit 33. The quarantine processing unit 33 is for executing a computer virus quarantine process on the files shown in the update file list. The data format of the update file list is not particularly limited, but may be recorded in a table format, for example.

  The file monitoring unit 21 of the virtual machine management unit 2 is for monitoring a file requested to be updated from the user virtual machine 4 to the virtual machine management unit 2. The update file list creation unit 22 is for creating an update file list indicating which file is updated in the virtual machine management unit 2 based on the output of the file monitoring unit 21.

  Note that each functional unit shown in the file quarantine apparatus 1 of FIG. 2 is a concept including a CPU function realized by a program. Here, the program is not only a program that can be directly executed by the CPU, but also a concept including a source format program, a compressed program, an encrypted program, and the like.

[1-2. Hardware configuration of file quarantine apparatus 1]
FIG. 3 is a diagram illustrating an example of a hardware configuration in which the file quarantine apparatus 1 illustrated in FIG. 2 is realized using a CPU. The file quarantine apparatus 1 includes a display 201, a CPU 202, a memory 203, a keyboard / mouse 204, a hard disk 205, a CD-ROM drive (optical drive) 206, and a communication circuit 207. The hard disk 205 stores a virtual machine management program 205a, a virtual machine data area 205b, a file quarantine processing program 205c, an update file list 205d, and the like.

  The virtual machine management program 205a or the file quarantine processing program 205c is installed by reading a program recorded on an optical disk such as the CD-ROM 206a via the CD-ROM drive 206. The CPU 23 executes processing based on the virtual machine management program 205b, the file quarantine processing program 205c, or the OS executed in the control virtual machine 3 or the user virtual machine 4.

  The virtual machine management unit 2 constituting the file quarantine apparatus 1 shown in FIG. 2 is realized by executing a virtual machine management program 205a on the CPU 202. Note that the virtual machine management unit 2 is a functional unit generated by executing a management program for realizing the virtualization technology, and corresponds to, for example, a hypervisor. Further, the file monitoring unit 21 and the update file list creation unit 22 in the virtual machine management unit 2 are also realized by executing the virtual machine management program 205a on the CPU 202.

  The activation programs for the control virtual machine 3 and the user virtual machine 4 may be included in the virtual machine management program 205a, or may be read from other devices.

  The network connection determination unit 31, the operation management unit 32, and the quarantine processing unit 33 in the control virtual machine 3 configuring the file quarantine apparatus 1 illustrated in FIG. 2 are realized by executing the file quarantine processing program 205c on the CPU 202. Is done. A part of the disk storage 5 constituting the file quarantine apparatus 1 shown in FIG. 2 corresponds to the virtual machine data area 205 b recorded in the hard disk 205.

[1-3. Start of file quarantine apparatus 1]
FIG. 4 is a diagram illustrating an example of a flowchart when the file quarantine apparatus 1 is activated. Upon receiving the power-on, the CPU 202 of the file quarantine apparatus 1 activates the virtual machine management unit 2 (operation (hereinafter referred to as Op) 301), subsequently activates the control virtual machine 3 (Op 302), and finally The user virtual machine 4 is activated (Op303).

  The virtual machine management unit 2 is an example using a Type 1 type hypervisor. The hypervisor refers to a control program for realizing a virtual machine (virtual machine) which is one of computer virtualization technologies. Type 1 type hypervisors include a type that directly operates on hardware and starts a host OS virtual machine, and a type 1 hypervisor that is embedded in a host OS kernel and operates. Further, the host OS virtual machine activates the guest OS virtual machine.

  In the Type 2 type hypervisor, the host OS is first operated on hardware, the hypervisor is virtualized on the host OS, and the virtual machine of the guest OS is further operated on the hypervisor. Therefore, in the file quarantine apparatus according to the present embodiment, a virtual machine management unit as a hypervisor is activated on a control virtual machine as a host OS, and a user virtual machine 4 as a guest OS on the virtual machine management unit. It is good also as a structure which starts.

  After the virtual machine management unit 2 is activated, programs for causing the file monitoring unit 21 and the update file list creation unit 22 to function are activated. After the control virtual machine 3 is activated, a program for causing the network connection determination unit 31, the operation management unit 32, and the quarantine processing unit 33 to function is activated. After the user virtual machine 4 is activated, a program for causing the predetermined application 41 and the OS 42 to function is activated.

[1-4. Processing of control virtual machine 3 (1)]
FIG. 5 is a diagram illustrating an example of a flowchart of processing in the control virtual machine 3. The CPU 202 executes network connection determination processing (Op501). FIG. 6 is a diagram illustrating an example of a flowchart of the network connection determination process. This network connection determination process is executed resident in the memory 203.

  In OP601, the CPU 203 monitors the state of the network interface (Op 601), and if there is a change, determines the content of the change in the state of the network interface (Op 602). For example, when this state change is “ON → OFF”, it is determined to be offline (Op 603). In other words, in this case, it can be determined that it is not connected to the in-house network. On the other hand, when this state change is “OFF → ON”, it is further determined whether or not communication with a quarantine server existing on the in-house network is possible (Op 606), and if communication is possible (Op 606, Yes), If the communication is not possible (Op 606, No), it is determined to be offline (Op 608).

  In OP601, the CPU 203 monitors the state of the network interface (Op 601), and if there is no change, determines the state of the network interface (Op 604). For example, when this state is maintained ON, it is determined whether or not communication with the quarantine server is possible (Op 606), and if communication is possible (Op 606, Yes), it is determined that the connection to the internal network is established ( If it is not communicable (Op606, No), it is determined to be offline (Op608). On the other hand, when it is determined that this state is maintained OFF, it is determined that the state is offline (Op605).

  Returning to FIG. 5, if the CPU 202 cannot determine that the user virtual machine is connected to the corporate network in Op 501 (Op 502, No), the CPU 202 notifies the virtual machine management unit 2 (Op 503).

