Information processing device and determination method

Abstract

To provide an information processing device capable of accurately determining the validity of an access request.SOLUTION: An information processing device 2 includes a guest OS 8, a host OS 10 that accesses a sector group stored in an external storage device 12 in response to an access request from the guest OS 8, and a virtualization control system 6 that is executed on hardware 4 and controls execution of the guest OS 8 and the host OS 10. The host OS 10 includes a back-end device driver 20 that acquires the access request from the guest OS 8, and a sector group access determination unit 26 configured to determine whether the access request is anomalous, based on a sector group access rule database 34 indicating a rule for accessing the sector group stored in the external storage device 12.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing apparatus and a determination method. [Background Art]

[0002] There is known an information processing apparatus comprising: a service operating system (hereinafter referred to as "service OS"); a security operating system (hereinafter referred to as "security OS"); and a control program that controls execution of the service OS and the security OS (see, for example, Patent Document 1).

[0003] The service OS hooks (acquires) an access request to a magnetic disk from a server program, and requests the security OS to determine the validity of the hooked access request. When the security OS determines that the access request from the server program is invalid, the service OS generates an error code based on the determination result from the security OS.

[0004] On the other hand, when the security OS determines that the access request from the server program is not invalid, the service OS executes access to the magnetic disk based on the access request from the server program in accordance with the determination result from the security OS. [Prior Art Documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent No. 4177957 [Summary of the Invention] [Problem to be Solved by the Invention]

[0006] In the conventional information processing devices described above, if the service OS itself is attacked by a malicious program, functions such as hooking access requests from server programs may be disabled. As a result, a problem arises in that the security OS cannot accurately determine the legitimacy of access requests from server programs.

[0007] Therefore, this disclosure provides an information processing device and a determination method that can accurately determine the legitimacy of an access request. [Means for solving the problem]

[0008] An information processing device according to one aspect of the present disclosure is an information processing device for determining unauthorized access in a vehicle, comprising: a first operating system; a second operating system that accesses a group of sectors stored in a storage device in response to an access request from the first operating system; and a virtualization control system that runs on a processor and controls the execution of the first operating system and the second operating system, wherein the second operating system includes: an acquisition unit that acquires the access request from the first operating system; and a determination unit that determines whether the access request is unauthorized based on rule information indicating rules for accessing the group of sectors stored in the storage device.

[0009] In this specification, a sector group refers to the file itself, the information describing the file (e.g., i-node information in Linux®), or the file system information. A sector group name refers to the file name representing the file itself, or the specific name of the information describing the file (e.g., a directory name). File information refers to metadata including the file name, file size, access permissions, change history, and information required by the access control system.

[0010] These comprehensive or specific embodiments may be implemented as a system, method, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM (Compact Disc-Read Only Memory), or as any combination of a system, method, integrated circuit, computer program, and recording medium. [Effects of the Invention]

[0011] According to an information processing device, etc., relating to one aspect of this disclosure, the legitimacy of an access request can be determined with high accuracy. [Brief explanation of the drawing]

[0012] [Figure 1] This is a block diagram showing the configuration of an information processing device according to an embodiment. [Figure 2] This figure shows an example of a device access log according to the embodiment. [Figure 3] This figure shows an example of a sector group database according to the embodiment. [Figure 4] This figure shows an example of a sector group access log according to the embodiment. [Figure 5] This figure shows an example of sector group access information according to the embodiment. [Figure 6] This figure shows an example of a sector group access rule database according to the embodiment. [Figure 7] This is a flowchart showing the overall operation flow of the host OS according to the embodiment. [Figure 8] This is a flowchart showing the operation flow of the access log analysis unit according to the embodiment. [Figure 9] This flowchart shows the operation flow of the sector group access determination unit according to the embodiment. [Figure 10] This flowchart specifically illustrates the process of step S305 in the flowchart shown in Figure 9. [Figure 11]It is a flowchart specifically illustrating the process of step S305 in the flowchart of FIG. 9. [Figure 12] It is a flowchart showing a first example of a behavior determination method using an N-th behavior rule. [Figure 13] It is a flowchart showing a second example of a behavior determination method using an N-th behavior rule. [Figure 14] It is a flowchart showing a third example of a behavior determination method using an N-th behavior rule. [Figure 15] It is a flowchart showing a fourth example of a behavior determination method using an N-th behavior rule. [Figure 16] It is a flowchart showing a fifth example of a behavior determination method using an N-th behavior rule. [Figure 17] It is a flowchart showing a sixth example of a behavior determination method using an N-th behavior rule. [Figure 18] It is a flowchart showing a seventh example of a behavior determination method using an N-th behavior rule. [Figure 19] It is a flowchart showing an eighth example of a behavior determination method using an N-th behavior rule. DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

[0013] An information processing device according to a first aspect of the present disclosure is an information processing device for determining unauthorized access in a vehicle, comprising: a first operating system; a second operating system that accesses a group of sectors stored in a storage device in response to an access request from the first operating system; and a virtualization control system that runs on a processor and controls the execution of the first operating system and the second operating system, wherein the second operating system includes: an acquisition unit that acquires the access request from the first operating system; and a determination unit that determines whether the access request is unauthorized based on rule information indicating rules for accessing the group of sectors stored in the storage device.

[0014] Here, a virtualization control system refers to a system that receives I / O information from the operating system running on the virtualization system through a hypervisor and exchanges I / O information with actual devices.

[0015] According to this embodiment, the second operating system hooks (acquires) access requests from the first operating system and analyzes the hooked access requests to determine their legitimacy. As a result, even if the security functions of the first operating system are disabled or tampered with by a malicious computer program, the second operating system can use the hooked access requests as information to monitor abnormalities in the first operating system, thereby enabling accurate determination of the legitimacy of access requests from the first operating system.

[0016] Furthermore, in the information processing apparatus according to a second aspect of the present disclosure, in the first aspect, the second operating system further includes an analysis unit that generates access log information linking the sector number and the sector group name included in the access request by referring to correspondence information indicating the correspondence between the sector number and the sector group name of the sector group stored in the storage area of ​​the storage device corresponding to the sector number, and the determination unit may be configured to determine whether the access request is invalid or not based on the rule information and the access log information.

[0017] According to this embodiment, even if the access request does not include a sector group name, access log information including the sector group name can be generated from the access request by referring to the corresponding information. This makes it easy to determine whether or not the access request is invalid based on the rule information and the access log information.

[0018] Furthermore, in the information processing device according to the third aspect of this disclosure, in the first or second aspect, the second operating system may be configured to further include a response unit that notifies an external party when the determination unit determines that the access request is invalid.

