JPH10333902A - Computer system with alteration detecting function - Google Patents

Abstract

PROBLEM TO BE SOLVED: To inspect the existence of alteration in an OS, an OS loader and other files to be inspected at the time of starting a computer and to start the OS, the OS loader and application after checking safety. SOLUTION: After initializing a basic I/O system (BIOS), a boot program 2 stored in a ROM 1 reads out 1st stored information 41 stored in an auxiliary storage device 4 independently of the OS and reads out a file 42 to be inspected in accordance with the read contents independently of the OS. The existence of a file to be inspected is checked by using these read contents and 2nd stored information stored in the ROM 1. After checking no alteration, the OS loader 42 is accessed to start up the OS 44.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer system with a falsification detection function, and more particularly to a computer system with a falsification detection function for detecting falsification of a file when the computer system is started.

[0002]

2. Description of the Related Art Conventionally, this kind of computer system with a falsification detection function is disclosed in, for example, "Research Report on Computer Virus Countermeasures System Focusing on Integrity Check Method" as a first example (March 1996, Information Processing Promotion Business). (Published by the Association), it is used to detect falsification of program files by computer viruses (hereinafter simply referred to as viruses). The system described in this report uses a cryptographic technique called digital signature to detect tampering of a program file by a virus. This basic principle will be described with reference to FIG.

A digital signature (hereinafter simply referred to as a signature) is generated in advance for a program file to be checked for falsification. This is a signature generation program. First, a program file to be inspected is compressed with a function called a Hash function, a compressed value is encrypted with a secret key (hereinafter, referred to as a secret key), and the encrypted data is used as a signature (FIG. 12A). ).

At the time of inspection, the program file is again
The value compressed by the ash function is compared with the value obtained by decrypting the signature with a public key (hereinafter referred to as a public key) (FIG. 12).
B). If the program has not been tampered with, the two values match. If they do not match, it can be determined that there has been some tampering.

[0005] The encryption system used here is called asymmetric encryption or public key encryption. The encryption key and the decryption key are different, and one has the property that the other cannot be guessed. It is impossible to forge a signature to conceal tampering with program files without knowing the secret key.

[0006] Also, the Hash function means that input data is 160
This is a one-way function that compresses to about a bit. A one-way function refers to a function that is computationally infeasible to back-calculate the original value converted to a certain value. Therefore, in order to hide the tampering, it is necessary to adjust the tampering contents so that the compression value by the Hash function does not change, but this is also impossible.

On page 5 of the above-mentioned report, notes on the operation of this prior art prototype system "IPAInCS" are described. There, it is safe to hold the OS and the signature verification system on a write-protected FD, and run the computer after starting the computer with the FD. This is because, if the OS loader, OS file, or the signature verification system itself is infected with a virus, the virus operates before the signature verification system checks for falsification. If this virus has a stealth function, then even if the infected (ie, altered) program file is inspected later, the alteration is concealed and cannot be detected. This is because the stealth function detects in advance that the program file is to be read for inspection, and passes the read result in which the falsified portion has been repaired.

[0008] At present, more than half of reports of computer virus infection damage in Japan are boot sector infection viruses that infect the OS loader, and it is highly necessary to take the above-mentioned operation method.

An example of a system for preventing program file falsification is disclosed in Japanese Patent Application Laid-Open No. Hei 6-230959. In this system, a dedicated extension board is used to operate BIOS and DOS whose functions have been extended, thereby preventing unauthorized rewriting of a program file. But this system,
It is not a mechanism that can detect the falsification of a program file after it has been tampered with, and it has a different purpose from the present invention, so it is not an alternative method of the present method. Moreover,
It monitors whether a virus has falsified a program file due to infection, and does not prevent falsification of an arbitrary file (for example, a data file storing security settings and encryption keys). Further, there is a restriction on a device configuration that requires a hardware configuration having a ROM and a RAM that cannot be accessed illegally.

[0010]

Problems with the prior art are as follows.
It is a matter of operability.

The reason is that, as shown in the first example of the prior art, in order to operate safely, a computer system is started up using a physically rewritable and secure medium to perform an inspection. There must be. However, as a practical matter, most computer users usually keep the OS and application programs on a hard disk. Hard disks are not physically rewritable media and have a high risk of tampering. Therefore, boot from a write-protected floppy disk storing the OS and the tamper inspection program, and
After inspecting the S and OS loader, it is inevitable to start up with the hard disk again. This imposes a user's troublesome operation and extra system startup waiting time.

