JP2006201845A - Computer preventing virus infection and secret information disclosure - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a computer preventing virus infection and proprietary information disclosure, capable of preventing simultaneously invasion of virus into an organization and disclosure of secret information from the organization and of freely transmitting/receiving the secret information with e-mails, etc. inside the organization. <P>SOLUTION: This computer comprises a first means constituting general environment consisting of OS and an application exclusive for transmission and reception with outside of the organization, a second means constituting secret environment consisting of OS and an application exclusive for transmission and reception inside the organization, and a third means permitting only reproduction of data with a predetermined form, such as text data not including a program nor control information from the general environment to the secret environment and permitting reproduction by storing prohibition of data reproduction of all the data, or by storing the reproduction data in a storage means from the secret environment to the general information for data exchange between two environments constituted of the first and second means. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a computer that handles confidential information inside an organization in addition to exchanging Web information and e-mails by connecting to the Internet, and in particular, prevents intrusion of a whistle that intrudes from the Internet into the organization and confidentiality from inside the organization. The present invention relates to a computer for preventing virus infection and confidential information leakage suitable for preventing information leakage.

Conventionally, the use of anti-virus software has been the mainstream as a virus countermeasure for computers. This software checks the contents of computer files for pre-registered virus patterns, and if they are included, determines that the files contain viruses and uses them. File access is prohibited.
On the other hand, measures to prevent leakage of confidential information include (1) products that prohibit writing to portable media such as FD, (2) methods that prohibit printing confidential files, and (3) prevent leakage due to attached files. Therefore, there are a method for prohibiting access of confidential files from an electronic mail application, and (4) a product that detects a confidential document leak by electronic mail by keyword search at a mail gateway.
Further, as described in Patent Document 1 below, there is a method of providing a multi-system parallel operation kernel on one computer, operating a plurality of systems, and improving security without modifying the system.
Further, as a virus detection technique for data exchanged between a plurality of systems, there is an intrusion detection system described in Non-Patent Document 1 below. Furthermore, as a method of transferring data that does not allow a virus to enter, there is a method of converting data into a different format such as an image to remove viruses in the data and converting the data into data, as described in Patent Document 2 below.
JP 2001-14239 A (paragraph 0018) JP 2001-67216 A Takeda, Amagasaki, “Network Intrusion Detection”, SOFTBANK PUBLISHING CO., LTD., June 9, 2000, p34-41

However, with the above anti-virus technology, virus patterns are regularly distributed from vendors of vendors, so viruses that are highly infectious and spread quickly cannot be delivered in time, resulting in infection with viruses and further organization. There is a situation where viruses are scattered inside.
On the other hand, in the above-described confidential information leakage prevention technology, it is necessary to take the measures (1) to (4) and other measures, but there is a drawback that usability deteriorates. That is, there is a problem that even if it is attempted to send confidential information by e-mail to a necessary person in the organization, it cannot be transmitted by (3).
In the technology described in Patent Document 1 and existing firewalls, communication is permitted or prohibited depending on the communication source, communication destination, protocol, and port number (application). If permitted, viruses and unauthorized access occur. There was a possibility that it would be difficult to use if prohibited. Furthermore, since the contents of the communication data are not inspected, there is a possibility that viruses are included.
As for the intrusion detection system, it is possible to prevent the attack by recognizing and detecting the pattern and combining it with a firewall. However, attacks by unknown viruses cannot be prevented.
Furthermore, although it is possible to remove the virus by converting the data into another format, the graphic data is likely to be converted into a graphic different from the first graphic. For example, if you consider a rectangle that contains a character string in it, once it is converted to image data, it can be distinguished from the image data whether it is a rectangle that contains a character string or four line segments and a character string. Not stick. This is particularly significant in the case of tables, and it is highly likely that the data will be very different from the original data.

  The present invention has been made in view of such a problem, and simultaneously prevents the invasion of a virus into the organization and the leakage of confidential information from inside the organization, and freely transmits and receives confidential information inside the organization by e-mail or the like. It is an object of the present invention to provide a computer for preventing virus infection and confidential information leakage.