[1-5. Processing of virtual machine management unit 2]
FIG. 7 is a diagram illustrating an example of a flowchart of processing in the virtual machine management unit 2. FIG. 8A is a diagram illustrating an example of creating an update file list based on a command received from the user virtual machine 4. Specifically, when it becomes necessary to manipulate data recorded in the disk storage 5 by executing the application 41 or the OS 42, the user virtual machine 4 makes a file update request to the virtual machine management unit 2. In this case, the virtual machine management unit 2 extracts a file update command requested from the user virtual machine 4 and creates an update file list indicating which file is an update target. .

  In the shared memory space 801 of the virtual machine management unit 2, instructions from the user virtual machine 4 are sequentially accumulated by a FIFO (First In, First Out) method (instruction 1 to instruction m). Here, the shared memory space 801 can be accessed (written) not only from the virtual machine management unit 2 but also from the user virtual machine 4.

  The CPU 203 that causes the file monitoring unit 21 of the virtual machine management unit 2 to function determines whether there is an unprocessed command on the buffer of the shared memory space 801 (Op 701). If an instruction is recorded on the buffer of the shared memory space 801, the CPU 202 reads the instruction. (Op702). For example, in FIG. 8A, “instruction 1” 81 is read from “instruction 1 to instruction m” recorded in the shared memory space 801. Note that the read instructions are sequentially deleted.

  The CPU 202 once transfers the read instruction to the disk storage 5 (Op 703). After the transfer, the CPU 202 determines whether or not the user virtual machine 4 is connected to the in-house network (Op 704). If not connected, the CPU 202 executes the processing of Op 705 to Op 707 below, and if connected, returns to Op 701. Repeat the process. In other words, the processing of Op 704 is determined based on the notification from the control virtual machine 3 (Op 503 or Op 505 in FIG. 5).

  In Op 705, the CPU 202 determines whether or not the read instruction is a write instruction (Op 704), and if it is a write instruction (Op 705, Yes), the CPU 202 copies it to the dedicated memory space 802 (Op 706). For example, “instruction 1” 81 in the shared memory space 801 is copied as “instruction n” 82 in the dedicated memory space 802.

  FIG. 8B is a diagram illustrating an example of a data structure of a command notified from the user virtual machine 4 to the virtual machine management unit 4. This data structure includes an instruction identification 85, a sector number 86, and actual data 87. Whether or not the read instruction is a write instruction may be determined based on whether or not the data of the instruction identification 85 indicates “write”. Here, the dedicated memory space 802 can be accessed (written / read) only from the virtual machine management unit 2, and cannot be accessed from the user virtual machine 4.

  The CPU 202 causes the update file list creation unit 22 to function and executes an update file list creation process (Op707). FIG. 9 is a diagram illustrating an example of a flowchart of the update file list creation process.

  The CPU 202 reads one instruction from the dedicated memory space (Op901). For example, “instruction 1” 83 in the dedicated memory space 802 shown in FIG. 8A is read. Note that each instruction in the dedicated memory space 802 is sequentially stored by FIFO (First In, First Out) method (instruction 1 to instruction n).

  The CPU 202 identifies the write destination based on the sector number 86 of the instruction read in Op 901 (Op 902). The method for specifying the writing destination differs depending on the file system employed by the user virtual machine 4, but in the following, a method for identifying the case where FAT is employed for the file system will be described.

  FIG. 10A is a diagram illustrating an example of a disk area allocated in the disk storage 5 for the user virtual machine 4. This disk area functions as an OS file system employed by the user virtual machine 4. For example, when FAT (File Allocation Table) is adopted as the file system, the file system includes a reserved area 101, a FAT area 102, a root directory 103, and a data area 104. In the reserved area 101, FAT area 102, root directory 103, and data area 104, sector numbers “0001 to 2000”, “1001 to 2000”, “2001 to 2000” indicating the position of the sector which is the minimum recording unit, for example. 3000 ”and“ 3001 to 4000 ”are respectively assigned.

  FIG. 10B is a diagram illustrating an example of the FAT area 102. The FAT area 102 includes a cluster number 111 indicating the position of a cluster in which file data is recorded in a data area 104 to be described later, and a subsequent cluster number 112 indicating the position of the cluster following the cluster number. . That is, by tracing the cluster number and the subsequent cluster number to the terminal symbol 113, it is possible to grasp where one file is recorded in the data area 104. A cluster is a unit for managing a plurality of consecutive sectors collectively.

  FIG. 10C is a diagram illustrating an example of the root directory 103. The root directory 103 includes a file name 121, an extension 122, an attribute 123, a reserved area 124, a time 125, a date 126, a head cluster number 127, and a file size 128. In particular, by referring to the root directory 103, the correspondence between the file name 121 and the leading cluster number 127 can be grasped.

  FIG. 10D is a diagram illustrating an example of the data area 104. The data area 104 includes a cluster number 131 and actual data 132. A part of the data with the file name “a” is recorded as the actual data 132 in the cluster with the cluster number 131 of “401” (data (1) of a). Similarly, in the cluster with the cluster number “402”, a part of the data with the file name “a” continuing to the data “a” (1) is recorded (data “a” (2)), and the cluster number “403” is recorded. In the cluster, a part of the data of the file name “a” is recorded following the data (2) of a (data (3) of a).

  When one instruction is read from the dedicated memory space 802, the CPU 202 determines a write destination corresponding to the instruction based on the sector number 86. For example, as described above, the reserved area 101, the FAT area 102, the root directory 103, and the data area 104 are preliminarily assigned with cluster number ranges, so if the sector number 86 is “0001 to 2000”, the reserved area 101, FAT area 102, root directory 103, and data area 104 are reserved. If it is an area, “1001 to 2000” is a FAT area, “2001 to 3000” is a root directory, and “3001 to 4000” is a data area. Therefore, since the sector number “3208” in FIG. 8B is in the range of “3001 to 4000”, it is determined as a data area.

