JP5682978B2 - Security system, security control method, and security control program - Google Patents

Description

  The present invention relates to a security system, a security control method, and a security control program, and more particularly, to a security system, a security control method, and a security control program for preventing viruses and malware in a computer system.

  Security systems for anti-virus and malware in current computer systems check all files in the computer system against a virus pattern list (black list) that contains virus and malware information, A blacklist method that detects and disinfects files that contain files and malware, and files that have been approved to run as executable files are registered in advance in the execution permission list (whitelist) and files that are not registered in the whitelist are executed. There is a white list method to suppress.

  A blacklist security system verifies all files in a computer system with a virus pattern list (blacklist) every time, so the load placed on the computer system during verification is high and software that operates simultaneously The impact on is great. In addition, it is necessary to update the virus pattern list every day in order to take measures against virus information that is increasing daily.

  On the other hand, the whitelist security system suppresses operations (execution / copying, etc.) for unauthorized programs and altered programs, but the subsequent actions (virus check and addition to the whitelist) Need to be done separately. In other words, a whitelist security system can prevent virus infection by suppressing execution of unregistered files in the whitelist even if a virus is mixed, but it will detect the virus itself. I couldn't. Therefore, once the computer system is set to the protected state by the security system, there is a risk that the virus will activate if the protected state is subsequently released, so the security risk is high, the introduction of new programs, There is a high possibility that it will be a restriction when updating a computer system such as updating an existing program. In addition, it is necessary to manually register and update the registration contents of the white list, which takes time when a new program is introduced or updated.

  Therefore, for example, in Japanese Patent Application Laid-Open No. 2011-113144 “Automatic transaction apparatus and automatic transaction system using the same” in Patent Document 1, a virus pattern list (black list) and an execution permission list (white list) are used in combination. An automated trading system has been proposed. In Patent Document 1, when an automatic transaction apparatus detects a program file that is not registered in the white list by comparing the information of the program file necessary for transaction processing with the registered white list during operation of the program file The program file information is transmitted to the monitoring server, the program file information is additionally registered in the black list as the information of the program file to be removed, and the additionally registered black list is returned to the transmission source automatic transaction apparatus. By doing so, the automatic transaction apparatus proposes a mechanism in which the matched program file is removed as a malicious program by comparing the received black list with all stored program files.

  Furthermore, in Patent Document 1, when updating the program file of the automatic placement transaction apparatus, the collation operation with the white list is stopped and the black list is acquired from the monitoring server. After updating, compare the acquired black list with all program files, and if they do not match, register them in the white list to allow the operation of the updated program file, If a matching program file exists, it is removed as an illegal program file.

JP 2011-113144 A (page 4-7)

  As described above, in the conventional security system, if only the mechanism of the black list is used, the virus can be detected and the malicious program can be removed, but the black list and all files are collated. There is a problem that the load applied to the computer system is high, and on the other hand, if it is only a mechanism of the white list alone, even if a virus is mixed, it is not registered in the white list. As long as it is possible to prevent virus activity by suppressing execution, it was not possible to detect the virus itself. In addition, for files that are not registered in the white list, the operation of the files is suppressed, and in order to cancel the suppression, it is necessary to manually register / update the information related to the files in the white list. There is a problem that it takes time to introduce and update.

  Furthermore, in the case of a security system such as Patent Document 1 that uses both a black list and a white list, a load for normal operation other than when a computer system is updated can be reduced. When a new device is installed or updated, it is necessary to stop the whitelist verification operation on the target device side and transfer the blacklist from the monitoring server, and the target device is set to the non-monitoring state. There is a security problem.

(Object of the present invention)
The present invention has been made in view of such circumstances. A security system, a security control method, and security capable of automatically updating a white list and preventing occurrence of an unmonitored state of a computer system. It is to provide a control program.

  In order to solve the above-described problems, the security system, the security control method, and the security control program according to the present invention mainly adopt the following characteristic configuration.

  (1) A security system according to the present invention includes a white list and uses a white list type information terminal device that suppresses execution of a file not registered in the white list. In the security system, the information terminal device includes: Have a master file list that pre-registers information related to files that are approved for use as a computer system to which the device belongs, and copy the files that have information related to files registered in the master file list And means for registering information relating to the file in the white list after execution of copying.

