JP6634819B2 - Information processing system, control method thereof, and program - Google Patents

Description

  The present invention relates to an information processing system, a control method thereof, and a program, and more particularly to a technique for making it difficult for a processing capability of a virtual server to be reduced by virus inspection.

  Conventionally, in a server system used in a cloud computing system, each service is provided for each container.

  Then, anti-virus software is introduced for each virtual server in each container to take measures against viruses.

  Here, the virus test is generally performed at the following three timings and methods.

(1) Real-time scanning: When a file is accessed, it is checked whether the target file is infected with a virus (scan).

(2) On-demand scan: a user manually selects a file and inspects (scans) whether the file is infected with a virus.

(3) Periodic scan: At a preset date and time, all the files stored on the disk are inspected (scanned) for a file infected with a virus.

  Further, in Patent Document 1, the state of a virtual machine is periodically saved as a snapshot, and when antivirus software detects a virus by so-called (1) real-time scanning, the virtual machine that has detected the virus is stopped. It is disclosed that a snapshot of a stopped virtual machine is used to restore the state of the virtual machine when the snapshot was saved.

JP 2010-44613 A

  However, when a virtual server performs a periodic scan, it consumes resources allocated to the virtual server, and the processing capability of services provided by the virtual server is reduced. Furthermore, when a plurality of virtual servers perform a periodic scan at the same time, the processing capability of the services provided by those virtual servers is reduced.

  Therefore, an object of the present invention is to provide a mechanism for making it difficult for the processing capacity of a virtual server to be reduced by virus inspection.

  The present invention is an information processing system comprising: a first container having a virtual server that provides a service to a client terminal; and a second container having a virus inspection virtual server that performs virus inspection. The virus inspection virtual server of Container 2 includes virtual disk duplication instructing means for instructing to duplicate all files stored in the virtual disk provided in the virtual server, and virtual disk duplication by the virtual disk duplication instructing means. First virus checking means for performing a virus check on all files, and file operation instructing means for instructing the virtual server to perform a file operation on a file in which a virus has been detected by the first virus checking means Wherein the virtual server of the first container is stored on the virtual disk. A file operation unit that performs a file operation on the file for which a file operation is instructed by the file operation instruction unit, and performs a virus check on the file that has been subjected to the file operation by the file operation unit. A second virus checker that does not perform a virus check on a file for which no file operation has been performed.

  Further, the present invention relates to a control method in an information processing system including a first container having a virtual server for providing a service to a client terminal and a second container having a virus inspection virtual server for performing a virus inspection. A virtual disk replication instructing means of the virus inspection virtual server, wherein the virtual disk replication instructing means instructs to replicate all files stored in the virtual disk provided in the virtual server; (1) a first virus inspection step in which all the files on the virtual disk duplicated in the virtual disk duplication instruction step are virus-examined by the virus inspection means; (1) File the virus-detected file A file operation instructing step of instructing the virtual server to perform an operation, wherein a file operation instruction of the virtual server is instructed by the file operation instructing step stored in the virtual disk. A file operation step of performing a file operation on the file, and a second virus checker of the virtual server performs a virus check on the file operated by the file operation step, and the file operation is performed by the file operation step. A second virus check step of not performing a virus check on files that do not exist.

  Further, the present invention can be read and executed by an information processing system including a first container having a virtual server for providing a service to a client terminal and a second container having a virus inspection virtual server for performing a virus inspection. Virtual disk duplication instruction means for instructing the virus inspection virtual server of the second container to duplicate all files stored on a virtual disk provided in the virtual server; A first virus checker for performing a virus check on all files on the virtual disk copied by the means, and an instruction to perform a file operation on a file in which a virus is detected by the first virus checker; Function as file operation instructing means for the first container. A file operation unit that performs a file operation on a file stored in the virtual disk and for which a file operation is instructed by the file operation instructing unit; It is characterized in that a virus check is performed, and a file that has not been subjected to a file operation by the file operation means functions as a second virus check means that does not perform a virus check.

  ADVANTAGE OF THE INVENTION According to this invention, it can make it difficult to reduce the processing capacity of a virtual server by virus inspection.

1 is a diagram illustrating a configuration of an information processing system according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a hardware configuration of an information processing apparatus 100 and a client terminal 101 illustrated in FIG. 1. FIG. 2 is a diagram illustrating an example of a software and hardware configuration of the information processing apparatus 100 according to the present invention. FIG. 2 is a diagram illustrating an example of a software and hardware configuration of the information processing apparatus 100 according to the present invention. 5 is a flowchart illustrating an example of a control process of the information processing apparatus 100 according to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a diagram illustrating a configuration of an information processing system according to an embodiment of the present invention.