A main object of the present invention is to reliably check whether an OS loader, an OS, or a program executed at the time of starting up another computer has been tampered with operability that does not cause a user to feel stress. .

Another object of the present invention is to simplify the configuration of an apparatus for realizing the first object.

Another object of the present invention is to speed up the tampering detection process.

Another object of the present invention is to improve the maintainability of the entire system.

[0016]

According to the first embodiment of the present invention, the boot program 2 stored in the ROM 1 is used to determine whether any of the files to be inspected stored in the auxiliary storage device 4 has been tampered with. Have a function to inspect. More specifically, the first storage information 4 stored in the auxiliary storage device 4
1 for reading stored information (31 in FIG. 1);
Inspection file reading means (32 in FIG. 1) for reading an arbitrary number of inspection files 42 from the auxiliary storage device 4 based on the description contents of the read first storage information 41, and a second program included in the boot program 2. Falsification detecting means (33 in FIG. 1) for inspecting the presence / absence of falsification of each file to be inspected from the stored information 34, the first stored information 41 read, and each file to be inspected 42.

The second embodiment of the present invention is characterized in that the second storage information 34 described in the first embodiment is obtained from a user's input. More specifically, the boot program 2 has storage information acquisition means (35 in FIG. 5) for acquiring the second storage information 34 from the input device 6.

The third embodiment of the present invention is characterized in that the presence or absence of tampering is checked by using a compression value based on a one-way function in the second embodiment. More specifically, a storage information obtaining unit (35 in FIG. 5) for obtaining the second storage information 34 from the input device 6, a file to be inspected 42 and the second storage information 3
4 has a falsification detecting means (33 in FIG. 5) for comparing the compression value obtained by compressing No. 4 with the one-way function and the compression value stored in the first storage information 41 in advance to determine whether there is falsification.

The fourth embodiment of the present invention is characterized in that the second storage information 34 is stored in the external storage device 7. More specifically, the boot program 2 has second storage information reading means (36 in FIG. 7) for acquiring the second storage information 34 from the external storage device 7, and the external storage device 7 It has means for preventing the information 34 from being falsified (71 in FIG. 7).

In the fifth embodiment of the present invention, the second storage information 34 is held in the external computer 8 and the calculation processing required for falsification detection is performed on the external computer 8 side. More specifically, the external computer 8 includes a falsification preventing means (81 in FIG. 8) for the second stored information 34 and a falsification detection calculating means (82 in FIG. 8) for performing calculations necessary for falsification detection.
The boot program 2 includes an external computer 8
Tamper detection means (37 in FIG. 8) for detecting whether each file to be inspected has been tampered with using the tamper detection calculation means 82 of the external computer 8 via the communication means 37. 33).

In the sixth embodiment of the present invention, the falsification detection function 3 is executed at the time of booting while the falsification detection program 9 is stored in the storage device 91 having the write protection function.
More specifically, the boot program 2 has a means for executing the falsification detection program 9 (38 in FIG. 9).

In the seventh embodiment of the present invention, the tampering detection function 3 is checked and executed at the time of booting by holding the tampering detection program 9 in the auxiliary storage device 4. More specifically, the boot program 2 includes a tampering detection program checking unit (39 in FIG. 10) that checks whether the tampering detection program 9 has been tampered with using a one-way function, and a tampering that executes the tampering detection program 9. And a detection program execution means (38 in FIG. 10).

In the eighth embodiment of the present invention, the OS loader 43 has a falsification inspection function 3. More specifically,
An alternative OS loader 46 reads an alteration detection program 9 having an alteration detection function 3 from the auxiliary storage device 4 and executes the alteration detection program 9 (46 in FIG. 11).
1) and an OS loader executing means (462 in FIG. 11) for reading and executing the OS loader 43 stored separately.

[0024]

According to the first embodiment of the present invention, the storage information reading means sends the inspection file reading means information for reading the inspection file, specifically, the storage of the inspection file in the auxiliary storage device. Provides stored physical location information. In addition, the falsification detecting means is provided with information for determining whether the falsified file is falsified, specifically, signature data for the falsified file.

The inspected file reading means provides the current contents of the inspected file to the falsification detecting means.

The falsification detecting means includes information for determining whether the provided file to be inspected has been tampered with, the contents of the current file to be inspected, and the second storage information (specifically, stored in the boot program 2). Is checked for falsification of the file to be inspected.

In the second embodiment and the third embodiment of the present invention, the stored information obtaining means provides the falsification detecting means with the second stored information.

