JPH06110718A - Virus protection system - Google Patents

Abstract

PURPOSE:To realize a virus protection system estimating the range of virus infection and restoring an infected program. CONSTITUTION:A file change is performed without damaging an existing file by the version control with a version control means 4. Thus, the version for which a change is added due to a virus infection, etc., is deleted any time and the previous state can be restored. By using the dependence of files between clients controlled by a dependence holding means 3 and the history of the file access, a file having the possibility of the virus infection can be alarmed to a system controller without fail. The version infected with virus is deleted without fail since the version is restored based on the inspection result. Thus, virus infection can be completely protected.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a virus protection system for a server in a client / server system.

[0002]

2. Description of the Related Art In recent years, personal computers (P
C) With the advent of workstations (WS) and the progress of network technology, an increasing number of systems share files in a client / server manner. As shown in FIG. 12, this system includes a large number of small computers (clients) 16-1 to 16-N that have only the files necessary to operate independently and a small number (only one) that holds a large number of files. However, the configuration is such that a large-scale computer (server) 15 is connected via a network 17. With this method,
Files that have been duplicately held by individual computers can be centrally managed in one place, and there is no need to copy and move files even if the client changes. further,
The client does not need to have a large disk installed and can use an inexpensive and compact computer.

In addition, recently, various damages have been reported by a program called a virus, which mainly causes damage to a computer, such as a PC. This program deletes files in the computer or destroys the basic OS program at a preset time, and has the function of transmitting to other programs via the program or OS. ing. When a program infected with a virus is executed, other programs are also infected with the virus. Therefore, the virus program checks all the files / directories accessible from the computer, and checks the programs that can be infected with the virus and the programs infected with the virus. Find a storable directory. In addition, programs that can be infected are sequentially read and a virus program is installed and then written back, or a program that has been infected with a virus is written to a storable directory. Further, a virus program is also incorporated in the OS that controls the program execution of the computer, and infection is tried each time the OS is started. A program called a virus checker that confirms the presence of a virus has also been developed.

Up to now, the main route has been to infect a virus through a medium such as a floppy disk. It is sufficient for the administrator of each computer to take care not to execute a program whose identity is unclear, and the damage is also caused. Limited to the computer that executed the virus program. However, in the client / server system, all the files of the user are stored in the server, and it is necessary for each client to be able to access them. Therefore, in principle, all files in the server can be accessed from the client, and execution of a virus-infected program by one careless user can infect all files in the server and cause a failure to all clients. There is a nature. Therefore, virus protection means is indispensable for the file server. However, the conventional file server is insufficient because there is only a method based on the access right. The access right method adopted in the conventional file server and its problems will be briefly described below.

In the client / server system,
The configurations of the file server 20 and the client 25 are shown in FIG.
Shown in. The file server 20 includes a request receiving unit 21 that receives a file request from a client, an access right checking unit 22 that checks an access right to a file, a file access unit 23 that reads and writes a file and its access attribute, and actually. The file holding means 24 holds a large number of files. On the other hand, the client 25 requests the server according to the application program 26 that requires a file in the server, the user identifier holding unit 27 that holds the identifier of the user who is currently using the client 25, and the instruction of the application program 26. It is composed of a request transmitting means 28 for sending out. In addition,
As for the identifier in the user identifier holding means 27, the client 25 logically connects to the server 20 (login or mount).
It is set when you do. In the logical connection, the password is checked and it is confirmed that the user is a legitimate user.

The operation of this system will be briefly described. First, the application program 26 of the client specifies the file name and the access type (read / write) and transmits the access request to the request transmission means 28. Upon receiving this request, the request transmitting means 28 reads the user identifier from the user identifier holding means 27,
A file request including an access type and a user identifier is created and sent to the server 20.

On the server 20 side, the request receiving means 21 receives this request, and the user having the user identifier accesses the file having the file name by the access type according to the content of the request.
The access request is transmitted to 3. Upon receiving this request, the file access means 23 first extracts the access attribute of the designated file from the file holding means 24, and the access right inspection means 2 together with the access type and the user identifier.
Send to 2. The access right inspection means 22 analyzes the stored access attribute, and inspects whether or not this file allows access of the access type to the user of the user identifier. The result is transmitted to the file access means, and only when the access is permitted, the access of the access type is performed on the file having the file name in the file holding means 24.

