JP6084916B2 - Data transmission restriction method, data transmission restriction device, and data transmission restriction program - Google Patents

Description

  The present invention relates to a technique for limiting data transmission.

  With the widespread use of smartphone terminals, many privacy infringement problems have been pointed out, such as phone numbers registered in their own terminals being unknowingly collected by third parties. Since the application program is created by another person and its operation is not always reliable, a mechanism for preventing the unauthorized transmission of privacy-related information in the user terminal is required.

  As such a mechanism, as shown in FIG. 5, an access control function CL1 for restricting access to privacy-related information from an AP (application program) 300, or a communication control function for restricting communication from the user terminal 1 to the outside. There is CL2 (Non-Patent Document 1).

“Manifest.permission”, Android Developers, [online], [Search November 1, 2013], <URL: http://developer.android.com/reference/android/Manifest.permission.html> William Enck, 6 others, “TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones”, In Proceedings of the 9th OSDI’10, p.1-15

  However, since the access control function only restricts access to the data itself, if the AP receives access permission even once, it cannot be involved in any processing after the access and prevent transmission from the user terminal to the outside. Is difficult.

  In that case, it is conceivable to use the communication control function described above. However, communication unrelated to the transmission of privacy-related information is also blocked. Further, since the communication control function restricts communication based on the IP address and port number, it is not possible to select a communication restriction target according to the type of data to be transmitted.

  The present invention has been made in view of the above circumstances, and an object thereof is to appropriately regulate the transmission of privacy-related information.

  According to a first aspect of the present invention, there is provided a data transmission restriction method in which a computer interrupts a data transmission process for transmitting data with a mark indicating privacy information, and whether to permit the transmission of the data. An inquiry step for storing the obtained result in the storage means, and reading the obtained result from the storage means and executing the data sending process when permission to send is received, disallowing The gist of the present invention is that it has an execution / stop step for stopping the data transmission process when the data is received.

  According to the present invention, when data transmission processing for transmitting data with a mark indicating privacy information is interrupted, the user is asked whether or not to permit the transmission of the data, and permission for transmission is received Since the data transmission process is executed and the data transmission process is stopped when the permission is not received, the transmission of privacy-related information can be appropriately regulated.

  The data transmission restriction method according to claim 2 is the data transmission restriction method according to claim 1, wherein in the interruption step, the data is restricted when the data is copied from a user area of a memory to a kernel area. The gist.

  The data transmission restriction method according to claim 3 is the data transmission restriction method according to claim 1 or 2, wherein, in the inquiry step, if the type of the data is included in a permission list, whether to permit the data transmission. The gist is not to ask the user whether or not.

  According to a fourth aspect of the present invention, there is provided a data transmission restriction device that interrupts a data transmission process for transmitting data with a mark indicating privacy information, and whether to permit transmission of the data to the user. Inquiry means for storing the obtained result in the storage means, and reading the obtained result from the storage means, and when the permission of sending is received, the data sending process is executed, and the permission is not given. In some cases, the present invention includes an execution / cancellation means for canceling the data transmission process.

  According to a fifth aspect of the present invention, in the data transmission restriction device according to the fourth aspect, the interruption unit causes the interruption when the data is copied from the user area of the memory to the kernel area. The gist.

  The data transmission restriction device according to claim 6 is the data transmission restriction device according to claim 4 or 5, wherein the inquiry means permits the data type if the data type is included in the permission list. The gist is not to ask the user whether or not.

  The gist of a data transmission restriction program according to a seventh aspect is to cause a computer to execute the data transmission restriction method according to any one of the first to third aspects.

  According to the present invention, transmission of privacy-related information can be appropriately regulated.

It is a reference figure at the time of outlining this invention. It is a figure which shows the functional block structure of a user terminal. It is a flowchart which shows the transmission restriction | limiting operation | movement of privacy related information. It is a figure which shows the example of a permission list. It is a reference figure at the time of explaining a prior art.

  As shown in FIG. 1, the present invention provides a data-out restriction function CL3 that restricts sending of privacy-related information while permitting access to the privacy-related information by the AP 300. For example, in the case of address book data, it is possible to read the address book data from the AP 300 when making a call or mail transmission, and provide a mechanism for keeping the use of the address book data inside the AP 300.

  Hereinafter, an embodiment for carrying out the present invention will be described with reference to the drawings.