  The information processing system according to the embodiment of the present invention is a system in which an information processing apparatus 100 (server) and a client terminal 101 are communicably connected to each other via a network such as the Internet.

  The information processing apparatus 100 (server) has a function as a Web server, and has a function of providing a Web service to the client terminal 101 in response to various requests from the client terminal 101.

  The information processing apparatus 100 (server) includes various services (for example, service A and service B) for each container.

  Hereinafter, an example of a hardware configuration of the information processing apparatus 100 and the client terminal 101 illustrated in FIG. 1 will be described with reference to FIG.

  FIG. 2 is a diagram illustrating an example of a hardware configuration of the information processing apparatus 100 and the client terminal 101 illustrated in FIG.

  In FIG. 2, reference numeral 201 denotes a CPU, which comprehensively controls each device and controller connected to the system bus 204. Also, the ROM 203 or the external memory 211 is required to implement a function executed by each server or each PC, such as a basic input / output system (BIOS) or an operating system program (hereinafter, OS), which is a control program of the CPU 201. Various programs and tables shown in FIG. 7 are stored.

  Reference numeral 202 denotes a RAM, which functions as a main memory, a work area, and the like for the CPU 201. The CPU 201 implements various operations by loading programs and the like necessary for executing processing from the ROM 203 or the external memory 211 into the RAM 202 and executing the loaded programs.

  An input controller 205 controls input from the input device 209 or the like. A video controller 206 controls display on a display device 210 (display unit) such as a liquid crystal display. The display device is not limited to a liquid crystal display, but may be a CRT display or the like. These are used by the client as needed.

  A memory controller 207 is connected to a hard disk (HD) for storing a boot program, various applications, font data, user files, edit files, various data, and the like, a flexible disk (FD), or a PCMCIA card slot via an adapter. Access to an external memory 211 such as a compact flash (registered trademark) memory.

  A communication I / F controller 208 connects and communicates with an external device via a network (for example, the LAN 103 shown in FIG. 1), and executes communication control processing on the network. For example, communication using TCP / IP is possible.

  Note that the CPU 201 enables display on the display device 210 by executing, for example, an outline font development (rasterization) process on a display information area in the RAM 202. Further, the CPU 201 enables a user instruction with a mouse cursor or the like (not shown) on the display device 210.

  Various programs operating on the hardware are recorded in the external memory 211 and are executed by the CPU 201 by being loaded into the RAM 202 as needed.

  Next, the software and hardware configurations of the information processing apparatus 100 according to the present invention will be described with reference to FIGS.

  FIG. 3 is a diagram illustrating an example of a software and hardware configuration of the information processing apparatus 100 according to the present invention.

  3 indicate a series of flows from S602 to S611 in FIG. 5 described later.

FIG. 4 is a diagram illustrating an example of a software and hardware configuration of the information processing apparatus 100 according to the present invention.
Also, the dotted arrows in FIG. 4 indicate the flow of S618 and S619 in FIG. 5 described later.

  The information processing apparatus 100 includes a physical CPU 317 (corresponding to the CPU 201) and a physical disk 316 (corresponding to the external memory 211) as physical hardware 315.

  Further, the information processing apparatus 100 has installed therein virtual environment management software 314 which is software for constructing a virtual environment such as VM software, and functions as a virtual environment management server 311.

  The virtual environment management server 311 is an application example of the virtual environment management server for constructing a virtual server according to the present invention.

  Further, the virtual environment management server 311 is assigned a virtual CPU 3 (313) and a virtual disk 3 (312), and performs a process in which the assigned virtual CPU 3 (313) functions as the virtual environment management server 311. Execute.

  The virtual environment management software 314 causes the virtual server A (301), the virtual server B (306), and the periodic virus scan server 401 to function as virtual servers.

  A virtual server A (301) and a virtual server B (306) are application examples of a virtual server that provides a service to a client terminal. The virtual server A (301) and the virtual server B (306) operate in different containers (first containers).

  The periodic virus scan server 401 is an application example of a virus inspection virtual server that performs a virus inspection. The periodic virus scan server 401 operates in a second container different from the first container.

  Software for providing the service of the Web service A (302) is installed in the virtual server A.

  Further, a virtual disk 1 (304) and a virtual CPU 1 (305) are assigned to the virtual server A (301), and the assigned virtual CPU 1 (304) performs processing to function as the virtual server A. Then, the virtual server A can write and read data only to the virtual disk 1 (304).

