JP4627266B2 - Information leakage prevention system due to unknown malware - Google Patents

Description

  The present invention relates to a system that prevents information leakage by malware such as unknown viruses and spyware.

Conventionally, as a countermeasure against malware such as unknown viruses and spyware, for example, those described in Patent Document 1 and Patent Document 2 below are known.
The one described in Patent Document 1 below detects whether a computer virus is detected by registering a unique series of characters and numerical values of a virus found in the past as a signature and comparing it with the code of an executable file. It is.
Also, the one described in Patent Document 2 below provides a detection method for malicious software such as computer viruses that can be detected even with new malicious software such as computer viruses. It has a function to determine whether or not it is correct, and a function to monitor unauthorized writing to pre-registered registry values, program files, and system files. It is regarded as an abnormal operation and execution is stopped.

Japanese Patent Application No. 2003-216445 Japanese Patent Application No. 2003-38129

However, since the technique described in Patent Document 1 determines whether or not the virus is based on a virus signature discovered in the past, an unknown computer virus cannot be detected.
Moreover, since the technique described in Patent Document 2 detects a computer virus based on an abnormal operation performed by malicious software, it can detect an unknown computer virus that exploits a known attack method or vulnerability. However, if an illegal operation executed by the computer virus is unexpected, the computer virus cannot be detected as in the above-mentioned Patent Document 1.
That is, there are cases where unknown computer viruses cannot be detected by the conventional techniques disclosed in Patent Document 1 and Patent Document 2. As a result, it is impossible to reliably prevent an illegal operation in which a computer virus leaks important data in the PC to an unrelated third party.

  An object of this invention is to provide the information leakage prevention system which can prevent reliably the information leakage by unknown malware.

  In order to achieve the above object, an information leakage prevention system for unknown malware according to the present invention creates virtual disks respectively corresponding to applications stored in a storage device, and creates virtual disks and physical disks associated with different applications. A means for prohibiting access to a typical hard disk, a means for transferring data from a virtual disk associated with an arbitrary application to a virtual disk associated with a different application, according to user settings, and an operating system Means for erasing all virtual disks upon completion.

According to the present invention, a virtual disk corresponding to each application is created. For example, unknown malware infected with a Web browser stores files of applications other than the Web browser, such as document files and e-mails. Since the virtual disk cannot be accessed at all, it is possible to reliably prevent the leakage of document files and e-mail contents due to unknown malware that has infected the Web browser.
In addition, depending on the settings from the user, a means for transferring data from a virtual disk associated with one application to a virtual disk associated with another application is provided, for example, downloaded by a web browser PDF files can be referenced with PDF browsing software, and information leakage by unknown malware can be prevented without losing convenience.

Hereinafter, an embodiment for carrying out the present invention will be specifically described with reference to the drawings.
FIG. 1 is a system configuration diagram showing an embodiment of the present invention.
A web browser 101, document software 102, and data transfer program 103 are stored in a storage device inside a personal computer (hereinafter, PC) 1 used by a user.
The data transfer program 103 is a program unique to the present invention for transferring data from a virtual disk associated with a certain application to a virtual disk associated with another application.
The call gate 104 represents the boundary between the application and the operating system 105 privilege level. The privilege level is an access classification provided by the CPU 121 to protect unauthorized access to the hardware 106 such as the memory 122 and the external storage device 123 (the file 131 and the registry 132 are stored in the external storage device). is there.

Normally, the application of the Web browser 101 or the document software 102 cannot directly access the hardware 106. When these applications access the hardware 106, a software interrupt instruction of the CPU 121 is executed.
The software interrupt is an instruction for requesting the CPU 121 to call the software interrupt routine 111 implemented in the operating system 105.
When executing the software interrupt, the CPU 121 stops the application execution process and transfers control to the operating system 105. The start address of the software interrupt routine of the operating system 105 is defined in the interrupt description table (IDT) 113.
The interrupt description table 113 is set when the operating system 105 is started.