  FIG. 2 is a diagram showing a functional block configuration of the user terminal 1 according to the present embodiment. The user terminal 1 includes a data transmission restriction device 100 that restricts transmission of privacy-related information, an AP (application program) 300 that operates inside the user terminal 1, an OS (operating system) 500 that operates inside the user terminal 1, The memory 700 is provided in the same. This will be described in detail below.

  The data transmission restriction device 100 is composed of a plurality of functional units as shown in FIG. Specifically, a data transmission detection unit 11 that detects privacy-related information transmission processing by the AP 300 and the OS 500, a data transmission control unit 12 that interrupts, executes, or cancels the transmission processing after the detection, and the interrupted transmission processing A data transmission destination specifying unit 13 that specifies a transmission destination of privacy-related information according to the above, a data transmission inquiry unit 14 that inquires the user about transmission permission / non-permission of suspended privacy-related information, and storing the inquiry result, Further, the data storage unit 15 stores a permission list in which privacy-related information for which transmission permission has been received is described.

  The AP 300 is an application program that operates on the OS 500 or Java VM (Java Virtual Machine, JAVA is a registered trademark) and provides a specific service. For example, it is a program that provides a telephone function, an e-mail function, and a web browsing function. It may be preinstalled in the user terminal 1 or downloaded from a predetermined server device.

  The OS 500 is a program that controls basic operations of the user terminal 1. For example, it is a UNIX (registered trademark) operating system such as Linux (registered trademark) or BSD (Berkeley Software Distribution).

  The memory 700 is a storage device that stores privacy-related information. The memory area is logically divided into a user area 700a used by the AP 300 and a kernel area 700b used by the OS 500 kernel. The memory itself is expressed as “area” in order to express that it is a physical storage means, but it may also be referred to as user space (or application space) or kernel space.

  The privacy related information is, for example, ID data and log data of the user terminal 1, address book data, transmission data and reception data in an electronic mailbox. The user terminal 1 is, for example, a smartphone terminal, a tablet terminal, or a personal computer.

  Next, the operation of the user terminal 1 will be described.

  In the present embodiment, a function (not shown in FIG. 2) for tracking data processing is used (see Non-Patent Document 2 described above). As a result, when the AP 300 reads the data, the user terminal 1 adds a mark M for identifying the data to the data on the memory 700, and also adds a mark M to the processing result using the data. Here, it is assumed that only privacy-related information is a marking target, and a different marking pattern is given depending on the type of privacy-related information.

  In addition, sending data means sending data to the outside of the memory 700. For example, in addition to transmitting from the user terminal 1 to a communication network, an external disk device, etc., transmitting to the internal disk device of the user terminal 1 (copying as a separate file within the user terminal) is also included.

  First, the basic operation when sending data will be described.

  When the AP 300 requests transmission processing after reading data from the user area 700a of the memory, the OS 500 copies the data from the user area to the kernel area, and the data is transmitted from the kernel area. Regardless of whether the destination is a communication network, an external disk device, or a built-in disk device, the data is sent out via a copy process to the kernel area.

  Next, privacy-related information transmission restriction operation performed by the data transmission restriction device 100 will be described. FIG. 3 is a flowchart showing privacy-related information transmission restriction operation.

  First, in step S1, when the data transmission detection unit 11 detects data transmission processing by the OS 500, the data transmission control unit 12 interrupts the transmission processing in step S2.

  Specifically, by detecting that a function for copying data from the user area to the kernel area is used, it is detected that data is about to be sent out. For example, in the case of Linux, the function “copy_from_user ()” is detected. In the case of BSD, the function “copyin ()” or “copyinstr ()” is detected, and the data transmission process is detected. The subsequent processing of the OS 500 is temporarily intercepted.

  Next, in step S3, the data transmission control unit 12 continues to determine whether or not the mark M is added to the data copied by the OS 500. If the data is not marked, it does not correspond to the privacy-related information, so the transmission restriction process in FIG. 3 is terminated, the interrupted data transmission process is returned to the OS 500, and the transmission process is continued as it is.

  On the other hand, since the privacy-related information is to be transmitted if the data is marked, first, in step S4, the data transmission destination specifying unit 13 specifies the type and transmission destination of the data. In S <b> 5, the data transmission inquiry unit 14 inquires the user of permission / non-permission of transmission of the data, and the inquiry result is stored in the data storage unit 15.