[0019] According to this embodiment, for example, if an unauthorized computer program is executed on the first operating system, appropriate action can be taken against the first operating system.

[0020] Furthermore, in the information processing device according to the fourth aspect of this disclosure, in the third aspect, the corresponding unit may be configured to further notify an external party and suspend access to the group of sectors stored in the storage device if the determination unit determines that the access request is invalid.

[0021] According to this embodiment, for example, if an unauthorized computer program is executed on the first operating system, the sectors stored in the storage device can be properly protected.

[0022] Furthermore, in the information processing device according to the fifth aspect of this disclosure, in any one aspect of the first to fourth aspects, the rule information may be configured such that the rule includes at least one of a process and an operation that grants access to the group of sectors stored in the storage device.

[0023] According to this embodiment, the legitimacy of an access request from the first operating system can be easily determined by determining, based on rule information, whether the process and / or operation requested by the access request is an authorized process and / or operation.

[0024] Furthermore, in the information processing device according to the sixth aspect of this disclosure, in the first aspect, the determination unit may be configured to determine whether the access request is invalid based on the rule information relating to the read and write permissions granted to the sector group.

[0025] According to this embodiment, the determination unit can determine whether or not an access request is invalid by taking into account the read and write permissions granted to the sector group.

[0026] Furthermore, in the information processing apparatus according to the seventh aspect of the present disclosure, in the first aspect, the second operating system may be able to access an external device, and the determination unit may be configured to determine whether the access request is invalid based on the rule information and the state of the external device.

[0027] According to this embodiment, the determination unit can determine whether or not the access request is invalid by taking into account the state of the external device.

[0028] Furthermore, in the information processing device according to the eighth aspect of this disclosure, in the first aspect, the determination unit may be configured to determine whether or not the access request is invalid based on the rule information and the state of the information processing device.

[0029] According to this embodiment, the determination unit can determine whether or not an access request is invalid by taking into account the state of the information processing device.

[0030] Furthermore, in the information processing apparatus according to the ninth aspect of this disclosure, in the first aspect, the determination unit may be configured to determine whether or not the access request is invalid based on the rule information and the state of the sector group.

[0031] According to this embodiment, the determination unit can determine whether or not an access request is invalid by considering the state of the sector group.

[0032] Furthermore, in the information processing apparatus according to the tenth aspect of this disclosure, in the first aspect, the determination unit may be configured to determine whether the access request is invalid based on the rule information and the access content to the sector group for which writing is permitted.

[0033] According to this embodiment, the determination unit can determine whether or not an access request is invalid by considering the content of the access to the group of sectors for which writing is permitted.

[0034] A determination method according to an eleventh aspect of the present disclosure is a determination method for determining unauthorized access in a vehicle using an information processing device comprising a first operating system, a second operating system that accesses a group of sectors stored in a storage device in response to an access request from the first operating system, and a virtualization control system that runs on a processor and controls the execution of the first operating system and the second operating system, wherein the second operating system obtains the access request from the first operating system, determines whether the obtained access request is unauthorized based on rule information indicating rules for accessing the group of sectors stored in the storage device, and outputs the result to the outside if it is determined that the access request is unauthorized.

[0035] According to this embodiment, the second operating system hooks access requests from the first operating system and analyzes the hooked access requests to determine their legitimacy. As a result, even if the security functions of the first operating system are disabled or tampered with by a malicious computer program, the second operating system can use the hooked access requests as information to monitor abnormalities in the first operating system, thereby enabling accurate determination of the legitimacy of access requests from the first operating system.

[0036] These comprehensive or specific embodiments may be implemented as a system, method, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM, or as any combination of a system, method, integrated circuit, computer program, or recording medium.

[0037] The embodiments will be described in detail below with reference to the drawings.

[0038] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, arrangement and connection configurations of components, steps, and the order of steps shown in the following embodiments are examples only and are not intended to limit this disclosure. Furthermore, among the components in the following embodiments, those not described in the independent claim representing the highest-level concept will be described as optional components.

[0039] (Embodiment) [1. Configuration of the Information Processing Device] First, the configuration of the information processing device 2 according to the embodiment will be described with reference to Figures 1 to 6. Figure 1 is a block diagram showing the configuration of the information processing device 2 according to the embodiment. Figure 2 is a diagram showing an example of a device access log 36 according to the embodiment. Figure 3 is a diagram showing an example of a sector group database 30 according to the embodiment. Figure 4 is a diagram showing an example of a sector group access log 38 according to the embodiment. Figure 5 is a diagram showing an example of sector group access information 32 according to the embodiment. Figure 6 is a diagram showing an example of a sector group access rule database 34 according to the embodiment.

[0040] As shown in Figure 1, the information processing device 2 according to this embodiment comprises hardware 4, a virtualization control system 6, a plurality of guest operating systems 8 (hereinafter referred to as "guest OS 8"), and a host operating system 10 (hereinafter referred to as "host OS 10") that operates on the virtualization control system 6. The information processing device 2 is a device for determining unauthorized access in a vehicle such as an automobile.

[0041] An external storage device 12 is electrically connected to the information processing device 2. The external storage device 12 is an example of a storage device, and is composed of, for example, a hard disk drive (HDD). The external storage device 12 has multiple storage areas for storing sector groups (data). Each of these multiple storage areas is assigned multiple sector numbers. As will be described later, the sector numbers are used to specify the storage area of ​​the external storage device 12 where the sector group is stored when the host OS 10 accesses the sector group stored in the external storage device 12 in response to an access request from the guest OS 8, and are composed of, for example, four-digit numbers.

[0042] In this specification, a sector group refers to the file itself, the information describing the file (e.g., i-node information in Linux®), or the file system information. A sector group name refers to the file name representing the file itself, or the specific name of the information describing the file (e.g., a directory name). File information refers to metadata including the file name, file size, access permissions, change history, and information required by the access control system.

[0043] Furthermore, the information processing device 2 is electrically connected to a network device 11 and a screen rendering device 13. The network device 11 and the screen rendering device 13 are examples of external devices.

[0044] Hardware 4 includes a processor, such as a CPU (Central Processing Unit) or an ECU (Electronic Control Unit), and provides an execution environment for multiple computer programs. Hardware 4 may consist of one processor or multiple processors.

[0045] The virtualization control system 6 is virtualization software that runs on hardware 4 (processor) and controls the execution of multiple guest OS 8 and host OS 10. This virtualization control system 6 allows multiple different operating systems (multiple guest OS 8 and host OS 10) to be virtualized and installed on a single piece of hardware 4. In this embodiment, the virtualization control system 6 is a hypervisor known as a Type 1 (bare metal) type.