In the fourth embodiment of the present invention, the second storage information stored in the external storage device is protected from tampering by the external storage device's tampering prevention means. The storage information reading unit acquires the second storage information from the external storage device and provides the second storage information to the tampering detection unit.

In the fifth embodiment of the present invention, the second storage information stored in the external computer is protected from falsification by the external computer's falsification prevention means. After the initialization processing of the peripheral device, the boot program transmits / receives data to / from the external computer via the communication means by the falsification detection means, and uses the falsification detection calculation means on the external computer side to perform falsification of each file to be inspected. Check for presence.

In the sixth embodiment of the present invention, the boot program executes the falsification detection program stored in the storage device with the write protection function by the falsification detection program execution means after the peripheral device is initialized.

In the seventh embodiment of the present invention, the boot program checks whether the falsification detection program stored in the auxiliary storage device 4 has been falsified by the falsification detection program inspection means after the peripheral device is initialized. Next, the falsification detection program is executed by the falsification detection program execution means. This inspects the file to be inspected.

In the eighth embodiment of the present invention, an alternative OS loader is executed by a boot program, and the alternative OS loader first executes an alteration detection program having an alteration inspection function by an alteration detection program execution means. This verifies the file to be inspected necessary for the OS to be started. Next, the alternative OS loader 46 reads and executes the separately stored OS loader 43 by the OS loader executing means, and the OS is started.

[0033]

BEST MODE FOR CARRYING OUT THE INVENTION

[1] Description of Configuration Next, an embodiment of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 1, the first embodiment of the present invention includes a control unit 100 and an auxiliary storage device 4.

The control unit 100 includes a ROM 1 and a RAM 102
And a CPU 1 for executing a program stored therein.
01.

Boot program 2 stored in ROM 1
After initializing peripheral devices including the auxiliary storage device 4 and enabling a basic input / output system (hereinafter abbreviated as BIOS), the OS loader 43 stored in the auxiliary storage device 4
Is loaded into the RAM 102 and executed.
The present invention is characterized in that the boot program 2 has a falsification detection function 3.

The auxiliary storage device 4 stores an OS file 44
And an OS loader 43 for reading the OS file 44 into the RAM 102 and executing it. In the present invention, an arbitrary number of arbitrary files are stored in the auxiliary storage device 4.
It can be set as a file under inspection 42 for checking for falsification when the system is started up, and the setting contents and information for falsification inspection, for example, information such as a digital signature, are stored in the first storage information 41. And

The falsification detecting function 3 includes a stored information reading means 31, a file to be inspected reading means 32,
Tampering detection means 33;

The storage information reading means 31 reads the first storage information 41 from the auxiliary storage device 4. The point in time when this process is performed, that is, the point in time when the boot program 2 starts, is before the start of the OS, and file access via the OS cannot be used. Therefore, it is necessary to access the auxiliary storage device 4 using only low-level functions of the BIOS. For example, if the OS is Microsoft MS
In the case of -DOS, the information of the physical location in the auxiliary storage device 4 where each file is stored can be obtained by referring to the directory data and the file allocation table (hereinafter abbreviated as FAT) of the auxiliary storage device 4. it can. That is, the correspondence between the file name and the entry point of the FAT is described in the directory data, and the physical storage position where the file is stored can be known by tracing the FAT sequentially from the entry point. Therefore, if the file name of the first storage information 41 is fixed in advance, the physical storage position in the auxiliary storage device 4 can be obtained from the file name, and can be read using the BIOS.
Similarly, in the case of another OS, the method of acquiring the physical storage position of the file performed by the OS may be executed and read by the BIOS.

The inspection file reading means 32 acquires the setting contents of the inspection file 42 from the read first storage information 41 and reads the inspection file 42 from the auxiliary storage device 4. Again, it is necessary to access the storage using only BIOS low-level functions. In this case, similarly to the above-described stored information reading unit 31, the physical storage position in the auxiliary storage device 4 may be obtained by the same method as performed by the OS to be used, and read using the BIOS.

The falsification detecting means 33 performs, for each file to be inspected read from the auxiliary storage device 4, information for inspection read from the first storage information 41 and second storage information 34 held by the boot program itself. Then, check for falsification. For example, a digital signature for each file to be inspected is stored as the first storage information 41, and a key for signature verification is stored as the second storage information 34.
The tampering detection means 33 checks whether or not each file to be inspected has been tampered with the digital signature and the signature verification key.