In order to achieve the above object, a virus infection and confidential information leakage prevention computer according to the present invention includes a first means constituting a general environment composed of an OS (operating system) and applications dedicated to transmission and reception outside the organization, A second environment that constitutes a confidential environment composed of an OS (operating system) and applications dedicated to transmission / reception with the inside of the organization, and a data exchange between the two environments constituted by the first and second means. Is allowed to copy data in a predetermined format, such as text data that does not contain programs or control information, from the confidential environment to the general environment. A third means for recording and duplicating is provided.
Further, the third means includes means for permitting duplication of data to be copied from the general environment to the confidential environment by dividing the data of a predetermined size or more into a plurality of data in accordance with a user instruction in the confidential environment. Features.
Further, the third means further includes means for permitting duplication of the composite graphic data to be copied from the general environment to the confidential environment by dividing the composite graphic data into a plurality of unit graphic data in accordance with a user instruction in the confidential environment. It is characterized by providing.
The first and second means constituting the general environment and the confidential environment include means for displaying the background color of the display device screen or the title color of the window of the application program in different colors.
The data exchange referred to here is data exchange manually performed by a computer user, and is an operation called copy and paste using a normal GUI. In this operation, the user specifies the area or object on the document to be copied, selects the copy menu, then specifies the copy destination document or location, selects the paste menu, and copies the data. To tell.

According to the present invention, data replication between the general environment and the confidential environment is restricted to exchange via the third means. For this reason, viruses contained in external mail received in the general environment and external web pages browsed in the general environment do not enter the confidential environment, and the security of the confidential information can be maintained. In other words, there is a virus in the form of text that includes a format of a program such as a document macro or an OS executable file or a format called HTML that cannot be directly interpreted by a person. Intrusion of a virus can be prevented by permitting only copying of data in a predetermined format such as text data not including control information.
In addition, as a method of intruding viruses, there is a method called buffer overflow that causes a large amount of data that a software developer does not expect to pass to a program and malfunctions. The security of the confidential environment can be ensured by dividing the data into a small amount of data and repeating the replication one by one according to the user's instruction in the confidential environment. For example, when copying text data, copying is allowed once, but the text data is divided into data smaller than a predetermined size and the paste operation is repeated to permit copying of the entire text. In this case, in order to reduce the burden of operation, it is desirable that after the paste, the cursor automatically moves to the end of the previous paste, and the user only has to repeat the paste process. Similarly, a composite figure is divided into a plurality of unit figures, and duplication is permitted by repeating the paste operation. As a result, the security of the confidential environment can be ensured from the buffer overflow attack.
On the other hand, when data is replicated from the confidential environment to the general environment, since all the replicated data is recorded in the storage means, there is a deterrent effect on unauthorized data replication.
On the other hand, in the exchange of data between confidential environments, confidential information can be freely exchanged because the above-mentioned restrictions are not imposed. In addition, even when sending confidential information to people outside the organization, it is encrypted and sent using e-mail, etc., but since all the contents are recorded in the storage means, it is sent without receiving approval from the organization. Even if it is going to be done, it will be understood that it was taken out to the general environment at the time of an audit at a later date, so a deterrent effect will work and leakage will not occur easily. If the deterrence effect is insufficient, only specific users can take it out to the general environment, and others can prevent data from being copied from the confidential environment to the general environment, thereby further enhancing leakage prevention. It can be carried out.
Computers equipped with such functions should be introduced to organizations that are highly affected by virus infections and secret leaks, such as companies that provide social infrastructure such as power and gas, financial institutions such as banks, police and military institutions, etc. By this, a very effective effect is exhibited.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
(Embodiment 1)
FIG. 1 is a functional block diagram showing an overall configuration according to Embodiment 1 of the present invention.
In FIG. 1, reference numeral 100 denotes a computer having a virus infection prevention function and a secret leakage prevention function. Reference numeral 102 denotes hardware including the CPU, hard disk, network device, and the like of the computer 100. Reference numeral 101 denotes an OS (operating system) running on the CPU 102.
Reference numeral 113 denotes a general environment HW (hardware) emulator operating on the OS 101. A representative product is VMWare. Reference numeral 112 denotes a general environment OS running on the general environment HW emulator 113. Reference numeral 111 denotes a general environment application running on the general environment OS 112.
A secret environment HW (hardware) emulator 123 operates on the OS 101.
A confidential environment OS 122 runs on the confidential environment HW emulator 123. Reference numeral 121 denotes a secret environment application running on the secret environment OS 122.
141 is an external connection gateway, which can communicate only with the general environment, and connects the general environment and a network outside the organization such as the Internet.
Reference numeral 142 denotes a confidential environment mail server, which can communicate only with the confidential environment.
Reference numeral 143 denotes a confidential environment server which can communicate only with the confidential environment. Here, the type of server is not particularly shown, but it is assumed to be a business server such as a file server or document management.
An audit server 144 can communicate only with the gateway 150 and accumulates all data copied from the confidential environment to the general environment.
A network 130 connects the computer 100 to the external connection gateway 141, the confidential environment mail server 142, the confidential environment server 143, and the monitoring server 144.
Reference numeral 150 denotes a gateway that mediates and restricts data exchange between the general environment and the confidential environment.

