KR101434794B1 - The method and system for defending program hacking - Google Patents

Abstract

The present invention relates to a method and a system for defending program hacking. The present invention provides a method for defending program hacking, which is configured to control access of a hacking process to a user process executed by a first operating system (OS). The method comprises the steps of: executing a second OS that is a virtual OS; setting the second OS as a host OS; setting the first OS as a client OS to be controlled by the host OS; and allowing the second OS to control the first OS to block the hacking process from accessing a first memory area where data on the user process is recorded. By the configuration as described above, the method and the system for defending program hacking according to the present invention can fundamentally block program hacking by controlling access of a hacking process to a memory.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and system for defending a program,

The present invention relates to a program hacking defense method and system, and more particularly, to a program hacking defense method and system for controlling access of a hacking program to a memory using OS virtualization technology.

2. Description of the Related Art [0002] Recently, various hardware devices are being digitized and digitized due to the development of the electronic field, and accordingly, hardware devices operated by software programs are increasing.

Among them, a computer is a representative example, and an operating system (OS) is installed in a computer, and various applications are installed in a computer as a separate program and operated. Such a computer corresponds not only to a personal computer such as a desktop but also to a communication terminal such as a smart phone.

However, the most problematic as the applications programmed by the software are used is the hacking of the program.

Generally, hacking refers to all kinds of activities that illegally access a vulnerable security network of a computer network or have a detrimental effect on the operation of an information system or a specific terminal. In the end, a developer who has developed a corresponding application by arbitrarily manipulating the program code of the application, And to make the application operate in a non-existent form.

As an example of program hacking, when copying program code to distribute an application to a plurality of unauthorized users or manipulating program code so that an application performs a function desired by a hacker .

Hacking such a program is a major problem that can never be ignored or overlooked, as it has a large impact on the system in which the copyright of the developer is violated or the application is executed.

Recently, there is a trend of researching an application program or an operating system installed in a user's computer to be used in other computers. For example, OS virtualization technology, process migration technology, and packaging technology by server administrators.

Operating system virtualization technology, unlike system virtualization technology, installs a virtual operating system layer between computer operating system and user application to store and migrate only virtual operating system layer, user application, and data to guarantee same computing environment in other computer to be.

These operating system virtualization technologies support lightweight migration compared to hardware virtualization, and efficiently manage resources of service providers in an environment that provides applications as services to users such as Utility Computing and Cloud Computing. Has become a necessary technology to be able to.

The present invention relates to a method and system for blocking program hacking using such operating system virtualization techniques.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a method and system for defending against program hacking using an operating system virtualization technology.

According to an aspect of the present invention, there is provided a program hacking defensive method configured to control access to a hacking process to a user process executed in a first operating system, the method comprising: executing a second operating system that is a virtual operating system; Setting the second operating system as a host operating system; Setting the first operating system as a client operating system under the control of the host operating system; And the second operating system controls the first operating system to prevent the hacking process from accessing a first memory area where data of the user process is recorded.

In addition, the present invention provides an embodiment in which the second operating system controls the first operating system such that the hacking process accesses a predetermined second memory area.

Further, the present invention may further comprise executing a defensive process for controlling a process executed in the first operating system in the second operating system, wherein the blocking process accessing step is a step in which the defensive process controls the hacking process And preventing the hacking process from accessing the first memory area.

In addition, the present invention provides an embodiment wherein the hacking process access blocking step blocks switching of a third memory area in which data of the hacking process is recorded to the first memory area.

The present invention further provides an embodiment including the step of the second operating system monitoring the hacking process and outputting the operation of the hacking process to the user.

Further, the present invention provides an embodiment wherein the first memory area is a ".data" area of the user process, and the hacking process is a "DLL"

The present invention also relates to a memory configured to store data; And a processor configured to control access of a hacking process to a user process running in a first operating system, wherein the processor executes a second operating system that is a virtual operating system, and the second operating system is a host, The first operating system is set as a client operating system under the control of the host operating system and the second operating system controls the first operating system to set a first memory area in which data of the user process is recorded, And to prevent the hacking process from accessing the computer system.

