JP5402169B2 - Execution control program and information processing system - Google Patents

Description

  The present invention relates to an execution control program and an information processing system.

  In recent years, with the spread of the Internet, damage caused by malicious programs such as computer viruses has increased. Such a malicious program, for example, replaces a normal program with itself, impersonates a normal program, and executes unauthorized processing.

  To find it, store the hash value of a normal program in advance, and compare it with the hash value of the executable file of the program of the same name that requests processing (writing, reading, etc.) to another program To check if the executable file has been tampered with. If tampering is found, the processing request is rejected.

JP 2007-140798 A

  However, although the above-described conventional technique is effective for detecting tampering, a problem arises when the program is properly updated. This problem will be described in detail. The hash value used in the above conventional technique is calculated using the value of the bit string in the program. For this reason, the hash value of the program before and after the update is different even if a person with a legitimate authority corrects the problem of the program or upgrades the version. For this reason, even if a program created by a person with legitimate authority updates another program for a legitimate purpose, the hash value of the updated program is different, so it can be executed even if it tries to execute the updated program. It will disappear.

  Furthermore, a more serious problem is that it is not enough to compare the hash values of programs to determine whether a program that is trying to update another program is truly legitimate. It is. That is, when a plurality of hash values of a program that is permitted to execute are registered, any program is permitted to be written to another program if it matches any one of the hash values. However, since it is not managed by which hash value program (= updater) the program to be written is to be updated, it is updated by an unrelated program, and as a result, the updated program operates. There is a fear that it will not.

  For example, recent word processing software and spreadsheet software have a function of describing a specific operation procedure as a program and performing automation. This program description language is called a macro language. Word processor software and spreadsheet software itself are programs registered in advance with hash values, but it is possible for word processor software to rewrite spreadsheet software using the macro function of word processor software created by a malicious user. . This is because when the user directly inputs the file name, the application program automatically saves the file with the extension for its own program, but when processing from the program as in macro processing, the file name can be freely set. This is because it can be defined. Specifically, a process for defining a file name of an execution program of spreadsheet software and storing a specific file using a macro function of word processing software is described. If a user opens a file of a word processing software set with such a macro function and executes the macro function, the execution program of the spreadsheet software is rewritten. As a result, spreadsheet software cannot be used.

  From the above, it is a serious problem to allow the updating of a legitimate program while preventing the unauthorized alteration of the program. The disclosed technology has been made in view of the above, and it is an object of the present invention to provide an execution control program and an information processing system capable of preventing unauthorized update of a program while permitting authorized update of the program. And

  The execution control program disclosed in the present application is, in one aspect, an introduction control procedure in which, when a plurality of programs are introduced by the introduction program, the plurality of programs introduced by the introduction program are associated and recorded as introduction information. And receiving an update processing request from the second program to the first program, referring to the introduction information, and determining whether the first program and the second program are associated with each other. If they are associated with each other, the computer allows the computer to execute an update control procedure for permitting the update process, and, on the other hand, for rejecting the update process.

  According to one aspect of the execution control program and the information processing system disclosed in the present application, it is possible to prevent unauthorized updating of a program while allowing authorized updating of the program.

FIG. 1 is a diagram for explaining the program execution control method according to the present embodiment. FIG. 2 is a diagram illustrating the configuration of the information processing system according to the present embodiment. FIG. 3 is a block diagram illustrating a configuration of the information processing apparatus. FIG. 4 is a diagram illustrating an example of a white list. FIG. 5 is a diagram illustrating an example of the introduction history. FIG. 6 is a diagram illustrating an example of the update history. FIG. 7 is a flowchart showing the processing procedure of the execution control program. FIG. 8 is a flowchart showing the processing procedure of the introductory program write processing. FIG. 9 is a flowchart showing a processing procedure of non-introduction program writing processing. FIG. 10 is a flowchart illustrating the processing procedure of the operation determination process. FIG. 11 is a flowchart showing a processing procedure of whitelist update processing. FIG. 12 is a flowchart illustrating an example of a processing procedure of whitelist integration processing. FIG. 13 is a diagram illustrating an example of an operation command issued by the OS when the program performs a file operation. FIG. 14 is an example of a management table for managing processes by the OS. FIG. 15 is a diagram illustrating an example of information necessary for specifying a process that has performed a file operation. FIG. 16 is a flowchart illustrating an example of the processing procedure of the introduction process. FIG. 17 is a flowchart illustrating an example of a processing procedure of update processing.