  (2) A security control method according to the present invention is a security control method in a security system having a white list and using a white list type information terminal device that suppresses execution of a file not registered in the white list. The information terminal device has a master file list in which information related to files approved for application as a computer system to which the device belongs is registered in advance, and the information related to files is registered in the master file list. And executing a copy of the file and registering information on the file in the white list after the copy is executed.

  (3) A security control program according to the present invention is characterized in that at least the security control method described in (2) is implemented as a program executable by a computer.

  According to the security system, security control method, and security control program of the present invention, a whitelist is registered by using a master file list in which information relating to a file that has been approved for application as a computer system to which an information terminal device belongs is registered in advance. It is possible to copy a file that has not been processed and add it to the white list, and it is not necessary to stop the collation operation by the white list, so that it is possible to avoid interruption of operation / processing due to execution suppression.

It is a system configuration figure showing an example of a system configuration of a security system by the present invention. FIG. 2 is an explanatory diagram showing an outline of an operation when copying a file in the security system of FIG. 1. It is explanatory drawing which shows the outline | summary of the operation | movement at the time of file execution in the security system of FIG. FIG. 3 is an explanatory diagram showing an example of a file copy confirmation screen for confirming to the user whether or not to copy a file that does not exist in the master file list in the information terminal device in the security system of FIG. 1. 2 is a flowchart illustrating an example of an operation when a file is copied to a designated location in an information terminal device by copy execution software of the information terminal device in the security system of FIG. 1. 2 is a flowchart showing an example of an operation when a file existing in an information terminal device is executed in the security system of FIG. 1. It is explanatory drawing which shows the outline | summary of the operation | movement at the time of file copy in the structural example different from FIG. 1 of the system configuration | structure of the security system by this invention.

  Preferred embodiments of a security system, a security control method, and a security control program according to the present invention will be described below with reference to the accompanying drawings. In the following description, the security system and the security control method according to the present invention will be described. However, the security control method may be implemented as a security control program that can be executed by a computer, or the security control program. It goes without saying that may be recorded on a computer-readable recording medium.

(Features of the present invention)
Prior to the description of the embodiments of the present invention, an outline of the features of the present invention will be described first. The present invention provides a security system that protects a computer system from computer viruses and malware, while taking advantage of the advantages of the conventional whitelist method, while the blacklist method and the present invention provide functions that are lacking in the conventional whitelist method. It is mainly made up by the introduction of two mechanisms with the newly added master file list, and the improvement of the work at the time of system update, which was the problem of the conventional white list method, and the reduction of the response at the time of virus contamination Features.

  That is, according to the present invention, when a computer system is updated, if the computer system is configured by a server and an information terminal device, a new installation file or an update file is installed in the server in advance. If a virus check is performed and no virus is detected, it is assumed that the newly installed file or update file is normal, and information on the newly installed file or update file is stored in the master file list original provided in the server in advance. Are additionally registered and transmitted to the information terminal device. The information terminal device overwrites and updates the master file list prepared in advance in its own device to update it to the latest state. The information terminal device refers to the master file list that has been updated to the latest state, and if information on a newly introduced file or an updated file to be supplied by the server has been registered, The installation file and update file are copied to the designated location, and information on the new installation file and update file is additionally registered in the white list.

  On the other hand, if information about newly installed files or updated files has not been registered in the master file list, the information terminal device installs new information based on the latest virus pattern list (black list) downloaded from the server. A virus check is performed on files and update files. If a virus is detected, it is recorded in the log, the user is notified that a virus has been detected, and if no virus is detected, a new one is introduced. Whether or not to copy the file or update file is displayed on the screen, and the user is allowed to select whether or not to execute the file copy.

  More specifically, the present invention relates to a security system related to information terminal devices constituting a computer system, a white list for registering information on files permitted to be executed in the information terminal device, and unregistered in the white list It is a file that is executed in the information terminal device after being copied (newly introduced or updated), and is a legitimate file that is recognized as a component of the computer system. A master file list that pre-registers information related to files that are certified as safe (that is, information related to files that are certified as a computer system to which the device belongs) and a virus that stores patterns for detecting viruses and malware Pattern list, the information edge It is configured to include in the device.

