JPH08179942A - Immune ic, and card and computer using the ic - Google Patents

Abstract

PURPOSE: To prevent the reduction of using efficiency of a memory and also to secure the extremely high durability against the destruction by means of the virus by storing the software, etc., in a semiconductor IC to detect the undesired software or computer programs. CONSTITUTION: The software, a computer program or the data are stored in a ROM 10 for detection of the undesired software or computer programs. A CPU 2 exchanges the information read out of a communication circuit connection device 6 via an input/output controller 5 with the storage medium of a compact storage 9 to fetch the data or programs which are newly inputted into a computer RAM 4 through a bus 3. Then these data and programs are compared with the information on the undesired software or computer programs stored in the ROW area, so that the presence of computer virus can be detected.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for ensuring the security of computation in a digital computer, and more particularly to a method and apparatus for detecting the presence of computer viruses and unwanted software or unwanted computer programs.

[0002]

2. Description of the Related Art Conventionally, a method for ensuring the security in calculation of a digital computer, or a computer
As a method to detect the presence of viruses and unwanted software or unwanted computer programs, software called vaccines are used, which check the programs and data read by the computer at the time of reading, or When trying to do something undesired, it was either disabled or a warning was issued to the user.

[0003]

In a conventional method for ensuring the security of digital computer calculations, or for detecting the presence of computer viruses and unwanted software or unwanted computer programs, a vaccine is provided. Is loaded into the computer's memory and operated. Therefore, it occupies the memory of the computer, and if the area of the memory where the vaccine exists is written or modified by the virus, the vaccine will not work. For this reason, not only was the utilization efficiency of the computer's memory reduced, but it was also extremely vulnerable to damage by viruses.

Further, the conventional vaccine is constituted by including the computer virus and a part of the unwanted software or the unwanted computer program, or data storing the characteristics thereof in advance. However, it did not provide protection against viruses and undesired programs that were not remembered.

Further, the conventional vaccine needs to be replaced periodically according to the change of the type of virus, but since the operation is complicated, it is not possible to read the new vaccine into the memory without fail to use it. ， It was a heavy burden for computer users.

An object of the present invention is to solve the above-mentioned problems of the prior art, to prevent the deterioration of the utilization efficiency of the memory of the computer, to be extremely durable against the destruction by a virus, and to store the data in advance. Computer virus and unwanted software, which can protect against computer viruses and unwanted programs, and which does not impose a heavy burden on computer users. It is to provide a method for detecting the presence of software or unwanted computer programs.

[0007]

The object of the present invention is to store software, a computer program, or data in a semiconductor integrated circuit for detecting the presence of undesired software or a computer program, and to store the software, the computer program, or the data in the semiconductor integrated circuit as necessary. In addition to the read-only memory, the semiconductor integrated circuit is configured to include at least a random access memory capable of both writing and reading, and detects the presence of the unwanted software or computer program in the read-only memory. The software, computer program, or data for doing so is stored in the read-only memory and is further incorporated into the computer so that the unwanted software or code is stored during operation of the computer. The new software, the new computer program, or the new data for detecting the existence of the computer program is stored in the random access memory, and the semiconductor integrated circuit has a card-like shape if necessary. The immune IC card is removable from the main body of the computer.
Immune ICs that allow the card to be replaced and the software, computer program, or data to be updated as necessary to detect the presence of unwanted software or computer programs
It can be reached by configuring the computer as a computer with a card.

[0008]

In the present invention, software, computer programs, or data for detecting the presence of unwanted software or computer programs is stored in the immune IC composed of a semiconductor integrated circuit. For this reason, these software, computer programs, or data do not reduce the utilization efficiency of the memory that the computer originally uses for the purpose of calculation.

Further, in the present invention, the semiconductor integrated circuit is configured to include at least the read-only memory and a random access memory capable of both writing and reading, which is added as necessary, and thus the above-mentioned undesirable situation The software, computer programs, or data for detecting the presence of software or computer programs can be stored in the read-only memory. For this reason, it is impossible to rewrite or destroy information by a virus, so it is extremely durable against a virus that has the function of destroying the vaccine itself.

Further, by incorporating this into a computer, new software, a new computer program, or new data for detecting the presence of unwanted software or computer program during the operation of the computer, Since it is stored in the random access memory, it can exert a defense function against viruses and unwanted programs that are not stored in advance.