The tampering detection function 3 can also verify whether the OS loader 43 has been tampered with. The OS loader is stored in a portion of the auxiliary storage device 4 called a boot sector. The boot sector is located at the physical beginning of the auxiliary storage device or at the beginning of each partition when a plurality of partitions are cut. If the drive name of the boot sector to be checked is described in the file name storage column of the first storage information 41, the physical position in the auxiliary storage device 4 can be specified. Further, if data for falsification inspection of the boot sector, for example, a digital signature is stored, the falsification detecting means 33 determines whether or not the boot sector has been falsified, that is, the OS loader 4 stored therein.
3 can be inspected for tampering. Strictly speaking, OS loader 4
Since the boot sector 3 is a part of the boot sector, whether the boot sector has been tampered with and whether the OS loader 43 has been tampered with are different. However, information such as a recording format is stored in the boot sector other than the program portion of the OS loader 43. There is no problem if you check for tampering, including this. If only the program portion is to be limited, for example, if a field for storing the number of skipped bytes at the head and the number of bytes to be ignored at the end is added to the first storage information 41, only the program portion to be checked can be specified.

The tampering detection function 3 can verify whether the OS file 44 has been tampered with. OS file 4
Here, 4 is a generic name for a basic OS program, a setting file to be read by the OS program, and various drivers executed when the OS is started. For example, taking a Microsoft MS-DOS as an example, the basic OS programs have file names “io.sys” and “msdos.
sys "," command.com ", etc., and the setting files read by them are" config.
For example, files such as “sys” and “autoexec.bat”, drivers described in the setting file are executed when the OS is started and are resident in the memory. If these file names are described in advance in the file name storage field of the first storage information 41 and data for falsification inspection, for example, a digital signature is described, the falsification detecting means 33
Can check whether the file executed or referred to at the time of booting the OS has been tampered with.

The falsification detection function 3 can verify whether the first storage information 41 itself has been falsified. The purpose of checking whether the first stored information 41 itself has been tampered with is as follows. For example, when a file to be inspected 42 is tampered with, the description for the file to be inspected 42 may be deleted from the first storage information 41, and the tampering may be evaded and the tampering may be concealed. The verification of the first stored information is useful for detecting the presence or absence of the concealment fact. As a specific method, for example, as shown in FIG. 3, at the end of the first storage information 41, falsification inspection storage information related to the information up to that point, for example, a digital signature is added, and the falsification detection unit 33 The falsification inspection may be performed using the falsification inspection storage information and the second storage information in the boot program 2. [2] Description of Operation Next, the operation of the embodiment of the present invention will be described with reference to FIGS.

When the computer system is turned on,
The execution address of the CPU 101 is set to the start address of the processing of the boot program 2 stored in the ROM 1,
Execution of the boot program 2 is started.

FIG. 2 is a flowchart showing the flow of processing of the boot program 2. The boot program 2 first executes a peripheral device initialization process (step A1).
This performs a test of connected peripheral devices, execution of initial settings, and initial settings of BIOS. This makes the BIOS usable. Steps A2 to A10 are features that characterize the present invention.

First, in step A2, the first storage information 41 is read using the storage information reading means 31 described above.

Next, in step A3, the first storage information 41
Check for your own tampering. For example, if the method uses a digital signature, first, as shown in FIG.
First storage information 41 stored at the end of the storage information 41
The part excluding the signature data of itself is compressed by the Hash function. Next, the signature data of the first stored information 41 at the end is decrypted using the key stored in the second stored information 34 in the boot program 2. The compressed value is compared with the decrypted value, and the presence or absence of tampering is checked based on whether they match.
If they match, there is no tampering, so the process proceeds to step A5, and if they do not match, the process proceeds to step A8 (step A4).

Step A5 is a step for confirming whether or not falsification has been performed for the number of files to be inspected 42 written in the first storage information 41. If the inspection of all the files to be inspected 42 has not been completed, the process proceeds to step A6, and if the inspection has been completed, the process proceeds to step A6.
Proceed to 11.

In step A6, each inspection file 42 is read by using the inspection file reading means 32 described above.

Next, in step A7, the inspection target file 4
2. Check for tampering. For example, if the method uses a digital signature, first, the file to be inspected is
Compress with h function. Next, the signature data stored in the first storage information 41 is decrypted using the key stored in the second storage information 34 in the boot program 2. The compressed value is compared with the decrypted value, and the presence or absence of tampering is checked based on whether they match. If they match, there is no tampering, so the process proceeds to step A5, and if they do not match, the process proceeds to step A8 (step A4).