Data exchange between the general environment and the confidential environment, the gateway on the network 130, and the server is restricted by the gateway 150 in order to prevent virus infection and leakage of confidential information.
That is, the application 111 in the general environment can communicate only with the external connection gateway 141 via the gateway 150, and the application 121 in the confidential environment can communicate only with the confidential environment mail server 142 and the confidential environment server 143 via the gateway 150. .

FIG. 2 is a diagram for explaining a data replication method from a general environment to a confidential environment.
In FIG. 2, reference numeral 201 denotes a user use shared memory in the general environment OS 112. This memory 201 is a memory used when a user in a general environment explicitly instructs copy and paste, and is called a clipboard in the Windows OS of Microsoft Corporation.
When a user copies data such as a file or text, the user designates a copy target of the file or text, operates the menu or the mouse to instruct the OS 112 or the application 111 to copy to the user shared memory 201, and then The copy destination folder and the position in the document are specified, and the OS 112 or the application 111 is instructed to paste from the user shared memory 201. By using this user use shared memory 201, it is possible to copy text and diagrams within a document, between documents, and between applications.
Reference numeral 202 denotes a user use shared memory monitoring module for the general environment, which is called when a user copies the user use shared memory 201 in the general environment, and has a function of passing the copied data to the gateway 150.
211 is a user use shared memory for the confidential environment, and has the same function as the user use shared memory 201 for the general environment.
A user use shared memory monitoring module 212 for the confidential environment.

A data replication method from the general environment to the confidential environment will be described with reference to the flowchart of FIG.
First, in step 301, when the user designates a copy target in the general environment and instructs the OS 112 or the application 111 to copy, the OS 112 or the application 111 copies the copy target to the user use shared memory 201.
In step 302, the general environment user use shared memory monitoring module 202 detects copying to the user use shared memory 201.
In step 303, the user use shared memory monitoring module 202 for the general environment transfers the copied data type and data to the gateway 150.
In step 304, when the transferred data type is permitted, the gateway 150 transfers it to the user use shared memory 211 for the confidential environment. If not permitted, the process ends here.
In step 305, when the user specifies the copy destination in the confidential environment and instructs paste to the OS 122 or application 121 in the confidential environment, the OS 122 or application 121 copies the data stored in the user use shared memory 211 to the copy destination. To copy.
By performing the operations shown in steps 301 and 305, the user can copy data from the general environment to the confidential environment. However, if the type of data transferred from the general environment is not permitted to be copied, the gateway 150 does not transfer it to the user use shared memory 211 in the confidential environment, and does not permit copying.
Here, data types that can be copied include text, image data, and charts that do not include macros, programs, or control information because there is a possibility of bringing a virus-containing document or executable file into a confidential environment.