The virtualization module 112 is a module unique to the present invention for monitoring access to a hard disk and a memory and making each virtual disk correspond to each application. Since the virtualization module 112 is incorporated as part of the operating system 105, the privilege level is different from that of the application. For this reason, the virtualization module 112 is protected from tampering by unknown malware that has infected the application. In addition, the virtualization module 112 monitors the page table 114 to prevent an attack in which malware uses other shared memory to infect other applications.
The page table 114 describes the correspondence between virtual addresses and physical memory addresses. By using the page table 114, it is possible to detect whether the memory area accessed by the application is a shared memory.

FIG. 2 is an explanatory diagram showing an operation example in which the Web browser 101 infected with malware according to the present invention destroys a file.
When a software interrupt for deleting or destroying a file stored in the external storage device is generated from the Web browser 101 infected with malware (S1), the CPU 121 executes a software interrupt routine registered in the interrupt description table 113. (S2), the file stored in the external storage device 123 is accessed (S3), and deleted or destroyed. Thereafter, the software interrupt routine notifies the CPU 121 of the end of the software interrupt, and returns control to the Web browser 101 (S4).
The CPU 121 executes processing of the next step after the software interruption of the Web browser 101 (S5).
As described above, the malware that has infected the Web browser 101 deletes or destroys all the files that the user executing the Web browser 101 has access rights to.

FIG. 3 is an explanatory diagram showing an operation example in which the virtualization module 112 according to the present invention blocks file destruction by malware.
The virtualization module 112 changes the registered contents of the interrupt description table 113 when the operating system 105 is started, so that the routine in the virtualization module 112 can process the software interrupt instead of the software interrupt routine (S1).
On the other hand, when an application such as the Web browser 101 or the document software 102 is started, the disk images 303 and 304 unique to the application are copied to the virtual disks 301 and 302 (S2). For example, the web browser disk image 303 is copied to the virtual disk 301 accessed by the web browser 101. An HTML file 311 and a registry 312 are stored in the virtual disk 301 accessed by the Web browser 101.
Similarly, the disk image 304 for the document software 102 is copied to the virtual disk 302 accessed by the document software 102. Document data 321 and a registry 322 are stored in the virtual disk 302 accessed by the document software 102.

Assume that the user is infected with malware while using the Web browser 101. In this case, in order to destroy the data, the malware generates a software interrupt requesting file deletion (S3). The CPU 121 executes the routine of the virtualization module 112 registered in the page table 114 (S4).
The routine of the virtualization module 112 accesses the file 311 on the virtual disk 301 accessed by the Web browser 101 and deletes the file (S5). Thereafter, the virtualization module 112 notifies the CPU 121 of the end of the software interrupt routine (S6). Then, the CPU 121 transfers control to the web browser 101, and execution of the web browser is resumed (S7).

In order to realize the above function, it is assumed that the virtualization module 112 has a function of correctly authenticating from which application the software interrupt is requested.
As an application authentication method, a method of taking a hash of an execution program file, a method of checking a file path of an execution program of an application, a method of checking configuration information of a process held by the operating system 105, or a method of these methods There are combinations.

As a method for realizing the virtualization module 112 of the present invention, all methods for authenticating an application are targeted. Malware infected with the Web browser 101 can leak and destroy the HTML file 311 on the virtual disk 301 accessed by the Web browser 101. However, since the files on the virtual disk 302 and the external storage device 123 accessed by the document software 102 can be protected from leakage or destruction, there is an effect that the influence of malware does not spread to other applications or the entire system.
Further, since the disk image 303 for the Web browser 101 is copied to the virtual disk 301 every time the Web browser 101 is restarted, there is an effect that the HTML file 311 destroyed by malware can be restored.

