KR101292004B1 - Method for security enhancement of source code package for web applications, and computer readable recording medium storing program for the same - Google Patents

Abstract

The present invention relates to a technique for strengthening security management on a source code package used in a web application. More specifically, the present invention generates a WGT file by first encrypting the source code of the web application with the symmetric key encryption technique before packaging the WGT file, and uses the symmetric key encryption technique when the WGT resource is read for the activation of the web application on the device. It provides a technology that prevents the third party from copying and randomly using the web application by strengthening security management by using it and decrypting it. According to the present invention, it is possible to prevent a third party from randomly copying the source code of the web application and utilizing it by reinforcing security management on the source code package of the web application. In particular, the present invention reduces the processing burden of the device during the decryption step by configuring to encrypt only the text portion without encrypting the image or video in the source code package, thereby greatly improving the security while maintaining the web application in the device This has the advantage of being configured so that when running, there is almost no degradation in operation performance.

Description

TECHNICAL FOR SECURITY ENHANCEMENT OF SOURCE CODE PACKAGE FOR WEB APPLICATIONS, AND COMPUTER READABLE RECORDING MEDIUM STORING PROGRAM FOR THE SAME}

The present invention relates to a technique for strengthening security management on a source code package used in a web application. More specifically, the present invention generates a WGT file by first encrypting the source code of the web application with the symmetric key encryption technique before packaging the WGT file, and uses the symmetric key encryption technique when the WGT resource is read for the activation of the web application on the device. It provides a technology that prevents the third party from copying and randomly using the web application by strengthening security management by using it and decrypting it.

A web application refers to a program that is executed based on the web. Specifically, a web application is a program that runs on a web browser of a device (computer or various terminal devices). The operation according to the purpose is performed.

FIG. 1 is a diagram illustrating an operation method of a general web application. The concept of the web application will be described with reference to FIG. 1. First, the web browser 111 requests a specific web page from the device 110 to the web server 120. In response to such a web page request, the web server 120 requests the web application server (WAS) 130 to process them in order to perform various logic processing and database interworking included in the requested web page.

Then, the web application server 130 selectively performs data processing in association with the database 131 as needed, and then returns the processing result of the logic processing and the database interworking operation to the web server 120. Subsequently, the web server 120 provides the received result back to the web browser 111, and as a result, a specific web page is displayed on the web browser 111.

Such a web application is generally installed automatically or manually as needed while a user opens a web page using the web browser 111 and performs a specific operation. For this purpose, a source code package for a web application is provided from the web application server 130. In general, a zip type compressed file consisting of text of HTML, CSS, and JavaScript and having an extension of * .wgt is provided. Such files are referred to herein as WGT compressed files or source code packages of web applications.

In this process, a third party may randomly copy and use the WGT compressed file of the web application. In other words, after copying the WGT compressed file, it can be decompressed to obtain HTML, CSS, and JavaScript text, and its contents can be reverse engineered to be used when developing your own web application. Substantially violating the copyright of the original web application, even if it happens, it is very difficult to detect, and even if detected, solving this problem is very cumbersome.

It is an object of the present invention to provide a technique for enhancing security management on source code packages used in web applications. In particular, it is an object of the present invention to generate a WGT file by first encrypting the source code of the web application with the symmetric key encryption technique before packaging the WGT, and using the symmetric key encryption technique when reading the WGT resource for the activation of the web application on the device. It is to provide technology that prevents unauthorized copying of web applications by unauthorized use by strengthening security management by using decryption.

In order to achieve this object, the source code package security method according to the present invention, the authoring device to obtain the source code of the web application; Selecting a text portion of the source code of the web application; Encrypting the selected text portion; A fourth step of executing a WGT package using the encrypted code for the web application; Providing a WGT package of the web application to a device; A sixth step of the device loading the web application WGT package; A seventh step of selecting a text part from the WGT package; An eighth step of decoding the selected text portion; A ninth step of parsing a WGT package using the decrypted code; And a tenth step of executing the web application.

On the other hand, in the source code package security method of the present invention, the encryption of the third step and the decryption of the eighth step are preferably performed by an ARIA symmetric key algorithm, wherein the authoring device and the device are connected to an external authentication server. It is preferable to receive a key for encryption of the third step and decryption of the eighth step through communication. In the second step of the source code package security method of the present invention, the text portion of the source code of the web application includes one or more of an HTML file, an HTM file, a JS file, and a CSS file for the web application. It is preferable.

On the other hand, the computer-readable recording medium according to the present invention stores a security program for executing the source code package security method as described above.

According to the present invention, it is possible to prevent a third party from randomly copying the source code of the web application and utilizing it by reinforcing security management on the source code package of the web application.