If tampering is detected in step A4, it is displayed on a separately connected display device if necessary, and it is confirmed whether or not to continue the startup process (steps A8 and A9). If the continuation is instructed from the separately connected input device, the process proceeds to step A5. If the continuation is instructed, the boot program processing is terminated.
The activation process is stopped (Step A10).

When all the files to be inspected have been inspected in step A5, the execution process of the OS loader 43 is performed in step A11. This is because the OS loader 43 written in the boot sector of the auxiliary storage device 4 is loaded into the RAM using the BIOS.
102 and the read RAM address contains the CP
By setting the execution address of U, the control is transferred to the OS loader 43. This ends the boot program processing. [3] Another Embodiment of the Invention Next, a second embodiment of the present invention will be described with reference to FIG.

FIG. 4 shows the structure of the first storage information 41 in the second embodiment.

In this embodiment, a compressed value obtained by compressing each file 42 to be inspected by a one-way function and a digital signature for the first stored information 41 itself are stored in the first stored information 41. The key for verifying the digital signature is the first key.
In the same manner as in the first embodiment, it is stored in the second storage information 34 in the boot program 2.

The boot program 2 in this embodiment
The falsification detecting means 33 first uses the signature data for the first stored information 41 itself as in the first embodiment,
Confirm that the stored information 41 itself has not been tampered with. Next, the inspection program read by the inspection file reading means 32 is compressed by a one-way function, and the compressed value is compared with the compressed value stored in the first storage information 41. If there is no falsification in the inspected file 42, this value matches. If the inspected file 42 has been tampered with, the tampering can be detected because the value of the compressed current content is different from the value of the stored compressed value.

The above compression value can be generated as long as the specification of the one-way function used is known. Therefore, the inspected program 42 is tampered with, and in order to conceal the tampering, even the compressed value stored in the first storage information 41
It may be rewritten with a compressed value as a result of falsification. In this case, the comparison between the above-mentioned compression values matches, and the inspection is passed.
It is possible to detect that tampering has been concealed by its own tampering inspection.

In this embodiment, as described above, even the first storage information 41 itself is falsified, and if the falsification is concealed in the file under inspection 42, one of the files under inspection 42 is tampered with. However, there is a demerit that it is not possible to specify which of the inspected files 42 has been tampered with by this method alone. However, since the signature decryption process only needs to be performed once, the processing time for verifying all the files 42 to be inspected is short. Therefore, it is useful when emphasizing the processing speed.

Next, a third embodiment of the present invention will be described with reference to FIG.
This will be described with reference to FIG.

FIG. 5 shows that, as a part of the falsification detection function 3 of the boot program 2, the above-mentioned second storage information 34 is obtained by an input operation of the user using the input device 6 and used by the falsification detection means 33. The feature is that.

The boot program 2 corresponds to step A in FIG.
After the initialization of the first peripheral device, the second storage information 34 is obtained from the input device 6. This is because the initialization of the input device 6 and the initialization of the BIOS have been completed in step A1.
What is necessary is just to receive input information from the input device 6 using IOS.

In this embodiment, since the second storage information 34 is obtained by an input operation of the user, there is a disadvantage that large-sized information cannot be used.
Is stored in the RO stored in the boot program 2.
There is an effect that information can be updated by separating from M1. Further, by separating the second storage information 34 from the ROM 1, the second storage information 34 can be kept secret from a third party who attempts to falsify. As a result, the following fourth embodiment becomes possible.

Next, a fourth embodiment of the present invention will be described with reference to FIG.
This will be described with reference to FIG.

FIG. 6 shows an example of the first storage information 42 in the fourth embodiment.

In this example, each inspection file 42 and second storage information that can be known only by the user are linked to the first storage information 41, and a compressed value compressed by a one-way function is stored. Here, the connection means that the second storage information is connected to the end of each file 42 to be inspected. In addition to the concatenation, a method of taking an exclusive OR (XOR) of two pieces of information may be used. The first storage information 41 itself has a compression value which is linked to the second storage information 34 and compressed by the one-way function at the end of itself.

The falsification detecting means connects the second stored information acquired by the stored information acquiring means at the time of inspection,
By calculating the compression value and comparing it with the value stored in the first storage information 41, it is confirmed whether or not each of the inspected files has been tampered with. The presence / absence of falsification of the first storage information 41 itself is similarly confirmed.