FIG. 4 is a diagram showing the configuration of the interrupt description table 113 according to the present invention.
The interrupt description table 113 includes “interrupt vector”, “attribute”, and “interrupt routine address”.
“Interrupt vector” represents an interrupt number. When an application executes a system call for requesting a file operation from the operating system 105, a software interrupt with an interrupt number (“002E”) is usually used.
“Attribute” represents the type of interrupt. As attribute values, there are an interrupt gate, a task gate, a trap gate, and the like.
“Interrupt routine address” describes the start address of the processing routine corresponding to each interrupt.
The operating system 105 sets the address of the software interrupt routine in the interrupt description table 113 at startup.
The virtualization module 112 of the present invention resets the “interrupt routine address” set in the interrupt description table 113 to the head address of its own software interrupt routine. As a result, all hard disk and memory accesses from applications can be monitored.

FIG. 5 is an explanatory diagram showing an operation example in which browsing of the PDF file 501 fails in the Web browser 101 according to the present invention.
When browsing the PDF file 501 with the Web browser 101, the Web browser 101 downloads the PDF file 501 and temporarily saves the PDF file 501 in the storage area of the cache. At this time, the web browser 101 generates a software interrupt requesting to save the PDF file 501 (S1).
The CPU 121 executes the routine of the virtualization module 112 registered in the page table 114 (S2).

The routine of the virtualization module 112 saves the PDF file 501 on the virtual disk 301 accessed by the Web browser 101 (S3).
Next, the Web browser 101 activates the PDF browsing software 501 and notifies the location of the PDF file 502 (S4).
The PDF browsing software 501 generates a software interrupt for referring to the location of the PDF file 502 received from the Web browser 101 (S5).
The CPU 121 executes the routine of the virtualization module 112 registered in the page table 114 (S6).
The routine of the virtualization module 112 tries to refer to the PDF file on the virtual disk 302 accessed by the PDF browsing software 501, but the corresponding PDF file exists on the virtual disk 301 accessed by the Web browser 101, but the PDF Since it does not exist in the virtual disk 302 accessed by the browsing software 501, the file reference fails.

FIG. 6 is an explanatory diagram showing an operation example of browsing the PDF file 502 by the Web browser 10 using the data transfer program 103 according to the present invention.
In FIG. 5, after the PDF browsing software 501 fails to refer to the PDF file 502, the user starts the data transfer program 103 of the present invention (S8).
The data transfer program 103 can be activated when the virtualization module 112 fails to refer to the PDF file 502.
Whether the data transfer program 103 displays the setting screen 801 shown in FIG. 8 and copies the PDF file 502 on the virtual disk 301 accessed by the Web browser 101 to the virtual disk 302 accessed by the PDF browsing software 501 is determined. Is specified. The method of designation will be described with reference to FIG.

When copying the PDF file 501, the data transfer program 103 generates a software interrupt requesting the file copy (S9).
The CPU 121 executes the routine of the virtualization module 112 registered in the page table 114 (S10).
The virtualization module 112 copies the PDF file 502 on the virtual disk 301 accessed by the Web browser 101 to the PDF file 601 on the virtual disk 302 accessed by the PDF browsing software 501 (S11).
The PDF browsing software 501 generates a software interrupt for browsing the PDF file 601 (S12).
The CPU 121 executes the routine of the virtualization module 112 registered in the page table 114 (S13).
The routine of the virtualization module 112 succeeds in referring to the PDF file 601 on the virtual disk 302 accessed by the PDF browsing software 501 (S14).

  As described in the explanation of FIG. 3, the virtualization module 112 has a function of correctly authenticating from which application the software interrupt is requested. For this reason, the virtualization module 112 permits only data transfer requests from the data transfer program 103 and can block all illegal data transfer requests from other applications.

FIG. 7 is an explanatory diagram showing an operation example in which the data transfer program 103 according to the present invention copies necessary data when the system is terminated.
The data transfer program 103 displays the setting screen 801 shown in FIG. 8 when the operating system 105 is terminated to reflect the change of the virtual disk in the disk image, and specifies to the user whether or not to copy the changed data to the disk image. (S1). The method of designation will be described with reference to FIG.
If specified, the data transfer program 103 generates a software interrupt requesting data copy from the virtual disk to the disk image (S2).
The CPU 121 executes the routine of the virtualization module 112 registered in the page table 114 (S3).
The virtualization module 112 copies the file on the virtual disk specified by the user to the disk image (S4).
For example, the HTML file 311 on the virtual disk 301 accessed by the Web browser 101 is the HTML file 701 on the disk image 303 for the Web browser, and the document file 321 on the virtual disk 302 accessed by the document software 102 is the document software 102. Copy to the document file 702 on the disk image 304.