Further, the present invention provides an embodiment wherein the second operating system is configured to control the first operating system such that the hacking process accesses a predetermined second memory area.

Further, the present invention is characterized in that the processor executes a defensive process in the second operating system for controlling a process executed in the first operating system, and the defensive process controls the hacking process so that the hacking process is performed in the first memory area To prevent access to the device.

In addition, the present invention provides an embodiment wherein the processor is configured to block a third memory area in which data of the hacking process is recorded from being switched to the first memory area.

Further, the present invention further includes an output unit outputting data to a user, wherein the processor controls the second operating system to monitor the hacking process, and controls the output unit to output the operation of the hacking process to a user An embodiment is provided.

Further, the present invention provides an embodiment wherein the first memory area is a ".data" area of the user process, and the hacking process is a "DLL"

According to another aspect of the present invention, there is provided a recording medium on which a program that can be executed by a computer and controls access to a hacking process to a user process executed in a first operating system is recorded. The program includes a second operating system that is a virtual operating system Executing; Setting the second operating system as a host operating system; Setting the first operating system as a client operating system under the control of the host operating system; And the second operating system controls the first operating system to block the hacking process from accessing a first memory area where data of the user process is recorded.

It will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. I will reveal.

Through the above-described configuration, the program hacking defense method and system according to the present invention can control the memory access of the hacking process, thereby blocking the program hacking. In addition, there is no need to encode or encrypt the data of the user process stored in the existing memory, thereby reducing the workload of the processor. In addition, the operation of the hacking process can be grasped in real time, and the hacking process can be analyzed to set up a response policy for the program hacking.

1 is a conceptual diagram for hacking a user process according to an embodiment of the present invention.
2 is a software configuration diagram of a program hacking defense system according to an embodiment of the present invention.
3 is a hardware block diagram of a program hacking defense system according to an embodiment of the present invention.
4 is a flowchart of a program hacking protection method according to an embodiment of the present invention.
5 is a flowchart of a program hacking protection method according to another embodiment of the present invention.
6 to 8 are views showing access control of a hacking processor for a user process according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. In the following description, the same constituent elements are given the same names and the same symbols for convenience of explanation.

The term used in the present invention is selected from general terms that are widely used at present. However, in some cases, some terms selected arbitrarily by the applicant, and in this case, the meaning is described in detail in the description of the relevant invention. The present invention should be understood as meaning with respect to a term other than a name.

The suffix "module" and " part "for the components used in the following description are given or mixed in consideration of ease of specification, and do not have their own meaning or role.

1 is a conceptual diagram for hacking a user process according to an embodiment of the present invention.

First, a user process is a program unit that performs an operation of a user application executed in an operating system.

A user application is software that provides various services such as a game program, an Internet search program, a word program, and a security program, and a user process refers to a program unit that performs a service operation of a user application in a processor.

The hacking process is a program unit that performs the operation of a hacking application written by a hacker. The hacking process manipulates the operation of the user process so that the user process performs a desired function of the hacker.

In order for the hacking process to manipulate the operation of the user process, the hacking process must access the user process, and the hacking process must operate as a user process. That is, the hacking process reads data such as code information and variable values of a user process from a memory, and operates as a user process.

Specifically, the hacking process executes the command "KeStackProcessAttach" in the operating system kernel to access the user process, and causes the hacking process to generate "Context Switching" as a user process.

"Context Switching" is a process in which the hacking process reads the memory data of the user process and changes the operating environment of the hacking process into the operating environment of the user process. Thus, the hacking process will operate like a user process.

Therefore, in order for the hacking process to access the user process, the hacking process must access the memory area used by the user process and read the memory data of the user process.

Therefore, to prevent the hacking process from accessing the user process, the hacking process should block access to the memory area of the user process.

The present invention is a program hacking prevention method and system configured to control access to a memory area of a hacking process, which will be described in detail below.