  Note that when the write destination is a reserved area, since an important file such as a master boot record (MBR) is rewritten, processing may be performed and a warning message may be output on the display.

  If the CPU 202 determines that the write destination is the FAT area 102 or the data area 104, the CPU 202 acquires the file name of the write destination (Op 906), and adds the acquired file name to the update file list (Op 907). For example, when the instruction data shown in FIG. 8B is read out and the cluster number of the cluster including the sector number 86 “3208” is “401”, the first cluster number 127 recorded in the root directory of FIG. Based on “401”, it is determined that the writing is for the file with the file name 121 “a”.

  If the sector number 86 is “3216”, the cluster number “402” of the cluster included in the sector number 86 is obtained, and then the cluster number is traced backward from the FAT area 102 shown in FIG. 10B. The first cluster number “401” of the area in which the file is recorded may be acquired, and it may be recognized that the corresponding file name 121 is “a”.

  On the other hand, if the CPU 202 determines that the write destination is the root directory, the CPU 202 further determines the write contents (Op904). When the CPU 202 determines that the write content is “change file name” in the root directory shown in FIG. 10C, the CPU 202 changes the file name in the update file list (Op905). If it is determined that the written content is “add file”, the file name is acquired in Op 906 and then added to the update file list (Op 907).

  FIG. 8C is a diagram showing an example of the update file list 205d (FIG. 2). A file name 91 and an update date 92 are recorded in the update file list 205d. The update file list 205 d is created in an area accessible from the control virtual machine 3 in the virtual machine management unit 2. For example, it is created in a data area accessible by the file publishing function of the virtual machine management unit 2.

[1-5. Processing of control virtual machine 3 (2)]
Even after the control virtual machine 3 notifies the virtual machine management unit 2 that it is not connected to the internal network in Op503 of FIG. 5, the network connection determination process (FIG. 6) described in Op501 of FIG. It is executed repeatedly. If the CPU 202 that causes the control virtual machine 3 to function determines that the user virtual machine 4 is connected to the internal network in the network connection determination process (Op504, Yes), the CPU 202 notifies the virtual machine management unit 2 accordingly. (Op505). For example, this applies to the case where the file quarantine apparatus 1 which is a notebook personal computer is connected to an in-house network from an outside location.

  When receiving the notification that the user virtual machine 4 is connected to the internal network, the CPU 202 of the virtual machine management unit 2 does not execute the processing of Op705 to Op707 in Op704 of FIG. That is, the update file list creation process is not executed. As a result, an updated file list can be created only for files that have been updated while the user virtual machine 4 is not connected to the in-house network.

  After Op 505, the CPU 202 executes a quarantine execution process (Op 506). FIG. 11 is a diagram illustrating an example of a flowchart of the quarantine execution process. When executing the quarantine execution process, the CPU 202 first temporarily stops the user virtual machine 4 (Op1101). Specifically, the user virtual machine 4 is temporarily stopped using the function of the operation management unit 32 shown in FIG.

  The CPU 202 mounts the disk area of the user virtual machine 4 (Op 1102). With these processes, the control virtual machine 3 can safely use the disk area allocated to the user virtual machine 4 in the disk storage 5 without conflicting with the user virtual machine 4.

  Subsequently, the CPU 202 executes a quarantine client process (Op 1103). FIG. 12 is a diagram illustrating an example of a flowchart of the quarantine client process. The CPU 202 that executes the quarantine client process activates the quarantine client (Op1201). For example, the quarantine client is executed as a new virtual machine generated in the control virtual machine 3. FIG. 13 is a diagram illustrating a configuration example of the quarantine client 1301 executed in the quarantine processing unit 33. The quarantine client 1301 includes an anti-virus program 1302 and a pattern file 1303.

  When the quarantine client 1301 is activated, the CPU 202 causes the virus countermeasure program 1302 to be executed in the quarantine client (Op1202). The CPU 202 that executes the anti-virus program 1302 accesses the anti-virus server 1312 connected to the file quarantine apparatus 1 via the network and updates the pattern file 1303.

  Next, the CPU 202 reads the update file list 205d held in the virtual machine management unit 2 (Op 1204). As shown in FIG. 8C, since the update file list 205d includes the file name to be updated, the CPU 202 executes a virus scan for each file corresponding to this file name (Op1205). For this reason, virus scanning of all files can be avoided and quarantine processing can be performed quickly.

  The quarantine client 1301 is configured to be connectable to the quarantine server 1311. The quarantine server 1311 authenticates that the file quarantine apparatus 1 can be connected to the internal network based on the quarantine processing result notified from the quarantine client 1301 (Op 1206). For example, when it is determined that the possibility of serious damage to the internal network is low according to the quarantine processing result, the quarantine server 1311 authenticates the file quarantine apparatus 1, so that the setting of the LAN device or the like is changed and the file quarantine apparatus 1 can be connected to the in-house network.

  Returning to FIG. 11, when the quarantine client processing of Op1103 is completed, the CPU 202 unmounts the disk area of the user virtual machine 4 when there is no virus or when the virus removal is successful (O1104, Yes) ( (Op 1105), the temporary stop of the user virtual machine 4 is released (Op 1107).

  On the other hand, when a virus is detected or virus removal fails (O1104, No), the CPU 202 displays a message indicating that there is a possibility of virus infection on the display 201 (Op1106).

  In FIG. 5, when the quarantine execution process of Op 506 is completed, the CPU 202 that executes the control virtual machine 3 returns to Op 502 and repeats the process (Op 502 to Op 506).

  In this embodiment, the file monitoring unit 21 includes processing functions of Op 701 to Op 705 in FIG. 7 as an example. As an example, the update file list creation unit 22 includes Op 707 in FIG. 7 and the processing function in FIG. 9. The quarantine processing unit 33 includes, as an example, Op 506 in FIG. 5 and processing functions in FIGS. 11 and 12. As an example, the network connection determination unit 31 includes the Op 501 in FIG. 5 and the processing function in FIG. The operation management unit 32 includes processing functions of Op 1101 and Op 1107 in FIG. 11 as an example.