  The type of data is specified by determining a marking pattern, for example. The data transmission destination is specified by analyzing the process stack and the kernel stack, for example. One of the stacks is returned to the system call invocation process, and the argument passed to the system call is analyzed there. When the transmission destination is a communication network, an FQDN (Fully Qualified Domain Name) or IP address is specified, and when the destination is an external disk device or a built-in disk device, a file path is acquired. Thereafter, the user of the user terminal 1 is presented with the type of data and the transmission destination in characters and voices, and an input for permission to send or not to send is requested.

  Subsequently, when the inquiry result to the user is read from the data storage unit 15 and the data transmission is permitted by the user, the data transmission control unit 12 transmits the data interrupted in step S2 in step S6. The processing is returned to the OS 500 to execute the transmission processing.

  On the other hand, if the data transmission is not permitted by the user, the data transmission control unit 12 stops (shuts down) the data transmission process by returning an error to the OS 500 in step S7. By returning an error to the OS 500, a system call error is returned to the AP 300, so that the data transmission process ends without interruption.

  The above is the privacy-related information transmission restriction operation.

  However, the data copy process from the user area to the kernel area may be performed a plurality of times with the same data being divided. In particular, in the case where transmission is permitted, a plurality of user inquiry processes can occur for the same data in a very short time.

  Therefore, a permission list that describes the type of data that has been permitted to be transmitted may be managed so that the inquiry process to the user is skipped for the permitted data. Therefore, the data transmission restriction device 100 generates a permission list as shown in FIG. 4 and manages it in the data storage unit 15. The thread ID is an identifier of a thread managed by the OS 500. The marking pattern is a bit string indicating the type of data. The generation bit is a bit string for an aging algorithm.

  Since the list length of the permission list is physically finite compared to the size of the data storage unit 15, when the permission list becomes full, any of the items in the list must be overwritten when newly added. Don't be. In order to determine the overwriting target, an aging algorithm used for memory paging is used to overwrite the old information.

  In other words, when hooking the copy processing of data from the user space to the kernel space (temporarily intercepting the processing), it is assumed that the data included in the permission list has already been permitted and step S5 is skipped. To do. On the other hand, for data not included, step S5 is executed and added to the permission list when permission is received from the user. If the permission list is full, the oldest aging algorithm is overwritten.

  As described above, according to the present embodiment, the data transmission process for transmitting the data marked with the privacy-related information mark is interrupted, and the user is asked whether or not to permit the transmission of the data. When the permission is received, the data transmission process is executed. When the permission is not received, the data transmission process is stopped, so that the transmission of privacy-related information can be appropriately regulated.

  Finally, the data transmission restriction device 100 described in the present embodiment can be realized by a computer having a memory and a CPU. It is also possible to construct each operation of the data transmission restriction device 100 as a program, install it on a computer and execute it, or distribute it via a communication network.

DESCRIPTION OF SYMBOLS 1 ... User terminal 100 ... Data transmission control apparatus 11 ... Data transmission detection part 12 ... Data transmission control part 13 ... Data transmission destination specific | specification part 14 ... Data transmission inquiry part 15 ... Data storage part 300 ... AP (application program)
500 ... OS (Operating System)
700 ... Memory 700a ... User area 700b ... Kernel area S1-S7 ... Step

Claims (5)

By computer
An interruption step for interrupting the data transmission processing for transmitting the data with the mark indicating the privacy information;
Asking the user as to whether or not to permit the transmission of the data, and storing the obtained result in the storage means;
An execution / cancellation step of reading the obtained result from the storage means and executing the data transmission process when permission for transmission is received, and canceling the data transmission process when not permitted. I have a,
In the interruption step,
A method of restricting data transmission, wherein the data is suspended when the data is copied from a user area of a memory to a kernel area . In the inquiry step,
2. The data transmission restriction method according to claim 1, wherein when the data type is included in the permission list, the user is not asked whether the permission is permitted. Interruption means for interrupting the data transmission processing for transmitting the data with the mark indicating the privacy information;
Inquiring means for asking the user whether to permit transmission of the data, and storing the obtained result in the storage means;
An execution / canceling unit that reads out the obtained result from the storage unit, executes the data transmission process when the transmission permission is received, and cancels the data transmission process when the permission is received; Have
The interruption means is
An apparatus for restricting data transmission, wherein the data is interrupted when the data is copied from a user area of a memory to a kernel area. The inquiry means is
4. The data transmission restriction device according to claim 3, wherein when the data type is included in the permission list, the user is not asked whether the permission is permitted. A data transmission restriction program that causes a computer to execute the data transmission restriction method according to claim 1.

Images