JP3974879B2 - Unauthorized access information security device, unauthorized access information security method, and program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an unauthorized access trace information maintenance device and the like for collecting information (hereinafter referred to as “unauthorized access trace information”) for performing a follow-up survey on unauthorized access to a computer device.
[0002]
[Prior art]
In recent years, with the spread of business use of the Internet, many companies and organizations have released server computers, sent information to an unspecified number of users, and provided services such as e-commerce. It has become. However, some server computers have insufficient security measures, and there are many cases where such server computers have been targeted by malicious humans and have been invaded.
If an unauthorized person enters the server computer, that is, if unauthorized access is allowed, important files are browsed, deleted, tampered with, or a back door or worm is set up. There is a possibility that damage will spread, such as an invasion of Accordingly, the administrator of the server computer is required to promptly respond to the case of unauthorized access.
[0003]
Conventionally, in order to respond to such unauthorized access to a computer device, conventionally, a device for collecting as much unauthorized access trace information as possible has been devised (see, for example, Patent Document 1).
[0004]
[Patent Document 1]
JP 2002-328897 A (page 3-4, FIG. 3)
[0005]
[Problems to be solved by the invention]
However, in the prior arts such as Patent Document 1, since the intruder has not been made to prevent the intruder from seeing that the illegal access trace information has been collected, the intruder does not collect the information. It was also possible to perform some operation on itself and change the collection result so that no trace of intrusion was known. For example, in general, an intruder attempts to erase a log that is a sign of his intrusion after the intrusion. In the prior art, it is easy to delete such logs, and it is impossible to follow the intruder's footsteps, and it becomes unclear what modifications have been made to the service. There was a problem.
[0006]
The present invention has been made to solve the technical problems as described above, and an object of the present invention is to reliably collect unauthorized access trace information without the intruder knowing it.
Another goal is to ensure that unauthorized access logs are collected after making the intruder think that the log output process has been successfully stopped.
Still another object is to reliably collect data sent from an intruder or data brought in from outside (hereinafter referred to as “external data”) without being known to the intruder.
[0007]
[Means for Solving the Problems]
For this purpose, the present invention constructs a server on a guest OS and collects unauthorized access trace information in the host OS that is the basis of the guest OS. That is, the unauthorized access trace information maintenance apparatus of the present invention operates a virtual operating system that is set so as to be logically connectable from the network on a real operating system that is set so as not to be logically connectable from the network. And a security means for transferring unauthorized access trace information for tracking the unauthorized access to the virtual operating system to the actual operating system.
[0008]
From another point of view, the unauthorized access trace information maintenance method of the present invention operates a virtual operating system logically connectable from the network on a real operating system logically connectable from the network; The method includes a step of collecting unauthorized access trace information for performing a follow-up investigation on unauthorized access to the virtual operating system, and a step of transferring the collected unauthorized access trace information to the actual operating system.
[0009]
On the other hand, the present invention can also be understood as a program for causing a computer device to realize a predetermined function. In other words, the program of the present invention tracks illegal access to a virtual operating system on a computer device on which a virtual operating system logically connectable from the network operates on a real operating system that cannot be logically connected from the network. This is to realize a function of collecting unauthorized access trace information for investigation and a function of transferring the collected unauthorized access trace information to an actual operating system.
[0010]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described in detail based on embodiments shown in the accompanying drawings.
FIG. 1 is a diagram showing a configuration of a computer system to which the present embodiment is applied. This computer system is configured by connecting the unauthorized access trace information maintenance apparatus 10 of the present invention and user terminals 21 to 2n via a computer network 30.
[0011]
The unauthorized access trace information maintenance apparatus 10 is provided with the unauthorized access trace information maintenance function of the present invention for a server computer that transmits information or provides services via a computer network 30. A specific hardware configuration is the same as that of a normal server computer, and includes a central processing unit (CPU), a main storage device, an external storage device (for example, a magnetic disk device), a communication control device, and the like.
[0012]
The user terminals 21 to 2n are terminals that receive information transmitted from the unauthorized access trace information maintenance apparatus 10 or receive services provided by the unauthorized access trace information maintenance apparatus 10. For example, it is realized by an information terminal such as a personal computer, a PDA (Personal Digital Assistance), or a mobile phone. A specific hardware configuration is the same as that of a normal information terminal, and includes a central processing unit (CPU), a main storage device, an external storage device (for example, a magnetic disk device), a communication control device, and the like.
The computer network 30 is exemplified by the Internet.
[0013]
Next, the software configuration of the unauthorized access trace information maintenance apparatus 10 in the present embodiment will be described.