In particular, the present invention reduces the processing burden of the device during the decryption step by configuring to encrypt only the text portion without encrypting the image or video in the source code package, thereby greatly improving the security while maintaining the web application in the device This has the advantage of being configured so that when running, there is almost no degradation in operation performance.

1 is a diagram illustrating a method of operating a general web application.
Figure 2 is a block diagram showing the detailed configuration of the entire system for implementing the web application source code package security method according to the present invention.
3 is a flowchart illustrating the concept of a web application source code package security method according to the present invention.
4 is a diagram illustrating an encryption process and a decryption process of an ARIA algorithm.

Hereinafter, with reference to the drawings will be described the present invention in more detail.

2 is a block diagram showing a detailed configuration of an entire system for implementing a web application source code package security method according to the present invention.

Referring to FIG. 2, the entire system for implementing the present invention includes a web application provider 500 (authoring apparatus), a device 200, a web application server 300, and an authentication server 400. . The web application server 300 may be different from the configuration of the related art described above with reference to FIG. 1.

The authentication server 400 manages a key to be used for encryption / decryption of the source code in the device 200 implementing the technology of the present invention, and the device 200 and the web application provider 500 through the mutual authentication process. ) Allows you to obtain these keys as needed. For encryption / decryption of the source code, preferably, ARIA (Academy, Research Institute, Agency) algorithm may be used. The scope of the present invention is not limited to this ARIA algorithm, and may be selected and used from various encryption / decryption algorithms. .

As for ARIA, the ARIA algorithm requires a cryptographic algorithm suitable for various environments such as e-government implementation. Therefore, it is a national encryption developed by cryptographic experts such as academia and the National Intelligence Service. Algorithm. ARIA is a general-purpose block encryption algorithm with an Involutional SPN structure optimized for lightweight environments and lightweight hardware implementations. The features of the ARIA algorithm are summarized as follows.

Block size: 128 bits

Key size: 128/192/256 bits

Overall structure: Involutional Substitution-Permutation Network

Rounds: 12/14/16 (depending on key size)

The ARIA algorithm was developed to improve efficiency in lightweight environments and lightweight hardware, and most of the operations used by ARIA consist of simple byte operations such as XOR. The name 'ARIA' comes from the first letters of the Academy, Research Institute, and Agency, and represents the joint efforts of the academic and research institutes involved in the development of the ARIA algorithm. ARIA was enacted as Korean Industrial Standard KS Standard of Korea on December 30, 2004. Data such as source code and specification are currently on the homepage of the IT Cyber Certification Office of National Cyber Safety Center (http://service1.nis.go.kr/). To distribute). An encryption process and a decryption process of the ARIA algorithm are shown in FIG. 4.

Next, the web application provider 500 includes a source security controller 510, a communication unit 520, a source encryption unit 530, a packaging unit 540, and an encryption key storage unit 550. Before examining the internal configuration of the web application provider 500 (authoring apparatus) in detail, first, a brief description will be made of the motivation required for the configuration of the present invention as shown in FIG.

A general application program (software) is in binary code form, so you can spend a considerable amount of time using tools such as a debugger to measure the source content, whereas a web application can use the source code contained in a WGT archive. Exists in the form of text such as HTML, CSS, and JavaScript, so anyone can easily understand the contents.

To enhance the security of web applications, W3C digital signature technology and WAC security technology are proposed. However, these technologies are technologies to prevent forgery of web applications and do not solve the problem of unauthorized copying of source code of web applications. As a result, it provides a technique for enhancing the security of the source code of the web application.

It looks at the internal configuration of the web application provider 500.

The communication unit 520 provides a path for accessing the external web application server 300 and the authentication server 400 through a network (for example, the web and the Internet). The communication unit 520 may be implemented using any network technology.

The source encryption unit 530 selects a text portion from the source code of the web application and performs encryption (encryption). In this case, the source code of the web application generally includes text, image, video, and audio data, of which the text portion is selected and encrypted by the source encryption unit 530. The text portion of the web application's source code includes HTML files, HTM files, JS files, and CSS files. As an encryption, an ARIA symmetric key algorithm may be preferably used, and the encryption key is preferably obtained through an authentication process with the authentication server 400.

The packaging unit 540 is a component for WGT packaging of the source code of the web application. In particular, the packaging unit 540 executes the packaging while the text portion of the source code is previously encrypted. In addition, the encryption key storage unit 550 is a space for storing an encryption key used by the source encryption unit 530 to execute text encryption using, for example, an ARIA symmetric key algorithm. The encryption key storage unit 550 is preferably provided in the hidden area so that the key information can be securely protected.