  On the other hand, the registries 312 and 322 on the virtual disks 301 and 302 are databases for storing system setting information and the like, and since there is a high possibility that the setting contents are altered by malware, in the present invention, the registry is Do not copy to disk image.

FIG. 8 is a diagram showing a setting screen example of the data transfer program 103 according to the present invention.
The data transfer program 103 includes “Selection”, “File Name”, “Virtual Disk”, and “Application” as display items. “Select” is a check button for determining whether or not to include a file as an operation target. “File name” is the path name of the changed file on the virtual disk. “Virtual disk” represents a virtual disk storing a file. “Application” represents a virtual disk of a file transfer destination.
The operation of the data transfer program 103 includes “select all”, “image”, “transfer”, and “cancel”. “Select All” is a button for checking all “Select” included in the list.
“Image” is a button for changing all “applications” included in the list to “disk images”.
“Transfer” is a button that requests the virtualization module to transfer data according to the setting contents of the list.
“Cancel” is a button for canceling data transfer.

In the present example, 811 indicates that the file “D: \ WEB \ document 1.pdf” is copied from the virtual disk accessed by the PDF browsing software 501 to the disk image for the PDF browsing software.
Similarly, 812 copies the file “D: \ WEB \ document 2.pdf” from the virtual disk accessed by the Web browser 101 to the virtual disk accessed by the PDF browsing software 501, and 813 does nothing. Reference numeral 814 denotes copying a file “D: \ WEB \ page 2.HTML” from the virtual disk accessed by the Web browser 101 to the disk image for the Web browser 101.

FIG. 9 is a diagram illustrating an operation example in which the virtualization module 112 according to the present invention protects the shared memory from destruction.
Normally, the Web browser 101 uses the shared memory 901 as a temporary storage area for cookie information and the like. When accessing the shared memory 901, the Web browser 101 generates a software interrupt for accessing the shared memory 901 (S1).
The CPU 121 executes the routine of the virtualization module 112 registered in the page table 114 (S2).
The virtualization module 112 refers to the registered contents of the page table 114 and checks whether another process is accessing the shared memory 901 (S3). At this stage, since the shared memory has not been accessed yet, the virtualization module 112 permits reference to data in the shared memory 901 (S4).
Next, consider a case where the document software 102 accesses the shared memory 901 described above. The document software 102 generates a software interrupt for accessing the shared memory 901 (S5).
The CPU 121 executes the routine of the virtualization module 112 registered in the page table 114 (S6).

The virtualization module 112 refers to the registered contents of the page table 114 and checks whether another process is accessing the shared memory 901 (S7). Since the Web browser 101 has already accessed the shared memory 901 at this time, the virtualization module 112 fails to access the shared memory 901 (S8).
In this example, two application examples are shown, but the same applies when the number of applications increases.

FIG. 10 is a diagram showing a configuration example of the page table 114 according to the present invention.
The page table 114 includes “physical address”, “attribute”, and “virtual address”.
“Physical address” represents a physical address on the memory. “Attribute” represents an attribute value of the memory, and a flag indicating whether a memory page exists, whether it has been accessed, and whether read / write is possible can be set.
The “virtual address” represents an address value in a virtual address space that can be seen from the application. The virtualization module 112 refers to the value of the “attribute” of the entry corresponding to the shared memory 901 in the page table 114 and determines whether to permit access to the shared memory 901.

Next, the virtualization module 112 will be described.
FIG. 11 is a flowchart showing processing of the virtualization module 112 according to the present invention.
The virtualization module 112 is automatically started when the operating system 105 is started (step 1101), changes the setting contents of the interrupt description table 113, and starts monitoring software interrupts from the application (step 1102).
As a monitoring process, the virtualization module 112 waits for reception of a software interrupt event (step 1103). When the virtualization module 112 receives a software interrupt event (step 1104), the received event type is a data copy event from the data transfer program 103. Is checked (step 1105).