In the present embodiment, as shown in FIG. 2, in the unauthorized access trace information maintenance apparatus 10, a virtual operating system (hereinafter “guest OS”) 12 on an actual operating system (hereinafter “host OS”) 11. To work. Then, on this guest OS 12, a system (server) for transmitting information or providing services to an unspecified number of users is constructed. Such a server construction by the guest OS 12 can be performed by existing software.
[0014]
In the present embodiment, only the guest OS 12 is set to be logically accessible from the network 30, and the host OS 11 is set to be not logically accessible from the network 30. Such settings can also be made by using existing software.
[0015]
Furthermore, on the guest OS 12, a kernel 13 which is a central part of the OS and a log output process 14 for outputting a log operate. Of course, other processes operating in a normal operating system can also be operated, but are omitted because they are not related to the present embodiment. Further, the unauthorized access trace information maintenance device 10 includes a log recording unit 15 managed by the guest OS 12 and a log recording unit 16 managed by the host OS 11. Actually, the auxiliary storage device possessed by the unauthorized access trace information maintenance device 10 is divided into an area managed by the guest OS 12 and an area managed by the host OS 11, but in FIG. The recording unit is illustrated in the corresponding operating system.
[0016]
The kernel 13 has the function of outputting the log to the log recording unit 16 while pretending that the log output process 14 has been stopped, the function of passing the command information keyed by the intruder to the guest OS 12 to the host OS 11, and the intruder Is installed with a module for realizing a function of transferring external data downloaded from an external network and installed in the guest OS 12 to the host OS 11. It should be noted that it is set so that a general user cannot see that such a module operates as a process in a user space or a kernel space such as a device driver. Also, the pipeline for passing data from the guest OS 12 to the host OS 11 is set so that it cannot be seen by general users.
[0017]
Normally, the log output process 14 outputs a log to both the log recording unit 15 and the log recording unit 16, but when instructed by the kernel 13 to output a log only to the log recording unit 16, according to the instruction, A log is output only to the log recording unit 16.
[0018]
Next, the operation of the unauthorized access trace information maintenance apparatus 10 having the above hardware configuration and software configuration will be described in detail. In the following description, the unauthorized access log information, command information entered by the intruder as key input, and external data brought in from the outside by the intruder will be described as examples of the unauthorized access trace information. However, the present embodiment is not limited thereto. It can be applied to any unauthorized access trace information.
(First embodiment)
The first embodiment is an embodiment for reliably collecting the log output by the log output process 14 without the intruder knowing it.
FIG. 3 shows an operation flow of the first embodiment.
[0019]
The log output process 14 logs logs to both the log recording unit 15 managed by the guest OS 12 and the log recording unit 16 managed by the host OS 11 every time an event occurs in a state where unauthorized access has not been made. Output.
That is, log data is acquired (step 105), and since the output destination is not designated from the kernel 13 (NO in step 106), the log is output to the log recording unit 15 and the log recording unit 16 (step 108). Then, it is determined whether there is log data (step 109). If there is log data, the process returns to step 105. If there is no log data, the process is terminated.
[0020]
Here, it is assumed that the intruder requests to stop the log output process 14. Generally, an intruder erases a log that is a sign of his intrusion after the intrusion. However, if an illegal act is further performed after the log is erased, the trace of the act is recorded as a log again. Therefore, first, in order to make a state in which no trace remains, the intruder performs the log output process 14. There is a case where an operation of stopping is performed. The kernel 13 determines whether or not there is a stop request (step 101). If there is no stop request, the determination of step 101 is repeated, and if there is a stop request, the log recording unit managed by the host OS 11 for the log output process 14 An instruction is issued to set 16 as the output destination (step 102). Then, the kernel 13 makes the log output process 14 invisible (step 103), and makes a response to the intruder that the log output process 14 has stopped (step 104).
[0021]
However, in this embodiment, the log output process 14 is not actually stopped, and the log output is continued to the log recording unit 16 that is an output destination that cannot be detected by the intruder. That is, the log output process 14 acquires log data (step 105), and since the output destination is specified from the kernel 13 (YES in step 106), the log is output only to the log recording unit 16 managed by the host OS 11. (Step 107). Then, it is determined whether there is log data (step 109). If there is log data, the process returns to step 105. If there is no log data, the process is terminated.
[0022]
In this embodiment, when the output destination is not specified from the kernel 13, the log output process 14 outputs logs to both the log recording unit 15 managed by the guest OS 12 and the log recording unit 16 managed by the host OS 11. However, the log may be output only to the log recording unit 15 managed by the guest OS 12.