  In addition, virus scan software 303 is installed in the virtual server A, and the virus scan software 303 can perform a virus inspection on each data in the virtual disk 1 (304).

  The virus scan software 303 has a real-time scan (real-time inspection) function. The Web service A and the remote software 407 access data and files stored in the virtual disk 1 ( Each time the operation is performed, a function of performing a virus inspection on the data, the file, and the like is provided.

  The remote software 407 is software having a function of accessing (operating) the data or file stored in the virtual disk 1 when receiving an operation instruction for data or a file from the virus scan software 402. is there.

  The virtual disk 1-A (406) (difference disk) is a virtual disk generated by creating a snapshot. When a snapshot has been created, data cannot be written to virtual disk 1 (304), but only data can be read, and data is written to virtual disk 1-A (406). Only the difference data from the virtual disk 1 is written to the (difference disk).

  Therefore, the Web service A reads data (file) from the virtual disk 1 and the virtual disk 1-A when the snapshot is created, and reads the data (file) from the virtual disk 1 and the virtual disk 1-A when writing the data (file). Write only to.

  Software for providing the service of the Web service B (307) is installed in the virtual server B (306).

  Further, a virtual disk 2 (309) and a virtual CPU 2 (310) are allocated to the virtual server B, and the allocated virtual CPU 2 (310) executes a process functioning as the virtual server B, The virtual server B can write and read data only on the virtual disk 2 (309).

  In addition, virus scan software 308 is installed in the virtual server B, and the virus scan software 308 can perform a virus inspection on each data in the virtual disk 2 (309).

  The virus scan software 308 has a real-time scan (real-time inspection) function, and the Web service A and the remote software 408 access data and files stored in the virtual disk 2 ( Each time the operation is performed, a function of performing a virus inspection on the data, the file, and the like is provided.

  The remote software 408 is software having a function of accessing (operating) the data or file stored in the virtual disk 2 when receiving an operation instruction of data or a file from the virus scan software 402. is there.

  A virtual disk 4 (403) and a virtual CPU 4 (404) are allocated to the periodic virus scan server 401, and the allocated virtual CPU 4 (404) executes a process that functions as the periodic virus scan server 401. The periodic virus scan server 401 can write and read data on the virtual disk 4 (403).

  Further, as described above, the virus scan software 402 can perform a virus inspection on the copy of the virtual disk 1 created when the snapshot is created.

Each virtual disk shown in FIG. 3 is a virtual disk to which each storage area of the physical disk 316 is allocated, and each virtual CPU shown in FIG.
Next, control processing of the information processing apparatus 100 of the present invention will be described with reference to FIG.
FIG. 5 is a flowchart illustrating an example of a control process of the information processing apparatus 100 according to the present invention.

  The processing of steps S601 to S608 illustrated in FIG. 5 is executed by the virtual CPU 4 (404) of the periodic virus scan server 401 according to the virus scan software 402 of the periodic virus scan server 401 of the information processing device 100.

  The processes of steps S609 and S610 shown in FIG. 5 are executed by the virtual CPU 1 (305) of the virtual server A according to the remote software 407 of the virtual server A (301) of the information processing device 100.

  The processing of steps S611 to S613 shown in FIG. 5 is executed by the virtual CPU 1 (305) of the virtual server A according to the virus scan software 303 of the virtual server A (301) of the information processing device 100.

  The processing of steps S614 to S619 shown in FIG. 5 is executed by the virtual CPU 3 (313) of the virtual environment management server 311 according to the virtual environment management software 314 of the information processing device 100.

  First, the virus scan software 402 determines whether the current time (time) has reached the timing (preset time) for performing periodic virus inspection of the virtual disk 1 (S601), and the current time (time). However, if it is determined that it is time to perform the periodic virus inspection of the virtual disk 1 (a preset time) (YES), the process proceeds to step S602.

  The virus scan software 402 transmits a snapshot creation instruction to the virtual environment management software 314 in step S602. ((1) Snapshot creation instruction in FIG. 3)

  S602 is an application example of the virtual disk copy instructing means of the present invention, and instructs to copy all the files stored in the virtual disk provided in the virtual server.