2 is a software configuration diagram of the program hacking defense system 10 according to the embodiment of the present invention.

First, before describing the program hacking defense system 10, an operating system virtualization technology will be described.

Virtualization is a technology that abstracts computer resources from physical resources.

In the past, physical computer resources such as central processing unit (CPU) and memory were connected to the operating system to form a computer system. That is, only one computer system can be configured in one hardware set (Set). However, unlike the conventional concept, virtualization is the construction of a plurality of operating systems and a computer system based thereon on one physical hardware.

Operating system virtualization (OS virtualization) runs a number of operating systems on one hardware. Many operating systems are divided into real operating systems (OS) driven by users and virtual operating systems (OS) running on actual operating systems .

Here, the actual operating system may be set as a host operating system and the virtual operating system may be set as a client operating system, and the client operating system is executed under the control of the host operating system. Accordingly, the host operating system can monitor and control all operations of the client operating system.

2 shows a software configuration of the program hacking defense system 10 in which an operating system virtualization technology is implemented. The program hacking defense system 10 includes a hardware platform 11, a host operating system 20, an application 21 31, a virtualization controller 22, and a client operating system (OS) 30.

A hardware platform 11 serves as an intermediary between an operating system and hardware, and is configured to support hardware input / output instructions for controlling the hardware. Therefore, the operating system can control the hardware through the hardware platform 11.

The host operating system 20 is a user operating system driven by an actual user. As described above, the host operating system 20 can control all operations of the client operating system 30. That is, the host operating system 20 can monitor and control operations of the client operating system 30 such as hardware control, process execution, thread execution, memory use, and the like.

The virtualization controller 22 performs execution and operation of the client operating system 30 under the control of the host operating system 20. [ The virtual control unit 22 may be configured as a virtual machine or a hypervisor that implements virtualization technology.

The client OS 30 is a virtual OS and is an operating system that is executed and driven under the control of the host operating system 20. [

The applications 21 and 31 are programs executed in the host operating system 20 or the client operating system 30, and executed according to a command of the user. The client operating system 30 is controlled by the host operating system 20 so that the application 31 executed in the client operating system 30 can be controlled not only by the client operating system 30 but also by the control of the host operating system 20. [ Lt; / RTI >

3 is a hardware block diagram of a program hacking defense system 100 according to an embodiment of the present invention.

As shown in the figure, the program hacking defense system 100 includes a processor 101, a memory 102, a user interface unit 103, and an output unit 104.

The processor 101 functions as a controller for controlling the memory 102, the user interface 103 and the output unit 104 to perform a program hacking protection method.

The processor 101 executes a first operating system, which is a real operating system (Real OS), and a second operating system, which is a virtual operating system, and executes the user process in the first operating system.

The processor 101 sets the second operating system as a host operating system (OS) 20 and sets the first operating system as a client operating system (OS) 30.

The second operating system set in the host operating system 20 can monitor and control all operations of the first operating system set in the client operating system 30. [ That is, the second operating system, which is the host operating system 20, can monitor and control operations such as hardware control, process execution, thread execution, and memory use of the first operating system, which is the client operating system 30.

Accordingly, the processor 101 controls the first operating system through the second operating system.

The processor 101 controls the second operating system that is the host operating system 20 to monitor the hacking process running in the first operating system that is the client operating system 30 and outputs the driving information of the hacking process through the output unit 104 To the user. The processor 101 can output driving information to the user such as which service the hacking process performs, access to which memory area, and the like.

Then, the processor 101 blocks the hacking process from accessing the first memory area, which is a memory area where data of the user process is recorded.

As described above, in order for the hacking process to operate the operation of the user process, the hacking process reads data such as code information and variable values of the user process in the first memory area. Then, the drive environment of the hacking process is set as the drive environment of the user process, and the drive is driven like a user process.