  Embodiments of an execution control program and an information processing system disclosed in the present application will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

  First, a program execution control method according to the present embodiment will be described. FIG. 1 is a diagram for explaining the program execution control method according to the present embodiment. In the example illustrated in FIG. 1, a main program A, a main program B, an update program B, and an introduction history 175 are stored in the hard disk device 170 included in the information processing apparatus.

  The main program A and the main program B are application programs used for predetermined purposes. The update program B is a program for updating the main program B for repairing defects and improving functions. The introduction history 175 is a file that records which installation program has introduced each program. The introduction program is a program including a program to be introduced and a setting file and various procedures for installing them.

  Here, how the main program A and the like are introduced by the introduction program will be described with reference to FIG. FIG. 16 is a diagram illustrating an example of program introduction processing by the introduction program. As shown in FIG. 16, when the introduction program is activated (step S101), the introduction program verifies whether an environment such as an OS (Operating System) is suitable for introduction of the program (step S102). If the environment is not suitable (No at Step S103), the introduction program ends the process without introducing the program.

  On the other hand, if the environment is suitable (Yes at Step S103), the introduction program acquires parameters input by the user for the designation of the introduction destination (Step S104), and expands the introduction target file to a temporary area (Step S104). S105). The files expanded here include programs and setting files.

  Then, the installation program transfers the installation target file to the installation destination (step S106), and performs environment settings necessary for the installation target program to operate on the OS or the like (step S107). Finally, the introduction program clears the temporary area and ends the introduction process (step S108).

  Thus, a plurality of files can be introduced in the program introduction process by the introduction program. The introduction history 175 shown in FIG. 1 indicates that one file called the main program A was introduced by the introduction program A, and two files called the main program B and the update program B were introduced by the introduction program B. .

  Next, how a main program such as the main program B is updated by an update program such as the update program B will be described with reference to FIG. FIG. 17 is a diagram illustrating an example of a program update process performed by the update program. As shown in FIG. 17, when the main program is started (step S201), the main program execution process starts the update program (step S202). Then, the execution process of the update program makes an inquiry to a predetermined server or the like to check whether there is an update file (step S203).

  If there is no update file (No at step S204), the update program execution process ends (step S205), and the main program execution process starts executing various processes (step S206). If the execution process of the update program has ended the execution process of the main program, the execution process of the update program starts the main program before ending itself.

  On the other hand, if there is an update file (Yes at step S204), the update program execution process downloads the update file (step S207). The update program execution process confirms the existence of the main program execution process (step S208). If the main program execution process exists (Yes at step S209), the main program cannot be updated as it is, so the update program execution process ends the main program execution process (step S210). ).

  Subsequently, the execution process of the update program decompresses the update file in the temporary area (step S211), and overwrites the main program with the decompressed file and updates it (step S212). Then, the execution process of the update program clears the temporary area (step S213), and then restarts the processing procedure from step S203 in order to check whether there is a further update file.

  Thus, in the program update process by the update program, the update target program is overwritten by the update program. Although overwriting of the program by such an update program is indispensable for repairing a defect or the like, overwriting of the program by a malicious program due to a computer virus or the like must be prevented.

  In order to solve this conflicting problem, in the program execution control method according to the present embodiment, the correspondence between the introduction program and the introduction program is recorded in the introduction history 175 during the introduction process by the introduction program. When the program is about to be overwritten, it is determined based on the introduction history 175 whether overwriting is executed as it is or overwriting is stopped.

  For example, in the example of the introduction history 175 shown in FIG. 1, it can be seen that the main program B and the update program B are introduced by the same introduction program. Since the programs introduced from the same introduction program are provided by the same vendor, it is considered that there is no danger even if one program overwrites the other program. Therefore, in the program execution control method according to the present embodiment, when the update program B tries to overwrite the main program B, the overwriting is executed as it is.

  On the other hand, in the example of the introduction history 175 shown in FIG. 1, it can be seen that the main program A and the main program B are introduced by different introduction programs. Since it is unclear whether programs installed from different installation programs are provided by the same vendor, there is no guarantee that one program can safely overwrite the other program. Therefore, in the program execution control method according to the present embodiment, when the main program A attempts to overwrite the main program B, the overwriting is stopped.

  As described above, in the program execution control method according to the present embodiment, an illegal program is determined by determining whether or not overwriting is possible based on whether or not the writing source program and the writing destination program are introduced by the same introduction program. Overwriting can be prevented. That is, by recording the correspondence between the introduction program and the introduction program in the introduction history 175 during the introduction process, it is possible to realize the above-described availability determination without imposing a burden on the system administrator. In addition, in the program execution control method according to the present embodiment, not only the program is overwritten by malicious intention but also the program can be prevented from being overwritten by mistake, malfunction, malfunction or the like.