Consider a case where the application program 26 is infected with a virus. The virus program starts running when the application program is executed. The virus program attempts to infect a file in the server with a virus, specifies the file name and the access type, and transmits the access to the request transmission means 28. The request transmitting unit 28 reads the user identifier of the user who is currently using the client from the user identifier holding unit 27, creates an access request, and sends it to the server 20.

On the server 20 side, the request receiving means 21 receives this request and transmits it to the file access means 23. The file access unit 23 first extracts the access attribute of the designated file from the file holding unit 24 and sends it to the access inspection unit 22 together with the access type and the user identifier. The access inspection means 22 analyzes the stored access attributes, and inspects whether or not this file allows access of the access type to the user having the user identifier. Only when permitted, the file access means 23 accesses the file in the file holding means 24. Therefore, by setting the attributes of the files / directories that each user can access (particularly change) to very limited attributes, most of the files in the server will not be given access permission from the access checking means 22, and viruses will not be released. The programs that a program can infect are very limited.

As described above, the server side limits the access to the file by using the user identifier and the access attribute, and as a result, only the program which the user who executes the virus program is allowed to change is affected. Absent. Therefore, the influence of virus contamination can be suppressed within the range of the user who executed the virus program by using the file access right method. However, this method has the following problems.

First, since access permission is always issued to other programs and directories managed by the user who has executed the virus program, it is not possible to prevent the virus from being infected.

Second, generally, there is not a separate program or directory for each user, but a common program or directory, that is, a program capable of virus infection or a directory capable of storing a virus program. Therefore, when a certain user executes a virus program, it is infected with a common program or the virus infected program is stored in a directory. Therefore, the virus is contaminated to the user who executed the program after that.

Thirdly, when a virus program is executed and the OS of a client is infected, if the client is used by another user as it is, the virus program in the OS operates and the user is allowed to access. It even infects programs / directories.

Fourth, such a server has a privileged user whose access is not prohibited by the above access right, and manages / operates the client / server system. Therefore, when a virus program is executed by a client or a server as a privileged user, all programs in the server can be infected. Furthermore, these causes of infection act in combination, further expanding the range of infection.

Further, since all files and all clients in the server may be infected, the virus checker inspects all files and all clients in order to confirm the absence of virus and the range of infection. It requires a huge amount of work in proportion to the number of files and clients.

[0016]

As described above, not only the conventional access right method cannot completely prevent the virus from being infected in the server, but also the fact that there is no virus in the server and the range of virus infection. It took a lot of work to check. An object of the present invention is to provide a virus protection method that estimates the range of virus infection and restores the infected program to the original.

[0017]

A virus protection system of the present invention is a client comprising a plurality of clients requesting file access and a server for performing file access according to file access from each of these clients. / Server system, the first managing means for managing the file access history of the plurality of clients and the file access dependency among the clients, in accordance with the access request from each of the clients, and the server. Of the file to be changed according to the file change request of the second file, and the second access means for managing the version for each file and the history of file access managed by the first access means are analyzed. The need for virus testing And an analyzing unit for detecting the file to be inspected and the client according to the file access dependency between the clients, and a unit for deleting an unnecessary version for each file according to the result of a predetermined virus inspection. It is characterized by doing.

In this system, the version management by the second management means allows the files to be changed without damaging the existing files. Therefore, the version that has been changed due to virus infection or the like can be deleted at any time and the previous state can be restored. Also, by using the file dependency relationship between the clients and the file access history managed by the first management means, the system administrator can be alerted to the file that may be infected by a virus, and the inspection result Since the version is reverted based on, the virus-infected version is always deleted. Therefore, virus infection can be completely prevented.

Further, since the analyzing means constantly analyzes the information to check the possibility of the presence of the virus, even if the virus is infected, it can be detected before it spreads over a wide area. In addition, it is possible to limit the clients and files that may be infected by a virus by using the dependency information between clients. Therefore, it is only necessary to inspect a small number of files and clients to check the presence of viruses in the server and the extent of infection when they exist.