[0046] Each of the multiple guest OS8s is a virtual machine (VM), such as Linux®, running on the virtualization control system 6, and is an example of a first operating system. Each of the multiple guest OS8s has multiple processes 14, an access control function 16, and a front-end device driver 18. In Figure 1, only one guest OS8 is shown for illustrative purposes. In this embodiment, multiple guest OS8s are configured to run on the virtualization control system 6, but the embodiment is not limited to this, and only one guest OS8 may be configured to run on the virtualization control system 6.

[0047] Each of the multiple processes 14 is a computer program that executes various functions of the guest OS 8. Each of the multiple processes 14 generates an access request to request access to a group of sectors stored in the external storage device 12 (for example, writing to or reading from a group of sectors) in order to execute various functions of the guest OS 8. In Figure 1, only one process 14 is shown for illustrative purposes.

[0048] The access control function 16 is a security function for monitoring access requests generated by each of the multiple processes 14. For example, if a malicious computer program such as malware is executed on the guest OS 8 and attempts to illegally access a group of sectors stored in the external storage device 12, the access control function 16 discards the access request generated by the malicious computer program.

[0049] The front-end device driver 18 is a virtual device driver (VirtIO) for driving the virtual network interface configured in the guest OS 8. The front-end device driver 18 sends access requests generated by each of the multiple processes 14 to the back-end device driver 20 (described later) of the host OS 10 via the virtualization control system 6. The front-end device driver 18 also receives access responses (described later) from the back-end device driver 20 of the host OS 10 via the virtualization control system 6.

[0050] The host OS 10 is a virtual machine, such as Linux (registered trademark), that runs on the virtualization control system 6, and is an example of a second operating system. Here, the virtualization control system refers to a system that receives I / O information from the guest OS 8 running on the virtualization system through the hypervisor and exchanges I / O information with the actual external storage device 12. The host OS 10 includes a backend device driver 20, a storage unit 22, an access log analysis unit 24, a sector group access determination unit 26, and a control response unit 28.

[0051] The backend device driver 20 is a virtual device driver (VirtIO) for driving a virtual network interface configured on the host OS 10, and is an example of an acquisition unit. The backend device driver 20 acquires (receives) access requests from the frontend device driver 18 of the guest OS 8 via the virtualization control system 6, and outputs the acquired access requests to the access log analysis unit 24.

[0052] Furthermore, as will be described later, if the sector group access determination unit 26 determines that the access request is not invalid, the backend-device driver 20 accesses the sector group stored in the external storage device 12 in response to the access request. In this case, the backend-device driver 20 sends an access response indicating the result of accessing the sector group stored in the external storage device 12 to the frontend-device driver 18 of the guest OS 8 via the virtualization control system 6. In addition, the backend-device driver 20 can also access the network device 11 and the screen rendering device 13.

[0053] The memory unit 22 is a memory that stores the sector group database 30, the sector group access information 32, and the sector group access rule database 34. These sector group database 30, sector group access information 32, and sector group access rule database 34 will be described later.

[0054] The access log analysis unit 24 is an example of an analysis unit and acquires a device access log 36 as a log of access requests acquired by the backend-device driver 20. Here, the device access log 36 is a table-format database, for example, as shown in Figure 2. As shown in Figure 2, the device access log 36 associates a timestamp, the target VM, the operation type, the sector number, and the payload. The timestamp is information indicating the date and time when the frontend-device driver 18 of the guest OS 8 sent the access request. The target VM is information indicating the guest OS 8 that sent the access request, for example, a sequential number such as "1", "2", ..., "n" assigned to multiple guest OS 8s. The operation type is information indicating the type of operation on the sector group by the access request, for example, "read" (reading the sector group) or "write" (writing to the sector group). The sector number is information for specifying the storage area of ​​the sector group in the external storage device 12. The payload is information indicating the content of the operation request (for example, information on what content to write).

[0055] In the example shown in Figure 2, the first line of the device access log 36 contains a) timestamp "2021 / 9 / 3 18:39:01.032", b) target VM "1", c) operation type "read", d) sector number "1111", and e) payload "e38182 (omitted)". In other words, the first line of the device access log 36 means that at the date and time of "2021 / 9 / 3 18:39:01.032", the guest OS 8 assigned number "1" sent an access request to request a read of the group of sectors stored in the storage area of ​​the external storage device 12 corresponding to sector number "1111".

[0056] Furthermore, the access log analysis unit 24 generates a sector group access log 38 from the device access log 36 based on the sector group database 30 stored in the storage unit 22. Here, the sector group database 30 is a table-format database, as shown in Figure 3, for example, and is an example of correspondence information. As shown in Figure 3, the sector group database 30 is a database that shows the correspondence between a sector number and the sector group name of the sector group stored in the storage area of ​​the external storage device 12 corresponding to that sector number. This sector group database 30 is generated, for example, when the information processing device 2 is first started up.

[0057] In the example shown in Figure 3, the first row of the sector group database 30 contains a) sector number "1111" and b) sector group name " / home / key / secret.dat". In other words, the first row name of the sector group database 30 means that the sector group with the sector group name " / home / key / secret.dat" is stored in the storage area of ​​the external storage device 12 corresponding to sector number "1111". Note that if a sector number is added due to an increase in the access request log, the sector group database 30 will be updated.

[0058] The access log analysis unit 24 first extracts only the logs related to the monitored guest OS 8 (for example, the guest OS 8 assigned the number "1") from the device access log 36. Next, the access log analysis unit 24 refers to the sector group database 30 stored in the storage unit 22 and generates a sector group access log 38 by associating the sector numbers contained in the extracted device access log 36 logs with the sector group names corresponding to those sector numbers. The access log analysis unit 24 outputs the generated sector group access log 38 to the sector group access determination unit 26.

[0059] Here, the sector group access log 38 is a table-format database, as shown in Figure 4, and is an example of access log information. As shown in Figure 4, the sector group access log 38 associates the timestamp with the operation type, sector number, sector group name, and payload.

[0060] In the example shown in Figure 4, the first line of the sector group access log 38 contains a) timestamp "2021 / 9 / 3 18:39:01.032", b) operation type "read", c) sector number "1111", d) sector group name " / home / key / secret.dat", and e) payload "e38182 (omitted)". In other words, the first line of the sector group access log 38 means that at the time of "2021 / 9 / 3 18:39:01.032", guest OS 8, which was assigned the number "1", sent an access request to read the sector group named " / home / key / secret.dat" stored in the storage area of ​​the external storage device 12 corresponding to sector number "1111".