  In the update process shown in FIG. 17, the main program starts the update program at the time of startup. However, the update program is started at the time of starting the OS or at a predetermined time regardless of the start of the main program. It is good.

  Next, the information processing system 1 according to the present embodiment will be described. FIG. 2 is a diagram illustrating a configuration of the information processing system 1 according to the present embodiment. In addition to the program execution control method described above, the information processing system 1 also executes control for restricting the operations of programs that are not registered in the white list. The white list is a file in which information related to programs that can be executed as usual is registered. Programs that are not registered here are subject to some restrictions during execution.

  As shown in FIG. 2, the information processing system 1 includes information processing apparatuses 10a to 10c, a server 20, and a network 30 that connects them. The information processing devices 10a to 10c are, for example, personal computers, and are connected to external storage devices 11a to 11c, respectively. The information processing apparatuses 10a to 10c execute information processing requested by users and other apparatuses, and also execute the above-described program execution control method and the like.

  The server 20 centrally manages the white list 21. The white list 21 stored in the server 20 is distributed from the server 20 to the information processing apparatuses 10a to 10c, and is used in the information processing apparatuses 10a to 10c to determine whether the program can be executed normally. . The white list 21 may be updated in the information processing apparatuses 10a to 10c. In this case, the difference is transmitted from the information processing apparatuses 10a to 10c to the server 20.

  The network 30 is connected to the Internet 31. The information processing apparatuses 10 a to 10 c are connected to the update file providing apparatus 22 via the network 30 and the Internet 31. The update file providing device 22 is a device that holds an update file for updating a program.

  Note that the information processing system 1 illustrated in FIG. 2 is an example, and the number of devices included in the information processing system 1 and the connection paths between the devices do not have to be as illustrated in FIG.

  Next, the configuration of the information processing apparatuses 10a to 10c illustrated in FIG. 2 will be described. Note that the information processing apparatuses 10a to 10c all have the same configuration, and therefore, the configuration will be described using the information processing apparatus 10a as an example.

  FIG. 3 is a block diagram illustrating a configuration of the information processing apparatus 10a. As shown in FIG. 3, the information processing apparatus 10a includes a CPU (Central Processing Unit) 110, an input unit 120, a display unit 130, a network interface unit (hereinafter referred to as “network I / F unit”) 140, An input / output interface unit (hereinafter referred to as “input / output I / F unit”) 150, a storage medium reading unit 160, a hard disk device 170, a RAM (Random Access Memory) 180, and a bus 190 for connecting them. .

  The CPU 110 is an arithmetic circuit that executes various arithmetic processes. The input unit 120 is a device for a user to input instructions and information, and is, for example, a keyboard or a mouse. The display unit 130 is a device that displays characters and graphics, for example, a liquid crystal display device. The network I / F unit 140 realizes communication with other devices connected via the network 30. The input / output I / F unit 150 realizes data input / output with the external storage device 11a.

  The storage medium reading unit 160 reads / writes data from / to a storage medium such as an optical disk. The hard disk device 170 is a storage device that stores various files. The RAM 180 is a work memory in which programs and data are expanded.

  The hard disk device 170 stores, for example, an OS program 171, an application program 172, an execution control program 173, a white list 174, an introduction history 175, and an update history 176.

  The OS program 171 is a program that implements various functions of the OS. The OS program 171 is read from the hard disk device 170 by the CPU 110 when the information processing apparatus 10 a is started up and is expanded in the RAM 180 to function as the OS 181.

  The application program 172 is read from the hard disk device 170 by the CPU 110 and expanded into the RAM 180 to become an execution process 183, which executes predetermined processing while making various requests to the OS 181. The application program 172 includes an update program for updating other programs.

  The execution control program 173 controls the operation of the program based on the white list 174 and prevents the program from being overwritten illegally by another program. The execution control program 173 is read from the hard disk device 170 by the CPU 110 after activation of the OS 181 in accordance with an instruction from the OS 181, developed in the RAM 180, and functions as the execution control process 182. A part of the execution control program 173 is incorporated in the OS 181 so as to function as the file access control unit 181a.

  The file access control unit 181a monitors and controls the reading process and the writing process executed by the OS 181 on the hard disk device 170 based on requests from the various execution processes 183.

  Here, the file access control unit 181 a traps an application program interface (hereinafter, “API”) prepared by the OS 181 that is used by the execution process 183 to perform file access of the hard disk device 170 via the OS 181. In addition, by separating the function of the file access control unit 181a from the execution control program 173 and mounting it as a file system driver of the OS 181, the 181 a is started when the OS 181 is started, and is executed from the execution process 183 via the OS 181. File access to the hard disk device 170 can be trapped. Alternatively, the execution control program 173 itself may be included in the OS 181 as a driver.