[0020]

EXAMPLES Examples of the present invention will be described below. FIG. 1 shows a server 1 configured by applying the virus protection system of the present invention.
2 is a block diagram of a client / server system including a client 10 and

The server 1 includes a request receiving means 2 for receiving an access request from a client, a dependency holding means 3 for creating and holding a dependency relationship between clients and files according to an access request from the client, and a change (insertion) to a file. , Delete, update) and manage the version by creating a version without directly reflecting it in the file,
File access means 5 for reading and writing files,
File holding means 6 for actually holding a large number of files
And analysis warning means 7 for analyzing the dependency relationship between clients and files held by the dependency holding means 3 and warning the system administrator of the necessity of virus inspection. On the other hand, the client 10 is composed of an application program 11 that requires a file in the server and a request transmission unit 12 that sends an access request to the server 2 according to an instruction from the application program 11. The operation of this system is briefly described below. (1) The application program 11 of the client sends an access request consisting of a file name and an access type (reading, writing) to the request transmitting means 12. (2) Upon receiving this request, the request sending means 12 creates a file request including the client name and sends it to the server 1. (3) In the server 1, the request receiving means 2 receives this request and transmits the file name, access type and client name to the version managing means 4.

(4) The version management means 4 checks whether the file having the specified file name is already managed. If not managed, file holding means 6
After inquiring the file access means 5 whether the file exists, the file is registered as a management target file.

(5) Next, the version management means 4 checks whether the specified file can be accessed by the access type according to the registered information, and determines the access mode (read, insert, update, delete). . The access process is continued only when the access is possible.

(6) Further, the version management means 4 is
The determined access form, file name, and client name are transmitted to the dependency holding means 3, and a file request for creating a version is transmitted to the file access means 5 so as not to damage the contents of the existing file.

(7) The file access means 5 performs the requested file access to the file in the file holding means 6, and the result is passed through the version management means 4, the request receiving means 2 and the request transmitting means 12. And transmitted to the application program 11.

(8) On the other hand, the dependency holding means 3 which has received the determined access form, file name and client name
Creates and holds dependencies between clients and files based on the information, and provides the information to the analysis warning means 7.

(9) The analysis warning means 7 always analyzes the information of the dependency holding means 3 and warns the system administrator together with the client and the program to be inspected when a virus inspection is necessary. Also, based on the result of the virus inspection from the system administrator, the version management unit 4 is informed of the version that is no longer required to be infected with the virus and is no longer needed or the version of the file infected with the virus.

(10) The version management means 4 reduces the versions that are no longer needed and restores the virus-infected file to the old version. Also,
Update information about the registered file.

Here, consider a case where the application program 11 is infected with a virus and the virus is transmitted to the files A, B, and C. The virus program starts running when the application program is executed. The virus program tries to infect the files A, B, and C in the server, specifies the file name and access type in the order shown in FIG. 2, and transmits the access request to the request transmission means 12. The request sending means creates and sends a file request from the access request to the server 1.

On the server 1 side, the request receiving means 2 receives these requests and transmits the file name, access type and client name to the version managing means 4. The version management unit 4 registers these files as those to be version-managed and determines the access form (reference, insertion, update, deletion) (see FIG. 3). Further, when the access form is update, the update request is changed to an access request such that a new version file is created so as not to lose the contents of the existing file, and nothing is done in the case of deletion. Tell. The file access means 5 makes these accesses to the file in the file holding means 6 and sends the result to the application program 11 via the version management means 4, the request receiving means 2 and the request transmitting means 12. Therefore, after processing the access request from the client, as shown in FIG. 4, the files A, B, and C are version a ₁ , respectively.
Virus infected version a ₂ , b from b ₁ , c _1
2 and c ₂ . However, the versions a ₁ , b ₁ , c
_Since the file of ₁ also remains without being changed, it can be restored by returning to the versions a ₁ , b ₁ , and c ₁ later.

The version management means 4 also informs the dependency holding means 3 of the determined access form, file name, and client name. The dependency holding unit 3 adds these pieces of information to the dependency relationship between the client and the file that has been retained so far. Therefore, FIG. 3 is added as the information on the dependency relationship between files in the client 10, and the information on the file dependency relationship for the client 10 is as shown in FIG.

The analysis warning means 7 always analyzes this dependency information to check whether there is an access pattern indicating the possibility of virus presence. If a corresponding access pattern is found and virus inspection is required, the system administrator is alerted by specifying the client or file to be inspected. Therefore, in the case of this example, as shown in FIG.
It was discovered that one file was continuously updated in a short time, and the client 10 is a client to be inspected for viruses, P is a file to be inspected (P is a file in which the application program 11 is stored), A ，
B and C are alerted to the system administrator. The system administrator checks the existence of the virus by means such as a virus checker and discovers the virus in the files P, A, B, and C. The system administrator inputs this result to the analysis warning means 7. The analysis alert means 7 informs the version management means 4 of a new version of the file as a unnecessary version if it is infected with a virus, and an old version as an unnecessary version if it is not infected, and deletes unnecessary versions. To do. Therefore, in this example, files P, A, B, C
, I.e., p _{1 of} file P and a ₂ , b ₂ , and c _{2 of} files A, B, and C are deleted, respectively, and restored to the file version before the virus infection.