[1-6. Modified example]
The file quarantine apparatus according to the present embodiment includes a user virtual machine that executes processing based on a user operation, a virtual machine management unit that receives a request from the user virtual machine and accesses a physical data area, and the user For the user virtual machine in the virtual machine management unit based on the output of the file monitoring unit and a file monitoring unit that monitors the file requested to be updated from the virtual machine management unit to the virtual machine management unit An update file list creation unit that creates an update file list indicating which file has been updated may be provided. Accordingly, it is possible to provide an update file list to another computer apparatus and to function as a file quarantine auxiliary apparatus that causes the other computer apparatus to execute a quarantine process.

[2. Second Embodiment]
Similarly to the first embodiment, the file quarantine apparatus according to the present embodiment is configured by a computer device (for example, a notebook personal computer) including a CPU. In the present embodiment, as in the first embodiment, the quarantine processing unit 33 of the control virtual machine 3 is not executed in the control virtual machine 3 but in a separately activated quarantine virtual machine. An example of execution will be described.

  Generally, a pattern file used by an anti-virus program used for quarantine varies depending on the type of OS to be quarantined. When the OS of the control virtual machine 3 and the OS of the user virtual machine 4 are different, the file system employed by each OS is also different. Therefore, the user virtual machine 4 is used by using a pattern file that can be recognized by the control virtual machine 3. It is difficult to quarantine these files.

  The file quarantine apparatus according to the present embodiment further includes a control virtual machine that controls a user virtual machine, and the control virtual machine activates the quarantine virtual machine as a quarantine processing unit, and causes the quarantine virtual machine to The quarantine process is executed, and the quarantine virtual machine is stopped when the quarantine process is completed. Therefore, the processing load of the control virtual machine can be distributed using the quarantine virtual machine. In addition, the quarantine process can be executed using a quarantine virtual machine that employs a file system common to the user virtual machine.

  In the file quarantine apparatus according to the present embodiment, the control virtual machine execution unit determines the OS of the quarantine virtual machine execution unit to be activated in accordance with the OS of the user virtual machine execution unit. Therefore, even if the OSs of the user virtual machine and the control virtual machine are different, the files managed in the same file system by matching the OS of the quarantine virtual machine with the user virtual machine. Can be handled.

[2-1. System configuration, hardware configuration and processing of each part]
FIG. 14 is a diagram illustrating a configuration example of a system of the file quarantine apparatus according to the present embodiment. The hardware configuration example of the file quarantine apparatus 1 according to the present embodiment is the same as that of FIG. 3 described in the first embodiment. In FIG. 14, the quarantine processing unit 33 is deleted from the control virtual machine 3 and a quarantine virtual machine 6 is added in the file quarantine apparatus 1 as compared with the configuration of FIG. 2.

  The quarantine virtual machine 6 is started as another virtual machine by the control virtual machine 3. The function of the quarantine virtual machine 6 is the same as that of the quarantine processing unit 33 shown in FIG. In this case, the quarantine virtual machine 6 is activated as a virtual machine that executes the same OS as the user virtual machine 4. Note that the specific processing content of each unit described in FIGS. 4 to 13 is the same as that of the first embodiment.

[3. Third Embodiment]
Similarly to the first embodiment, the file quarantine apparatus according to the present embodiment is configured by a computer device (for example, a notebook personal computer) including a CPU. In the present embodiment, as in the first embodiment, the quarantine execution process of FIG. 11 is executed not only when controlled by the network connection determination unit 31 but also when a predetermined condition is received upon receiving a user instruction. An example will be described.

  For example, when the user goes out for a long period of time, the number of files updated while going out increases, and there is a possibility that the processing after the return will be longer. At this time, if the virus inspection can be performed with the latest virus pattern while going out, the time of the quarantine process after the return can be shortened. In this embodiment, in order to shorten the time of the quarantine process, the server that distributes the anti-virus pattern file can be accessed not only from the intranet but also from the outside.

  The file quarantine apparatus according to the present embodiment includes a pattern file acquisition availability determination unit that determines whether or not the latest virus pattern file can be acquired, and the quarantine processing unit includes the latest virus in the pattern file acquisition availability determination unit. When it is determined that the pattern file can be acquired, a computer virus quarantine process is executed based on the updated file list. Therefore, the quarantine process can be efficiently performed without acquiring the pattern file from the antivirus server after connecting to the in-house network.

[3-1. System configuration, hardware configuration and processing of each part]
FIG. 15 is a diagram illustrating a configuration example of a system of the file quarantine apparatus according to the present embodiment. The hardware configuration example of the file quarantine apparatus 1 according to the present embodiment is the same as that of FIG. 3 described in the first embodiment. In FIG. 15, a pattern file acquisition possibility determination unit 34 is added as compared with the configuration of FIG.

  Upon receiving a user operation, the CPU 202 that causes the pattern file acquisition possibility determination unit 34 to function determines whether a pattern file can be acquired via the network interface 9. For example, it is determined whether a pattern file can be acquired by accessing a predetermined server via a public LAN. If acquisition is possible, the flowchart of the quarantine execution process shown in FIG. 11 is executed. Note that the specific processing content of each unit described in FIGS. 4 to 13 is the same as that of the first embodiment.

[4. Fourth Embodiment]
Similarly to the first embodiment, the file quarantine apparatus according to the present embodiment is configured by a computer device (for example, a notebook personal computer) including a CPU. In the present embodiment, as in the first embodiment, instead of specifying the file to be quarantined based on the updated file list 205d created by the control from the network connection determination unit 31, the network non-connection period record is recorded. An example will be described in which a quarantine process is performed by specifying a file updated during a period when the network is not connected to the network.