Since the immune IC of the present invention can be mounted on a substrate to form a card-shaped immune IC card, it can be attached to and detached from the main body of the computer, and the immune IC card can be replaced to replace the computer. Software, computer programs, or data can be updated to detect the presence of unwanted software or computer programs without a significant burden on the user. Therefore, according to the present invention, it is possible to provide a method for ensuring the security in the calculation of the digital computer. In addition,
It is possible to realize a computer having an immune IC card, which can easily detect the presence of viruses and unwanted software or unwanted computer programs.

[0012]

The present invention will be described in detail below with reference to examples.

A first embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram of a computer system including the immune IC of the present invention. In the present embodiment, the immune IC 1 of the present invention is configured as an integrated circuit including a logic circuit using a MOS (metal-oxide-semiconductor) transistor of Si semiconductor and a ROM (read only memory) area 10. In this case, the idea of the present invention can be realized whether the integrated circuit is monolithic or hybrid. In this embodiment, the ROM stores software, computer programs, or data for detecting the presence of unwanted software or computer programs. Although a ROM is used in the present embodiment, an electrically rewritable RAM, E, or E is used instead of the ROM.
A semiconductor memory such as EPROM can also be used.
This is because so-called vaccine software can be easily written in a rewritable semiconductor memory. However, in the case of an electrically rewritable semiconductor memory, it is necessary to configure the computer or the semiconductor memory so that data cannot be written from the computer to the semiconductor memory when the semiconductor memory is incorporated into the computer. This is because the contents of the semiconductor memory may be rewritten by a so-called computer virus. In order to prevent data writing, at the interface between the computer and the semiconductor memory, the voltage of the R / W pin of the semiconductor memory may be fixed to the READ side. For this, the voltage may be fixed by the interface board on the computer side, and of course, the R / W pin of the semiconductor memory may be connected to the Vcc terminal. When writing the vaccine software, a method of taking out the semiconductor memory from the computer and rewriting it, and a method of releasing the voltage fixing on the interface board on the computer side and rewriting it through the computer are considered.

The CPU 2 receives, via the bus 3, information read from the communication line connection device 6 via the input / output control device 5 and data or programs newly input by exchanging the storage medium of the small storage device 8. RA for calculation
The presence of computer viruses is detected by comparison with information relating to unwanted software or computer programs stored in the ROM area 10 after being loaded into the M4.

When it is confirmed that a computer virus is present, a warning message is displayed on the display device 7 to inform the user of the computer of the presence of the computer virus and the operation of the computer is stopped. .

In the present invention, since the ROM area 10 stores information relating to undesired software or computer programs, the utilization efficiency of the calculation RAM used by the computer for its original calculation is reduced. Will not be invited. In addition, the ROM area 10
Even if there is a program or data in which a new type of virus exists that is not stored in, the contents stored in the immune chip 1 will not be destroyed or lost as a result of the execution of these programs and data.

Further, in the present invention, since the semiconductor integrated circuit includes at least a read-only memory and a random access memory capable of both writing and reading which is added as necessary, the above-mentioned undesirable software is added. Software, computer programs, or data for detecting the presence of software or computer programs can be stored in the read-only memory. For this reason, it is impossible to rewrite or destroy information by a virus, so it is extremely durable against a virus that has the function of destroying the vaccine itself.

Further, by incorporating this into a computer, new software, a new computer program, or new data for detecting the presence of unwanted software or computer program during the operation of the computer, Since it is stored in the random access memory, it can exert a defense function against viruses and unwanted programs that are not stored in advance.

Further, since the immune IC of the present invention can be mounted on a substrate to form a card-shaped immune IC card, it can be attached to and detached from the main body of the computer. In order to detect the presence of unwanted software or computer programs without compromising computer users,
Software, computer programs, or data can be updated. Therefore, according to the present invention,
It is possible to provide a method for ensuring security in calculation of a digital computer. Furthermore, it is possible to realize a computer having an immune IC card that is easy to detect the presence of computer viruses and unwanted software or unwanted computer programs.