When another client refers to any one of the versions p ₁ , a ₂ , b ₂ and c ₂ infected with these viruses, the dependency holding means 3 includes a client as shown in FIG. The dependencies between them are retained. Therefore, the analysis alerting means 7 uses the virus-infected version p.
Further alert the system administrator to check client B referencing ₁ and file D updated after that reference. This exchange of virus checks with the system administrator continues until there is no version that may be infected with a virus.

Next, consider a case where a problem occurs in the conventional access right method. In this method, the version management means 4 leaves the existing file as an old version, and deletes it only when the system administrator confirms that it is not infected with a virus. The effects of virus infection can be removed at any time. Therefore, virus infection can be prevented even in the first case. Further, the dependency holding unit 3 holds the dependency relation between files and the client dependency relation, and the analysis alarming unit 7 can trace the file which may be infected in the second case and the third case, The influence of virus infection can be removed by the inspection of the system administrator. Furthermore, since this method does not use any access right, it can protect even in the fourth case. Finally, in this method, the client and the file that may be infected are obtained based on the dependency information of the dependency holding unit 3, and the analysis alert unit 7 always analyzes the dependency information before the virus infection spreads greatly. Since it alerts the system administrator, it is only necessary to inspect a small number of files and clients to check the presence of viruses and the extent of infection with virus checkers.
Finally, a specific example of each element that constitutes this embodiment will be described.

The request sending means 12 and the request receiving means 2 are essential components in the client / server system.
UNIX client / server file system N
Taking the FS as an example, the request transmitting means 12 includes an NFS client and its communication program (XDR, RPC, UDP,
The request receiving unit 2 corresponds to an NFS server and its communication program, and its specifications are TCP / IP standardization organizations (IAB: Internet Activit).
es Board) published as RFC.
Therefore, it will be obvious to those skilled in the art, and further description is omitted here.

The file holding means 6 is a non-volatile storage medium composed of a magnetic disk, an optical disk, a semiconductor memory or the like, which holds a large number of files and is capable of reading / writing. Generally, a magnetic disk device is used.

The file access means 5 obtains the storage position of the file in the file holding means from the file name (or its identifier), and reads / writes the file according to the access request. UN
Taking IX as an example, the file system corresponds to this,
For details, refer to the document “UNIX Kernel Design: Kyoritsu Publishing,”
Maurice J Bach).

The version management means 4 realizes a change (insertion, deletion, update) to a file without damaging the file in the file holding means 6, so that the version (version)
Create and manage that information. As shown in FIG. 7, the version information table that manages version information is composed of a file name field and a plurality of version fields. The file name of a file that can be seen by the user and the actual file name of each version. Holds the correspondence relationship of. The leftmost file name in the version field means the oldest version, and the rightmost means the latest version. In addition, (del
ted) means deleted. Therefore, in FIG. 7, the DEF file is deleted.
A schematic flow of the version management means 4 using this table is shown in FIG.

That is, the version management means 4 first checks whether the file having the designated file name is already managed (step S1). If the file is not managed, the file access unit 5 is inquired whether it exists in the file holding unit 6 and then registered as a management target file (step S2). Next, the version management means 4 checks whether the specified file can be accessed by the access type according to the registered information, and determines the access mode (read, insert, update, delete) (steps S3, S4). . If the access is impossible, an error occurs and the processing is interrupted.

Further, the version management means 4 transmits the decided access form, file name, and client name to the dependency holding means 3, and changes the file request to make a version so as not to damage the contents of the existing file. 5 (step S5). For example, when the access form is reference, the field in the table of FIG. 7 is searched to find the latest rightmost version of the version, which is read by the file access means 5 (step S6). If the access form is insertion, a file with a new version name is created and registered in the file holding means 6, and the version name is written at the beginning of the version field (step S7). If the access form is deletion, (deleted) is written at the right end of the field (step S8). If the access form is update, a file with a new version name is created, registered in the file holding means 6, and the new version name is written in the rightmost end of the field (step S).
9). As a result of the virus check, the version that is no longer needed is actually deleted from the file holding means 6 when its name is deleted from the table.