  Then, upon receiving the snapshot creation instruction from the virus scan software 402 (S614), the virtual environment management software 314 copies (duplicates) the virtual disk 1 (304) and copies (duplicates) the virtual disk 1. (405) is created (generated) (S615). The copy (copy) (405) of the virtual disk 1 created here is set by the virtual environment management software 314 so that the virus scan software 402 can access it. ((2) Creation of copy of virtual disk 1 in FIG. 3)

  S615 is an application example of the duplication unit of the present invention, and duplicates all files stored on the virtual disk provided in the virtual server according to the instruction from the virtual disk duplication instruction unit.

  Then, the virtual environment management software 314 creates (generates) the virtual disk 1-A (differential disk) 406 (S616), and notifies the virus scan software that the copying of the virtual disk and the creation of the differential disk are completed. The information is transmitted (notified) to 402 (S617).

  The virtual disk 1-A (difference disk) 406 is set by the virtual environment management software 314 so that the virtual server A can perform read / write access.

  Then, when the virus scan software 402 receives from the virtual environment management software 314 that the copying of the virtual disk and the creation of the difference disk have been completed (S603), the virus scanning software 402 responds to the copy of the virtual disk 1 (405). Periodic virus inspection processing is performed (S604). ((3) Virus test in Fig. 3)

  S604 is an application example of the first virus checking means of the present invention, and performs a virus check on all files of the virtual disk copied by the virtual disk copying instructing means.

  After the difference disk is generated in S616, the Web service 302 writes the data to be written to the virtual disk 1 by operating the Web service 302 on the difference disk (406). ((4) Data update in FIG. 3)

  Then, the virus scan software 402 determines whether or not a virus has been detected in the periodic virus inspection processing in S604 (S605). If it is determined that a virus has been detected (S605: YES), An instruction to open the file in which the virus has been detected is transmitted to the remote software 407 (S606). At this time, the virus scan software 402 transmits the file path of the file in which the virus was detected to the remote software 407. ((5) Operation instruction in FIG. 3)

  S606 is an application example of the file operation instructing means of the present invention, and instructs the virtual server to perform a file operation on a file in which a virus has been detected by the first virus checking means.

  Then, the remote software 407 issues an instruction from the virus scan software 402 to open a file in which a virus is detected (a file stored in the virtual disk 1 (304)) and a file in which the virus is detected (virtual disk 1 ( When the file path of the file stored in (304) is received (S609), the file in which the virus is detected (the file specified based on the file path) (the file stored in virtual disk 1 (304)) is received. Then, a file open operation (operation on the file) is performed (S610). ((6) File operation in FIG. 3)

  Step S610 is an application example of the file operation unit of the present invention, and performs a file operation on a file stored in a virtual disk and instructed by the file operation instruction unit.

  Then, the virus scan software 303 monitors the accessed file in the virtual disk 1, and when the file is accessed, performs a virus inspection on the file in real time. .

  Therefore, the virus scan software 303 performs a real-time virus inspection on the file (the file stored in the virtual disk 1 (304)) to detect a virus (S611). ((7) Real-time inspection in FIG. 3)

  Step S611 is an application example of the second virus checking unit of the present invention, in which a file that has been subjected to a file operation by the file operation unit is subjected to a virus check, and a file that has not been subjected to a file operation by the file operation unit is subjected to a virus check. Perform no processing.

  Then, the virus scan software 303 quarantines the file in which the virus is detected, or removes the detected virus (S612), and instructs the virus scan software 402 of the file in which the virus is detected. A message indicating that the quarantine or the detected virus has been eliminated is transmitted (S613).

  S612 is an application example of the disinfecting means of the present invention, in which the second virus inspecting means removes a virus detected by the virus inspection on the file operated by the file operating means or isolates the file. Do.

  Upon receiving, from the virus scan software 303, the quarantine of the file where the virus was detected or the removal of the detected virus (S607), the virus scan software 402 copies the virtual disk 1 (405), and An instruction to delete the virtual disk 1-A (differential disk) (406) is transmitted to the virtual environment management software 314 (S608).

  When the virtual environment management software 314 receives an instruction to delete the virtual disk 1 (405) and delete the virtual disk 1-A (differential disk) (406) from the virus scan software 402 (S618), the virtual disk 1 The copy (405) of the virtual disk 1 is deleted ((1) deletion of the copy of the virtual disk 1 in FIG. 4), and the differential data of the virtual disk 1-A (differential disk) (406) is updated to the virtual disk 1 (304). Then, the virtual disk 1-A (difference disk) (406) is deleted (S619) ((2) reflection / deletion of the difference disk in FIG. 4).

  As described above, according to the present invention, it is possible to prevent the processing capability of the virtual server from being reduced by virus inspection.