  Specifically, when the OS 181 issues a read instruction or a write instruction to the driver that controls the hard disk device 170, the file access control unit 181a temporarily traps the instruction. Then, the contents of the instruction and the application program 172 that is the entity of the instructing process are acquired from the management table of the OS 181, and the information is sent to the execution control process 182 as information in the format of FIG. 15.

  FIG. 13 shows a data format of a command for the OS 181 to issue a read instruction or a write instruction to the hard disk device 170.

  This command includes the process number of the execution process 183 that issued the instruction, a file operation command such as a write process and a read process for the hard disk device 170, and file operation data. The file operation data includes the target file name in the case of writing or reading processing, and information for further writing when the writing processing is designated.

  The process number is a unique number assigned when the application program 172 becomes the execution process 183 in order to manage an execution process having a plurality of OSs 181.

  Next, a procedure for specifying the application program 172 from the process number is shown.

  The file access control unit 181a obtains information related to an execution process that has requested the OS 181 for read processing and write processing from the management table (FIG. 14) in the OS 181. The process number is extracted from the instruction (FIG. 13) acquired by the file access control unit 181a, and compared with the management table (FIG. 14) of the OS 181 to acquire the program path of the application. The program path of this application is information of the application program 172 stored in the hard disk device 170 of FIG. Next, the parent process number corresponding to the process number is acquired from the management table (FIG. 14). If this is not 0 indicating the IDLE process that is the starting point of all processes, the management table is set with the parent process number as the new process number. Compare with FIG. The program path of the retroactive application is acquired until the parent process number becomes zero.

  As a result, the file access control unit 181a generates information that summarizes the process number, the parent process number, the module name, and the application program path as shown in FIG. 15, which is information to be passed to the operation control unit 182a.

  13 and 14 are examples, and the configuration differs depending on the OS.

  Then, the file access control unit 181a performs processing for executing the read instruction and the write instruction as they are, canceling them, or changing the contents of the instructions according to the response from the execution control process 182.

  The execution control process 182 includes an operation control unit 182a, an operation determination unit 182b, an introduction control unit 182c, an update control unit 182d, and a white list update unit 182e. The operation control unit 182a is a control unit that controls the execution control process 182 as a whole, and calls the functions of the operation determination unit 182b, the introduction control unit 182c, or the update control unit 182d according to the notification content from the file access control unit 181a. .

  The operation determination unit 182b determines whether or not the designated program is registered in the white list 174 as a program that may be executed as usual. An example of the white list 174 is shown in FIG. As shown in FIG. 4, the white list 174 has items such as a name, a file name, a version, and a hash value.

  The name is the name of the program. The file name is a physical file name of the program. The version is a number for identifying the version of the program. The hash value is a hash value generated by inputting a program into a hash function.

  Specifically, the operation determination unit 182b generates a hash value from the application program of the designated program, and if the white list 174 has a row having the same hash value as the hash value, the program is executed as usual. It is determined that the program can be executed. If the white list 174 does not contain a row having the same hash value as the generated hash value, the hash value is generated from the program of the parent process, and again compared with the white list 174 for determination. If all the parent processes are checked and the white list 174 is not met, it is determined that the program is not a program that can be executed as usual.

  The introduction control unit 182c monitors the introduction process by the introduction program, and records the correspondence between the introduction program and the introduction program in the introduction history 175. An example of the introduction history 175 is shown in FIG. As illustrated in FIG. 5, the introduction history 175 has items such as an introduction program ID, an introduction program name, an introduced program path name, a version, and a hash value, and a row is added for each installed program.

  The introduction program ID is a unique number assigned for each introduction process by the introduction program. The introduction program name is the name of the introduction program. The installed program path name is a file name with a path of a program installed by the installed program. The version is a number indicating the version of the program installed by the installation program. The hash value is a hash value of a program introduced by the introduction program.

  The value of the introduction program ID in the first and second lines of the introduction history 175 shown in FIG. 5 is common to “INS001”. This indicates that the introduced programs corresponding to the first and second lines are introduced by the same introduction process, that is, introduced by the same introduction program.

  The update control unit 182d monitors the writing process other than the introduction process by the introduction program, prevents the program from being overwritten illegally, and records the result in the update history 176 when the program is properly updated. To do. An example of the update history 176 is shown in FIG. As illustrated in FIG. 6, the update history 176 includes items such as a serial number, an updated program path name, a previous version, a new version, a previous hash value, and a new hash value.