  If the computer system is configured as a server client system and includes a server that performs virus checking, the server checks for viruses whenever a new installation file or update file to be copied to an information terminal device is generated. This is performed based on the original virus pattern list updated to the latest state. If the virus check result is normal, it is additionally registered in the master file list original in the server and updated to the latest state. Further, the server transmits the master file list original and the virus pattern list original updated to the latest state to each information terminal device on the client side, and a master file prepared in advance on each information terminal device on the client side Copy over the list and virus pattern list. By operating in this way, the master file list and virus pattern list of each information terminal device on the client side are also updated to the latest state.

  In addition, when the computer system is configured as a stand-alone system consisting only of an information processing apparatus that does not have a server, external storage such as a USB memory storing the latest master file list original and virus pattern list original is processed. By externally connecting to the device, the information processing device reads the latest master file list original and virus pattern list original via the external storage, and overwrites them on the master file list and virus pattern list in the information terminal device. Alternatively, the master file list and the virus pattern list of the information terminal device on the client side are updated to the latest state by performing manual update using a dedicated command for security control.

  Then, when copying a file into the information terminal device and when executing a file within the information terminal device, the following security management is performed.

1. When copying a file (1) If the information on the target file is registered in the master file list, the file is copied, and the information on the file is additionally registered in the white list. If the copy execution control unit (for example, the copy execution control program) does not have update authority, the file is not copied.

  (2) If the information related to the target file is not registered in the master file list, the virus pattern is checked based on the virus pattern list. If a virus is detected, the user is notified of the virus detection. The file is not copied. On the other hand, if no virus is detected, the user is inquired whether or not to execute the copy of the file. If the user selects to execute the copy, the file is copied, and further, information on the file is displayed in white. On the other hand, when the user does not select execution of copying, the file is not copied. If the copy execution control unit (for example, the copy execution control program) does not have update authority, the file is not copied.

2. When executing a file (1) When information on an execution file is registered in the white list, the file is executed.

  (2) If the information related to the executable file is not registered in the white list, the virus pattern is checked based on the virus pattern list. If a virus is detected, the user is notified that the virus has been detected, and The file is not executed. On the other hand, when no virus is detected, the information on the file is not registered in the white list, so the file is not executed.

  As described above, the present invention is a security system related to an information terminal device using a white list, and is executed in the information terminal device after copying (new introduction or update) even if it is not registered in the white list. A master file list for preregistering information related to files that are legitimate files recognized as a component of the computer system to which the information terminal device belongs and that are certified as safe by virus checking is Provided separately from the list. For example, when copying a file, if the target file is registered in the master file list, the file is copied and the information about the file is added and registered in the white list. To do.

  Thus, by adding a new master file list as described above to the white list and black list (virus pattern list) in the prior art, it is possible to protect the computer system and detect viruses. In addition, the white list can be automatically updated to reduce the time and effort required for updating and the load on the computer system, and it is also possible to prevent the occurrence of a non-monitoring state of the computer system.

(Configuration example of embodiment)
Next, a configuration example of the security system of the present invention will be described in detail with reference to the system configuration diagram of FIG. FIG. 1 is a system configuration diagram showing an example of a system configuration of a security system according to the present invention, and shows an example in which an information terminal device 10 and a server 50 are configured. The information terminal device 10 and the server 50 are connected by a communication line 90. The information terminal device 10 includes a control unit 101 and a storage unit 102. In the storage unit 102, a white list in which security software 20 that executes security measures by being executed by the control unit 101 and information on files (application program files, etc.) that are permitted to be executed in the own apparatus are registered. 21. The master file list 22 and virus pattern list 23 transmitted from the server 50, and at least copy execution software 30 that executes a copy operation of the file 40 (application program file or data file) by being executed by the control unit 101 is stored. Has been.