Next, another embodiment will be described with reference to FIG. FIG. 2 is a top view of the immune IC of the present invention including the random access memory (RAM) in this embodiment. In this embodiment, the immune IC 1 is composed of a ROM area 21 and a RAM area 22 composed of Si semiconductor circuits, both of which are integrated on the same Si chip. The ROM area 21 stores information about unwanted software or computer programs. In addition, even if there is a program or data in which a new type of virus exists, the information of which is not stored in advance in the ROM area 10, the contents stored in the immune chip 1 are destroyed as a result of the execution thereof. It will not be lost or lost.

Further, in the embodiment of the present invention, the immune IC1 is R
It is configured to include both the OM area 21 and the RAM area 22. Software, computer programs, or data for detecting the presence of software or computer programs are stored in the ROM area 21 and cannot be rewritten or destroyed by viruses. In addition, information about new unwanted software or computer viruses detected by the software or computer programs described above is stored in RAM.
It is stored in area 22 and is used with the information originally in ROM area 21 and thereafter to detect computer viruses. Therefore, the immune IC1 has a learning period function and can cope with new computer viruses and virus variants.

Further, in this embodiment, since the management software of the computer, the so-called operating system root part, or all of it is stored in the ROM area 21 of the immune IC1, a new type of computer virus or virus should be used. The system can be easily restored even if a variant of the system invades the computer system and the software for operating the system is destroyed.

Next, another embodiment will be described with reference to FIG. FIG. 3 is a top view of the immune IC of the present invention including the random access memory (RAM) as an external component in the present embodiment. In this embodiment, the immune IC 1 is hybridly integrated with a RAM 31 (random access memory 31) externally on a printed circuit board 32, and both are connected by a wiring 34.

In this embodiment, the hybrid integrated circuit is constructed as an IC card and can be connected via electrodes 33 to the hardware of a computer system.
As described above, if the immune IC card of the present invention is used to construct an immune IC card, information relating to unwanted software or computer viruses stored in the ROM area of the immune IC can be easily updated. Moreover, it is durable against breakage. Further, compared to the conventional case where the vaccine is read from the floppy disk or the like into the memory of the computer or the external storage device, the labor of the user is remarkably reduced. Therefore, there is an advantage that it is possible to prevent forgetting or making mistakes in updating the vaccine.

Since the immune IC card of this embodiment is small and lightweight, it can be easily delivered by mail or the like.
The cost is also low. Therefore, it is possible to regularly provide the user with the immune IC card including the latest information regarding unwanted software and computer viruses. For example, a certain annual membership fee is collected from the user, and the immune IC card with the latest information is included at regular intervals.
By distributing the code to users, the security of the computer can be improved easily and dramatically.

A flow chart of the procedure for detecting unwanted software and computer viruses used in the three embodiments described so far is shown in FIG. In this detection procedure,
The computer first reads the information about the unwanted software or computer virus from the immune IC and compares it with the program or data in the memory of the computer. If the same or common instructions are included, the execution of the program is stopped, and the presence of the virus is indicated on the display device to inform the user.

FIG. 5 is a flow chart showing a procedure when the immune IC of the present invention uses the RAM area to perform the learning period function. There are two ways that immune ICs can obtain information about new and unwanted software and viruses:
The first is a method of detecting an invasion of a virus into a computer system and additionally writing information at that time into a RAM area to increase the information. This corresponds to natural infection in terms of correspondence with the immune system of the living body. On the other hand, external information about new and unwanted software and viruses
There is a method to write in the AM area, which corresponds to vaccination. In either case, once you have the information,
By the same procedure as shown in FIG. 4, it becomes possible to detect unwanted software and computer virus.

Another embodiment of the present invention will be described with reference to FIG. FIG. 6 is an external view of a computer using the immune IC card of the present invention. The immune IC card is easy to put on and take off as shown in FIG. 6, and therefore, information about unwanted software and computer viruses can be easily updated, and is durable against destruction. Further, compared to the conventional case where the vaccine is read from the floppy disk or the like into the memory of the computer or the external storage device, the labor of the user is remarkably reduced. Therefore, there is an advantage that it is possible to prevent forgetting or making mistakes in updating the vaccine.

Next, another embodiment of the present invention will be described with reference to FIG. FIG. 7 is a block diagram of a computer for detecting unwanted software or computer program when reading data from the outside.