  The serial number is a unique number that is counted up each time a row is added. The update program path name is a file name with the path of the program updated by the update program. The previous version is the number of the version before the update of the program updated by the update program. The new version is an updated version number of the program updated by the update program. The previous hash value is a hash value before the update of the program updated by the update program. The new hash value is an updated hash value of the program updated by the update program.

  The first and third lines of the update history 176 shown in FIG. 6 relate to the same program and indicate that this program has been updated twice. That is, in the first update corresponding to the first row, the program with the version “9.0” and the hash value “873jd75d” is updated to the program with the version “9.1” and the hash value “83s84j7z”. ing. In the second update corresponding to the third line, the program with the version “9.1” and the hash value “83s84j7z” is updated to the program with the version “9.2” and the hash value “93fg492s”. ing.

  The update control unit 182d verifies whether or not these programs have been introduced by the same introduction program, as described above, in order to determine whether or not the program to update another program is valid. For this verification, the update control unit 182d refers to the update history 176 in addition to the introduction history 175.

  Since only the hash value at the time of introduction of the program remains in the introduction history 175, if the program has already been updated, the current hash value of the program is checked against the introduction history 175. It is not possible to determine whether it was introduced by the installation program. Although it is conceivable to check by the installed program path name, it is not preferable because the path may be changed for some reason.

  Therefore, the update control unit 182d compares the current hash value of the program with the introduction history 175, and if it cannot be identified by which introduction program the introduction program is installed, the update control unit 182d refers to the update history 176 to determine the hash value of the program at the time of introduction. get. Then, the acquired hash value at the time of introduction is compared with the introduction history 175 to identify which introduction program has been used for introduction.

  For example, in the case of the program updated twice in the example shown in FIG. 6, the current hash value “93fg492s” is set to the previous one from the data in the third row in which the value of the new hash item is set. The hash value “83s84j7z” is acquired. Subsequently, “873jd75d” that is the second previous hash value is acquired from the data in the first row in which “83s84j7z” that is the previous hash value is set as the value of the item of the new hash.

  And since there is no row in the update history 176 in which the second hash value “873jd75d” is set as the value of the new hash item, “873jd75d” is acquired as the hash value of the program at the time of introduction. The By comparing this “873jd75d” with the introduction history 175 shown in FIG. 5, “INS001” which is the introduction program ID of the introduction program is acquired.

  The update control unit 182d adds the updated program information to the white list 174 if the updated program is registered in the white list 174 when the program is properly updated. This is because the hash value of the updated program has changed, and if this is not done, the updated program will not be executed normally.

  The white list update unit 182e executes update processing of the white list 174. Specifically, the white list update unit 182e makes an inquiry to the server 20, and if the white list 21 has been updated, the white list 21 is downloaded. Then, the white list update unit 182e integrates the white list 21 into the white list 174. The update history is also updated during the integration process. The update of the update history is not performed by the white list update unit 182e, but is updated in the form of requesting an update process to the update processing unit 182d.

  Then, the white list update unit 182e compares the integrated white list 174 with the white list 21 and transmits the difference to the server 20 if there is a difference. This difference is added by the update control unit 182d so that the program updated by the update program operates normally, and is used for the update work of the white list 21 in the server 20.

  Next, the procedure of processing executed by the execution control program 173 shown in FIG. 3 will be described. FIG. 7 is a flowchart showing the processing procedure of the execution control program 173. As shown in FIG. 7, when the execution control program 173 is activated, the white list update unit 182e executes a white list update process described later to update the white list 174 (step S301).

  Subsequently, the operation control unit 182a waits for a file access notification from the file access control unit 181a (step S302). If there is a notification regarding the writing process (Yes at Step S303), the operation control unit 182a identifies the process that has requested the OS 181 to perform the writing process based on the information included in the notification (Step S304). .

  Here, if the process that requested the writing process is the one in which the introduction program is in an execution state (Yes at Step S305), the operation control unit 182a sends the introduction program writing process described later to the introduction control unit 182c. This is executed (step S306). Note that whether or not the introduction program is in an execution state can be determined based on, for example, the extension of the program or the behavior of the process. For example, in the Windows (registered trademark) OS of Microsoft Corp., it is stipulated that the installation program is implemented according to a procedure prescribed by Microsoft Corp. and uses msi as an extension. Prior to the introduction of the introduction program, it was recommended that the introduction program introduced by the introduction program be compiled in a cab format with an extension called a cabinet format. From the above, in the Windows (registered trademark) OS, it is determined whether the program is an installation program with an extension such as msi or cab.

  In other OSs such as UNIX (registered trademark) and their derivative OS, Linux (registered trademark) and BSD, a management program for managing the installed program is determined by each OS. It is possible to determine that the activated file is an installation program.