The dependency holding means 3 is the version management means 5
Create and hold a dependency between clients and files based on the access form, file name, and client name from. As shown in FIG. 9, the dependency relationship table holding the dependency relationships exists for each client, and is composed of a file name, an access form, and a pointer field. Each table stores the file access executed by the client, which is necessary to limit the range of virus infection. Dependency holding means 3 shown in FIG.
7 shows a flow of creating a dependency table of. Information that is no longer needed as a result of the virus inspection is deleted.

That is, first, it is judged whether or not the access form is reference (step S11), and if it is other than reference, the access form corresponding to the file name is added to the table designated by the client name (step S11). S1
2). On the other hand, when the access form is reference, it is determined whether or not the specified file has already been updated or inserted in the table (step S13), and if it exists, it is added to the table specified by the client name. The file name and access form are added, and the update and insertion entries found in step S13 are linked by a pointer (step S14). The analysis warning means 7 processes the following four. (1) The information in the dependency holding means 3 is constantly analyzed to check if there is an access pattern that requires virus inspection as described below. Pattern A: Access pattern indicating possibility of virus operation a. The files are changed more than a predetermined frequency in the entire server. b. A file is changed more than a predetermined frequency by one client. c. The file with the predetermined name is changed. Pattern B: When a virus is found to exist, its access pattern may have a widespread effect a. Cumulative number of file changes in one client exceeds a predetermined number. b. Cumulative references exceed a predetermined number of times in one modified file. (2) When virus inspection is necessary, the client and file to be inspected for virus are obtained as follows and the system administrator is alerted.

In the case of pattern A, a file changed in the access pattern, a file referenced before the access pattern, and a client in which the access pattern is found are set as inspection targets. In the case of pattern B, the client in which the access pattern is found or the file included in the access pattern is set as the inspection target. (3) Based on the result of the virus inspection performed by the system administrator, the version no longer needed is obtained and transmitted to the version managing means as follows.・ If you find that you are not infected with a virus, consider the version before that as an unnecessary version.・ If you find out that you are infected with a virus, make the version after that version unnecessary.

(4) Based on the result of the virus inspection performed by the system administrator, the system administrator is alerted to the files and clients that need further virus inspection as follows. -Client that referred to the file where the virus was found. Files modified on the client where the virus was found.

In this embodiment, only the function of detecting the possibility of being infected with a virus and the function of returning to the original state when the virus is infected are provided. Therefore, it has been assumed that the system administrator or the like uses another means such as a virus checker to determine whether or not the computer is infected. This will make the system administrator's job harder, so next, I will describe the infection judgment function that judges whether or not a virus has been infected.

In order to detect a virus infection on the server, first, prepare an infected file that can infect the client or server with the virus at any time, and before the virus infects the contents of the infected file on the client side. Put a copy on the server side. Then, for the infected file on the server side, update access does not occur for that file, or for the infected file on the client side, it is regularly changed compared with the copy in the server. Investigate whether there is any. If there is an update access or an updated trace, it means that the client that issued the update access or the client that has the updated trace is infected with a virus, and the virus infection can be detected. Hereinafter, a specific description will be given with reference to FIG. FIG. 11 shows a system configuration for virus detection.

The infected file B that can be accessed by anyone exists in the client. Infected file A that anyone can access to the server and the infected file A
A file update monitoring means for monitoring updates to the file, a copy file of the infected file B on the client,
There is a file comparison and monitoring unit that periodically compares and monitors whether the content of the infected file B in the client matches the content of the copy file of the infected file B in the server. Here, consider a case where a virus program is started on the client.

(1) First, the virus program searches for a file that can infect itself. Here, the virus program finds an infected file A accessible by anyone in the server and an infected file B accessible by anyone in the client. (2) Next, the virus program attempts to infect the found file with a virus and updates the file. Therefore, the infected files A and B are updated and the virus is infected. Here, the update of the infected file A in the server is detected by the file update monitoring means in the server, and it can be seen that the virus program exists in the client that requested the file update.

(3) The file comparison and monitoring means in the server periodically compares the infected file in the client with its copy in the server and checks whether they match. Here, the infected file B in the client does not match because it has been updated in step 2 by the virus program. Therefore, it is understood that the virus program exists in the client having the infected file B.

As described above, if the virus program exists in the client, either the infected file A in the server or the infected file B in the client is changed, and the virus is updated by the file update monitoring means or the file comparison monitoring means. The presence of is detected.