  The security software 20 is executed by the control unit 101 to execute security measures in the information terminal device 10 based on information registered in the white list 21, the master file list 22, and the virus pattern list 23, The copy execution software 30 is also provided with a function of granting overwrite copy authority (update authority) of files and the like. The copy execution software 30 may be realized as a general application program, and must be registered in advance in the white list 21 and given copy authority (update authority) regarding the file 40 and the like. is there. Here, the security software 20 is preferably realized as a system program having access authority for the entire system, but the copy execution software 30 may be realized as a general application program. In the security system shown in FIG. 1, the security control unit that executes security measures and the copy execution control unit that copies files 40 are security software 20 and copy execution software 30, respectively, and are executed by the control unit 101 of the computer. Although the case where it implement | achieves by the program control to perform is demonstrated, you may make it comprise such a means by the hardware logic using firmware etc., for example.

  On the other hand, the server 50 includes a control unit 501 and a storage unit 502. The storage unit 502 is not registered in the white list and is recognized as a component of the computer system to which the information terminal device 10 belongs with respect to a file executed in the information terminal device 10 after copying (new introduction or update). Master file list original 52 in which the latest information on a file that is a legitimate file and has been confirmed to be safe by the virus check is registered, and the latest pattern for detecting a virus or malware in the virus check of the file And at least a virus pattern list original 53 in which is registered. The master file list original 52 and virus pattern list original 53 are executed as necessary by executing the control unit 501 to update the master file list 22 and virus pattern list 23 in the information terminal device 10 to the latest state. Is transmitted to the information terminal device 10.

  When the security software 20 in the information terminal device 10 is executed by the control unit 101, execution of only the files registered in the white list 21 is permitted for each executable file operating in the information terminal device 10. And execution suppression is performed for files not registered in the white list 21. The security software 20 checks whether or not the copy execution software 30 that performs the file copy operation has an update authority when the file copy operation is to be performed. , Has a function of inhibiting the file copy operation.

  Furthermore, when copying the file, the security software 20 checks whether or not information related to the file is registered in the master file list 22, and if it is registered, it is a new valid file. In addition, as a copy / move operation for a file with a normal virus check result, an operation such as copy or move of the file is permitted. When the file is copied by the copy execution software 30, information on the file is registered in the white list 21. It has the function to do. On the other hand, if no information about the file is registered in the master file list 22, a virus check is performed by checking against the virus pattern list 23. If the virus check result is normal and no virus is detected, the user is checked. After obtaining the confirmation from, the operation of copying or moving the file is permitted, and when the file is copied by the copy execution software 30, it has a function of registering information on the file in the white list 21.

  In addition, when a virus is detected as a virus check result, it has a function of suppressing operations such as copying and moving and storing the fact in a log file.

  The white list 21 is a list for registering information related to files that are given execution permission by the security software 20. Execution files that are not registered in the white list 21 are inhibited from being executed by the security software 20 even if they are to be executed.

  The master file list 22 is a list that is updated to the latest state by the master file list original 52 transmitted from the server 50 as necessary. The master file list 22 is not registered in the white list 21 and is copied (newly installed or newly installed). This is a list in which information (path / file name, size, checksum, etc.) relating to a file to be executed in the information terminal device 10 is registered after the update. The file registered in the master file list 22 means that it has been certified to operate in the information terminal device 10. For example, when a new executable file used as an application program is created and applied (installed) to the information terminal device 10, the master file list is not yet registered in the white list 21 in the information terminal device 10. 22, it is not an unknown file, but a server 50 has no virus and it is a legitimate file recognized as a component of the computer system to which the information terminal device 10 belongs. It can be shown that the file is certified to operate in the information terminal device 10.

  Basically, as described above, in a server client type computer system, the latest master file list original 52 that is common to the entire computer system on the server 50 to which each information terminal device 10 on the client side is connected. The state is managed, and as described above, the master file list original 52 is transmitted to each information terminal device 10 constituting the computer system as necessary, so that each information terminal device 10 is prepared. The registered contents of the master file list 22 are updated to the latest state.

  That is, each time an update file to be applied to each information terminal device 10 on the client side is generated on the server 50, a virus check on the update file is performed, and it is confirmed that the file is a file in which no virus is detected. Is registered in the master file list original 52. As a result, the master file list original 52 in the latest state is transmitted from the server 50 to each information terminal device 10 as necessary, and the registered contents of the master file list 22 provided in each information terminal device 10 are stored. Updated to the latest status. Therefore, the file registered in the master file list 22 of each information terminal device 10 is a legitimate file used on the computer system in the server client format, and is a safe file that has been virus-checked. I mean.