[0061] Furthermore, the access log analysis unit 24 updates the sector group access information 32 stored in the storage unit 22 based on the generated sector group access log 38. Here, the sector group access information 32 is a table-format database, for example, as shown in Figure 5. As shown in Figure 5, the sector group access information 32 associates the sector group name with the last access date and time, the last accessing process, the last operation, and the last sector number.

[0062] In the example shown in Figure 5, the first line of the sector group access information 32 contains: a) sector group name " / var / log / system.log", b) last access date and time "2021 / 9 / 17 04:43:21.213", c) last accessing process "systemlogd", d) last operation "write", and e) last sector number "1234". In other words, the first line of the sector group access information 32 means that the last access to the sector group named " / var / log / system.log" was a write operation by the process "systemlogd" to the memory area of ​​the external memory device 12 corresponding to sector number "1234" at the date and time "2021 / 9 / 17 04:43:21.213".

[0063] The sector group access determination unit 26 is an example of a determination unit, and it determines whether or not an access request from the guest OS 8 is invalid based on the sector group access information 32 and sector group access rule database 34 stored in the storage unit 22, and the sector group access log 38.

[0064] Here, the sector group access rule database 34 is a database that shows the correspondence between the sector group name of a sector group and the rules for accessing that sector group, for each sector group stored in the external storage device 12. Specifically, the sector group access rule database 34 is a table-format database, as shown in Figure 6, for example, and is an example of rule information. As shown in Figure 6, the sector group access rule database 34 associates the sector group name with the access permission process, the access permission operation, and the sector group type. The access permission process is information (rule) indicating the process that is permitted to access the sector group. The access permission operation is information (rule) indicating the operation that is permitted to access the sector group. The sector group type is information indicating the type of sector group (personal information or log).

[0065] In the example shown in Figure 6, the first row of the sector group access rule database 34 contains a) the sector group name " / home / key / secret.dat", b) the process that is allowed to access it "updateservice", c) the operation that is allowed to access it "read", and d) the sector group type "personal information". In other words, the first row of the sector group access rule database 34 means that the process that is allowed to access the sector group named " / home / key / secret.dat" which contains "personal information" is "updateservice", and the operation that is allowed to access it is read.

[0066] In this embodiment, the sector group access rule database 34 includes processes and operations that are permitted to access the sector group stored in the external storage device 12 as rules for accessing the sector group, but it is not limited to this, and may include only one of either processes or operations.

[0067] The sector group access determination unit 26 compares the sector group access rule database 34 and the sector group access log 38 to determine whether the process and operation attempting to access the sector group stored in the external storage device 12 conforms to the rules defined in the sector group access rule database 34. Furthermore, the sector group access determination unit 26 compares the sector group access information 32 and the sector group access log 38 to determine whether the behavior of the guest OS 8 accessing the sector group is an permitted behavior. The sector group access determination unit 26 outputs the determination result to the control response unit 28.

[0068] The permitted behaviors include, for example, a) operations to append to a log file (a group of sectors indicating the log), and b) operations to read the group of sectors when the information processing device 2 is first started. In the former case, even if write permission is granted to the log file, only appending to the log file occurs, so operations that attempt to modify or delete a part of the log file can be determined to be unauthorized access. In the latter case, for example, the group of sectors indicating the policy of the access control function 16 of the guest OS 8 is generally read only when the information processing device 2 is first started, so operations that attempt to read this group of sectors after a considerable amount of time has elapsed since the first start can be determined to be unauthorized access.

[0069] Furthermore, the sector group access determination unit 26 can acquire information related to the information processing device 2, such as information indicating the startup time of the information processing device 2 and information indicating the startup mode of the information processing device 2. The information processing device 2 is started in either normal mode or repro mode.

[0070] The control response unit 28 is an example of a response unit and controls the response based on the determination result of the sector group access determination unit 26. Specifically, if the sector group access determination unit 26 determines that the access request is invalid, the control response unit 28 sends an error notification to the external server 40 equipped with SIEM (Security Information and Event Management) functionality. If the sector group access determination unit 26 determines that the access request is not invalid, the control response unit 28 instructs the backend-device driver 20 to access the sector group stored in the external storage device 12 in response to the access request.

[0071] [2. Operation of the Information Processing Device] [2-1. Overall operation of the host OS] The overall operation of the host OS 10 according to this embodiment will be described with reference to Figure 7. Figure 7 is a flowchart showing the overall operation flow of the host OS 10 according to this embodiment.

[0072] As shown in Figure 7, first, the access log analysis unit 24 acquires a device access log 36 as a log of access requests obtained by the backend-device driver 20 (S101).

[0073] Next, the access log analysis unit 24 extracts only the logs related to the monitored guest OS 8 from the device access log 36, then refers to the sector group database 30 stored in the storage unit 22, and generates a sector group access log 38 by associating the sector numbers included in the extracted logs with the sector group names corresponding to those sector numbers (S102).

[0074] Next, the sector group access determination unit 26 determines whether the access request from the guest OS 8 is invalid based on the sector group access information 32 and sector group access rule database 34 stored in the storage unit 22, and the sector group access log 38 (S103). The sector group access determination unit 26 outputs the determination result to the control response unit 28.

[0075] If the sector group access determination unit 26 determines that the access request is invalid (YES in S103), the control response unit 28 determines the type of sector group to which the access request is directed based on the sector group name included in the sector group access log 38 (S104).

[0076] If the sector group type is "log" (in S104, "log"), the control response unit 28 notifies the external server 40 of the error (S105). In this case, the timing at which the control response unit 28 notifies the external server 40 of the error is predetermined at regular intervals (for example, every 5 minutes). At this time, the sector group access determination unit 26 deletes the contents of the sector group access information 32 related to the unauthorized access request. After that, the flowchart in Figure 7 is terminated.

[0077] On the other hand, if the type of sector group is "personal information" (as indicated in S104), the control response unit 28 notifies the external server 40 of the error and instructs the backend-device driver 20 to stop accessing the sector group corresponding to the access request (S106). In this case, the timing of the control response unit 28 notifying the external server 40 of the error and stopping access to the sector group is immediate. The control response unit 28 may also notify the external server 40 of the sector group access log 38 which has been determined to be invalid when notifying the external server 40 of the error. At this time, the sector group access determination unit 26 deletes the contents of the sector group access information 32 related to the invalid access request. After that, the flowchart in Figure 7 is terminated.

[0078] Returning to step S103, if the sector group access determination unit 26 determines that the access request is not invalid (NO in S103), the control response unit 28 instructs the backend-device driver 20 to access the sector group stored in the external storage device 12 in response to the access request (S107). At this time, the sector group access determination unit 26 updates the sector group access information 32 based on the content of the access request. After that, the flowchart in Figure 7 ends.