  On the other hand, if the process that requested the writing process is not the one in which the introduction program is in an execution state (No in step S305), the operation control unit 182a sends the non-introduction program writing process to be described later to the update control unit 182d. This is executed (step S307).

  When the file access control unit 181a receives a notification regarding the reading process (No at Step S303), the operation control unit 182a identifies the process that has requested the OS 181 to perform the reading process based on information included in the notification. (Step S308). Here, if the process that requested the read process is the one in which the introduction program has been executed (Yes at step S309), the operation control unit 182a instructs the file access control unit 181a to execute the read process as it is. (Step S313).

  On the other hand, if the process that requested the read process is not the one in which the introduction program is in the execution state (No at Step S309), the operation control unit 182a causes the operation determination unit 182b to execute an operation determination process described later (Step S310). ). As a result, if it is found that the process that requested the read process may execute the normal process (Yes in step S311), the operation control unit 182a causes the file access control unit to execute the read process as it is. Instruct 181a (step S313).

  If it is found that the process that requested the reading process is not a process that can execute the normal process (No in step S311), the operation control unit 182a instructs the file access control unit 181a to cancel the reading process. (Step S312).

  After completing the above processing procedure, the operation control unit 182a returns to step S302 and waits for the next notification from the file access control unit 181a.

  FIG. 8 is a flowchart showing a processing procedure of the introductory program writing process (step S306) shown in FIG. As shown in FIG. 8, firstly, an operation determination process by the operation determination unit 182b is executed (step S401). Here, if it is found that the introduction program may not execute the normal processing (No at Step S402), the introduction control unit 182c accesses the file so as to change the write destination path to the external storage device 11a. The control unit 181a is instructed (step S403).

  As described above, the execution control program 173 changes the installation destination of the program to a place different from the normal place, even if the introduction process is not registered in the white list. And after installing the program, although it imposes restrictions on reading and writing of files, it can be started. By such control, it becomes possible to confirm in a safe state the operation and function of a program that is not officially permitted to be executed. Note that the change destination of the write destination path may not be the external storage device 11a as long as it does not adversely affect other programs.

  On the other hand, if it is found that the introduction program can execute the normal processing (Yes at Step S402), the introduction control unit 182c determines the information on the write destination file based on the information included in the notification. Is acquired (step S404). If the writing destination file is not a program (No at Step S405), the introduction control unit 182c instructs the file access control unit 181a to execute the writing process as it is (Step S407).

  If the write destination file is a program (Yes at step S405), the introduction control unit 182c stores the information of the introduction program and the introduction program in the introduction history 175 in association with each other (step S406). Then, the introduction control unit 182c instructs the file access control unit 181a to execute the writing process as it is (step S407).

  FIG. 9 is a flowchart showing a processing procedure of the non-introduction program writing process (step S307) shown in FIG. As shown in FIG. 9, first, an operation determination process by the operation determination unit 182b is executed (step S501). Here, if it is found that the request source program may not execute normal processing (No in step S502), the update control unit 182d changes the write destination path to the external storage device 11a. The file access control unit 181a is instructed (step S503).

  On the other hand, if it is found that the request source program can execute normal processing (Yes in step S502), the update control unit 182d determines that the write destination file is based on the information included in the notification. The information regarding is acquired (step S504). If the writing destination file is not registered in the white list 174 (No in step S505), the update control unit 182d instructs the file access control unit 181a to execute the writing process as it is (step S505). S515).

  If the write destination file is registered in the white list 174 (Yes at step S505), the update control unit 182d refers to the introduction history 175 and the update history 176, and introduces the program corresponding to the write destination program. A program ID is acquired (step S506). In addition, the update control unit 182d refers to the introduction history 175 and the update history 176, and acquires the introduction program ID corresponding to the program that requested the writing process (step S508).

  Here, if neither of them can be acquired (No at Step S507 or No at Step S509), it means that the programs are not installed by the same introduction program, so the update control unit 182d cancels the writing process (Step S507). S512).

  Further, when both of the introduction program IDs can be acquired (Yes at Step S507 and Yes at Step S509), the update control unit 182d compares the acquired introduction program IDs (Step S510). Here, even if the installation program IDs do not match (No in step S511), the programs are not installed by the same installation program, so the update control unit 182d cancels the writing process (step S511). S512).

  On the other hand, when the introduction program IDs match (Yes at Step S511), the update control unit 182d adds information to the update history 176 (Step S513). Further, the update control unit 182d updates the information in the white list 174 corresponding to the program to be written so that the updated program can be executed normally (step S514). Then, the update control unit 182d instructs the file access control unit 181a to execute the writing process as it is (step S515).