Next, a data replication method from the confidential environment to the general environment will be described with reference to FIG.
When a user who uses the computer 100 in a confidential environment wants to transfer a copy of data such as a file or text to the general environment, the user can specify a copy target of the file or text and operate the menu or mouse to operate the confidential environment. The OS 122 or the application 121 is instructed to copy to the user shared memory 211, and then the OS 122 or the application 121 is instructed to paste from the user shared memory 211 by specifying the copy destination folder or the position in the document. By using this user use shared memory 211, it is possible to copy text and charts from the confidential environment to the general prefectural border in the same manner as described with reference to FIG.
When data is replicated from the confidential environment to the general environment, the gateway 150 transfers all of the replicated data to the monitoring server 144 and stores it in the storage device of the storage server 144. In this case, the copy data transfer source user name and date are added and stored. The accumulated data is used when searching for the leakage source of confidential data.

The data replication method from the confidential environment to the general environment will be described in detail using the flowchart of FIG.
First, in step 501, a user in a confidential environment designates a copy target file and instructs the OS 122 and the application 121 to copy.
In step 502, the user use shared memory monitoring module 212 for the confidential environment detects a copy to the user use shared memory 211.
In step 503, the user use shared memory monitoring module 212 for the confidential environment transfers the copied data type and data to the gateway 150.
In step 504, when the transferred data type is a file, the gateway 150 transfers the file to the user environment shared memory 201 for general environment. Further, the data is transferred to the audit server 144. The audit server 144 accumulates the data in the storage device together with the user name and date for later auditing.
In step 505, the user designates a copy destination in a general environment and instructs the OS 112 and the application 111 to paste.
By performing the operations shown in steps 501 and 505, the user can copy data from the confidential environment to the general environment.
In this embodiment, only files can be duplicated. As long as the file can be duplicated, all data such as text and diagrams can be duplicated. Furthermore, since it can be stored together with the file name in the audit server 144, it is easy to audit.
There is also a form in which duplication is restricted to encrypted files only. In this case, it is necessary to check whether the file format is the designated encryption format and whether the file format is encrypted so that it can be decrypted for later auditing.

(Embodiment 2)
In the first embodiment, the gateway 150 operates on the computer 100 used by the user. The gateway 150 can be placed on another computer. However, in this case, the OS 101 forces communication so that communication related to the confidential environment and the general environment is restricted as in the first embodiment.

(Embodiment 3)
In the first embodiment, the general environment and the confidential environment exist on one computer 100. This is for user convenience, computer installation cost, and computer space. If the means of communication between the confidential environment and the general environment is limited as shown above, it will be on a separate computer. It does not matter if it exists.

(Embodiment 4)
In the first embodiment, there are two hardware simulators 113 and 123 on the OS 101, and a general environment and a confidential environment are constructed. A system can also be constructed by regarding the lower-level OS 101 as an OS for a confidential environment. FIG. 12 shows the configuration in this case.
Even in this configuration, data replication in the general environment and the confidential environment is restricted in the same manner as in the first embodiment.
In FIG. 12, the same parts as those in FIG. 1 are denoted by the same reference numerals.

(Embodiment 5)
In the first, second, and fourth embodiments described above, a general environment and a confidential environment exist on one computer 100, and it may be difficult for a computer user to distinguish between the two environments.
What is necessary is just to comprise as follows in order to eliminate this.
FIG. 6 is a diagram illustrating a method for distinguishing two environments using a GUI.
In FIG. 6, reference numeral 600 denotes a display of the computer 100. The display 600 is controlled by the OS 101.
Reference numeral 601 denotes a general environment display, which is mainly controlled by the general environment hardware emulator 113 and the OS 112.
Reference numeral 604 denotes a window of the application 111 that operates in a general environment.
Reference numeral 602 denotes a background of the general environment display 601, which is the remaining part of the display where the window 604 is not displayed.
Reference numeral 603 denotes the title of the window 604.
Reference numeral 605 denotes a confidential environment display, which is mainly controlled by the confidential environment hardware emulator 123 and the OS 122.
The general environment and the confidential environment are distinguished by changing the colors of the display background 602 and the application title 603. For example, the general environment is red and the confidential environment is blue. As a result, the user can easily distinguish the two environments.