Forgery of the stored information in order to conceal the falsification of the program to be inspected requires a computational complexity due to the nature of the one-way function unless the user can know the second stored information. Difficult.

In this embodiment, in addition to the effects of the third embodiment, there is an effect that the processing speed is increased because the encryption processing is not included, and the boot program 2 can be simplified.

Next, a fifth embodiment of the present invention will be described with reference to FIG.
This will be described with reference to FIG.

In this embodiment, the second storage information 34 is stored in the external storage device 7, and the boot program 2 includes second storage information reading means 36 for acquiring the second storage information from the external storage device 7. The external storage device 7 is the second
Is provided with means for preventing falsification of the stored information 34.

The external storage device 7 can be composed of, for example, a floppy disk and its drive. In this case, the second storage information reading unit 36 accesses the drive by using the BIOS, and thereby stores the second storage information 34.
Can be obtained. The tampering prevention means 71 may apply write protection to the floppy disk.

This embodiment has an effect that the stored information can be easily updated by separating the second stored information 34 from the ROM 1 in which the boot program 2 is stored.

Next, a sixth embodiment of the present invention will be described with reference to FIG.
This will be described with reference to FIG.

In this embodiment, the second storage information 34 is stored in the external computer 8, and the external computer is required to detect the falsification of the second storage information using the second storage information. Falsification detection calculation means 82 for performing various calculations. Furthermore, the boot program 2
A communication unit 37 with the external computer 8 is provided. Then, the tampering detection means 33 of the boot program 2
By using the falsification detection calculation means 82 of the external computer 8 via the communication information 37 with the external computer 8, it is possible to determine whether each of the files 42 to be inspected has been tampered with. Shall be inspected.

The external computer 8 referred to in this embodiment
Can be composed of, for example, an IC card having a calculation function of public key encryption and a reader / writer thereof.

As an IC card having a function of calculating public key cryptography, TB98S manufactured by CP8 Transac is known. If such a card is used, the decryption processing of the signature is separated from the boot program 2 as the above-described tampering detection calculation means 82,
Can be done on the card side. In this case, the tampering detection means 33 on the boot program 2 side
Is sent to the IC card, the decrypted value is received, and the value is compared with the value compressed by the boot program 2 to check for tampering.

The second stored information falsification preventing means 81 when an IC card is used for the external computer 2 can be realized by a predetermined procedure, for example, a function that does not permit updating of data unless the PIN code of the user is verified. . This function is a function that an IC card generally has.

Further, when an IC card is used for the external computer 2, the communication means 37 on the boot program 2 side
For example, this can be realized by using a reader / writer connected via the RS232-C port. This means that the boot program 2 first initializes peripheral devices (step A in FIG. 2).
1) Therefore, at the time of starting the inspection, the BIOS related to RS232-C can be used, and the communication may be performed using this.

In this embodiment, a part of the calculation processing relating to falsification detection is separated from the boot program in the ROM 1, so that it is easy to deal with a change in the calculation processing or an upgrade.

Next, a seventh embodiment of the present invention will be described with reference to FIG.
This will be described with reference to FIG.

In this embodiment, the falsification detection program 9 having the falsification detection function 3 is stored in the storage device 91 with the write protection function.

Storage Device 91 with Write Protect Function
Can be composed of an expansion board and an expansion ROM mounted on the expansion board. Many expansion boards have on-board an expansion ROM on which a BIOS for handling the board is mounted. To cope with this, boot programs of many computer systems have a function of searching an extended ROM address space for storing a BIOS or not, and calling an initial routine when found. . If the tampering detection program 9 is stored in the extension ROM on the extension board, the function of calling the above-mentioned initial routine remains unchanged.
It becomes 8.

Storage device 91 with write protect function
Can also be constituted by a floppy disk and its drive device. That is, the boot program 2 is stored in the storage device 9
A method of reading the falsification detection program 9 from 1 is, for example, to store the falsification detection program 9 in a physical continuous area starting from a predetermined physical position in the storage device 91 and read it from the predetermined position using the BIOS. Good. The execution method may be such that the IP address of the CPU 100 is set to the head address of the falsification detection program 9 read into the RAM 102 by a jump instruction.

In this embodiment, the falsification detection function 3 is separated from the boot program in the ROM 1, so that it is possible to easily cope with a change in the detection method or an upgrade.

Next, an eighth embodiment of the present invention will be described with reference to FIG.
0 will be described.