Accordingly, the processor 101 prevents the hacking process from accessing the first memory area in order to block the hacking process from operating as a user process. The hacking process reads data such as code information and variable values of the user process and prevents the hacking process operating environment from being set as the driving environment of the user process.

Then, the processor 101 controls the first operating system so that the hacking process approaches the predetermined second memory area. The hacking process causes the data stored in the second memory area, which is not the first memory area storing the data of the user process, to be read, thereby blocking the hacking process from accessing the user process.

Data of a virtual process other than the data of the user process is stored in the pre-set second memory area. Accordingly, the hacking process accesses the predetermined virtual process, not the user process.

In this memory access control method, the processor 101 blocks the third memory area in which the data of the hacking process is recorded from being switched to the first memory area.

The memory 102 may be a data storage for storing data and the memo ratio 120 may be a nonvolatile storage medium such as a hard disk or a volatile storage medium such as a RAM.

The user interface unit 103 is configured to receive a user command from a user. The user interface unit 140 includes a keyboard, a mouse, a voice input device, and the like. The user interface unit 140 receives commands such as execution of a user process from a user, and transmits the received user commands to the processor 101.

The output unit 104 may be a device for outputting data to a user, and the output unit 104 may be composed of various output devices such as a display device such as a monitor, a sound output device such as a speaker, and a printer device. Accordingly, the processor 101 can output the driving information of the hacking process to the user in various ways according to the configuration of the output unit 104. [

4 is a flowchart of a program hacking protection method according to an embodiment of the present invention.

As shown in the figure, the program hacking protection method includes a step (S100) of executing a user process in a first operating system, a step S200 of executing a second operating system which is a virtual operating system, a step S300 of setting a second operating system as a host operating system, (S400) of setting the first operating system as a client operating system, controlling the first operating system (S500) of the second operating system, monitoring a hacking process running in the first operating system (S600) (S700) blocking access of the hacking process to the first memory area in which the first memory area is recorded.

First, the processor 101 executes a user process in the first operating system (S100). In response to a user command input through the user interface unit 103, a user process is executed.

Then, the processor 101 executes a second operating system that is a virtual operating system (S200)

The processor 101 sets the second operating system to the host operating system 20 and sets the first operating system to the client operating system 30 in operation S300.

As described above, the second operating system set in the host operating system 20 can monitor and control all operations of the first operating system set in the client operating system 30. [ That is, the second operating system, which is the host operating system 20, can monitor and control operations such as hardware control, process execution, thread execution, and memory use of the first operating system, which is the client operating system 30.

Accordingly, the processor 101 controls the first operating system through the second operating system (S500)

The processor 101 monitors the hacking process running in the first operating system (S600). The processor 101 controls the second operating system, which is the host operating system 20, so that the first operating system, which is the client operating system 30, It can monitor the hacking process being executed and output the driving information of the hacking process to the user through the output unit 104. [

The processor 101 blocks the hacking process from accessing the first memory area in which the data of the user process is written (S700)

As described above, in order for the hacking process to operate the operation of the user process, the hacking process reads data such as code information and variable values of the user process in the first memory area. Then, the drive environment of the hacking process is set as the drive environment of the user process, and the drive is driven like a user process.

Accordingly, the processor 101 prevents the hacking process from accessing the first memory area in order to block the hacking process from operating as a user process. The hacking process reads data such as code information and variable values of the user process and prevents the hacking process operating environment from being set as the driving environment of the user process.

5 is a flowchart of a program hacking protection method according to another embodiment of the present invention.

As shown in the figure, the program hacking protection method further includes a step (S800) of setting a hacking process to access a predetermined second memory area.

The processor 101 controls the first operating system so that the hacking process approaches a predetermined second memory area. The hacking process causes the data stored in the second memory area, which is not the first memory area storing the data of the user process, to be read, thereby blocking the hacking process from accessing the user process.

Data of a virtual process other than the data of the user process is stored in the pre-set second memory area. Accordingly, the hacking process accesses the predetermined virtual process, not the user process.