  For example, instead of creating an update file list only when not connected to the corporate network, an update file list that includes a time stamp at the time of update is always created, and information about the period when the network was disconnected is used. Based on this, identify the files to be scanned for viruses.

  The file quarantine apparatus according to the present embodiment includes a network non-connection period recording unit that records a period in which the file was not connected to a predetermined network, and the update file list created by the update file list creation unit is a time for each file. The quarantine processing unit includes a stamp, and determines a target file for the quarantine processing based on the period recorded by the network non-connection period recording unit and the time stamp. Therefore, even when the constantly updated file list is created, the target file can be accurately identified and the quarantine process can be performed efficiently.

[4-1. System configuration, hardware configuration and processing of each part]
FIG. 16 is a diagram illustrating a configuration example of a system of the file quarantine apparatus according to the present embodiment. The hardware configuration example of the file quarantine apparatus 1 according to the present embodiment is the same as that of FIG. 3 described in the first embodiment. In FIG. 16, a network non-connection period recording unit 35 is added as compared with the configuration of FIG. The CPU 202 that causes the update file list creation unit 22 to function always creates the update file list 205d, and no control command is issued from the network connection determination unit 31 to the update file list creation unit 22.

  The CPU 202 that causes the network connection determination unit 31 to function notifies the network non-connection period recording unit 35 of the network connection state. In response to this, the CPU 202 that causes the network disconnection period recording unit 35 to function records a period during which the network is disconnected. For example, the time determined to be disconnected and the time determined to be connected are recorded.

  The CPU 202 that causes the quarantine processing unit 33 to function acquires the period when the network is disconnected from the network disconnection period recording unit 35, and the file update date in the update file list corresponds to the period when the network is disconnected. Is identified as the file to be scanned. For example, the process for specifying the scan target file may be executed before Op 1103 of the quarantine execution process shown in FIG. Alternatively, it may be executed before Op 1204 of the quarantine client process shown in FIG. Note that the specific processing content of each unit described in FIGS. 4 to 13 is the same as that of the first embodiment.

[5. Fifth Embodiment]
Similarly to the first embodiment, the file quarantine apparatus according to the present embodiment is configured by a computer device (for example, a notebook personal computer) including a CPU. In the present embodiment, as in the first embodiment, the file to be quarantined is not specified based on the updated file list 205d created by the control from the network connection determination unit 31, but in the fourth embodiment. In the same manner as described above, an example will be described in which a network non-connection period recording unit is provided and a quarantine process is performed by specifying a file updated during a period when the network is not connected. However, in the present embodiment, the network connection determination unit identifies the target file for virus scanning.

  The file quarantine apparatus according to the present embodiment includes a network non-connection period recording unit that records a period of time when the file was not connected to a predetermined network, and the update file list created by the update file list creation unit includes The network connection determining unit includes a time stamp, and determines a target file for the quarantine process based on the period and the time stamp. Therefore, even when the constantly updated file list is created, the target file can be accurately identified and the quarantine process can be performed efficiently.

[5-1. System configuration, hardware configuration and processing of each part]
FIG. 17 is a diagram illustrating a configuration example of a system of the file quarantine apparatus according to the present embodiment. The hardware configuration example of the file quarantine apparatus 1 according to the present embodiment is the same as that of FIG. 3 described in the first embodiment. In FIG. 17, a network non-connection period recording unit 35 is added as compared with the configuration of FIG. The CPU 202 that causes the update file list creation unit 22 to function always creates the update file list 205d, and no control command is issued from the network connection determination unit 31 to the update file list creation unit 22.

  The CPU 202 that causes the network connection determination unit 31 to function determines a virus scan target file based on the update file list 205d and the in-company network non-connection period from the network non-connection period recording unit 35. FIG. 18 is a process flowchart in the control virtual machine 3 of the present embodiment. In FIG. 18, Op503a and Op505a are changed and Op505b is added to FIG. That is, at Op 503a and Op 505a, the network non-connection period recording unit 35 is notified of the connection / non-connection of the in-house network. Further, the file to be scanned is determined before Op 506 (Op 505b). Note that the specific processing content of each unit described in FIGS. 4 and 6 to 13 is the same as that of the first embodiment.

[6. Sixth Embodiment]
Similarly to the first embodiment, the file quarantine apparatus according to the present embodiment is configured by a computer device (for example, a notebook personal computer) including a CPU. In this embodiment, an example will be described in which a file to be recorded is copied to specify a scan target file.

  For example, when specifying a file that has actually been rewritten from sector-by-sector writing to the disk, it is necessary to determine from the writing to the disk and the current state of the disk. However, if the current state of the disk is used for analysis work for specifying the target file, actual writing cannot be performed until the analysis is completed. In this embodiment, in order to avoid a delay in writing, a copy (copy) of a disk area used by the user environment is created when the user goes out, and the analysis work and the disk rewrite by the user environment are performed in parallel. Creation of a copy (copy) of a disk is triggered by notification from the network connection determination unit.

  In the file quarantine apparatus according to the present embodiment, a network connection determination unit that determines whether or not the file quarantine apparatus is connected to a predetermined network, and the network connection determination unit determines that the file quarantine apparatus is not connected to the predetermined network. A recording area duplicating unit that duplicates a recording area of a file for a user virtual machine managed by the virtual machine management unit and creates a copying area, and the update file list creating unit includes: The update file list is created based on the files recorded in the copy area. Therefore, an updated file list can be efficiently created from the copied recording area.

[6-1. System configuration, hardware configuration and processing of each part]
FIG. 19 is a diagram illustrating a configuration example of a system of the file quarantine apparatus according to the present embodiment. The hardware configuration example of the file quarantine apparatus 1 according to the present embodiment is the same as that of FIG. 3 described in the first embodiment. In FIG. 19, a recording area duplication unit 23 in the virtual machine management unit 2 is added as compared with the configuration of FIG. Upon receiving the notification from the network connection determination unit 31, the CPU 202 that causes the recording region duplication unit 23 to perform processing of copying the original region 51 of the disk storage 5 to the copy region 52. Here, the original area is an area allocated to the user virtual machine 4 where the original file is recorded.