In this embodiment, a falsification detection program 9 having a falsification detection function 3 is stored in the auxiliary storage device 4,
In the boot program 2 in the OM 1, a falsification detection program compression value 391 obtained by compressing the falsification detection program 9 with a one-way function in advance is recorded. And at boot time,
A value obtained by compressing the content of the current program to be inspected by a one-way function and a compressed value 391 of the stored falsification detection program
To check whether the tampering detection program 9 itself has been tampered with (the tampering detection program checking means 3).
9). The falsification detection program 9 can be read by, for example, storing the falsification detection program 9 in a physical continuous area starting from a predetermined physical position in the storage device 91 and reading out the falsification detection program 9 from the predetermined position to the RAM 102 using the BIOS. Good. The falsification detection program execution means 38 stores the IP address of the CPU 100 in the RAM 10
2 may be set to the start address of the falsification detection program 9 read.

In this embodiment, a function newly provided in the boot program 2 stored in the ROM 1 for implementing the present invention is a simple falsification detection program checking means 39 using a one-way function, and a falsification detection program. Since only the tampering detection program execution means 38 for loading and executing the program 9 is used, the program size of the boot program 2 can be reduced and the occupied memory space of the ROM 1 can be reduced.

Next, a ninth embodiment of the present invention will be described with reference to FIG.
This will be described with reference to FIG.

In this embodiment, a falsification detection program executing means 461 for reading the falsification detection program 9 having the falsification detection function 3 from the auxiliary storage device 4 and executing it,
An alternative OS loader 46 having OS loader executing means 462 for reading and executing the OS loader 43 separately stored in a physical location other than the boot sector in the auxiliary storage device 4
It is provided in the boot sector of the auxiliary storage device 4.

The falsification detection program execution means 461
For example, the falsification detection program 9 is stored in a physical continuous area starting from a predetermined physical position of the auxiliary storage device 4, and the RAM 102 is read from the predetermined position using the BIOS.
Then, the IP address of the CPU 100 may be set to the start address of the falsification detection program 9 read into the RAM 102 by a jump command.

The OS loader executing means 462 can be similarly configured. That is, the separately stored OS loader may be stored in a physical continuous area starting from a predetermined physical position of the auxiliary storage device 4, and may be read and executed in the same manner as the falsification detection program execution means 461.

In this embodiment, a plurality of OSs are installed in the auxiliary storage device 4 and used separately.
The falsification detection function 3 operates after the OS to be started, that is, the boot sector to be started is designated. As a result, only the files necessary for the OS to be started can be inspected for tampering, and the inspection processing time can be reduced.

The first effect is that, before the OS loader or the OS is started, the OS loader, the OS file, or any other file has been tampered with reliably and without the user being conscious. That can be verified. The reason is that the above-mentioned verification is performed by the boot program, which is surely executed when the computer system is started, and is stored in the ROM, so that there is no fear of tampering itself. .

The second effect is that the hardware configuration can be simplified. The reason is that a software module for performing a tampering check is added to a boot ROM of a normal system, and a utility program for locating a file to be checked in a physically continuous area of the auxiliary storage device 4 and generating the first storage information 41 This is because the present invention can be configured only by using the, and does not require the addition of special hardware.

[0094]

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of an embodiment of the present invention.

FIG. 2 is a flowchart for explaining the operation of the present invention.

FIG. 3 is a diagram illustrating an example of first storage information;

FIG. 4 is a diagram for explaining another example of the first storage information.

FIG. 5 is a diagram illustrating a configuration of another embodiment of the present invention.

FIG. 6 is a diagram illustrating another example of the first storage information.

FIG. 7 is a diagram illustrating a configuration of another embodiment of the present invention.

FIG. 8 is a diagram illustrating a configuration of another embodiment of the present invention.

FIG. 9 is a diagram illustrating a configuration of another embodiment of the present invention.

FIG. 10 is a diagram illustrating a configuration of another embodiment of the present invention.

FIG. 11 is a diagram illustrating a configuration of another embodiment of the present invention.