  In the case of a stand-alone computer system in which the server 50 does not exist, the master file list 22 and the virus pattern list 23 provided in each information terminal device 10 are transferred via an external medium (external storage) such as a USB memory. The registered contents of the master file list 22 and the virus pattern list 23 are updated by overwriting and the registered contents of the master file list 22 and the virus pattern list 23 are directly updated by using a command prepared in advance. By doing so, it is updated to the latest state.

  The virus pattern list 23 is equivalent to the pattern file used in the existing black list type security system, and transmits the latest virus pattern file from the virus pattern list original 53 of the server 50 as necessary. It is updated to the latest state by downloading, or it is updated to the latest state by directly downloading from the website of each manufacturer that provides an existing blacklist security system on the Internet or the like.

  The copy execution software 30 has a function of copying, overwriting, and moving, for example, a file 40 that is a general file, and is registered in advance in the white list 21 and given an update authority that allows file update operations. It is necessary.

(Description of operation of embodiment)
Next, an example of the operation of the security system shown in FIG. 1 as an embodiment of the present invention will be described with reference to the explanatory diagrams of FIGS. 2-1, 2-2, and 3 and the flowcharts of FIGS. This will be described in detail. FIG. 2-1 is an explanatory diagram showing an outline of operations at the time of file copying in the security system of FIG. 1, and FIG. 2-2 is an outline of operations at the time of file execution in the security system of FIG. It is explanatory drawing which shows. 3 is an explanatory diagram showing an example of a file copy confirmation screen for confirming to the user whether or not to copy a file that does not exist in the master file list 22 in the information terminal device 10 in the security system of FIG. is there. FIG. 4 is a flowchart showing an example of an operation when the file 40 is copied to a designated location in the information terminal device 10 by the copy execution software 30 of the information terminal device 10 in the security system of FIG. FIG. 5 is a flowchart showing an example of an operation when the file 40 existing in the information terminal device 10 is executed in the security system of FIG.

  First, an outline of the operation of the security system of FIG. 1 will be described using the explanatory diagram of FIG. The server 50 performs the virus check on the basis of the virus pattern list original 53 updated to the latest state whenever a newly introduced file or an update file to be copied to the information terminal device 10 on the client side is generated. If it is normal, it is additionally registered in the master file list original 52 in the server 50 and updated to the latest state. As described above, the master file list original 52 and virus pattern list original 53 updated to the latest state are transmitted to each information terminal device 10 as necessary, and the master file list 22 in each information terminal device 10 is transmitted. The virus pattern list 23 is updated to the latest state (sequence Seq1 in FIG. 2-1 and sequence Seq3 in FIG. 2-2).

  Further, the information terminal device 10 refers to the white list 21 and the master file list 22 as shown in FIG. 2A every time a situation occurs in which the file 40 to be executed in the device is copied. If it is registered in the master file list 22 and the copy execution software 30 has file copy authority (update authority), the copy execution software 30 performs a copy operation of the file 40 (FIG. 2). -1 sequence Seq2). Further, after the copy operation is performed, the registration operation to the white list 21 is also performed.

  Further, the information terminal device 10 refers to the white list 21 as shown in FIG. 2-2 every time a situation in which the file 40 is to be executed in the device occurs. If it is registered, the file 40 is executed (sequence Seq4 in FIG. 2-2).

  Next, the master file list 22 or the virus pattern list 23 is updated by executing the copy execution software 30 of the client-side information terminal device 10 constituting the server client type computer system, using the flowchart of FIG. An example of the operation will be described.