  The CPU 202 that causes the update file list creation unit 22 to function creates an update file list 205 d based on the copy area 52. Note that the specific processing content of each unit described in FIGS. 4 to 13 is the same as that of the first embodiment. Further, the quarantine processing unit 33 may perform the quarantine process on any of the original area 51 and the copy area 52.

[7. Seventh Embodiment]
Similarly to the first embodiment, the file quarantine apparatus according to the present embodiment is configured by a computer device (for example, a notebook personal computer) including a CPU. In the present embodiment, an example in which a scan target file is specified using a virtual disk in a recording area in which a file is recorded will be described.

  For example, when the actual contents of the disk are used for the process of specifying the file in which writing has occurred (update file creation process), writing by other processes may be delayed. In this embodiment, by using the virtual disk function, update file creation processing can be performed without delaying writing by other processing.

  Specifically, by using the virtual disk function, the change contents are managed in the difference area while the original area is held. Thereby, the latest disk contents can always be referred from the outside of the virtual machine management unit 2, and the original area can be referred from the inside of the virtual machine management unit 2.

  In the file quarantine apparatus according to the present embodiment, a file recording area for a user virtual machine managed by the virtual machine management unit includes an original area and a difference area. A virtual recording area for recording a file requested to be updated by a machine management unit in the difference area, wherein the update file list creating unit is configured to update the file based on the files recorded in the original area and the difference area; Create a file list. Therefore, the update file list can be efficiently created by reflecting the contents of the difference area in the original area.

[7-1. System configuration, hardware configuration and processing of each part]
FIG. 20 is a diagram illustrating a configuration example of a system of the file quarantine apparatus according to the present embodiment. The hardware configuration example of the file quarantine apparatus 1 according to the present embodiment is the same as that of FIG. 3 described in the first embodiment. In FIG. 20, a virtual disk function unit 24 in the virtual machine management unit 2 is added as compared with the configuration of FIG. When receiving the notification from the network connection determination unit 31, the virtual disk function unit 24 performs a process of reflecting the difference area 55 of the disk storage 5 in the original area 56. Here, the original area is an area allocated to the user virtual machine 4 where the original file is recorded.

  The update file list creation unit 22 creates the update file list 205 d based on the difference area 55 and the original area 56. Note that the specific processing content of each unit described in FIGS. 4 to 13 is the same as that of the first embodiment.

[8. Eighth Embodiment]
Similarly to the first embodiment, the file quarantine apparatus according to the present embodiment is configured by a computer device (for example, a notebook personal computer) including a CPU. In this embodiment, an example in which a scan target file is specified based on the correspondence between a file name and sector information will be described.

  For example, by creating a correspondence table of the file (path name) and the sector number where the file is actually stored from the contents of the disk area in advance, it becomes the target of the write command in the update file list creation process. Can easily identify the file.

  The file quarantine apparatus according to the present embodiment includes a correspondence relationship holding unit that retains a correspondence relationship between a file accessible by the user virtual machine and position information where the file is recorded in the physical data area, and an update file The list creation unit creates an update file list based on the output of the file monitoring unit and the correspondence relationship holding unit. Therefore, the update file list can be efficiently created based on the correspondence between the file and the recording position.

[8-1. System configuration, hardware configuration and processing of each part]
FIG. 21 is a diagram illustrating a configuration example of a system of the file quarantine apparatus according to the present embodiment. The hardware configuration example of the file quarantine apparatus 1 according to the present embodiment is the same as that of FIG. 3 described in the first embodiment. In FIG. 21, a correspondence relationship holding unit 25 in the virtual machine management unit 2 is added as compared to the configuration of FIG. The correspondence holding unit 25 records a file recorded in an area allocated to the user virtual machine 4 in the disk storage 5 and sector information as position information in association with each other. The correspondence relationship holding unit 25 may be created upon receiving a notification from the network connection determination unit 31 or may be created at an arbitrary timing.

  The update file list creation unit 22 creates the update file list 205 d based on the correspondence relationship holding unit 25. FIG. 22 is a diagram illustrating an example of the correspondence relationship holding unit 25. For example, a file name 221, a sector number (1) 222, a sector number (2) 223,..., A sector number (n) 224 are recorded in the correspondence relationship holding unit 25.

  The CPU 202 that causes the update file list creation unit 22 to function determines the sector number in which the write command shown in FIG. 8B matches the sector number 86 as the correspondence holding unit 25 (sector number (1) 222, sector number (2) 223,. The file name associated with this sector number is recorded in the updated file list 205d. Note that the specific processing content of each unit described in FIGS. 4 to 13 is the same as that of the first embodiment.

[9. Ninth Embodiment]
Similarly to the first embodiment, the file quarantine apparatus according to the present embodiment is configured by a computer device (for example, a notebook personal computer) including a CPU. In this embodiment, the update file list 205d is created in a shared memory between the virtual machine management unit 2 and the control virtual machine 3.

  For example, after connecting to the in-house network, a virus check process is performed on a file whose file name exists in the update file list 205d. As described above, the update file list 205d is set to be accessible from the control virtual machine 3 using the file disclosure function of the virtual machine management unit 2, for example. However, if the update file list 205d is created in the shared memory between the virtual machine management unit 2 and the control virtual machine 3, it is not necessary to use the file disclosure function.

  In the file quarantine apparatus according to the present embodiment, the update file list created by the update file list creation unit is recorded in an area that can be commonly accessed by the virtual machine management unit and the control virtual machine. Therefore, it is possible to reduce the processing load on the virtual machine management unit 2 and efficiently publish the update file list.

