JP7119480B2 - Application execution authority management device, method and program - Google Patents

Description

The present invention relates to an application execution authority management device, an application execution authority management method, and an application execution authority management program for managing application execution authority.

There is no end to security incidents in which confidential information is stolen, leaked, or destroyed by viruses (targeted attacks, ransomware, etc.). In the "Top 10 Information Security Threats 2016" announced by the Information-technology Promotion Agency, "No.2: Information leaks due to targeted attacks" and "No.3: Fraud and extortion using ransomware" were selected. Obvious.

Even if a virus invades a computer, it is possible to prevent the occurrence of damage by restricting the operation of the virus. However, in reality, the virus executes its processing without being restricted. The reason for this is that the authority of the processing that an application such as a virus tries to execute is not managed, and the processing (file access, network access, etc.) unintended by the user is performed. For this reason, it is necessary to manage application executable rights so that applications running on a computer can only perform processes intended by users.

One method of managing application execution authority is to manage it at the OS (Operating System) level. Specifically, the application developer is forced to declare usage rights in advance. By notifying the user when the application actually requests the authority, the user selects permission or prohibition.

In addition, as a method of managing application execution authority, a method of controlling authority of an application alone is known. For example, Patent Literature 1 describes a method for stably managing application operations in a system. The method described in Patent Document 1 hooks an API (Application Programming Interface) function required when an application is started, and outputs the contents of the call stack for that API function. Then, the contents of the output call stack are retrieved and confirmed in a stack database that stores the contents of the call stacks of various API functions.

Japanese Unexamined Patent Application Publication No. 2002-200001 describes a method of restricting resource operations for users who do not have access privileges. The method described in Patent Document 2 captures an operation request from a process or OS to a computer resource before accessing the computer resource, and determines whether or not there is access authority to the computer resource specified by the captured operation request. judge.

Japanese Patent Publication No. 2010-509654 JP-A-2003-044297

However, the method of managing at the OS level has a problem that it cannot be realized with an OS that does not take any countermeasures. On the other hand, when the execution authority is controlled by the application alone, the above-mentioned problem with the OS does not occur. However, when the execution authority is controlled for each application alone, there is a problem that it is not possible to appropriately control operations performed by a plurality of applications in cooperation.

The above problem will be described below using a specific example. FIG. 9 is an explanatory diagram showing an example in which two applications operate in cooperation. For example, it is assumed that application AP-A1 illustrated in FIG. 9 performs file access, and application AP-B1 performs network access. In this case, the user can only determine that "application AP-A1 is an application for file access" and "application AP-B1 is an application for network access". Therefore, the user may determine that only file access is permitted and that only network access is permitted, and grant authority to applications AP-A1 and AP-B1.

However, assume that the application AP-A1 is an application that performs unauthorized processing. At this time, if both applications are authorized, there is a possibility that the data illegally obtained by the application AP-A1 will be sent to the outside in cooperation with the application AP-B1. .

FIG. 10 is an explanatory diagram showing an example in which a plurality of applications operate in cooperation. In the example shown in FIG. 10, application AP-A2 and application AP-B2 each perform file access, and application AP-C performs network access. It is assumed that both the application AP-A2 and the application AP-B2 are linked with the application AP-C. It is also assumed that the application AP-A2 is an application that performs correct processing, and the application AP-B2 is an application that performs illegal processing.

Also in the example shown in FIG. 10, it is assumed that authority management is performed for each application. If an attempt is made to prohibit network access by application AP-C in an attempt to control the network from an unknown application, processing from application AP-A2 that performs correct processing cannot be executed. On the other hand, if the setting is made to permit network access by the application AP-C, processing from the application AP-B2, which performs unauthorized processing, is permitted.

SUMMARY OF THE INVENTION Accordingly, it is an object of the present invention to provide an application execution authority management device, an application execution authority management method, and an application execution authority management program that enable a user to appropriately manage the execution authority of a linked application.

An application execution authority management device according to the present invention detects an API used by a started application, and analyzes application authority, which is the authority required by the application alone in order to execute the detected API. a cooperative application detection unit that detects a cooperative application that is an application that cooperates with the started application based on the detected API; and an authority obtained by adding the application authority of the cooperative application to the application authority of the started application. as the execution authority for the activated application, and a notification section for notifying the user of the determined execution authority.

The application execution authority management method according to the present invention detects an API used by a started application, analyzes the application authority that is the authority required by the application alone in order to execute the detected API, and executes the detected API. Based on the API, detect a cooperative application that is an application that cooperates with the launched application, and add the application authority of the launched application to the application authority of the cooperative application, and set the execution authority of the launched application. and notifying the user of the determined execution authority.