The source security control unit 510 controls these modules as a whole. That is, the source security control unit 510 selects only text portions such as HTML files, HTM files, JS files, CSS files among the source codes of the web application, and encrypts the selected text portions in the source encryption unit 530. Then, the package unit 540 executes the WGT package using the encrypted source code for the web application to generate a web application source code package.

Meanwhile, the device 200 includes a device security controller 210, a communication unit 220, a source decoder 230, a source verification unit 240, and a decryption key storage unit 250. Hereinafter, an internal configuration of the device 200 will be described.

The communication unit 220 provides a path for accessing the external web application server 300 and the authentication server 400 through a network (for example, the web or the Internet). The communication unit 220 may be implemented using any network technology.

The source decoder 230 finds an encrypted portion from the web application source code package provided from the web application server 300 and decrypts it again (decryption). Finding the encrypted part can be done by looking for the data header, but it can also be a way of promising which part to encrypt through the technical convention. The decryption algorithm used in the source decryption unit 230 is configured in pairs with the encryption algorithm used in the source encryption unit 530, and which algorithm is used is defined in the technical convention.

The source verification unit 240 checks whether the web application source code package reconfigured as described above is properly configured.

In addition, the decryption key storage unit 240 is a space for storing a decryption key used when the source decryption unit 230 executes text decryption using, for example, an ARIA symmetric key algorithm, and decrypts the key information so that the key information can be safely protected. The key storage unit 250 is preferably provided in the hidden area.

The device security controller 210 controls the various modules of the device as a whole. That is, the device security controller 210 receives the web application WGT package from the web application server 300 and loads it as necessary, and selects a text portion from the WGT package. Thereafter, the selected text portion is decoded (decrypted) by the source decoder 230, and the WGT package is parsed using the decoded code. Then run the web application to make it work.

3 is a flowchart illustrating the concept of a web application source code package security method according to the present invention. Since most of the technical configuration has already been described with reference to [FIG. 2], hereinafter, only the flow of the process will be briefly described. The process order is not limited to that shown in [FIG. 3], and some steps may be configured in reverse order within the scope of the object of the invention.

(Step S1): The web application provider 500 (authoring device) selects the text portion from the source code of the web application, and encrypts the selected text portion by a predetermined encryption algorithm. The text portion of the web application's source code includes HTML files, HTM files, JS files, and CSS files. As the encryption algorithm, it is preferable to use a symmetric algorithm in consideration of the processing resources required for the decryption operation in the device 200 later, for example, the ARIA algorithm described above in detail may be used.

(S2 step): Web application provider 500 performs the WGT packaging using the source code is encrypted text portion.

(Step S3): The web application in which the WGT packaging is completed is provided to the device 200 through the web application server 300.

(S4 step): Then, the device 200 loads the web application provided above. Specifically, the device 200 prepares to execute a program by loading the WGT package of the web application source code.

(Step S5): Since the text portion is encrypted in the WGT package of the web application, the web application cannot be executed without decrypting it. Accordingly, the device 200 selects an encrypted portion, that is, a text portion, from the source code of the web application through the source decoder 230 and executes decryption. The algorithm used for decryption is selected to pair with the algorithm used in step S1, preferably an ARIA algorithm.

In step S6, the web application source code package is restored to plaintext through the decryption process, and thus the device 200 parses the web application source code package.

(Step S7): Then, the device 200 executes a web application to perform a desired operation.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

200: device
210: device security control unit
220: communication unit
230: source decoder
240: source verification unit
250: decryption key storage unit
300: web application server
400: authentication server
500: Web application provider (authoring device)
510: source security control
520:
530: source code
540: packaging
550: encryption key storage unit

Claims (6)

A first step of the authoring apparatus securing source code of the web application;
Selecting only a text portion including at least one of an HTML file, an HTM file, a JS file, and a CSS file for the web application from the source code of the web application;
Encrypting the selected text portion by a preset symmetric key algorithm;
A fourth step of executing a WGT package using the encrypted code for the web application;
Providing a WGT package of the web application to a device;
A sixth step of the device loading the web application WGT package;
Selecting a text portion of the WGT package including at least one of an HTML file, an HTM file, a JS file, and a CSS file for the web application;
An eighth step of decoding the selected text portion by the preset symmetric key algorithm;
A ninth step of parsing a WGT package using the decrypted code;
A tenth step of executing the web application;
Source code package security method of the web application configured to include.
The method according to claim 1,
And encrypting the third step and decrypting the eighth step using an ARIA symmetric key algorithm.
The method according to claim 2,
The authoring apparatus and the device are provided with a key for encryption of the third step and decryption of the eighth step through communication with an external authentication server. .
delete A computer-readable recording medium having recorded thereon a security program for executing a method for securing a source code package of a web application according to any one of claims 1 to 3. delete

Images