[9-1. System configuration, hardware configuration and processing of each part]
FIG. 22 is a diagram illustrating a configuration example of a system of the file quarantine apparatus according to the present embodiment. The hardware configuration example of the file quarantine apparatus 1 according to the present embodiment is the same as that of FIG. 3 described in the first embodiment. In FIG. 22, compared to the configuration of FIG. 2, an update file list 205 d is created in the shared memory 26 between the virtual machine management unit 2 and the control virtual machine 3. Note that the specific processing content of each unit described in FIGS. 4 to 13 is the same as that of the first embodiment.

[10. Tenth Embodiment]
Similarly to the first embodiment, the file quarantine apparatus according to the present embodiment is configured by a computer device (for example, a notebook personal computer) including a CPU. In the present embodiment, the process of the update file creation unit 22 is executed not by the virtual machine management unit 2 but by the control virtual machine 3.

  For example, by setting the control virtual machine 3 to be accessible to the disk storage 5 of the virtual machine management unit 2, the update virtual file list creation process can be executed in the control virtual machine 3.

  In the file quarantine apparatus according to the present embodiment, the update file list creation unit is executed in the control virtual machine. Therefore, it is possible to reduce the processing load on the virtual machine management unit 2 and efficiently publish the update file list.

[10-1. System configuration, hardware configuration and processing of each part]
FIG. 24 is a diagram illustrating a configuration example of a system of the file quarantine apparatus according to the present embodiment. The hardware configuration example of the file quarantine apparatus 1 according to the present embodiment is the same as that of FIG. 3 described in the first embodiment. In FIG. 24, compared to the configuration of FIG. 2, an update file list creation unit 22 is provided in the control virtual machine 3, and an update file list 25d is also held in the control virtual machine 3. The setting for enabling access to the disk storage 5 from the control virtual machine 3 may be realized by the file publishing function of the virtual machine management unit 2. Note that the specific processing content of each unit described in FIGS. 4 to 13 is the same as that of the first embodiment.

[11. Other Embodiments]
[11-1. Combination of Embodiments]
A part or all of the configurations described in the first to tenth embodiments may be combined.

[11-2. Realization method of each functional block]
In the above embodiment, each functional block shown in FIG. 2 and the like is realized by processing of a CPU that executes software. However, some or all of them may be realized by hardware such as a logic circuit. In addition, you may make it make an operating system (OS) further process a part of program.

  Regarding the above embodiment, the following additional notes are disclosed.

(Appendix 1)
A user virtual machine that executes processing based on user operations;
A virtual machine management unit that receives a request from the user virtual machine and accesses a physical data area;
A file monitoring unit for monitoring a file requested to be updated from the user virtual machine to the virtual machine management unit;
Based on the output of the file monitoring unit, an update file list creation unit that creates an update file list indicating which file is updated for the user virtual machine in the virtual machine management unit;
A file quarantine apparatus comprising: a quarantine processing unit that executes a computer virus quarantine process on the files indicated in the update file list.

(Appendix 2)
A network connection determination unit for determining whether or not the device is connected to a predetermined network;
The file quarantine apparatus according to appendix 1, wherein the update file list creation unit creates the update file list when the network connection determination unit determines that the file quarantine apparatus is not connected to the predetermined network. .

(Appendix 3)
The file quarantine apparatus according to appendix 1 or 2, further comprising an operation management unit that stops the operation of the user virtual machine while the quarantine processing is being executed in the quarantine processing unit.

(Appendix 4)
A control virtual machine for controlling the user virtual machine;
The control virtual machine activates the quarantine virtual machine as a quarantine processing unit, causes the quarantine virtual machine to execute the quarantine process, and stops the quarantine virtual machine when the quarantine process ends. The file quarantine apparatus according to any one of 1 to 3.

(Appendix 5)
The file quarantine apparatus according to appendix 4, wherein the control virtual machine execution unit determines an OS of a quarantine virtual machine execution unit to be activated in accordance with an OS of the user virtual machine execution unit.

(Appendix 6)
It further comprises a pattern file acquisition availability determination unit that determines whether or not the latest virus pattern file can be acquired,
The quarantine processing unit executes computer virus quarantine processing based on the updated file list when the pattern file acquisition availability determination unit determines that the latest virus pattern file can be acquired. The computer apparatus as described in any one of.

(Appendix 7)
A network non-connection period recording unit that records a period of time when the network was not connected to the predetermined network;
The update file list created by the update file list creation unit includes a time stamp for each file,
The quarantine processing unit determines a target file for the quarantine processing based on a period recorded by the network disconnection period recording unit and the time stamp, according to any one of appendix 1 or 3-7. File quarantine equipment.

(Appendix 8)
A network non-connection period recording unit that records a period of time when the network was not connected to the predetermined network;
The update file list created by the update file list creation unit includes a time stamp for each file,
The file quarantine apparatus according to any one of appendix 1 or 3 to 7, wherein the network connection determination unit determines a target file for the quarantine process based on the period and the time stamp.

(Appendix 9)
A network connection determination unit for determining whether or not the device is connected to a predetermined network;
When the network connection determination unit determines that the file quarantine apparatus is not connected to the predetermined network, the file connection area for the user virtual machine managed by the virtual machine management unit is copied. A recording area duplicating unit for creating a duplicating area;
The file quarantine apparatus according to any one of appendices 1 to 8, wherein the update file list creation unit creates the update file list based on a file recorded in the copy area.

(Appendix 10)
The file recording area for the user virtual machine managed by the virtual machine management unit is composed of an original area and a difference area, and the virtual machine management unit requests an update from the user virtual machine. A virtual recording area for recording the recorded file in the difference area,
The file quarantine apparatus according to any one of appendices 1 to 8, wherein the update file list creation unit creates the update file list based on files recorded in the original area and the difference area.

(Appendix 11)
A correspondence relationship holding unit that retains a correspondence relationship between a file accessible by the user virtual machine and position information where the file is recorded in the physical data area;
The file quarantine apparatus according to any one of appendices 1 to 10, wherein the update file list creation unit creates an update file list based on an output of the file monitoring unit and the correspondence relationship holding unit.