An application execution authority management program according to the present invention detects an API used by a started application in a computer, and analyzes the application authority, which is the authority required by the application alone in order to execute the detected API . Application authorization analysis processing, cooperative application detection processing for detecting a cooperative application that is an application that cooperates with the launched application based on the detected API, adding the application authorization of the cooperative application to the application authorization of the launched application It is characterized by executing an execution authority determination process of determining the authority as the execution authority of the activated application, and a notification process of notifying the user of the determined execution authority.

ADVANTAGE OF THE INVENTION According to this invention, a user can manage the execution authority of the application to cooperate appropriately.

1 is a block diagram showing a configuration example of an embodiment of an application execution authority management device according to the present invention; FIG. FIG. 4 is an explanatory diagram showing an operation example of an application execution authority management device; FIG. 4 is an explanatory diagram showing an example of an application management table; FIG. 10 is an explanatory diagram showing an example of a linked application management table; FIG. 4 is an explanatory diagram showing an example of an execution authority management table; 5 is a flow chart showing an operation example of an application execution authority management device; 5 is a flow chart showing an operation example of an application execution authority management device; 1 is a block diagram showing an overview of an application execution authority management device according to the present invention; FIG. FIG. 4 is an explanatory diagram showing an example of a case where applications operate in cooperation; FIG. 4 is an explanatory diagram showing an example of a case where a plurality of applications operate in cooperation;

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described with reference to the drawings. The present invention proposes a method of correctly managing authority not only for a single application but also for cooperating applications and notifying the user. In order to implement this method, a mechanism for managing the execution authority of individual applications and a mechanism for detecting cooperating applications are combined. That is, the authority to execute the application alone and the authority to execute the linked application are collectively managed as the authority to execute the application.

In the following description, the notation will be used separately to distinguish between the "execution authority for a single application" and the "authority combining the execution authority for a single application and the execution authority for a cooperating application". Specifically, the "execution authority for a single application" is referred to as "application authority", and the "authority combining the execution authority for a single application and the execution authority for a cooperating application" is referred to as "application execution authority".

FIG. 1 is a block diagram showing a configuration example of an embodiment of an application execution authority management device according to the present invention. The application execution authority management device 100 of this embodiment includes a simple application analysis unit 1, a simple analysis result storage unit 2, an application analysis unit 3, an application information acquisition unit 4, and an analysis/acquisition result storage unit 5. It includes an application detection unit 6 , a cooperative application storage unit 7 , an application authority determination unit 8 , an execution authority notification unit 9 , an execution authority storage unit 10 , an execution authority control unit 11 and a storage unit 12 .

The application execution authority management device 100 operates by intervening in the processing between the OS and the application through API hooks. In the application execution authority management device 100 of this embodiment, the processing of the simple application analysis unit 1 is started with the activation of the application as a trigger. In addition, the processing of the application analysis unit 3 is started with the call of each API from the application as a trigger.

FIG. 2 is an explanatory diagram showing an operation example of the application execution authority management device 100 of this embodiment. As illustrated in FIG. 2, application AP-A and application AP-B cooperate to execute processing.

As described above, in this embodiment, the application execution authority management device 100 intervenes between the OS and the application to analyze the APIs used by the application. From the analysis results, the application permissions (file access, network access, etc.) of the application are confirmed. Further, the application execution authority management device 100 detects the application AP-B that cooperates with the application AP-A, and determines that the "app authority of the application AP-A alone" and the "application authority of the application AP-B that cooperates with the application AP-A" are determined. authority", and the combined authority is stored as "execution authority of application AP-A" (step S101 in FIG. 2).

After that, the application execution authority management device 100 notifies the user of the execution authority of the generated application AP-A, and accepts the user's selection of permission or prohibition. If there is a change in execution authority, the application execution authority management device 100 notifies the user again. If the user selects "permit", the application execution authority management device 100 continues the process, and if the user selects "prohibit", does not execute the process (step S102 in FIG. 2).

The operation of each component included in the application execution authority management device 100 will be described below.

The storage unit 12 stores various information necessary for the application execution authority management device 100 to perform processing. The contents stored in the storage unit 12 will be described later. The storage unit 12 is implemented by, for example, a magnetic disk or the like.