In the above description, the log output process 14 is positioned as a process having a function of outputting a log to a designated output destination, and the kernel 13 instructs the log output process 14 to use the log recording unit 16 as an output destination. It was configured as follows. However, the kernel 13 informs the log output process 14 that the process has been requested to stop, and when the log output process 14 receives this information, the log recording unit 16 is set as the output destination. Good.
[0023]
Next, the process invisibility in step 103 will be described. The process invisibility refers to, for example, a setting that does not display information about a process (hereinafter, referred to as “invisible setting”) in response to a display request for a list of processes being executed from a user. That is, by making the invisible setting for the log output process 14, the kernel 13 does not display the log output process 14 as an executing process even if there is a request from the user. Can be seen as not running.
[0024]
The processing in this case will be described with reference to FIG.
The kernel 13 receives a request to display a list of processes being executed from the user (step 111), and reads information on one process from information on all processes managed by the kernel 13 (step 112). Then, it is determined whether or not the invisible setting is performed for the process (step 113). If the invisible setting is not performed, the process information is displayed (step 114), and then there is a next process. Judgment is made (step 115).
On the other hand, if the invisible setting is performed, it is determined whether or not there is a next process without displaying the process information (step 115).
If there is a next process, the process returns to step 112. If there is no next process, the process is terminated.
[0025]
In the first embodiment, with the configuration as described above, an intruder who stops the log output process 14 and performs unauthorized access assumes that the log output process 14 has been successfully stopped, The host OS 11 that cannot be perceived by a person has the effect of reliably collecting unauthorized access logs.
[0026]
(Second embodiment)
The second embodiment is an embodiment for reliably collecting data transmitted by the intruder to the guest OS 12 without the intruder knowing. Note that the data transmitted to the guest OS 12 is exemplified by command information entered by the intruder as a key, and therefore, the command information will be described below as an example. However, all data transmitted by the intruder may be collected. Further, specific data or all data received by the intruder may be collected.
FIG. 5 shows the operation flow of the second embodiment.
[0027]
The kernel 13 acquires command information sent from the intruder (step 201). For example, all character strings passed from the intruder to the shell are acquired. Then, the kernel 13 delivers the acquired command information to the host OS 11 (step 202), and performs processing based on the command information (step 203).
[0028]
In step 202, the system time is added to the command information as the time when the command information is input. Accordingly, it is possible to monitor command information sent from an intruder on the host OS 11 side using, for example, a screen as shown in FIG. In FIG. 7, the symbol “|” represents a field delimiter, and the fields are, in order from the left, time on the host OS 11, time on the guest OS 12, process ID, user ID, process name, file descriptor number, The terminal name, the type of the input character string, the length of the key input character string, and the key input character string are shown.
[0029]
The second embodiment has an effect that the data sent from the intruder can be reliably collected without being known to the intruder by the configuration as described above.
[0030]
(Third embodiment)
The third embodiment is an embodiment for reliably collecting external data brought from the outside by the intruder without being informed by the intruder. Note that bringing in external data refers to an act in which an intruder downloads binary data (for example, a program) or text data from an external network and places it in a storage device managed by the guest OS 12.
FIG. 6 shows the operation flow of the third embodiment.
[0031]
The kernel 13 detects that the intruder is trying to install external data (step 301). Then, the kernel 13 transfers the external data to the host OS 11 (step 302) and stores the external data (step 303).
[0032]
The third embodiment has an effect that the external data brought in from the outside by the intruder can be reliably collected without being informed by the intruder by the configuration as described above.
[0033]
(Fourth embodiment)
The fourth embodiment is an additional function to the first to third embodiments. That is, in the first to third embodiments, when an activity that is a precursor to the maintenance (transfer) of information from the guest OS 12 to the host OS 11 occurs, this is described as a personal computer, PDA, It notifies a device such as a mobile phone or a pager. For example, e-mail can be used as the notification means. Note that the notification destination information (information for specifying the notification destination device, e-mail address, etc.) may be defined in advance in the unauthorized access trace information maintenance device 10.
[0034]
For example, as an activity that is a precursor of command information maintenance as described in the second embodiment, there is a shell call. In addition, as an activity that is a precursor to the preservation of external data as described in the third embodiment, opening and closing of ports can be mentioned. In order to download and install external data, first the port is opened and the external data is downloaded there. An activity also includes access to an important file (password file or the like).