  In the processing procedure shown in FIG. 9, the process for confirming the matching of the installed programs when the program is about to be overwritten is performed only for the programs registered in the white list 174. By controlling in this way, it is possible to reduce the load caused by the process of confirming the matching of the introduction programs.

  FIG. 10 is a flowchart showing a processing procedure of the operation determination processing (step S310, step S401, step S501) shown in FIGS. As illustrated in FIG. 10, the operation determination unit 182b acquires information related to the determination target process from the information acquired by the file access control unit 181a and notified to the operation control unit 182a (step S601). Then, the operation determination unit 182b generates a hash value from a program corresponding to the determination target process (step S602), and searches the white list 174 using the hash value as a search key (step S603).

  If the search is hit (Yes at Step S604), the operation determination unit 182b determines that the determination target process may be executed as usual (Step S605). On the other hand, when the search does not hit (No at Step S604), the operation determination unit 182b confirms the presence / absence of the parent process from the information related to the determination target process (Step S606). If there is no parent process (No at Step S607), it is determined that the process to be determined cannot be executed normally (Step S608). If a parent process exists (Yes at step S607), a hash value is generated from the program of the parent process (step S609), and the white list 174 is searched again using the hash value of the parent process as a search key (step S603).

  FIG. 11 is a flowchart showing a processing procedure of the white list update process shown in FIG. As shown in FIG. 11, the white list update unit 182e inquires of the server 20 whether or not the white list 21 is updated (step S701). If there is no update (No at step S702), the white list update process ends.

  If there is an update (Yes at Step S702), the white list updating unit 182e downloads the white list 21 from the server 20 (Step S703) and integrates it into the white list 174 (Step S704). Then, the white list update unit 182e compares the integrated white list 174 with the white list 21 (step S705), and if there is a difference (Yes in step S706), transmits the difference to the server 20 (step S707).

  FIG. 12 is a flowchart illustrating a processing procedure of processing (step S704) for integrating the white list illustrated in FIG. One line is read from the white list 21 (step S801). If the reading is successful (Yes in step S802), the white list 21 and the white list 174 before integration are compared, and the hash value is confirmed (step S803). For the programs with the matching hash values (Yes at step S804), the white list 21 and the white list 174 determine that the programs are integrated, and the process returns to step S801 to read the next line from the white list 21.

  For programs whose hash values do not match (No in step S804), it is checked whether either the name or the file name matches (step S805). If they match (Yes in step S806), the version number is changed. When the comparison is made (step S807) and the white list 21 is the same or larger than the white list 174 (Yes at step S808), the white list 174 is integrated (step S809). It is necessary to add information to the update history 176 following the integration process (step S810). At this time, the white list update unit 182e notifies the update control unit 182d and requests the update history 176 to add information. Then, the process returns to step S801, and the next line is read from the white list 21.

  Conversely, if the version number is compared and the white list 174 is larger than the white list 21 (No in step S808), the white list 174 is newer than the white list 21 and is not integrated into the white list 174. Returning to step S801, the next line is read from the white list 21. If neither the name nor the file name match (No in step S806), the white list 21 is integrated into the white list 174 as a new program (step S811), and the process returns to step S801 to return to the next list from the white list 21. Read one line.

  If all the lines of the white list 21 have been processed (No at step S802), the process of integrating the white list is ended.

  As described above, in this embodiment, since the update of the program is controlled based on the information acquired when the program is introduced, it is possible to prevent the program from being illegally updated without taking time and effort.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Supplementary Note 1) When a plurality of programs are introduced by the introduction program, an introduction control procedure for recording the plurality of programs introduced by the introduction program as introduction information in association with each other;
An update process request from the second program is received with respect to the first program, the introduction information is referred to, and it is determined whether or not the first program and the second program are associated with each other. An execution control program that causes the computer to execute an update control procedure that permits the update process if it is attached, and rejects the update process if it is not associated.

(Additional remark 2) Let a computer further perform the operation control procedure which defines operation | movement of a specific program based on a program list,
The introduction information is associated with the introduction program, the program introduced by the introduction program is managed, and the update control procedure is performed when the second program is permitted to operate based on the program list. Refer to the introduction information, compare the introduction program associated with the second program with the introduction program associated with the first program, and determine whether the two introduction programs match. The execution control program according to appendix 1, wherein the update process of the second program is permitted if they match, and the update process is rejected if they do not match.

(Supplementary Note 3) In the program list, when the operation of the first program is permitted in the program list, the update control procedure is performed when the first program is updated by the second program. The execution control program according to appendix 2, wherein update information indicating that the program has been updated is recorded in the program list.

