KR102053493B1 - Safe patch system and method of white list - Google Patents

Abstract

A white list safety patch system and method is disclosed. Create one white list package including a white list patch to allow execution of a predetermined process and a terminal updater program for installing the white list patch. A list patch server for transmitting the generated white list package; Receiving a white list package from the list patch server, and executes the terminal updater program included in the received white list package without confirmation of forgery, the existing white list patch included in the white list package without confirmation of forgery According to the above-described configuration, a white list package consisting of an allow process in the list patch server and a terminal updater program for updating the white list of the terminal are configured as one white list package to the terminal. It is configured to provide the terminal updater program allows the events for the processes included in the white list package only, and otherwise blocks the contamination or forgery of the processes contained in the white list package, The terminal may safely execute the terminal updater program and the white list included in the white list package to update the white list.

Description

SAFE PATCH SYSTEM AND METHOD OF WHITE LIST}

The present invention relates to the security of a terminal for preventing infection of malware such as ransomware, and specifically, to secure the terminal by patching a white list safely. A white patch safety patch system and method are disclosed.

Malware, such as ransomware, is becoming more and more intelligent, and hundreds of thousands of malicious codes are being poured out every day.

The damage caused by these malicious codes is getting bigger.

In the related art, damage is prevented in the form of blocking access to malicious codes by using a black list mainly composed of signatures of malicious codes.

However, vaccine companies can only update hundreds of malicious codes a day, so they cannot keep up with the emergence of such malicious codes. In other words, due to the black list, there is no limit to the prevention of damage.

The opposite of blacklisting is the use of white lists, which allow access to processes. In the case of using a white list, it is more safe to use because it manages the allowed processes. It can be much more powerful than blacklists, which can't keep up with the emergence of malware. In the case of allowing the process using the white list, the validation of the process may be configured to verify the acceptance using a hash function or a public certificate.

However, the white list method also has a problem in that real-time response is difficult. A program patch is generated several times a day for an application or a mobile application installed in a terminal. However, it is not easy for a user to determine whether a white list is added, that is, whether to allow execution. The user may have a fear of whether or not he may run.

In particular, a hash function value is calculated using a hash function, and the process must be determined every time whether the process is contaminated in comparison with the existing hash function value.

In addition, if the whitelist acceptance process is verified by the public certificate, it may also result in the whitelist being rendered obsolete by theft or revocation of the public certificate.

On the other hand, when using a hash function, if the file size is large, it takes a considerable time to calculate the hash function value for the access process of the file. Since all processes must verify whether they are whitelisted by using a hash function, the verification time and execution time of the process are considerably required, and the terminal requires considerable resources.

Meanwhile, in the case of updated versions of various applications or mobile applications, it is necessary to update or add to the white list. However, it is not easy for the user to determine whether the white list is added to each update. have.

10-1277623 10-1710928

It is an object of the present invention to provide a white list safety patch system.

Another object of the present invention is to provide a white patch safety patch method.

The white list safety patch system according to the above object of the present invention includes a white list patch for allowing execution of a predetermined process and a terminal updater program for installing the white list patch. A list patch server for generating one white list package including a) and transmitting the generated white list package; Receiving a white list package from the list patch server, and executes the terminal updater program included in the received white list package without confirmation of forgery, the existing white list patch included in the white list package without confirmation of forgery It may be configured to include a user terminal for updating in the list.

In this case, the user terminal is configured to allow an event for a process included in the white list patch by the terminal updater program, and block an event for a process included in the white list patch by another program. Can be.

Here, the user terminal, the terminal updater included in the white list package is executed without verification by a hash function (Hash function) or authentication signature, and included in the white list package by the executed terminal updater The white list patch can be configured to update to an existing white list without verification by hash function or verification by certificate signature.

According to another aspect of the present invention, there is provided a method for safely patching a white list, the list patch server including a white list patch for allowing execution of a predetermined process and a terminal for installing the white list patch. Generating one white list package including an updater program; transmitting, by the list patch server, the generated white list package to a user terminal; Receiving a white list package from a server; executing, by the user terminal, a terminal updater program included in the received white list package without confirmation of forgery; and receiving the received terminal updater program from the user terminal. Included in White List Package The existing site lists the patch without checking whether the forgery can be configured to include the step of updating a whitelist.

Here, the updating of the white list patch included in the received white list package by the executed terminal updater program to the existing white list without confirmation of forgery is performed by the user terminal, the white list by the terminal updater program. It may be configured to allow an event for a process included in the patch and to block an event for the process included in the white list patch by another program.

In this case, the step of the user terminal to execute the terminal updater program included in the received white list package without confirming whether the forgery, Verification of the terminal updater program included in the white list package by a hash function (Hash function) or It can be configured to run without verification by a certificate signature.