FIG. 12 is a diagram for explaining a conventional technique.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ROM 2 Boot program 3 Falsification detection function 31 Saved information reading means 32 File to be inspected reading means 33 Falsification detecting means 34 Second stored information 35 Saved information input means 36 Second stored information reading means 37 Communication means 38 Falsification detection program Execution means 39 Tamper detection program inspection means 391 Tamper detection program compressed value 4 Auxiliary storage device 41 First storage information 42 File under inspection 43 OS loader 44 OS file 45 Boot sector 46 Alternative OS loader 461 Tamper detection program execution means 462 OS loader Execution means 47 Falsification detection program 48 File list to be inspected 6 Input device 7 External storage device 71 Falsification prevention means 8 External computer 81 Falsification prevention means 82 Falsification detection calculation means 9 Falsification detection program Gram 91 Storage device with write protect function 100 Control unit 101 CPU 102 RAM

Claims (13)

[Claims] When booting, first, a boot program in a ROM is started, the boot program starts an OS loader in an auxiliary storage device, and the OS loader starts an OS in the auxiliary storage device. Storage information reading means for reading the first storage information stored in the auxiliary storage device, the boot program; and any test target from the auxiliary storage device based on the content of the read first storage information. A file to be inspected reading means for reading a file; determining whether or not each of the files to be inspected has been tampered with from the second storage information held in the boot program, the first stored information read and each of the files to be inspected; A computer system having a falsification inspection function including a falsification detection unit for performing inspection. 2. The falsification detecting means according to claim 1, wherein a digital signature for each of the files to be inspected is stored in the first storage information, and a key for signature verification is stored in the second storage information. A computer system for inspecting each inspected file for tampering with the digital signature and the signature verification key. 3. A computer system according to claim 1, wherein said OS loader stored in said auxiliary storage device is used as one of said files to be inspected to check for falsification at boot time. 4. A computer system according to claim 1, wherein said OS file stored in said auxiliary storage device is used as one of said files to be inspected to check for tampering at boot time. 5. A function for checking whether the first stored information has been tampered with, wherein the first stored information has information for its own tampering inspection, and the tampering detection means according to claim 1 checks whether the first stored information has been tampered with. A computer system comprising: 6. A compressed value obtained by compressing each of the files to be inspected by a one-way function and a digital signature for the first stored information are stored in the first stored information, and a digital signature for the first stored information is stored in the second stored information. Storing a key for signature verification, the falsification detecting unit checks whether the first stored information has been falsified with the digital signature and the key for signature verification,
A computer system for inspecting each inspected file for tampering with the compressed value. 7. The computer system according to claim 1, wherein said boot program includes storage information obtaining means for obtaining said second storage information from an input device, and wherein said second storage information is obtained from a user's input. . 8. The first storage information according to claim 7, wherein the first storage information includes a compression value obtained by compressing each of the files to be inspected and the second storage information by a one-way function, and the first storage information itself. And a compressed value obtained by compressing the second stored information with a one-way function, and the falsification detecting unit acquires the second stored information obtained by the stored information obtaining unit according to claim 7. The compression value is calculated again using the storage information of the above, and by comparing the compression value stored in the first storage information with the compression value, it is possible to determine whether each of the inspected files and the first storage information has been tampered with. A computer system characterized by inspecting. 9. The external storage device having the second storage information in the external storage device, wherein the boot program includes second storage information reading means for acquiring the second storage information from the external storage device. Is a computer system comprising a means for preventing the falsification of the second stored information. 10. An external computer having the second stored information, wherein the external computer performs a falsification preventing means for the second stored information, and performs a calculation required for falsification detection using the second stored information. The boot program includes a communication unit with the external computer, and the falsification detection unit according to claim 1, wherein the falsification detection unit is configured to store the first storage information, the files to be inspected, A computer system for detecting whether each of the files to be inspected has been tampered with by using a tampering detection calculation unit of the external computer through a communication unit with the external computer. 11. The falsification detection program having the falsification detection function according to claim 1 is stored in a storage device having a write protection function, and the boot program includes means for executing the falsification detection program. Computer system. 12. A falsification detection program having a falsification detection function according to claim 1 is stored in said auxiliary storage device, and a value obtained by compressing said falsification detection program by a one-way function is stored in said ROM in advance. The boot program checks whether the falsification detection program itself has been falsified by compressing the falsification detection program with a one-way function and comparing the value with the stored compressed value. A computer system comprising: a falsification detection program inspection unit; and a falsification detection program execution unit that executes the falsification detection program. 13. The falsification detection program having the falsification detection function according to claim 1 is stored in the auxiliary storage device, and the OS loader stored in a boot sector of the auxiliary storage device is stored in advance in the auxiliary storage device. An alteration detection program executing means for storing the OS in a location other than the boot sector of the device and reading and executing the alteration detection program from the auxiliary storage device; and an OS loader executing means for reading and executing the stored OS loader. A computer system having the alternative OS loader provided in a boot sector of the auxiliary storage device.