(Embodiment 6)
With the configuration as described above, even if the general environment is contaminated with a virus, the risk of the confidential environment being contaminated and the confidential file in the confidential environment being destroyed or taken out is solved.
However, depending on the type of virus, even if you do not destroy or take out files, you can start large programs one after another, intentionally execute infinite loops, attack other machines via the network 130, Some make the computer itself inoperable.
In contrast, in the first embodiment, the OS 101 controls the usage rate of the CPU in the hardware 102 of the general environment (111, 112, 113) and the confidential environment (121, 122, 123), and the gateway By controlling the amount of communication 150, even if the general environment is infected with a virus, the confidential environment can be used without any problem.

(Embodiment 7)
In the first embodiment, when copying data from the general environment to the confidential environment, there is no particular limitation on the data size. However, as a method of illegal intrusion, a method of invading by sending data larger than the size assumed by the receiving side is known.
In the seventh embodiment, a method of copying while limiting the size will be described with reference to FIGS.
In FIG. 7, first, in step 701, the user specifies the text to be copied in a general environment and instructs the OS 112 and the application 111 to copy.
In step 702, the user use shared memory monitoring module 202 for the general environment detects a copy to the user use shared memory 201.
In step 703, the user use shared memory monitoring module 202 for the general environment transfers the identifier and data of the long text data as the copied data type to the gateway 150.
In step 704, when the gateway 150 determines that the text data exceeds the predetermined size based on the sent text data identifier, the text data is divided into a predetermined length. In this case, it is desirable that the unit length to be divided is a length that enters the human field of view when displayed. In other words, it is desirable that the length is at most about half a page, and the length is such that it is possible to reasonably confirm whether or not an unnatural code is included in the text containing a virus.
In step 705, the previously divided text data is sent to the user use shared memory 211 in the confidential environment one by one. Details will be described later with reference to FIG.

The processing of one divided text data in step 705 will be described with reference to FIG.
In step 801, the gateway 150 sends the divided text data to the user use shared memory 211 in the confidential environment.
In step 802, the user moves the cursor to the copy destination and instructs paste. The application 121 pastes text data in the shared memory at the cursor position, and moves the cursor position to the end of the pasted text.
In step 803, the user-used shared memory monitoring module 212 for the confidential environment detects the paste, deletes the pasted data, and issues a transmission request for the next delimited text data to the gateway 150.
By repeating this process, the long text data to be copied in the general environment specified in step 701 can be copied to the confidential environment.

Although the method of dividing and copying text data has been described with reference to FIG. 7, the method of copying a composite graphic will be described with reference to the flowchart of FIG.
Here, the composite figure is a figure composed of a plurality of basic figures, for example, FIG. FIG. 1 is composed of a plurality of basic figures such as a quadrangle such as 100 to 102, 111 to 113, and 130 straight lines. FIG. 9 describes a method of copying each basic figure while saving the user's operation as much as possible.
First, in step 901, the user designates a composite figure to be copied in a general environment and instructs the OS 112 and the application 111 to copy.
In step 902, the user use shared memory monitoring module 202 for the general environment detects a copy to the user use shared memory 201.
In step 903, the user-usage shared memory monitoring module 202 for general environment transfers the composite graphic identifier and data to the gateway 150 as the copied data type.
If the gateway 150 determines in step 904 that the composite graphic data is composite graphic data based on the identifier of the composite graphic data sent, the composite graphic data is divided into unit graphic data.
In step 905, the divided unit graphics are sent one by one to the user use shared memory 211 in the confidential environment. Details are shown in FIG.
By repeating this process, the composite graphic data to be copied in the general environment specified in step 901 can be copied to the confidential environment.

The processing of one unit graphic data in step 905 will be described with reference to the flowchart of FIG.
First, in step 1001, the gateway 150 sends one unit graphic data to the user use shared memory 211 in the confidential environment.
In step 1002, the user displays a copy destination page and instructs paste. The application 121 pastes the unit graphic in the shared memory 211 on the page displaying it.
In step 1003, the user-usable shared memory monitoring module 212 for the confidential environment detects the paste, deletes the pasted data, and then issues a transmission request for the next unit graphic data to the gateway 150.
By repeating this process, the composite graphic data to be copied in the general environment specified in step 901 can be copied to the confidential environment.