  In the flowchart of FIG. 4, first, it is confirmed whether or not the file 40 to be copied is the master file list 22 or the virus pattern list 23 (step C-1). If the file 40 is the master file list 22 or the virus pattern list 23 (Yes in Step C-1), it is confirmed whether the copy execution software 30 has update authority (Step C-7). If the user has update authority (Yes at Step C-7), the master file list 22 or the virus pattern list 23 in the information terminal device 10 is copied (Step C-5). In this case, since the copy target file 40 is the master file list 22 or the virus pattern list 23 (Yes in step C-11), the copy process of the file 40 is terminated. As a result, the master file list 22 or virus pattern list 23 in the information terminal device 10 is updated. On the other hand, when the copy execution software 30 does not have update authority (No in Step C-7), the copy operation of the file 40 is inhibited (Step C-8).

[Copy files]
Next, by executing the copy execution software 30 of the client-side information terminal device 10 constituting the server-client-type computer system using the flowchart of FIG. 4, the master file list 22 and the virus pattern list 23 are not obtained. An example of the operation when copying the file 40 from the outside to a specified location in the information terminal device 10 will be described.

  In the flowchart of FIG. 4, first, when the file 40 to be copied is not the master file list 22 or the virus pattern list 23 (No in Step C-1), the process proceeds to Step C-2, and the file 40 It is confirmed whether or not the information related to the information coincides with any information registered in the master file list 22 (step C-2). If information on the file 40 exists in the master file list 22 (Yes in step C-2), the server 50 has already been certified as the computer system, and the virus check result is normal. Since the file is guaranteed to exist, the process proceeds to step C-7 to execute the operation of copying the file 40 to the designated location, and the copy execution software 30 has update authority. (Step C-7), and if there is an update authority (Yes in Step C-7), the process proceeds to Step C-5 and the file 40 is copied (Step C). -5).

  Thereafter, in this case, since the file 40 to be copied is not the master file list 22 or the virus pattern list 23 (No in Step C-11), information related to the file 40 is newly registered in the white list 21 after the copy is completed. (Step C-6), the file 40 copy process is terminated. On the other hand, when the copy execution software 30 does not have update authority (No in Step C-7), the copy operation of the file 40 is inhibited (Step C-8).

  In step C-2, if the information about the file 40 does not exist in the master file list 22 (No in step C-2), the file that has not yet been certified as the computer system. In addition, since the virus check has not been performed, the virus check based on the virus pattern list 23 is performed (step C-3). If information that matches any of the information registered in the virus pattern list 23 exists in the file 40 (Yes in step C-3), the file 40 is a file infected with a virus. Therefore, the notification of virus detection is executed by screen display, log output, etc., and the copy operation of the file 40 is stopped (step C-9).

  On the other hand, when the information that matches any information registered in the virus pattern list 23 does not exist in the file 40 (No in Step C-3), the file 40 is the master file. Although it is not yet registered in the list 22, the virus check result is normal, so a file copy confirmation screen as shown in FIG. 3 is displayed on the screen and an instruction from the user is awaited (step C-4). In other words, on the file copy confirmation screen shown in FIG. 3, for example, a message “You are trying to copy a file that does not exist in the master file list. Do you want to copy?” Alternatively, the user is prompted to select one of the buttons “Cancel Copy”.

  When the user selects the “Cancel Copy” button (No in Step C-4), the copy operation of the file 40 is stopped (Step C-10). On the other hand, when the user selects the “execute copy” button (Yes in step C-4), it is confirmed whether or not the copy execution software 30 has update authority (step C-7), and update authority is determined. (Yes in Step C-7), the file 40 is copied (Step C-5). Thereafter, in this case, since the file 40 to be copied is not the master file list 22 or the virus pattern list 23 (No in Step C-11), information related to the file 40 is newly registered in the white list 21 after the copy is completed. (Step C-6).

  In the above operation example, if the information about the file 40 does not match any information registered in the master file list 22, a virus check based on the virus pattern list 23 is performed, and the virus is checked. When the check result is normal and the user selects the “execute copy” button, the copy operation of the file 40 is executed. However, information on the file 40 is the master file list 22. If the virus check result is normal, the copy operation of the file 40 may not be executed without making an inquiry to the user.

[Run file]
Next, an example of the operation when the file 40 existing in the information terminal device 10 as an execution file is executed in the information terminal device 10 will be described with reference to the flowchart of FIG.

  In the flowchart of FIG. 5, first, it is confirmed whether or not the information related to the file 40 to be executed matches any information registered in the white list 21 (step R-1).