In this example, the immune IC1 of the present invention is used.
Is configured as an integrated circuit including a logic circuit including a MOS (metal-oxide-semiconductor) transistor of Si semiconductor and a ROM (read only memory) area. In this case, the idea of the present invention can be realized whether the integrated circuit is monolithic or hybrid. In this embodiment, the ROM stores software, computer programs, or data for detecting the presence of unwanted software or computer programs.

FIG. 8 is a flow chart showing a procedure for detecting undesirable software or computer virus when reading information from the outside in this embodiment. In this embodiment, the input / output control device 5 itself has a function of detecting unwanted software and computer viruses, and the information stored in the immune IC 1 is read out by the input / output control device 5 and input / output. The presence of a computer virus is detected by comparing the information read from the communication line connection device 6 via the control device 5 with the information about the unwanted software or computer program. In this case, in addition to detecting undesired software or computer virus by comparing and collating the data strings included in the program, the program read in the input / output control device 5 is temporarily operated, You can check if you do not have suspicious behavior.

In this case, the CPU of the computer body
2 and the calculation RAM4 are not used for virus detection, so the performance of the computer is not degraded.
It is possible to detect unwanted software and computer viruses efficiently.

When it is confirmed that a computer virus is present, a warning message is displayed on the display device 7 to inform the user of the computer of the presence of the computer virus and the operation of the computer is stopped. .

Next, another embodiment of the present invention will be described with reference to FIGS. 9 and 10. FIG. 9 is a block diagram of a computer for detecting unwanted software or computer programs when transferring programs and data inside the computer. In this embodiment,
The immune IC1 of the present invention is a logic circuit using a MOS (metal-oxide-semiconductor) transistor of Si semiconductor, and RO.
It is configured as an integrated circuit including an M (read only memory) area. In this case, the idea of the present invention can be realized whether the integrated circuit is monolithic or hybrid. In this embodiment, the ROM stores software, computer programs, or data for detecting the presence of unwanted software or computer programs.

FIG. 8 is a flow chart of a procedure for detecting an unwanted software or computer program when transferring a program or data inside the computer in the present embodiment. In this embodiment, a bus monitor 90 is provided, which itself has the function of detecting unwanted software and computer viruses. The immune IC 1 is connected to the bus monitoring device 90. The information stored in the immune IC 1 is the bus monitoring device 9
The presence of a computer virus is detected by comparing it with the information about the unwanted software or computer program contained in the information read out to 0 and transferred via the bus 3. In this case, in addition to detecting undesired software or computer virus by comparing and collating the data strings included in the program, the program read in the bus monitoring device 90 is once simulated to operate and is suspicious. You can check whether it does not work.

In this case, the CPU of the computer body
2 and the calculation RAM4 are not used for virus detection, so the performance of the computer is not degraded.
It is possible to detect unwanted software and computer viruses efficiently.

When it is confirmed that a computer virus is present, a warning message is displayed on the display device 7 to inform the user of the computer of the presence of the computer virus and the operation of the computer is stopped. .

[0038]

As described above, according to the present invention, the utilization efficiency of the memory of the computer is not deteriorated, and the durability against the destruction by the virus is extremely high. Computer virus and unwanted software, which provides protection against non-existent viruses and unwanted programs, and which keeps the computer computer's computational safety low and does not impose a heavy burden on computer users. A method can be provided for detecting the presence of software or unwanted computer programs.

[0039]

[Brief description of drawings]

FIG. 1 is a block diagram of a computer system including an immune IC of the present invention.

FIG. 2 is a top view of an immune IC of the present invention including a random access memory (RAM).

[Fig. 3] Random access memory (RAM) for immune IC
FIG. 6 is a top view of the immuno-IC card of the present invention integrated with the substrate.

FIG. 4 is a flow chart of detecting unwanted software.

FIG. 5 is a flow diagram of a procedure for enhancing the ability to detect unwanted software with a learning function.

FIG. 6 is an external view of a computer using an immune IC card according to an embodiment of the present invention.

FIG. 7 is a block diagram of a computer for detecting unwanted software or a computer program when reading data from the outside.

FIG. 8 is a flow chart of a procedure for detecting unwanted software or computer programs when reading information from the outside.