[0035]
In the fourth embodiment, as described above, the system administrator is notified of the maintenance of information from the guest OS 12 to the host OS 11 at the time of occurrence of the warning, so that the unauthorized access can be traced to the system administrator. It has the effect that it is possible to start immediately.
[0036]
(Fifth embodiment)
The fifth embodiment is also an additional function to the first to third embodiments. That is, even in the first to third embodiments, the password of the system administrator described in the server password file built on the guest OS 12 is rewritten, and the legitimate system administrator cannot log in to the server. This can happen. In this embodiment, in preparation for such a situation, an interface for accepting only communication from the host OS 11 is provided in the guest OS 12. That is, the system administrator who has the authority to log in to the host OS 11 can log in to the server on the guest OS 12 without entering a password. Since only the guest OS 12 is visible to the intruder, such an interface between the guest OS 12 and the host OS 11 is not visible to the intruder.
[0037]
The fifth embodiment has an effect that it is possible to log in from the host OS 11 even if the password of the system administrator in the server on the guest OS 12 is rewritten by the configuration as described above.
[0038]
Note that the communication that can be accepted by the interface provided in this embodiment is not limited to that from the host OS 11, but can be from the entire network. In that case, a function for establishing communication for providing an interface to the shell when a specific packet is received is incorporated in the kernel 13. Alternatively, the kernel 13 may incorporate a function of resetting the system administrator password when a specific packet is received. Thus, the system administrator whose password has been rewritten can log in to the server without inputting the password by sending this specific packet to the kernel 13 from any computer on the network.
Furthermore, by incorporating a recovery user account (user ID and password) not described in the password file into the kernel 13, it is possible to adopt a configuration that enables login with the user ID and password. .
[0039]
【The invention's effect】
Thus, according to the present invention, it is possible to reliably collect unauthorized access trace information without the intruder knowing it.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an overall configuration of a computer system to which the exemplary embodiment is applied.
FIG. 2 is a diagram showing a software configuration of an unauthorized access trace information maintenance apparatus according to the present embodiment.
FIG. 3 is a flowchart showing the processing operation of the first example in the present embodiment.
FIG. 4 is a flowchart for explaining process invisibility in the first example of the present embodiment;
FIG. 5 is a flowchart showing a processing operation of a second example of the present embodiment.
FIG. 6 is a flowchart showing a processing operation of a third example of the present embodiment.
FIG. 7 is a diagram showing a screen output example according to a second example of the present embodiment;
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 ... Unauthorized access trace information maintenance apparatus, 11 ... Host OS, 12 ... Guest OS, 13 ... Kernel, 14 ... Log output process, 15, 16 ... Log recording part

Claims (5)

On a computer device on which a virtual operating system that is set to be connectable from the network operates on a real operating system that is set to be unable to connect from the network ,
The virtual on operating systems on the virtual log of unauthorized access to the operating system, the first log recording unit wherein not under the control of the real operating system manages the virtual operating system, or the virtual operating system Log output means for outputting to a second log recording unit managed by
In response to a request to stop the log output unit, the log output unit controls the log to be output to the first log recording unit and not to the second log recording unit , and a list of processes being executed An unauthorized access information maintenance apparatus comprising: a control unit configured to perform invisible setting on the log output unit so that process information is not displayed even when there is a display request . 2. The unauthorized access information maintenance apparatus according to claim 1 , wherein the control means responds to the request for stopping the log output means that the log output means has been stopped. The unauthorized access information maintenance apparatus according to claim 1, wherein the virtual operating system includes an interface for logging in from the real operating system. On a computer device on which a virtual operating system that is set to be connectable from the network operates on a real operating system that is set to be unable to connect from the network ,
A first process running on the virtual operating system collecting a log of unauthorized access to the virtual operating system;
A first process running on the virtual operating system passing the collected log of unauthorized access to the real operating system ;
The invisible setting is such that the second process operating on the virtual operating system does not display process information in response to a request to display a list of running processes in response to a request to stop the first process. unauthorized access information maintenance method characterized by comprising the step of performing setting for the first process. On a real operating system that is configured so that it cannot be connected from the network, to a computer device that runs a virtual operating system that is configured so that it can be connected from the network .
A function implemented on the virtual operating system, the function of collecting a log of unauthorized access to the virtual operating system;
A function implemented on the virtual operating system, the function of passing the collected log of unauthorized access to the real operating system ;
An invisible setting that is a function that operates on the virtual operating system and is configured to not display process information even when there is a request to display a list of running processes in response to a request to stop the function to be transferred A program for realizing a function to be performed for the passing function .

Images