  If information on the file 40 exists in the white list 21 (Yes in step R-1), the file 40 is executed because it is a file for which execution permission has been given. (Step R-4). On the other hand, when the information about the file 40 does not exist in the white list 21 (No in step R-1), the execution of the file 40 is suppressed because the file is not permitted to execute. However, at this time, if the virus check has not been performed, a virus check based on the virus pattern list 23 is performed (step R-2). If information that matches any of the information registered in the virus pattern list 23 exists in the file 40 (Yes in step R-2), the file 40 is a file infected with a virus. Therefore, the notification of virus detection is executed by screen display, log output, or the like (step R-5). Thereafter, in order to suppress the execution of the file 40, the process proceeds to step R-3.

  On the other hand, if no information that matches any information registered in the virus pattern list 23 exists in the file 40 (No in step R-2), the virus check result is normal. Therefore, there is no need to notify the user, and the process proceeds to step R-3 to suppress the execution of the file 40 (step R-3).

(Other embodiments of the present invention)
In the embodiment described above, as shown in the system configuration diagram of FIG. 1, the case where the server 50 exists as a server client type computer system has been described. However, the security system according to the present invention includes the information terminal device 10. In the case of a stand-alone computer system that does not include a server such as the server 50. FIG. 6 is an explanatory diagram showing an outline of the operation at the time of file copying in a configuration example different from FIG. 1 of the system configuration of the security system according to the present invention, and is a stand-alone computer system composed only of the information terminal device 10 2 shows an example of an operation at the time of file copy of the security system in FIG.

  The security system shown in FIG. 6 includes an external storage 60 that can be externally connected to the information terminal device 10 instead of the server 50 in the case of FIG. As the external storage 60, any storage device such as a USB memory, a CD-R, a DVD-R, or a hard disk device can be used. In the external storage 60, there are stored a master file list original 62 and a virus pattern list original 63 having the same registration contents as the master file list original 52 and virus pattern list original 53 in the server 50 in the case of FIG. .

  The information terminal device 10 externally connects the external storage 60, reads the master file list original 62 and virus pattern list original 63 in the external storage 60, and enters the master file list 22 and virus pattern list 23 in the information terminal device 10. By performing the overwrite copy operation, the registered contents of the master file list 22 and the virus pattern list 23 in the information terminal device 10 can be updated. Alternatively, the registered contents of the master file list 22 and the virus pattern list 23 may be manually updated directly using a command prepared in advance.

  As an example of operation in the security system shown in FIG. 1 and FIG. 6, the virus pattern list 23 is provided in the information terminal device 10 so that a virus check is performed when copying a file or when executing a file. Although the example has been described, the virus pattern list 23 may not be provided in the information terminal device 10, and the virus check and associated processing may not be performed when copying a file or executing a file.

(Explanation of effect of embodiment)
As described in detail above, the following effects are obtained in the embodiment of the present invention.

  In the case of a conventional whitelist security system, as described above, even if a virus is mixed, as long as it is not registered in the whitelist, it is not possible to prevent virus activity by suppressing execution. It can, but cannot detect the virus itself. Further, for a file that is not registered in the white list, the operation of the file is suppressed, and in order to cancel the suppression, it is necessary to manually register information regarding the file in the white list. Further, in the case of a security system such as Patent Document 1 that uses both a black list and a white list, the load during normal operation other than during the computer system update can be reduced. When a new file is installed or an old file is updated, the whitelist verification operation of the target device must be stopped and the blacklist must be transferred from the monitoring server, and the target device is set to the non-monitoring state. Occurs and there is a security problem.

  On the other hand, in the security system according to the embodiment of the present invention, it is possible to detect viruses using the virus pattern list 23 while maintaining the system protection using the white list 21 for the information terminal device 10 that is the target of the security system. .

  In addition, by using a master file list 22 in which files that have been approved for application as a computer system to which the information terminal device 10 belongs are registered in advance, a new file that is not registered in the white list 21 is automatically copied. In addition, it is possible to additionally register in the white list 21. As a result, it is not necessary to stop the collation operation of the white list 21, and it is possible to avoid interruption of operation / processing due to execution suppression, so that the security effect can be maintained as it is and The trouble of updating the list 21 can also be saved. Furthermore, the virus check by the virus pattern list 23 does not need to be always performed by the information terminal device 10 and can be performed only when necessary, so that the load on the information terminal device 10 and the computer system is reduced. It can also be reduced.