(Supplementary Note 4) When download data downloaded from an external device is integrated into the program list and the download data does not include update information indicating that the first program has been updated, the update information is The execution control program according to appendix 3, further causing a computer to execute a list update procedure to be transmitted to the external device.

(Appendix 5) When a plurality of programs are introduced by the introduction program, introduction control means for associating and recording the plurality of programs introduced by the introduction program as introduction information;
An update process request from the second program is received with respect to the first program, the introduction information is referred to, and it is determined whether or not the first program and the second program are associated with each other. And an update control means for permitting the update process if it is attached, and rejecting the update process if it is not associated.

(Supplementary Note 6) When a plurality of programs are introduced by the introduction program, an introduction control step of associating and recording the plurality of programs introduced by the introduction program as introduction information;
An update process request from the second program is received with respect to the first program, the introduction information is referred to, and it is determined whether or not the first program and the second program are associated with each other. And an update control step of permitting the update process if it is attached, and rejecting the update process if it is not associated.

(Supplementary note 7) An information processing system including a server and an information processing device,
The server
A storage unit for storing a program list for defining the operation of a specific program;
A transmission unit that transmits the program list stored in the storage unit to the information processing apparatus,
The information processing apparatus includes:
A receiving unit for receiving the program list from the server;
An operation control unit that defines the operation of a specific program based on the received program list;
When a plurality of programs are introduced by the introduction program, an introduction control unit that records a plurality of programs introduced by the introduction program as introduction information in association with each other,
When receiving an update processing request from the second program for the first program and determining that the operation of the second program is permitted based on the program list, further refer to the introduction information, It is determined whether or not the first program and the second program are associated with each other, and if they are associated with each other, the update processing request of the second program is permitted. Is an update control unit that rejects the update processing request;
An information processing system comprising:

1 Information processing system 10a-c Information processing apparatus 110 CPU
120 Input unit 130 Display unit 140 Network I / F unit 150 Input / output I / F unit 160 Storage medium reading unit 170 Hard disk device 171 OS program 172 Application program
173 Execution control program 174 White list 175 Introduction history 176 Update history 180 RAM
181 OS
181a File access control unit 182 Execution control process 182a Operation control unit 182b Operation determination unit 182c Update control unit 182d Update control unit 182e White list update unit 183 Execution process 190 Bus 11a-c External storage device 20 Server 21 White list 22 Provide update file Device 30 Network 31 Internet

Claims (3)

When a plurality of programs are introduced by the introduction program, an introduction control procedure for recording the plurality of programs introduced by the introduction program as introduction information in association with the introduction program ;
An operation control procedure that defines the operation of a specific program based on a program list;
When an update processing request from the second program is received with respect to the first program and the operation of the second program is permitted based on the program list, the introduction information is referred to, and the second program The introduction program associated with the first program is compared with the introduction program associated with the first program, and it is determined whether or not the two introduction programs match. When the first program is updated by the second program when the first program is permitted in the program list and the operation of the first program is permitted in the program list, Update information indicating that the first program has been updated is recorded in the program list, and the first program is properly When new is, when the first program that has been updated is registered in the program list, while adding information of the updated programs in the program list,
An execution control program that causes a computer to execute an update control procedure that rejects the update process when the two introduction programs do not match . Download data downloaded from an external device is integrated into the program list, and if the download data does not include update information indicating that the first program has been updated, the update information is sent to the external device. The execution control program according to claim 1 , further causing the computer to execute a list update procedure to be transmitted. An information processing system including a server and an information processing device,
The server
A storage unit for storing a program list for defining the operation of a specific program;
A transmission unit that transmits the program list stored in the storage unit to the information processing apparatus,
The information processing apparatus includes:
A receiving unit for receiving the program list from the server;
An operation control unit that defines the operation of a specific program based on the received program list;
An introduction control unit that records a plurality of programs introduced by the introduction program as introduction information in association with the introduction program when a plurality of programs are introduced by the introduction program ;
When an update processing request from the second program is received with respect to the first program and the operation of the second program is permitted based on the program list, the introduction information is referred to and the second program is referred to The introduction program associated with the first program is compared with the introduction program associated with the first program, and it is determined whether or not the two introduction programs match. When the first program is updated by the second program when the first program is permitted in the program list and the operation of the first program is permitted in the program list, Update information indicating that the first program has been updated is recorded in the program list, and the first program is properly When new is, when the first program that has been updated is registered in the program list, while adding information of the updated programs in the program list,
If the both installation program do not match, and rejects the update control unit said update processing,
An information processing system comprising:

Images