The simple application analysis unit 1 determines application authority required by the application. Specifically, when the simple application analysis unit 1 detects the activation of an application, it creates a list of APIs to be loaded by the application. Then, the simple application analysis unit 1 determines the application authority required by the started application from the created list of APIs based on a predetermined rule.

As a predetermined rule, for example, there is a rule that "if the socket API is used, the application has authority for network communication". However, the content of the determined rule is not limited to this content. Authorities defined by the execution environment (OS, for example) may be associated with the contents of the API.

The simple analysis result storage unit 2 stores the application authority determined by the simple application analysis unit 1 in the application management table of the storage unit 12 in association with the application.

The application analysis unit 3 determines application authority required by the application. Specifically, the application analysis unit 3 determines the application authority required by the application from the executed API based on a predetermined rule.

As a predetermined rule, for example, there is a rule that "when performing READ access with the CreateFile API, the application has authority to read the file". However, the content of the determined rule is not limited to this content. Authorities defined by the execution environment (OS, for example) may be associated with the contents of the API.

Furthermore, the application analysis unit 3 determines whether the executed API is an API for manipulating a shared memory or a NamedPipe. If the executed API is an API that operates a shared memory or a NamedPipe, further processing by the application information acquisition unit 4 is performed.

APIs for operating shared memory include, for example, “CreateFileMapping API”. APIs for operating NamedPipe include, for example, “CreateNamedPipe API” and “CreateFile API”.

The application information acquisition unit 4 acquires information about the name and direction (that is, read or write) of the shared memory or NamedPipe from the executed API. The application information acquisition unit 4 may, for example, acquire the name and direction of the NamedPipe from the information of the API called by the application (API name, argument values, etc.).

The analysis/acquisition result storage unit 5 registers the application authority determined by the application analysis unit 3 in the application management table. Further, the analysis/acquisition result storage unit 5 associates the information acquired by the application information acquisition unit 4 with the application authority determined by the application analysis unit 3 and registers them in the application management table.

FIG. 3 is an explanatory diagram showing an example of an application management table. In the example shown in FIG. 3, the application name and application authority of the started application, the shared memory used by the application and its direction, and the NamedPipe name and its direction are associated and stored in the application management table. show.

The cooperative application detection unit 6 detects an application that cooperates with the activated application (hereinafter referred to as a cooperative application) based on predetermined rules based on the information in the application management table and the executed API. Specifically, the cooperative application detection unit 6 detects at least one of an application that exists in the same folder as the started application, an application that is called by the started application, and an application that communicates with the started application. detected as a federated application. In the following description, communication between applications is referred to as interprocess communication. Note that the following rule is exemplified as the predetermined rule.

An example of the first rule is "whether applications are stored in the same folder". For this rule, the cooperative application detection unit 6 may acquire the execution folder of the application, enumerate all the exe files under the same folder, and detect it as a cooperative application.

An example of the second rule is "whether another process is started from the process". For this rule, the cooperative application detection unit 6 may list corresponding exe files from the CreateProcess API and detect them as cooperative applications.

An example of a third rule is "whether there is interprocess communication for window messages". For this rule, the cooperative application detection unit 6 may list exe files having the corresponding window handle from the SendMessage API and detect them as cooperative applications.

An example of the fourth rule is "whether or not inter-process communication is being performed regarding shared memory". For this rule, the cooperative application detection unit 6 may list exe files that use the matching shared memory name from the application management table and detect them as cooperative applications. In this case, considering the usage direction of the shared memory, the cooperative application detection unit 6 may determine that the application is the cooperative source application if it is writing, and that it is the cooperative destination application if it is only reading. .

An example of the fifth rule is "whether or not inter-process communication is performed on named pipes". For this rule, the cooperative application detection unit 6 may list exe files that use the matching NamedPipe name from the application management table and detect them as cooperative applications. In this case, considering the usage direction of the NamedPipe, the linked application detection unit 6 may determine that the application is the source application when writing, and the destination application when reading only.

An example of the sixth rule is "whether inter-process communication is being performed with respect to COM (Component Object Model)". For this rule, the cooperative application detection unit 6 may list exe files having the corresponding CLSID from the CoCreateInstance API and detect them as cooperative applications.

In addition, the above rule is an example, and is not limited to these contents. Other rules regarding application communication, invocation, and storage locations may be determined.

The linked application storage unit 7 registers the linked application detected by the linked application detection unit 6 in the linked application management table of the storage unit 12 . FIG. 4 is an explanatory diagram showing an example of a cooperative application management table. The linked application management table illustrated in FIG. 4 indicates that the linked application and the linked destination application are stored in association with each other.