FIG. 9 is a block diagram of a computer for detecting unwanted software or computer programs when transferring programs and data inside the computer.

FIG. 10 is a flow diagram of a procedure for detecting unwanted software or computer programs when transferring programs and data within the computer.

[Explanation of symbols]

 1 Immune IC 2 CPU 3 Bus 4 Calculation RAM 5 Input / output control device 6 Communication line connection device 7 Display device and input / output device 8 Mass storage device 9 Small storage device 10, 21 ROM area 22 RAM area 31 RAM 32 Printed circuit board 33 electrodes 34 wiring 60 computer main body 61 immune IC card 90 bus monitoring circuit.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Yoshinobu Nakagome 1-280, Higashi Koigokubo, Kokubunji, Tokyo Metropolitan Research Center, Hitachi, Ltd.

Claims (13)

[Claims] 1. An immune system I comprising at least a semiconductor integrated circuit storing software, a computer program, or data for detecting the presence of unwanted software or a computer program.
C. 2. The immune IC according to claim 1, wherein the semiconductor integrated circuit includes at least a read-only memory. 3. The immune IC according to claim 1 or 2, wherein the semiconductor integrated circuit includes at least a random access memory capable of both writing and reading in addition to the read-only memory. 4. The software, computer program, or data for detecting the presence of said unwanted software or computer program according to claim 2 or 3 is stored in said read-only memory. An immune IC characterized by the following. 5. The new software, the new computer program, or the new data for detecting the presence of the undesired software or computer program during the operation of the computer according to claim 3 or 4. , An immune IC which is stored in the random access memory. 6. The new software, the new computer program, or the new data according to claim 5, wherein a change protection area set on a storage device of the computer is changed or information is written. An immune IC, which is used for detecting the presence of the above-mentioned undesirable software or computer program, which is configured to include at least an instruction to be executed or information necessary for its execution. 7. The new software, the new computer program, or the new data is given from the outside when the computer operates, or the computer itself is stored in a storage device of the computer. Immune I characterized by detecting an instruction to change or write information to the change protection area set in step 1 or information necessary for its execution and storing it in the random access memory.
C. 8. The immune IC according to claim 7, wherein an instruction to perform a change operation or an information write operation to a change protection area set on the storage device of the computer, or information necessary for execution thereof is issued. An immune IC characterized in that it is used in a computer with a logic circuit for detecting passage through an input / output bus with the outside of the computer. 9. The immune IC according to claim 7, wherein an instruction to perform a change operation or an information write operation to a change protection area set on the storage device of the computer or information necessary for the execution thereof is issued. , An immune IC, characterized in that it is used in a computer, with a logic circuit for detecting passage through the instruction bus of the computer. 10. An unnecessary one of the software, the computer program, or the data for detecting the presence of the unwanted software or computer program according to claim 1. An immune IC having a function of masking things. 11. The semiconductor integrated circuit according to claim 1, wherein the semiconductor integrated circuit has a card-like shape and is attachable / detachable to / from a computer main body, and the immune card having the card-like shape is replaced to replace the card. An immune IC characterized by the ability to update software, computer programs, or data to detect the presence of unwanted software or computer programs. 12. A semiconductor integrated circuit that stores software, a computer program, or data for detecting the presence of undesired software or a computer program, the semiconductor integrated circuit including the read-only memory and the write. The software, computer program, or data for detecting the presence of the undesired software or computer program, which comprises at least a random access memory capable of both reading, is stored in the read-only memory. New software, new computer program, if stored, and for detecting the presence of said unwanted software or computer program during computer operation, Immune IC card, wherein the new data, as well as stored in random access memory, to have a card shape. 13. A semiconductor integrated circuit that stores software, a computer program, or data for detecting the presence of undesired software or a computer program, the semiconductor integrated circuit comprising a read-only memory, write and read. And at least a random access memory capable of detecting the presence of the undesired software or computer program in the read-only memory. New software, new computer program, stored in the read-only memory, for detecting the presence of unwanted software or computer programs during computer operation. Memory or new data is stored in a random access memory, and the semiconductor integrated circuit has a card-like shape and is an immune IC card that can be attached to and detached from the computer body. A computer characterized by being able to update software, computer programs, or data for detecting the presence of said undesired software or computer programs.