[0079] [2-2. Operation of the Access Log Analysis Unit] The operation of the access log analysis unit 24 will be explained in detail with reference to Figure 8. Figure 8 is a flowchart showing the operation flow of the access log analysis unit 24 according to the embodiment.

[0080] As shown in Figure 8, the access log analysis unit 24 first obtains the latest log from the device access log 36 (S201). Next, the access log analysis unit 24 determines whether the target VM included in the latest obtained log is the monitored guest OS 8 (S202). If the target VM included in the latest obtained log is not the monitored guest OS 8 (NO in S202), the flowchart in Figure 8 is terminated.

[0081] On the other hand, if the target VM included in the latest acquired log is the monitored guest OS8 (YES in S202), the access log analysis unit 24 determines whether the sector number included in the latest acquired log is registered in the sector group database 30 (S203).

[0082] If the sector number included in the most recently acquired log is registered in the sector group database 30 (YES in S203), the access log analysis unit 24 generates a sector group access log 38 by associating the sector number included in the most recently acquired log with the sector group name corresponding to that sector number registered in the sector group database 30 (S204). After that, the flowchart in Figure 8 is terminated.

[0083] On the other hand, if the sector number included in the most recently acquired log is not registered in the sector group database 30 (NO in S203), the access log analysis unit 24 determines whether the operation type included in the most recently acquired log is "write" (S205). If the operation type included in the most recently acquired log is not "write" (NO in S205), the flowchart in Figure 8 is terminated.

[0084] On the other hand, if the operation type included in the most recently acquired log is "write" (YES in S205), the access log analysis unit 24 determines whether the most recently acquired log is an operation on a sector group registered in the sector group access rule database 34 (S206). If the most recently acquired log is not an operation on a sector group registered in the sector group access rule database 34 (NO in S206), the flowchart in Figure 8 is terminated.

[0085] On the other hand, if the most recently acquired log is an operation on a sector group registered in the sector group access rule database 34 (YES in S206), the access log analysis unit 24 registers the sector number and the name of the sector group corresponding to that sector number in the sector group database 30 (S207), and proceeds to step S204.

[0086] [2-3. Operation of the Sector Group Access Determination Unit] The operation of the sector group access determination unit 26 will be explained in detail with reference to Figure 9. Figure 9 is a flowchart showing the operation flow of the sector group access determination unit 26 according to the embodiment.

[0087] As shown in Figure 9, the sector group access determination unit 26 first obtains the latest log from the sector group access log 38 (S301). Next, the sector group access determination unit 26 determines whether the operation type included in the obtained latest log is an access permission operation corresponding to the sector group name of the latest log included in the sector group access rule database 34 (S302). That is, the sector group access determination unit 26 determines whether the access request is invalid based on the rule information regarding read and write permissions granted to the sector group. If the operation type included in the obtained latest log is not an access permission operation (NO in S302), the sector group access determination unit 26 determines that the access request from the guest OS 8 is invalid (S303). After that, the flowchart in Figure 9 ends.

[0088] On the other hand, if the operation type included in the most recently acquired log is an access permission operation (YES in S302), the sector group access determination unit 26 determines whether the process is an access permission process corresponding to the sector group name of the most recently acquired log included in the sector group access rule database 34 (S304). If the process is not an access permission process (NO in S304), the sector group access determination unit 26 determines that the access request from the guest OS 8 is invalid (S303). After that, the flowchart in Figure 9 is terminated.

[0089] On the other hand, if the process is an access-permitted process (YES in S304), the sector group access determination unit 26 determines, based on the sector group access information 32, whether the access behavior to the sector group stored in the external storage device 12 is an permitted behavior (S305). If the behavior is not an permitted behavior (NO in S305), the sector group access determination unit 26 determines that the access request from the guest OS 8 is invalid (S303). After that, the flowchart in Figure 9 is terminated.

[0090] On the other hand, if the behavior is an authorized behavior (YES in S305), the sector group access determination unit 26 determines that the access request from the guest OS 8 is not invalid (S306). After that, the flowchart in Figure 9 is terminated.

[0091] Here, with reference to Figures 10 and 11, we will specifically explain the process of step S305 in the flowchart of Figure 9. Figures 10 and 11 are flowcharts that specifically illustrate the process of step S305 in the flowchart of Figure 9.

[0092] The sector group access determination unit 26 determines, based on the first behavior rule to the Nth behavior rule, whether or not the behavior is permitted by each of the first behavior rule to the Nth behavior rule.

[0093] As shown in Figure 10, the sector group access determination unit 26 determines whether the behavior is permitted by the first behavior rule if the behavior is not as described above (S401). If the behavior is not permitted by the first behavior rule (NO in S401), the sector group access determination unit 26 determines that the access request from the guest OS 8 is invalid (S402). The flowchart in Figure 10 then terminates.

[0094] On the other hand, if the behavior is permitted by the first behavior rule (YES in S401), the sector group access determination unit 26 determines whether or not the behavior is permitted by the second behavior rule (S403). If the behavior is not permitted by the second behavior rule (NO in S403), the sector group access determination unit 26 determines that the access request from the guest OS 8 is invalid (S402). After that, the flowchart in Figure 10 ends.

[0095] Similarly, if the behavior is permitted by the second behavior rule (YES in S403), the sector group access determination unit 26 determines whether the behavior is permitted by the Nth behavior rule (S404). If the behavior is not permitted by the Nth behavior rule (NO in S404), the sector group access determination unit 26 determines that the access request from the guest OS 8 is invalid (S402). After that, the flowchart in Figure 10 ends.

[0096] If the behavior is permitted by the Nth behavior rule (YES in S404), the sector group access determination unit 26 determines that the access request from the guest OS 8 is not invalid (S405). Then, the flowchart in Figure 10 is terminated.

[0097] Next, with reference to Figure 11, a method for determining behavior using the first behavior rule will be explained. The first behavior rule is, for example, a rule concerning the behavior of accessing sector groups when the information processing device 2 is first started up.

[0098] As shown in Figure 11, if access to the sector group is not prohibited except during the initial startup of the information processing device 2 (NO in S501), the flowchart in Figure 11 is terminated. On the other hand, if access to the sector group is prohibited except during the initial startup of the information processing device 2 (YES in S501), the sector group access determination unit 26 determines whether or not an access request from the guest OS 8 is stored in the sector group access information 32 (S502).

[0099] If the sector group access information 32 contains an access request from the guest OS 8 (YES in S502), the sector group access determination unit 26 determines that the access request from the guest OS 8 is invalid (S503). After that, the flowchart in Figure 11 is terminated.