The application authority determination unit 8 acquires the cooperative application from the data stored in the cooperative application management table, and acquires the application authority of each application from the application management table. Then, the application authority determination unit 8 determines the execution authority of the activated application based on the application authority of the activated application and the application authority of the cooperative application. Specifically, the application authority determination unit 8 determines the authority obtained by adding the application authority of the cooperative application to the application authority originally possessed by the activated application as the execution authority of the activated application.

The execution authority notifying section 9 notifies the user of the execution authority determined by the application authority determining section 8, and receives a response regarding permission or prohibition of the execution authority. Specifically, the execution authority notification unit 9 sets the authority determined by the application authority determination unit 8 as the execution authority required by the application, and notifies the user of the "application information" and the "execution authority". Then, the execution authority notifying section 9 obtains an answer about the permission or prohibition of the execution authority from the user. The information of the application to be notified is, for example, the contents of the cooperation source application and the cooperation destination application.

For example, it is assumed that the name of the cooperation source application is "AP1.exe" and that this application itself has application authority for file access. On the other hand, it is assumed that the cooperation destination application (AP2) has application authority for network access and is the cooperation application of AP1. In this case, the execution authority notification unit 9 may notify the user of the execution authority for AP1 alone and the execution authority in combination with the cooperative application AP2, and may receive a response regarding permission or prohibition of the execution authority.

The execution authority storage unit 10 registers the response about permission or prohibition of the execution authority acquired from the user in the execution authority management table of the storage unit 12 . FIG. 5 is an explanatory diagram showing an example of an execution authority management table. The execution authority management table exemplified in FIG. 5 indicates that execution authority for AP1 alone is permitted, and execution authority for combination with cooperative application AP2 is prohibited.

Note that the execution authority notification unit 9 does not have to refer to the execution authority management table and notify the user again of the execution authority for which permission or prohibition has already been notified. Specifically, the execution authority notification unit 9 may combine the information of the cooperation destination application and determine whether or not the execution authority has already been notified.

The execution authority control unit 11 controls whether to execute or stop API processing based on the information in the execution authority management table. For example, when the processing of the activated application is prohibited, the execution authority control unit 11 may prohibit execution by returning an error without executing the original API inside the hooked API. Further, when the processing of the cooperative process (cooperative application) is prohibited, the execution authority control unit 11 may prohibit activation of the cooperative process or inter-process communication. In this case as well, the execution authority control unit 11 may perform API hooking in the same manner as described above, or hook the API of the cooperation destination process to perform control.

Simple application analysis unit 1, simple analysis result storage unit 2, application analysis unit 3, application information acquisition unit 4, analysis/acquisition result storage unit 5, cooperative application detection unit 6, and cooperative application storage unit 7 , the application authority determination unit 8, the execution authority notification unit 9, the execution authority storage unit 10, and the execution authority control unit 11 are implemented by a CPU of a computer that operates according to a program (application execution authority management program).

For example, the program is stored in the storage unit 12 of the application execution authority management device 100, the CPU reads the program, and according to the program, the simple application analysis unit 1, the simple analysis result storage unit 2, the application analysis unit 3, and the application information It operates as an acquisition unit 4, an analysis/acquisition result storage unit 5, a cooperative application detection unit 6, a cooperative application storage unit 7, an application authority determination unit 8, an execution authority notification unit 9, an execution authority storage unit 10, and an execution authority control unit 11. may

In addition, simple application analysis unit 1, simple analysis result storage unit 2, application analysis unit 3, application information acquisition unit 4, analysis/acquisition result storage unit 5, cooperative application detection unit 6, and cooperative application storage unit 7, the application authority determination unit 8, the execution authority notification unit 9, the execution authority storage unit 10, and the execution authority control unit 11 may each be realized by dedicated hardware.

Next, the operation of the application execution authority management device 100 of this embodiment will be described. 6 and 7 are flowcharts showing an operation example of the application execution authority management device 100 of this embodiment.

The application execution authority management device 100 starts the processing illustrated in FIG. 6 with activation of the application as a trigger. Further, the application execution authority management device 100 starts the processing illustrated in FIG. 7 triggered by each API being called from the application.

The simple application analysis unit 1 acquires the application authority of the single application (step S1 in FIG. 6). Specifically, the simple application analysis unit 1 creates a list of APIs loaded by the application, and determines the application authority required by the application based on predetermined rules.