In this manner, the memory access control method of the hacking process is such that the processor 101 blocks the third memory area in which the data of the hacking process is recorded from being switched to the first memory area.

The processor 101 executes a defensive process for controlling a process executed in the first operating system in the second operating system in order to execute the program hacking defensive method described above and the defensive process controls the hacking process, May be prevented from approaching the first memory area.

The above-described program hacking prevention method controls the access of the hacking process to the memory 102 to prevent the program hacking from occurring and does not need to encode or encrypt the data of the user process stored in the existing memory 102, Can be reduced. Also, since the operation of the hacking process can be grasped in real time, the hacking process can be analyzed and a policy for responding to the program hacking can be established.

6 to 8 are views showing access control of a hacking processor for a user process according to an embodiment of the present invention.

6 illustrates that the processor 101 controls the first operating system via the second operating system to prevent the hacking process from accessing the user process. This is to prevent the processor 101 from accessing the first memory area for the hacking process.

FIG. 7 illustrates that the processor 101 controls the first operating system via the second operating system, allowing the hacking process to access the virtual process. This is to control the processor 101 to access the predetermined second memory area of the hacking process.

Figure 8 illustrates that processor 101 controls the first operating system via the second operating system to prevent the dynamically generated hacking process from accessing the memory area of the user process. This is to prevent the process 101 from accessing the ".data" area where the user process data is stored, such as the "DLL"

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, Of course.

Claims (13)

A program hacking defensive method configured to control access of a hacking process to a user process running in a first operating system,
Executing a second operating system that is a virtual OS;
Setting the second operating system as a host operating system;
Setting the first operating system as a client operating system under the control of the host operating system; And
The second operating system controls the first operating system so that the hacking process accesses the predetermined second memory area to prevent the hacking process from accessing the first memory area in which the data of the user process is written Include a program hacking defense method. delete The method according to claim 1,
Further comprising executing, in the second operating system, a defensive process for controlling a process executed in the first operating system,
The hacking process access blocking step includes:
Wherein the defensive process controls the hacking process to block the hacking process from accessing the first memory area. The method according to claim 1,
The hacking process access blocking step includes:
And blocking a third memory area in which data of the hacking process is recorded from being switched to the first memory area. The method according to claim 1,
And the second operating system monitors the hacking process and outputs the operation of the hacking process to the user. The method according to claim 1,
Wherein the first memory area is a ". Data" area of the user process,
Wherein the hacking process is a "DLL" process that is a dynamic creation process. A memory configured to store data; And
A processor configured to control access of a hacking process to a user process running on a first operating system,
The processor comprising:
A second operating system that is a virtual operating system (Virtual OS), sets the second operating system as a host operating system, sets the first operating system as a client operating system under the control of the host operating system, Wherein the second operating system controls the first operating system so that the hacking process accesses the predetermined second memory area to prevent the hacking process from accessing the first memory area in which the data of the user process is written. system. delete 8. The method of claim 7,
The processor comprising:
Configured to execute a defensive process in the second operating system to control a process executed in the first operating system and to prevent the defensive process from accessing the first memory area by controlling the hacking process, Defense system. 8. The method of claim 7,
The processor comprising:
And to prevent switching of a third memory area in which data of the hacking process is recorded to the first memory area. 8. The method of claim 7,
Further comprising an output section,
The processor comprising:
The second operating system to monitor the hacking process and to control the output unit to output the operation of the hacking process to the user. 8. The method of claim 7,
Wherein the first memory area is a ". Data" area of the user process,
Wherein the hacking process is a "DLL" process that is a dynamic creation process. A recording medium on which a program executable by a computer and controlling access to a hacking process to a user process executed in a first operating system is recorded,
The program includes:
Executing a second operating system that is a virtual OS; Setting the second operating system as a host operating system; Setting the first operating system as a client operating system under the control of the host operating system; And the second operating system controls the first operating system so that the hacking process accesses a predetermined second memory area, thereby blocking access of the hacking process to a first memory area in which data of the user process is recorded .

Images