[0100] On the other hand, if no access request from the guest OS 8 is stored in the sector group access information 32 (NO in S502), the sector group access determination unit 26 determines whether the timestamp of the access request is within the expected initial startup time (e.g., 1 minute) (S504). If the timestamp of the access request is not within the expected initial startup time (NO in S504), the sector group access determination unit 26 determines that the access request is invalid (S503). After that, the flowchart in Figure 11 ends.

[0101] On the other hand, if the timestamp of the access request is within the expected initial startup time (YES in S504), the sector group access determination unit 26 determines that the behavior is a behavior permitted by the first behavior rule (S505). In this case, the sector group access determination unit 26 stores the access request from the guest OS 8 in the sector group access information 32. After that, the flowchart in Figure 11 is terminated.

[0102] The following sections will describe various examples of behavior determination methods using the Nth behavior rule, with reference to Figures 12 to 19.

[0103] First, with reference to Figure 12, we will explain a first example of a behavior determination method using the Nth behavior rule. Figure 12 is a flowchart of the first example of a behavior determination method using the Nth behavior rule. The Nth behavior rule is, for example, a rule concerning the behavior of accessing the private key of a client certificate.

[0104] As shown in Figure 12, the sector group access determination unit 26 determines whether the access request is for access to the private key of the client certificate (S601). If the access request is not for access to the private key of the client certificate (NO in S601), the flowchart in Figure 12 is terminated.

[0105] On the other hand, if the access request is for access to the private key of the client certificate (YES in S601), the sector group access determination unit 26 obtains information from the access log analysis unit 24 indicating the current connection destination for the network device 11 (S602). Based on this, the sector group access determination unit 26 determines whether or not it is accessing the network device 11, which is a legitimate connection destination (i.e., whether or not there is a request for the client certificate) (S603).

[0106] If the system is accessing the legitimate network device 11 (YES in S603), the sector group access determination unit 26 determines that the behavior is permitted by the Nth behavior rule (S604). The flowchart in Figure 12 then terminates.

[0107] On the other hand, if the network device 11, which is the legitimate connection destination, is not currently being accessed (NO in S603), the sector group access determination unit 26 determines that the access request is invalid (S605). After that, the flowchart in Figure 12 is terminated.

[0108] In this way, the sector group access determination unit 26 determines whether or not an access request is malicious by considering the state of the network device 11. This allows it to detect malicious access requests when an attacker attempts to illegally read the private key of a client certificate.

[0109] Next, with reference to Figure 13, a second example of a behavior determination method using the Nth behavior rule will be described. Figure 13 is a flowchart of the second example of a behavior determination method using the Nth behavior rule. The Nth behavior rule is, for example, a rule concerning the behavior of accessing a file that contains a phone number.

[0110] As shown in Figure 13, the sector group access determination unit 26 determines whether the access request is for access to a file containing telephone numbers (S701). If the access request is not for access to a file containing telephone numbers (NO in S701), the flowchart in Figure 13 is terminated.

[0111] On the other hand, if the access request is for access to a file containing telephone numbers (YES in S701), the sector group access determination unit 26 obtains information indicating the current operation on the screen rendering device 13 from the log of the access log analysis unit 24 (S702). Based on this, the sector group access determination unit 26 determines whether or not an operation related to telephone numbers, such as making a phone call, is currently underway on the screen rendering device 13 (S703).

[0112] If an operation related to a telephone number, such as making a phone call, is in progress (YES in S703), the sector group access determination unit 26 determines that the behavior is permitted by the Nth behavior rule (S704). After that, the flowchart in Figure 13 is terminated.

[0113] On the other hand, if the user is not performing an operation related to a phone number, such as making a phone call (NO in S703), the sector group access determination unit 26 determines that the access request is invalid (S705). After that, the flowchart in Figure 13 is terminated.

[0114] In this way, the sector group access determination unit 26 determines whether or not an access request is malicious by considering the state of the screen drawing device 13. This makes it possible to detect malicious access requests when an attacker attempts to illegally access a phone number listed in a file stored on the external storage device 12.

[0115] Next, with reference to Figure 14, a third example of a behavior determination method using the Nth behavior rule will be described. Figure 14 is a flowchart of the third example of a behavior determination method using the Nth behavior rule. The Nth behavior rule is, for example, a rule concerning the behavior of accessing a file that is read within a certain time after the startup of the information processing device 2.

[0116] As shown in Figure 14, the sector group access determination unit 26 determines whether the access request is for access to a file that will be read within a certain time after the information processing device 2 is started (S801). If the access request is not for access to a file that will be read within a certain time after the information processing device 2 is started (NO in S801), the flowchart in Figure 14 is terminated.

[0117] On the other hand, if the access request is for access to a file that will be read within a certain time after the information processing device 2 is started (YES in S801), the sector group access determination unit 26 obtains information indicating the startup time of the information processing device 2 (S802). Based on this, the sector group access determination unit 26 determines whether the access time to the file is within the time period defined by the rule (i.e., within a certain time after the information processing device 2 is started) (S803).

[0118] If the time of access to the file falls within the time limit specified by the rule (YES in S803), the sector group access determination unit 26 determines that the behavior is permitted by the Nth behavior rule (S804). After that, the flowchart in Figure 14 is terminated.

[0119] On the other hand, if the time of access to the file is not within the time period specified by the rules (NO in S803), the sector group access determination unit 26 determines that the access request is invalid (S805). After that, the flowchart in Figure 14 is terminated.

[0120] In this way, the sector group access determination unit 26 determines whether an access request is malicious or not by considering the state of the information processing device 2. This makes it possible to detect malicious access requests when an attacker attempts to illegally read a file that should be read within a certain time after the information processing device 2 starts up (for example, a kernel module or initialization file) outside of that time.

[0121] Next, with reference to Figure 15, a fourth example of a behavior determination method using the Nth behavior rule will be described. Figure 15 is a flowchart of the fourth example of a behavior determination method using the Nth behavior rule. The Nth behavior rule is, for example, a rule concerning the behavior of accessing the decryption key for repro (program rewriting process). Note that the decryption key for repro is a file that is read only when the information processing device 2 is started in repro mode in order to perform a system update of the information processing device 2.

[0122] As shown in Figure 15, the sector group access determination unit 26 determines whether the access request is for access to the decryption key for reproduction (S901). If the access request is not for access to the decryption key for reproduction (NO in S901), the flowchart in Figure 15 is terminated. In a similar use case, it is possible to determine whether the sector area to be written to is a sector area to be reproduced. In this case, the normal / abnormal status of the access may be determined by the processing from step S902 onwards.

[0123] On the other hand, if the access request is for access to a decryption key for repro (YES in S901), the sector group access determination unit 26 obtains information indicating the startup mode of the information processing device 2 and determines the type of startup mode obtained (normal mode or repro mode) (S902).