The simple analysis result storage unit 2 stores the application authority of the application itself (step S2). Specifically, the simple analysis result storage unit 2 stores the determined application authority information in the application management table, and ends the process. After the application is started, the processing illustrated in FIG. 7 is started with the execution of each API hooked as a trigger.

The application analysis unit 3 acquires the application authority of the single application (step S3). Specifically, the application analysis unit 3 uses information (API name and argument values) of the API called by the application, and determines the application authority required by the application based on predetermined rules.

The application analysis unit 3 also determines whether or not the executed API is an API for manipulating a shared memory or a NamedPipe (step Sp1). If the executed API is an API that operates a shared memory or a NamedPipe (Yes in step Sp1), the application information acquisition unit 4 acquires application information (step S4). Specifically, the application information acquisition unit 4 uses information (API name and argument values) of the API called by the application to acquire information about the name and direction (read/write) of the shared memory and NamedPipe. On the other hand, if the executed API does not operate the shared memory or the NamedPipe (No in step Sp1), the process proceeds to step S5.

The analysis/acquisition result storage unit 5 stores the application authority and information for each application (step S5). Specifically, the analysis/acquisition result storage unit 5 stores the determined application authority and information in the application management table.

The cooperative application detection unit 6 detects the cooperative application (step S6). Specifically, the cooperative application detection unit 6 detects a cooperative application based on a predetermined rule based on the information in the application management table and the information on the executed API (API name and argument values).

The cooperative application storage unit 7 stores the information of the cooperative application (step S7). Specifically, the cooperative application storage unit 7 stores information on the detected cooperative application in the cooperative application management table.

The application authority determination unit 8 determines the execution authority of the application (step S8). Specifically, the application authority determination unit 8 acquires the application authority of the single application as the first application authority from the data stored in the application management table. Further, the application authority determining unit 8 acquires the cooperative application from the data stored in the cooperative application management table, and acquires the application authority of each cooperative application from the application management table as the second application authority. Then, the application authority determination unit 8 determines application execution authority from the first application authority and the second application authority.

The execution authority notification unit 9 determines whether or not there is an unconfirmed authority (step Sp2). Specifically, the execution authority notification unit 9 acquires the permission status of the application execution authority from the execution authority management table, compares the acquired data with the application execution authority determined in step S8, and notifies the user. It is determined whether or not there is an execution authority that does not exist. If there is an unconfirmed authority (Yes in step Sp2), the execution authority notification unit 9 displays a confirmation screen (step S9) and accepts the user's answer. On the other hand, if there is no unconfirmed authority (No in step Sp2), the process proceeds to step S11.

The execution authority saving unit 10 saves the confirmation result (step S10). Specifically, the execution authority storage unit 10 stores the result of permission or prohibition selected by the user in the execution authority management table.

The execution authority control unit 11 controls the operation of the application (step S11). Specifically, the execution authority control unit 11 acquires the permission status of the application execution authority from the execution authority management table. Then, based on the acquired data, the execution authority control unit 11 continues the execution of the application process if it is permitted, and makes the application process an error if it is prohibited.

As described above, in this embodiment, the application analysis unit 3 detects the API used by the activated application and analyzes the application authority of the application. Further, the cooperative application detection unit 6 detects the cooperative application of the activated application based on the detected API. Then, the application authority determination unit 8 determines the execution authority of the activated application based on the application authority of the activated application and the application authority of the cooperative application, and the execution authority notification unit 9 determines the determined execution authority. to the user. Therefore, the user can appropriately manage the execution authority of the cooperating application.

In other words, by using the application execution authority management device 100 of the present embodiment, it is possible to accurately grasp and control the operation of not only individual applications but also cooperating applications. Therefore, it is possible to protect the user from malicious actions unintended by the user and enhance security.

For example, in the case of the example shown in FIG. 9, by using the application execution authority management device 100 of the present embodiment, the user can determine that "application AP-A1 is an application that performs file access and network access." be possible. Therefore, for example, the application AP-A1 can access a file and can be appropriately managed as an application that may transmit data to the outside.

Further, for example, in the case of the example shown in FIG. 10, by using the application execution authority management device 100 of the present embodiment, the user permits the communication of the application AP-C when the application AP-A2 cooperates, and the application Communication of application AP-C when AP-B2 is linked can be prohibited.