(Embodiment 8)
Each of the above embodiments is assumed to be used in an organization. In the eighth embodiment, a configuration that can be used for telework at home will be described. FIG. 11 is an overall configuration diagram.
In FIG. 11, reference numeral 1101 denotes the Internet connecting the home where the computer 100 is installed and the organization.
Reference numeral 1102 denotes a communication gateway included in the OS 101. Here, an IPsec tunnel mode gateway, which is an Internet standard encryption communication protocol, is assumed.
Cryptographic communication with authentication of the confidential environment is realized with the internal network 1104 of the organization. Details are disclosed in general books and will not be described in detail here.
Reference numeral 1103 denotes a gateway that realizes the same IPsec as the communication gateway 1102. The communication gateway 1102 at home is part of the OS 101 and is software, but the communication gateway 1103 is realized as hardware.
Reference numeral 1104 denotes an internal network of the organization.
In such a configuration, IPsec can be used to securely connect the network 1104 in the organization and the confidential environment hardware, and the same computer environment as in the organization can be obtained while at home. Moreover, the use of the Internet as a consumer is realized using a general environment, and one computer 100 can be used for two purposes, and is safer than before.

It is a functional block diagram which shows the whole structure which concerns on Embodiment 1 of this invention. It is a figure explaining the data replication method from a general environment to a confidential environment. It is a flowchart explaining the data replication method from a general environment to a confidential environment. It is a figure explaining the data replication method from a confidential environment to a general environment. It is a flowchart which shows the data replication procedure from a confidential environment to a general environment. It is a figure which shows the method of distinguishing two environments using GUI. It is a flowchart which shows the procedure which copies, restrict | limiting the size of text data. It is a flowchart which shows the procedure which sends the divided | segmented text data to the user utilization shared memory of a confidential environment one by one. It is a flowchart which shows the procedure which duplicates a composite figure. It is a flowchart which shows the procedure which sends the divided unit figure one by one to the user use shared memory of a secret environment. It is a block diagram which shows the structure in the case of installing the computer of this invention in the house outside an organization, and communicating with an organization. FIG. 3 is a block diagram illustrating an example of constructing a system by regarding one OS as an OS for a confidential environment.

Explanation of symbols

100 Computer with Virus Infection Prevention Function and Secret Leakage Prevention Function 101 OS (Operating System)
102 Hardware Including CPU 111 General Environment Application Running on General Environment OS 112 General Environment OS Running on General Environment HW Emulator
113 HW emulator for general environment 121 Application for confidential environment running on OS for confidential environment 122 OS for confidential environment running on HW emulator for confidential environment
123 HW emulator for confidential environment 130 Network 141 External connection gateway 142 Mail server for confidential environment 143 Server for confidential environment 144 Audit server 150 Gateway 201 User shared memory for general environment 202 User shared memory monitoring module for general environment 211 User-used shared memory for confidential environment 212 User-used shared memory monitoring module for confidential environment

Claims (4)

  A first means for configuring a general environment composed of operating systems and applications dedicated to transmission / reception outside the organization; a second means for configuring a confidential environment composed of operating systems and applications dedicated to transmission / reception within the organization; and 1) Regarding data exchange between the two environments constituted by the second means, only copying of data in a predetermined format such as text data not including programs and control information is permitted from the general environment to the confidential environment, and confidential A computer for preventing virus infection and leakage of confidential information, characterized by comprising third means for prohibiting the copying of all data from the environment to the general environment or recording all the copied data in the storage means to enable the copying.   The third means includes means for permitting duplication of data to be copied from the general environment to the confidential environment by dividing the data of a predetermined size or more into a plurality of data according to a user instruction in the confidential environment. The virus infection and confidential information leakage prevention computer according to claim 1.   The third means further includes means for permitting duplication of the composite graphic data to be copied from the general environment to the confidential environment by dividing the composite graphic data into a plurality of unit graphic data in accordance with a user instruction in the confidential environment. The virus infection and confidential information leakage prevention computer according to claim 1 or 2.   The first and second means constituting the general environment and the confidential environment comprise means for displaying the background color of the display device screen or the title color of the window of the application program in different colors, respectively. The virus infection and confidential information leakage prevention computer according to any one of to 3.

Images