[0124] If the startup mode is Repro mode (in S903, "Repro mode"), the sector group access determination unit 26 determines that the behavior is permitted by the Nth behavior rule (S904). Then, the flowchart in Figure 15 is terminated.

[0125] On the other hand, if the startup mode is normal mode (in S903, "normal mode"), the sector group access determination unit 26 determines that the access request is invalid (S905). After that, the flowchart in Figure 15 is terminated.

[0126] In this way, the sector group access determination unit 26 determines whether or not an access request is malicious by considering the state of the information processing device 2. This allows the system to detect malicious access requests when the information processing device 2 is started in normal mode and an attacker attempts to illegally access the decryption key for reproduction and obtain the secret key information.

[0127] Next, with reference to Figure 16, a fifth example of a behavior determination method using the Nth behavior rule will be described. Figure 16 is a flowchart of the fifth example of a behavior determination method using the Nth behavior rule. The Nth behavior rule is, for example, a rule concerning the behavior of writing to a surface other than the startup surface. Note that writing to a surface other than the startup surface occurs only when the information processing device 2 is started in repro mode.

[0128] As shown in Figure 16, the sector group access determination unit 26 determines whether the access request is for writing to a surface other than the startup surface (S1001). If the access request is not for writing to a surface other than the startup surface (NO in S1001), the flowchart in Figure 16 is terminated.

[0129] On the other hand, if the access request is for writing to a surface other than the startup surface (YES in S1001), the sector group access determination unit 26 acquires information indicating the startup mode of the information processing device 2 and determines the type of startup mode acquired (normal mode or repro mode) (S1002).

[0130] If the startup mode is Repro mode (in S1003, "Repro mode"), the sector group access determination unit 26 determines that the behavior is permitted by the Nth behavior rule (S1004). Then, the flowchart in Figure 16 is terminated.

[0131] On the other hand, if the startup mode is normal mode (in S1003, "normal mode"), the sector group access determination unit 26 determines that the access request is invalid (S1005). After that, the flowchart in Figure 16 is terminated.

[0132] In this way, the sector group access determination unit 26 determines whether or not an access request is malicious by considering the state of the information processing device 2. This allows the system to detect malicious access requests when an attacker illegally rewrites the firmware by writing to a surface where writing should not normally occur, or when they forcibly activate the rewritten surface through a forced rollback or the like.

[0133] Next, with reference to Figure 17, a sixth example of a behavior determination method using the Nth behavior rule will be described. Figure 17 is a flowchart of the sixth example of a behavior determination method using the Nth behavior rule. The Nth behavior rule is, for example, a rule concerning the behavior of accessing a file that should be read only once after the information processing device 2 is started.

[0134] As shown in Figure 17, the sector group access determination unit 26 determines whether the access request is for access to a file that should be read only once after the information processing device 2 is started (S1101). If the access request is not for access to a file that should be read only once after the information processing device 2 is started (NO in S1101), the flowchart in Figure 17 is terminated.

[0135] On the other hand, if the access request is for a file that should be read only once after the information processing device 2 is started (YES in S1101), the sector group access determination unit 26 obtains information about the last access from the sector group access information 32 (S1102). Based on this, the sector group access determination unit 26 determines whether the access to the file that should be read only once after the information processing device 2 is started is the first read after the information processing device 2 is started (S1103).

[0136] If access to a file that should be read only once after the startup of the information processing device 2 is the first read after the startup of the information processing device 2 (YES in S1103), the sector group access determination unit 26 determines that the behavior is a behavior permitted by the Nth behavior rule (S1104). After that, the flowchart in Figure 17 is terminated.

[0137] On the other hand, if an access to a file that should be read only once after the startup of the information processing device 2 is not the first read after the startup of the information processing device 2 (NO in S1103), the sector group access determination unit 26 determines that the access request is invalid (S1105). After that, the flowchart in Figure 17 is terminated.

[0138] In this way, the sector group access determination unit 26 determines whether an access request is malicious or not by considering the state of the file (sector group). This allows the system to detect malicious access requests when an attacker attempts to illegally read a file that is only read once after the information processing device 2 is started (for example, an initial startup configuration file) in an attempt to scout the initial settings of the information processing device 2.

[0139] Next, with reference to Figure 18, we will explain a seventh example of a behavior determination method using the Nth behavior rule. Figure 18 is a flowchart of the seventh example of a behavior determination method using the Nth behavior rule. The Nth behavior rule is, for example, a rule concerning the behavior of updating an application (hereinafter referred to as "app").

[0140] As shown in Figure 18, the sector group access determination unit 26 determines whether the access request is for an application update (S1201). If the access request is not for an application update (NO in S1201), the flowchart in Figure 18 is terminated.

[0141] On the other hand, if the access request is for an application update (YES in S1201), the sector group access determination unit 26 monitors the payload of the sector group access log 38 and searches for a string that starts with "http" (S1202).

[0142] If the payload of the sector group access log 38 contains a matching string (a string starting with "http") and also contains a URL (Uniform Resource Locator) that is on the whitelist (YES in S1203), the sector group access determination unit 26 determines that the behavior is a behavior permitted by the Nth behavior rule (S1204). After that, the flowchart in Figure 18 is terminated.

[0143] On the other hand, if the payload of the sector group access log 38 does not contain the corresponding string, or if the URL listed in the whitelist is not included (NO in S1203), the sector group access determination unit 26 determines that the access request is invalid (S1205). After that, the flowchart in Figure 18 is terminated.

[0144] In this way, the sector group access determination unit 26 considers the content of the access to the sector group for which writing is permitted and determines whether or not the access request is malicious. This makes it possible to detect malicious access requests when an attacker, impersonating a legitimate application update, illegally writes an unauthorized external URL (for example, a C&C server) to the sector group.

[0145] Next, with reference to Figure 19, we will describe an eighth example of a behavior determination method using the Nth behavior rule. Figure 19 is a flowchart of the eighth example of a behavior determination method using the Nth behavior rule. The Nth behavior rule is, for example, a rule concerning the behavior of writing to a log file. Note that writing to the log file only occurs in the last sector (i.e., only appending occurs).

[0146] As shown in Figure 19, the sector group access determination unit 26 determines whether the access request is a write to the log file (S1301). If the access request is not a write to the log file (NO in S1301), the flowchart in Figure 19 is terminated.

[0147] On the other hand, if the access request is for writing to a log file (YES in S1301), the sector group access determination unit 26 obtains the last sector number from the sector group access information 32 (S1302). Based on this, the sector group access determination unit 26 determines whether the target sector for writing is the last sector (S1303).