(Appendix 12)
The update file list created by the update file list creation unit is recorded in an area that can be accessed in common by the virtual machine management unit and the control virtual machine. Quarantine equipment.

(Appendix 13)
The file quarantine apparatus according to any one of appendices 1 to 12, wherein the update file list creation unit is executed in the control virtual machine.

(Appendix 14)
A user virtual machine that executes processing based on user operations;
A virtual machine management unit that receives a request from the user virtual machine and accesses a physical data area;
A file monitoring unit for monitoring a file requested to be updated from the user virtual machine to the virtual machine management unit;
An update file list creation unit that creates an update file list indicating which file is updated for the user virtual machine in the virtual machine management unit based on the output of the file monitoring unit; File quarantine aid.

(Appendix 15)
A file quarantine program for realizing a file quarantine apparatus using a computer,
A process for executing a user virtual machine for executing a process based on a user operation;
A process of receiving a request from the user virtual machine and executing a virtual machine management unit that accesses a physical data area; and
A file monitoring process for monitoring a file requested to be updated from the user virtual machine to the virtual machine management unit;
An update file list creation process for creating an update file list indicating which file is updated for the user virtual machine in the virtual machine management unit based on the output of the file monitoring process;
A file quarantine program for causing a computer to execute a computer virus quarantine process for a file indicated in the update file list.

(Appendix 16)
Executing a user virtual machine for executing processing based on a user operation;
Receiving a request from the user virtual machine and executing a virtual machine management unit that accesses a physical data area; and
A file monitoring step of monitoring a file requested to be updated from the user virtual machine to the virtual machine management unit;
An update file list creation step for creating an update file list indicating which file is updated for the user virtual machine in the virtual machine management unit based on the output of the file monitoring step;
And a quarantine process for executing a computer virus quarantine process on the files indicated in the update file list.

1: File quarantine device 2: Virtual machine management unit 3: Control virtual machine 4: User virtual machine 5: Disk storage 9: Network interface 21: File monitoring unit 22: Update file list creation unit 31: Network connection determination Unit 32: Operation management unit 33: Quarantine processing unit 41: Application 42: OS

Claims (11)

A user virtual machine that performs processing;
A virtual machine management unit that receives a request from the user virtual machine and accesses a physical data area;
A file monitoring unit for monitoring a file requested to be updated from the user virtual machine to the virtual machine management unit;
Based on the output of the file monitoring unit, an update file list creation unit that creates an update file list indicating which file is updated for the user virtual machine in the virtual machine management unit;
A file quarantine apparatus comprising: a quarantine processing unit that executes a computer virus quarantine process on the files indicated in the update file list. A network connection determination unit for determining whether or not the device is connected to a predetermined network;
The file quarantine according to claim 1, wherein the update file list creation unit creates the update file list when the network connection determination unit determines that the file quarantine apparatus is not connected to the predetermined network. apparatus.   The file quarantine apparatus according to claim 1, further comprising an operation management unit that stops the operation of the user virtual machine while the quarantine processing is being executed in the quarantine processing unit. A control virtual machine for controlling the user virtual machine;
The control virtual machine starts a quarantine virtual machine as a quarantine processing unit, causes the quarantine virtual machine to execute the quarantine process, and stops the quarantine virtual machine when the quarantine process ends. Item 4. The file quarantine apparatus according to any one of Items 1 to 3. The file quarantine apparatus according to claim 4, wherein the control virtual machine determines an OS of a quarantine virtual machine to be activated in accordance with an OS of the user virtual machine. It further comprises a pattern file acquisition availability determination unit that determines whether or not the latest virus pattern file can be acquired,
The quarantine processing unit executes a computer virus quarantine process based on the updated file list when it is determined by the pattern file acquisition availability determination unit that the latest virus pattern file can be acquired. The file quarantine apparatus according to any one of 5. A network non-connection period recording unit that records a period of time when the network was not connected to the predetermined network;
The update file list created by the update file list creation unit includes a time stamp for each file,
The said quarantine process part determines the object file of the said quarantine process based on the period and the said time stamp which were recorded by the said network non-connection period recording part. The file quarantine unit described. A correspondence relationship holding unit that retains a correspondence relationship between a file accessible by the user virtual machine and position information where the file is recorded in the physical data area;
The file quarantine apparatus according to claim 1, wherein the update file list creation unit creates an update file list based on an output of the file monitoring unit and the correspondence relationship holding unit. A user virtual machine that performs processing;
A virtual machine management unit that receives a request from the user virtual machine and accesses a physical data area;
A file monitoring unit for monitoring a file requested to be updated from the user virtual machine to the virtual machine management unit;
An update file list creation unit that creates an update file list indicating which file is updated for the user virtual machine in the virtual machine management unit based on the output of the file monitoring unit; File quarantine aid. A file quarantine program for realizing a file quarantine apparatus using a computer,
A process of executing a user virtual machine that executes the process;
A process of receiving a request from the user virtual machine and executing a virtual machine management unit that accesses a physical data area; and
A file monitoring process for monitoring a file requested to be updated from the user virtual machine to the virtual machine management unit;
An update file list creation process for creating an update file list indicating which file is updated for the user virtual machine in the virtual machine management unit based on the output of the file monitoring process;
A file quarantine program for causing a computer to execute a computer virus quarantine process for a file indicated in the update file list. Executing a user virtual machine for executing the process;
Receiving a request from the user virtual machine and executing a virtual machine management unit that accesses a physical data area; and
A file monitoring step of monitoring a file requested to be updated from the user virtual machine to the virtual machine management unit;
An update file list creation step for creating an update file list indicating which file is updated for the user virtual machine in the virtual machine management unit based on the output of the file monitoring step;
And a quarantine process for executing a computer virus quarantine process on the files indicated in the update file list.

Images