  Further, an object of the present invention is to provide a storage medium storing a program code of software for realizing the functions of the above-described embodiments to a system or an apparatus, and a computer (or CPU or MPU) of the system or apparatus to store the storage medium. It is needless to say that the present invention is also achieved by reading and executing the program code stored in the medium.

  In this case, the program code itself read from the storage medium realizes the function of the above-described embodiment, and the program code itself and the storage medium storing the program code constitute the present invention.

  As a storage medium for supplying the program code, for example, a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile card, a ROM, and the like can be used.

  When the computer executes the readout program code, not only the functions of the above-described embodiments are realized, but also the OS (basic system or operating system) running on the computer based on the instruction of the program code. ) May perform some or all of the actual processing, and the processing may realize the functions of the above-described embodiments. An information processing device (computer) that can read and execute the program code realizes the functions of the above-described embodiment.

  Further, after the program code read from the storage medium is written into a memory provided on a function expansion board inserted into the computer or a function expansion unit connected to the computer, the function is executed based on the instruction of the program code. It goes without saying that a CPU or the like provided in an expansion board or a function expansion unit performs part or all of actual processing, and the processing realizes the functions of the above-described embodiments.

Reference Signs List 100 information processing device 101 client terminal

Claims (5)

An information processing system comprising: a first container including a virtual server that provides a service to a client terminal; and a second container including a virus inspection virtual server that performs virus inspection,
The virus inspection virtual server of the second container,
Virtual disk copy instructing means for giving an instruction to copy all files stored on the virtual disk provided in the virtual server,
First virus checking means for performing a virus check on all files on the virtual disk copied by the virtual disk copying instructing means;
File operation instructing means for instructing the virtual server to perform a file operation on a file in which a virus has been detected by the first virus inspection means;
With
The virtual server of the first container,
File operation means for performing a file operation on a file stored in the virtual disk and for which a file operation has been instructed by the file operation instructing means;
A second virus inspection unit that performs a virus inspection on a file that has been subjected to a file operation by the file operation unit and does not perform a virus inspection on a file that has not been subjected to a file operation by the file operation unit;
An information processing system comprising: The virtual server is
2. The apparatus according to claim 1, further comprising: a disinfecting unit that disinfects a virus detected by the second virus inspection unit on a file that has been subjected to a file operation by the file operation unit and that detects the virus, or isolates the file. The information processing system as described. The information processing system further includes a virtual environment management server for constructing a virtual server,
The virtual environment management server,
The information processing system according to claim 1, further comprising a duplication unit that duplicates all files stored on the virtual disk provided in the virtual server in accordance with an instruction from the virtual disk duplication instruction unit. A control method in an information processing system including: a first container including a virtual server that provides a service to a client terminal; and a second container including a virus inspection virtual server that performs virus inspection,
A virtual disk copy instructing means of the virus inspection virtual server, wherein a virtual disk copy instructing step of instructing to copy all files stored in the virtual disk provided in the virtual server;
A first virus inspection step in which the first virus inspection means of the virus inspection virtual server performs a virus inspection on all files of the virtual disk duplicated by the virtual disk duplication instruction step;
A file operation instructing unit of the virus inspection virtual server, wherein the file operation instructing unit instructs the virtual server to perform a file operation on a file in which a virus is detected in the first virus inspection step;
With
A file operation step of performing a file operation on a file whose file operation is instructed by the file operation instructing step, wherein the file operation means of the virtual server is stored in the virtual disk;
A second virus checker of the virtual server that performs a virus check on the file that has been subjected to the file operation in the file operation step, and does not perform a virus check on the file that has not been subjected to the file operation in the file operation step; Inspection process,
A control method comprising: A program readable and executable by an information processing system including a first container including a virtual server that provides a service to a client terminal and a second container including a virus inspection virtual server that performs virus inspection,
A virus inspection virtual server of the second container,
Virtual disk copy instructing means for giving an instruction to copy all files stored on the virtual disk provided in the virtual server,
First virus checking means for performing a virus check on all files on the virtual disk copied by the virtual disk copying instructing means;
An instruction to perform a file operation on a file in which a virus has been detected by the first virus inspection means functions as a file operation instruction means to issue to the virtual server;
The virtual server of the first container,
File operation means for performing a file operation on a file stored in the virtual disk and for which a file operation has been instructed by the file operation instructing means;
A program for performing a virus check on a file for which a file operation has been performed by the file operation means, and functioning as a second virus check means for not performing a virus check on a file for which a file operation has not been performed by the file operation means. .

Images