Next, an outline of the present invention will be described. FIG. 8 is a block diagram showing an outline of an application execution authority management device according to the present invention. An application execution authority management device 80 (for example, an application execution authority management device 100) according to the present invention detects an API used by a started application and analyzes application authority, which is authority required by the application alone. A permission analysis unit 81 (for example, the application analysis unit 3) and a cooperation application detection unit 82 (for example, the cooperation application detection unit 6) that detects a cooperation application that is an application that cooperates with the started application based on the detected API. ), and an execution authority determining unit 83 (for example, the application authority determining unit 8) that determines the execution authority of the activated application based on the application authority of the activated application and the application authority of the cooperative application. and a notification unit 84 (for example, the execution authority notification unit 9) that notifies the user of the execution authority.

With such a configuration, the user can appropriately manage the execution authority of the cooperating application.

Further, the execution authority determination unit 83 may determine the authority obtained by adding the application authority of the cooperative application to the application authority of the activated application as the execution authority of the activated application.

Further, when the executed API is an API that operates a shared memory or a NamedPipe, the application authority analysis unit 81 acquires information on the name and direction of the shared memory or NamedPipe from the executed API, and the cooperative application detection unit 82 A cooperative application may be detected using the acquired information. With such a configuration, it becomes possible to detect a cooperative application more appropriately.

In addition, the linked application detection unit 82 links at least one of an application existing in the same folder as the started application, an application called by the started application, and an application communicating with the started application. It can be detected as an application.

Further, the application execution authority management device 80 may include a control unit (for example, the execution authority control unit 11) that controls processing of the detected API. Then, the notification unit 84 may receive a response from the user regarding the notified execution authority, and the control unit may control API processing according to the received response.

Further, if the determined execution authority is already notified to the user, the notification unit 84 may suppress notification of the execution authority. According to such a configuration, it is possible to reduce the confirmation burden on the user.

Specifically, the notification unit 84 associates the received answer from the user with the notified execution authority and stores it in the storage unit, and determines whether or not the user has been notified based on the content stored in the storage unit. You may

1 simple application analysis unit 2 simple analysis result storage unit 3 application analysis unit 4 application information acquisition unit 5 analysis/acquisition result storage unit 6 cooperative application detection unit 7 cooperative application storage unit 8 application authority determination unit 9 execution authority notification unit 10 execution authority Storage unit 11 Execution authority control unit 12 Storage unit 100 Application execution authority management device

Claims (9)

an application authority analysis unit that detects APIs used by the launched application and analyzes application authority that is the authority required by the application alone in order to execute the detected API ;
a cooperative application detection unit that detects a cooperative application that is an application that cooperates with the activated application based on the detected API;
an execution authority determination unit that determines an authority obtained by adding the application authority of the linked application to the application authority of the activated application as the execution authority of the activated application;
and a notification unit for notifying a user of the determined execution authority. 2. The application execution authority management device according to claim 1, wherein the execution authority determination unit determines authority obtained by adding the application authority of the cooperative application to the application authority of the activated application as the execution authority of the activated application. If the API used by the launched application is an API that operates a shared memory or a NamedPipe, the application authority analysis unit acquires information about the name and direction of the shared memory or NamedPipe from the API,
3. The application execution authority management device according to claim 1, wherein the cooperative application detection unit detects the cooperative application using the acquired information. The cooperative application detection unit detects , as a cooperative application, at least one of an application called by the started application and an application communicating with the started application. 1. The application execution authority management device according to claim 1. A control unit that controls the processing of the detected API,
The notification unit receives a response from the user to the notified execution authority,
The application execution authority management device according to any one of claims 1 to 4, wherein the control unit controls the processing of the API according to the received reply. 6. The application execution according to any one of claims 1 to 5, wherein the notification unit suppresses notification of the execution authority when the determined execution authority is already notified to the user. Authority control device. 7. The notification unit stores the received response from the user in association with the notified execution authority in the storage unit, and determines whether or not the user has been notified based on the content stored in the storage unit. application execution authority management device. Detecting the APIs used by the launched application, analyzing the application authority that is the authority required by the application alone to execute the detected API ,
detecting a cooperative application that is an application that cooperates with the activated application based on the detected API;
determining the authority obtained by adding the application authority of the linked application to the application authority of the activated application as the execution authority of the activated application;
An application execution authority management method characterized by notifying a user of a determined execution authority. to the computer,
Application authority analysis processing for detecting an API used by the launched application and analyzing the application authority, which is the authority required by the application alone to execute the detected API ,
cooperative application detection processing for detecting a cooperative application that is an application that cooperates with the activated application, based on the detected API;
an execution authority determination process of determining an authority obtained by adding the application authority of the linked application to the application authority of the activated application as the execution authority of the activated application;
An application execution authority management program for executing notification processing for notifying the user of the determined execution authority.

Images