[0148] If the sector to be written to is the last sector (YES in S1303), the sector group access determination unit 26 determines that the behavior is permitted by the Nth behavior rule (S1304). Then, the flowchart in Figure 19 is terminated.

[0149] On the other hand, if the sector to be written to is not the last sector (NO in S1303), the sector group access determination unit 26 determines that the access request is invalid (S1305). After that, the flowchart in Figure 19 is terminated.

[0150] In this way, the sector group access determination unit 26 considers the content of the access to the sector group for which writing is permitted and determines whether or not the access request is malicious. This makes it possible to detect malicious access requests when an attacker illegally writes to a sector other than the last sector of the log file in order to erase the traces of the attack by tampering with a portion of the log.

[0151] [3. Effects] In this embodiment, the host OS 10 hooks access requests from the guest OS 8 and analyzes the hooked access requests to determine their legitimacy. This allows the host OS 10 to use the hooked access requests as information to monitor abnormalities in the guest OS 8, even if the guest OS 8's access control function 16 is disabled or tampered with by a malicious computer program, thereby enabling accurate determination of the legitimacy of access requests from the guest OS 8.

[0152] (Other variations) Although information processing devices and determination methods relating to one or more embodiments have been described above based on the above embodiments, this disclosure is not limited to the above embodiments. Without departing from the spirit of this disclosure, various modifications that a person skilled in the art can conceive of may be applied to the above embodiments, and forms constructed by combining components from different embodiments may also be included within the scope of one or more embodiments.

[0153] In the above embodiment, each component may be implemented by dedicated hardware or by executing a computer program suitable for each component. Each component may also be implemented by a program execution unit such as a CPU or processor reading and executing a computer program recorded on a recording medium such as a hard disk or semiconductor memory.

[0154] Furthermore, while the above embodiment employs a hypervisor (TYPE1 type) as the virtualization control system, it is not limited to this, and an application including a hypervisor that runs on a certain operating system (TYPE2 type) may also be employed.

[0155] Furthermore, some or all of the functions of the information processing apparatus according to the above embodiment may be realized by a processor such as a CPU executing a computer program.

[0156] Some or all of the components constituting each of the above-described devices may consist of a removable IC card or a standalone module. The IC card or module is a computer system consisting of a microprocessor, ROM, RAM, etc. The IC card or module may also include the above-described multi-functional LSI. The microprocessor operates according to a computer program, thereby enabling the IC card or module to achieve its function. The IC card or module may also be tamper-resistant.

[0157] This disclosure may be the methods described above. It may also be a computer program that implements these methods using a computer, or a digital signal including the computer program. Furthermore, this disclosure may be the computer program or the digital signal recorded on a computer-readable non-temporary recording medium, such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray® Disc), semiconductor memory, etc. It may also be the digital signal recorded on these recording media. Furthermore, this disclosure may involve transmitting the computer program or the digital signal via telecommunications lines, wireless or wired communication lines, networks such as the Internet, data broadcasting, etc. Furthermore, this disclosure may be a computer system comprising a microprocessor and memory, wherein the memory stores the computer program, and the microprocessor operates according to the computer program. Furthermore, the computer program or the digital signal may be transmitted by recording and transferring it on the recording medium, or by transferring the computer program or the previous The digital signals may also be transmitted via the aforementioned network or the like, and implemented by another independent computer system. [Industrial applicability]

[0158] The information processing device relating to this disclosure is applicable, for example, to a virtual ECU that has a function to detect abnormalities in inter-VM communication. [Explanation of Symbols]

[0159] 2. Information Processing Device 4 Hardware 6. Virtualization control system 8 Guest OS 10 Host OS 11 Network Devices 12 External storage devices 13. Screen drawing devices 14 Processes 16. Access control function 18 Front-end device drivers 20 Backend-Device Drivers 22 Memory section 24 Access Log Analysis Department 26 Sector group access determination unit 28 Control Response Unit 30-sector database 32 Sector Group Access Information 34 Sector Group Access Rule Database 36 Device Access Logs 38 Sector Group Access Log 40 External Servers

Claims

1. An information processing device for determining unauthorized access to a vehicle, The first operating system and A second operating system accesses a group of sectors stored in a storage device in response to an access request from the first operating system, The system comprises a virtualization control system that runs on a processor and controls the execution of the first operating system and the second operating system, The second operating system described above is: An acquisition unit that acquires the access request from the first operating system, An analysis unit generates access log information that links the sector number and the sector group name included in the access request, by referring to correspondence information that shows the correspondence between the sector number and the sector group name of the sector group stored in the storage area of ​​the storage device corresponding to the sector number, The device includes rule information indicating rules for accessing the group of sectors stored in the storage device, and a determination unit that determines whether the access request is invalid based on the access log information. Information processing device.

2. The second operating system further includes a response unit that notifies an external party if the determination unit determines that the access request is invalid. The information processing apparatus according to claim 1.

3. The corresponding unit further notifies an external party and stops access to the group of sectors stored in the storage device if the determination unit determines that the access request is invalid. The information processing apparatus according to claim 2.

4. The rule information includes, as a rule, at least one of a process and an operation that permits access to the group of sectors stored in the storage device. The information processing apparatus according to any one of claims 1 to 3.

5. The determination unit determines whether the access request is invalid based on the rule information relating to the read and write permissions granted to the sector group. The information processing apparatus according to claim 1.

6. The second operating system described above is capable of accessing external devices. The determination unit determines whether the access request is invalid based on the rule information and the state of the external device. The information processing apparatus according to claim 1.

7. The determination unit determines whether the access request is invalid based on the rule information and the state of the information processing device. The information processing apparatus according to claim 1.

8. The determination unit determines whether the access request is invalid based on the rule information and the state of the sector group. The information processing apparatus according to claim 1.

9. The determination unit determines whether the access request is invalid based on the rule information and the access details to the sector group for which writing is permitted. The information processing apparatus according to claim 1.

10. A determination method for determining unauthorized access in a vehicle using an information processing device comprising: a first operating system; a second operating system that accesses a group of sectors stored in a storage device in response to an access request from the first operating system; and a virtualization control system that runs on a processor and controls the execution of the first operating system and the second operating system, wherein The second operating system obtains the access request from the first operating system, By referring to correspondence information that shows the correspondence between a sector number and the sector group name of the sector group stored in the storage area of ​​the storage device corresponding to that sector number, access log information is generated from the access request that associates the sector number and the sector group name included in the access request. Based on the rule information indicating the rules for accessing the group of sectors stored in the storage device, and the access log information, it is determined whether the acquired access request is invalid. If the access request is determined to be invalid, the result is output externally. Judgment method.

Images