In the case of a data copy event, a process of copying data on the virtual disk to another virtual disk or disk image is executed (step 1106), and the process is repeated from step 1103.
If the event is not a data copy event in step 1105, the virtualization module 112 checks whether it is an application activation event (step 1107).
In the case of an application activation event, the disk image for the application is copied to the virtual disk by the method shown in FIG. 3 (step 1108), and the process is repeated from step 1103.
In step 1107, if the event is not an application activation event, the virtualization module 112 checks whether it is a file operation system call event (step 1109). In the case of a file operation system call event, a virtual disk unique to the application is accessed (step 1110), and the process is repeated from step 1103.

If it is determined in step 1109 that the event is not a file operation system call event, it is checked whether the system call event is a shared memory operation (step 1112). In the case of a system call event of a shared memory operation, it is checked whether or not the shared memory has been accessed (step 1113). If the shared memory has been accessed, the virtualization module fails to access the shared memory (step 1114) and repeats from step 1103.
If the shared memory has not been accessed in step 1113, access to the shared memory is permitted (step 1115), and the processing from step 1103 is repeated.

If it is not a shared memory operation system call event in step 1112, it is checked whether the termination processing of the operating system 105 has been completed (step 1116).
The termination process of the operating system 105 is a process in which the virtualization module 112 reflects the changed data on the virtual disk in the disk image.
If it is determined in step 1116 that the operating system 105 has not been terminated, the data transfer program 103 is started (step 1117), and the process is repeated from step 1103.
When the termination processing of the operating system 105 has been completed in step 1116, all virtual disks are erased (step 1118) and the processing is terminated.

Next, the data transfer program 103 will be described.
FIG. 12 is a flowchart showing the processing of the data transfer program 103 according to the present invention.
When the data transfer program 103 is activated by the user or the virtualization module 112 (step 1201), it receives setting information for copying data from the virtual disk to another virtual disk or from the virtual disk to the disk image (step 1201). 1202), a data copy event is transmitted to the virtualization module 112 (step 1203).

1 is a system configuration diagram showing an embodiment of the present invention. It is explanatory drawing which shows the operation example which the web browser infected with the malware concerning this invention destroys a file. It is explanatory drawing which shows the operation example in which the virtualization module concerning this invention blocks the file destruction by malware. It is a figure which shows the structural example of the interrupt description table concerning this invention. It is explanatory drawing which shows the operation example in which browsing of a PDF file fails with the Web browser concerning this invention. It is explanatory drawing which shows the operation example which browses a PDF file with a web browser using the data transfer program concerning this invention. It is explanatory drawing which shows the operation example in which the data transfer program concerning this invention copies required data at the time of a system end. It is a figure which shows the example of a screen of the data transfer program concerning this invention. It is explanatory drawing which shows the operation example in which the virtualization module concerning this invention protects a shared memory from destruction. It is a figure which shows the structure of the page table concerning this invention. It is a flowchart which shows the process of the virtualization module as described in this invention. It is a flowchart which shows the process of the data transfer program as described in this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... PC, 101 ... Web browser, 102 ... Document software, 103 ... Data transfer program, 104 ... Call gate, 105 ... Operating system, 106 ... Hardware, 111 ... Software interruption routine, 112 ... Virtualization module, 113 ... Interrupt Description table, 114 ... page table, 121 ... CPU, 122 ... memory, 123 ... external storage device, 131 ... file, 132 ... registry.

Claims (1)

Means for creating a virtual disk corresponding to each application stored in the storage device and prohibiting access to a virtual disk or a physical hard disk associated with a different application;
Means for transferring data from a virtual disk associated with an arbitrary application to a virtual disk associated with a different application according to user settings;
A means to erase all virtual disks when the operating system exits;
An information leakage prevention system by unknown malware, characterized by comprising:

Images