  The configuration of the preferred embodiment of the present invention has been described above. However, it should be noted that such embodiments are merely examples of the present invention and do not limit the present invention in any way. Those skilled in the art will readily understand that various modifications and changes can be made according to a specific application without departing from the gist of the present invention.

10 Information terminal device 20 Security software 21 White list 22 Master file list 23 Virus pattern list 30 Copy execution software 40 File 50 Server 52 Master file list original 53 Virus pattern list original 60 External storage 62 Master file list original 63 Virus pattern list original 90 Communication line 101 Control unit 102 Storage unit 501 Control unit 502 Storage unit

Claims (9)

In a security system that uses a white list type information terminal device that has a white list and suppresses execution of a file that is not registered in the white list,
The information terminal device has a master file list in which information related to files approved for application as a computer system to which the device belongs is registered in advance, and for files in which information related to files is registered in the master file list, Means for executing a copy of the file; means for registering information relating to the file in the white list after execution of the copy;
A security system characterized by comprising: The information terminal device has a virus pattern list, and for a file for which information related to the file is not registered in the master file list, means for performing a virus check based on the registered contents of the virus pattern list; If detected, means to suppress copying of the file, and if no virus is detected, the user is inquired whether to copy or cancel the file, and the user performs copying. When selecting to do, means for executing a copy of the file, and means for registering information about the file in the white list;
The security system according to claim 1, comprising: When the information terminal device tries to execute a file, if the information related to the file is registered in the white list, the information terminal device executes means for executing the file, and the information related to the file is included in the white list. If not registered, a means for performing a virus check on the file based on the registered contents of the virus pattern list, and if a virus is detected, a notification of virus detection is made and Means for inhibiting execution, means for inhibiting execution of the file if no virus is detected,
The security system according to claim 2 , further comprising: A server having a master file list original and a virus pattern list original is provided.
The server updates the master file list original to the latest state, means for updating the virus pattern list original to the latest state, and the master file list original updated to the information terminal device as necessary. Means for transmitting, and means for transmitting the updated virus pattern list original to the information terminal device as necessary;
Have
The information terminal device includes means for copying the received master file list original to the master file list, and means for copying the received virus pattern list original to the virus pattern list. Item 4. The security system according to item 2 or 3 . A security control method in a security system using a white list type information terminal device that has a white list and suppresses execution of a file that is not registered in the white list,
The information terminal device has a master file list in which information relating to files approved for application as a computer system to which the device belongs is registered in advance. Performing a copy of the file; registering information about the file in the whitelist after the copy is performed;
A security control method characterized by comprising: The information terminal device has a virus pattern list, and for a file for which information related to the file is not registered in the master file list, performing a virus check based on the registered contents of the virus pattern list; If detected, the step of inhibiting the copying of the file, and if no virus is detected, the user is inquired whether to copy or cancel the file, and the user performs the copying. When selecting to do, a step of copying the file, and a step of registering information on the file in the white list,
The security control method according to claim 5, further comprising: When the information terminal device intends to execute a file, if the information related to the file is registered in the white list, the information terminal device executes the file, and the information related to the file is included in the white list. If not registered, a step of performing a virus check on the file based on the registered content of the virus pattern list; if a virus is detected, a notification of virus detection is made and A step of inhibiting execution, and a step of inhibiting execution of the file if no virus is detected;
The security control method according to claim 6 , further comprising: A server having a master file list original and a virus pattern list original is provided.
The server updates the master file list original to the latest state, updates the virus pattern list original to the latest state, and updates the master file list original updated to the information terminal device as necessary. Transmitting the virus pattern list original updated to the information terminal device as necessary,
Have
The information terminal device copying the received master file list original to the master file list; copying the received virus pattern list original to the virus pattern list;
The security control method according to claim 6 or 7 , characterized by comprising:   9. A security control program, wherein the security control method according to claim 5 is implemented as a program executable by a computer.

Images