The infected files A and B are not limited to text files, but command files,
Any kind of file stored in the computer such as a library file, an execution file, a file storing the OS itself can be used. As described above, in this embodiment, the version management by the version management means 4 allows the file to be changed without damaging the existing file. Therefore, the version that has been changed due to virus infection or the like can be deleted at any time and the previous state can be restored. Further, by using the dependency relationship of the files between the clients managed by the dependency holding means 3 and the file access history, it is possible to always alert the system administrator of a file that may be infected with a virus, and to check the inspection result. Since the versions are reverted based on this, the virus-infected version is always deleted. Therefore, virus infection can be completely prevented.

Further, since the analysis alarm means 7 constantly analyzes the information to check the possibility of the presence of the virus, even if the virus is infected, it can be detected before it spreads over a wide area. In addition, it is possible to limit the clients and files that may be infected by a virus by using the dependency information between clients. Therefore, it is only necessary to inspect a small number of files and clients to check the presence of viruses in the server and the extent of infection when they exist.

[0053]

As described above, this virus protection function not only completely prevents the virus from infecting the server, but also confirms that there is no virus in the server and confirms the range of virus infection. You just have to inspect the files in. Therefore, very efficient virus countermeasures can be realized.

[Brief description of drawings]

FIG. 1 is a block diagram showing the configuration of a client / server system for realizing a virus protection system according to an embodiment of the present invention.

FIG. 2 is a diagram showing an example of an access request from a client in the system of the embodiment.

FIG. 3 is a diagram showing an example of an access form confirmed by a server in the system of the embodiment.

FIG. 4 is a diagram showing an example of version relationships managed by a server in the system of the embodiment.

FIG. 5 is a diagram showing file dependency relationships of clients managed by the server in the system of the embodiment.

FIG. 6 is a diagram showing a dependency relationship between clients managed by a server in the system of the embodiment.

FIG. 7 is a diagram showing an example of a version management table managed by the server in the system of the embodiment.

FIG. 8 is a flowchart showing an example of a version management operation executed in the server in the system of the embodiment.

FIG. 9 is a diagram showing an example of a dependency relationship table managed by a server in the system of the embodiment.

FIG. 10 is a flowchart showing an example of a dependency relationship table creating operation executed in the server in the system of the embodiment.

FIG. 11 is a diagram for explaining an example of a virus inspection method adopted in the system of the embodiment.

FIG. 12 is a block diagram conceptually showing a conventional client / server system.

FIG. 13 is a diagram for explaining a file access operation in a conventional client / server system.

[Explanation of symbols]

1 ... Server, 2 ... Request receiving means, 3 ... Dependency holding means, 4 ... Version management means, 5 ... File access means, 6 ... File holding means, 7 ... Analysis warning means, 10 ...
client.

Claims (3)

[Claims] 1. A client / server system comprising a plurality of clients that request file access and a server that performs file access according to the file access from each of these clients, wherein the server is First management means for managing file access histories of the plurality of clients and file access dependencies among the clients according to an access request, and a version of a file to be changed in response to a file change request from each client A second management unit that creates and manages a version for each file, and a history of file access managed by the first management unit are analyzed to detect the necessity of virus inspection, and File between clients Client / server, characterized in that it comprises: an analyzing means for tracing the file to be inspected and the client in accordance with the dependency relationship of the access, and a means for deleting an unnecessary version for each of the files according to the result of a predetermined virus inspection. System virus protection method. 2. An application program for requesting access to a file, a plurality of clients comprising request transmitting means for transmitting the access request to a server via a network, request receiving means for receiving an access request from the client, and In a client / server system in which a server including a file access unit that performs a file access according to a request and a file holding unit that stores a file is connected via a network, a file change (insert, delete, update) is performed on the server. ) Creates and manages a new version of the file when it is needed, realizes the file change without damaging the existing file in the file holding means and deletes the specified unnecessary version. , Version tube From the history of file access performed by the management means, the dependency relationship between the client that inserted / updated the file and the client that referenced the file and the dependency relationship between the files due to the order of file access in each client Always analyze the dependency holding means created and held, and the information of the dependency holding means to check whether there is a need for virus inspection, and if necessary, alert the system administrator by specifying all clients and files to be checked and The system administrator analyzes the virus based on the result of the virus check, informs the version management means of the unnecessary version, and has the analysis and alerting means to alert the system administrator of the clients and files that need to be inspected. The system administrator inspects the client and files for viruses according to the instructions of the analysis alert method. , Virus protection system, characterized in that teach the result to the analysis warning means. 3. The virus protection system according to claim 2, wherein the server further has a virus inspection unit.