The updating of the white list patch included in the received white list package to the existing white list by the user terminal without checking forgery may be performed by the executed terminal updater program in the user terminal. The white list patch included in the white list package can be configured to update to an existing white list without verification by a hash function or verification by an authentication signature.

According to the above-described white list safety patch system and method, the white patch configured as an allow process in the list patch server and a terminal updater program for updating the white list of the terminal are configured to be provided to the terminal as one white list package. By allowing the event for the process included in the white list package only by the terminal updater program, and blocking other than that to prevent contamination or forgery of the process included in the white list package, the terminal in the terminal updater program included in the white list package The white list can be safely executed to update the white list.

When the terminal updater program is included in the white list package, the terminal updater is configured to execute without additional forgery verification, such as calculating a hash function value or verifying an authorized certificate, thereby enabling safe and rapid white list updating. That is, there is an effect that can automatically secure the safety by automating the update.

In the process of updating and patching a general application or a mobile application, the terminal updater can be immediately put on the white list and used immediately, thereby effectively blocking the contamination of the process.

1 is a block diagram of a white list safety patch system according to an embodiment of the present invention.
2 is a flowchart illustrating a safety patch method of a white list according to an embodiment of the present invention.

As the inventive concept allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. In describing the drawings, similar reference numerals are used for similar elements.

Terms such as first, second, A, and B may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a white list safety patch system according to an embodiment of the present invention.

Referring to FIG. 1, the white list safety patch system 100 according to an exemplary embodiment may be configured to include a list patch server 110 and a user terminal 120.

In the white list safety patch system 100 according to an embodiment of the present invention, the list patch server 110 may be configured to generate a white list patch or a black list patch.

Here, when generating the white list patch, the terminal updater program for the white list patch may be included in one white list package and provided to the user terminal 120.

When the terminal updater program is included in the white list package, the user terminal 120 automatically executes the application process included in the white list patch by automatically executing it immediately without forgery verification using a hash function or a public certificate. It can be configured to allow updates or mobile application updates.

The safety list system 100 of the white list allows an event for a process included in the white list package only by a terminal updater program included in the white list package. Otherwise, the whitelist safety patch system 100 blocks and forgeries the process included in the white list package. Is configured to prevent.

In addition, various data or processes included in various white list patches may be safely updated automatically without contamination by using a terminal updater program.

When adding a specific process to the white list, the user may be asked. However, the white list is automatically verified and updated to prevent the user from denying or rejecting the white list process. Eliminate the fear of running the process.

Here, the list patch server 110 may include a process report receiving module 111, a white list patch generating module 112a, a black list patch generating module 112b, a white list online database 113a, and a black list online database 113b. It may be configured to include a terminal updater program generation module 114, a white list package generation module 115, a white list package transmission module 116a, a black list package transmission module 116b.

The user terminal 120 may include the event detection module 121, the white list process allowing module 122a, the black list process blocking module 122b, the process suspending module 122c, the white list local database 123a, and the black list. Local database 123b, white list adding module 124a, black list adding module 124b, process report transmission module 125, white list package download module 126a, black list patch download module 126b, terminal updater It may be configured to include a program autorun module 127.

Hereinafter, the detailed structure is demonstrated.

First, the event detection module 121 of the user terminal 120 may be configured to detect an event generated at an operating system (OS) terminal of the user terminal 120. For example, there may be deletion, modification, creation, and copy of a specific file.

The event detection module 121 may detect which program acts on which file.

The white list process allowing module 122a, the black list process blocking module 122b, and the process suspending module 122c respectively allow, block or allow / block the process of the event detected by the event detection module 121. It may be configured to perform a process such as allow / block after.

The white list process permission module 122a may be configured to refer to the white list local database 123a to determine whether the process is registered in the white list stored in the white list local database 123a. If the determination is registered, the white list process permission module 122a may be configured to allow execution of the process.

In this case, the white list process permission module 122a may be configured to calculate a hash function value for the process according to the previously detected event, and to compare it with the hash function value of the corresponding process already registered in the white list. Thereby, if the hash function values match, it can be configured to determine that the process is not contaminated and allow execution.

The black list process blocking module 122b may be configured to refer to the black list local database 123b to determine whether the corresponding process is registered in the black list stored in the black list local database 123b. If the determination result is registered, the black list process blocking module 122b may be configured to block execution of the process.

The blacklist extracts and stores signatures of known malware.

The black list process blocking module 122b executes prior to the determination of the white list process permission module 122a described above, and when it is determined that the process is not in the black list, the white list process permission module 122a is added to the white list. It can be configured to determine if there is.

When the process is not registered in the white list or the black list, the process suspend module 122c may be configured to suspend execution of the process.

The process pause module 122c queries the user by displaying on the display of the user terminal 120 whether the process is executed in the pause state, and executes the process when the user gives a response to the permission. It can be configured to.

The white list adding module 124a is configured to add a process, which is allowed to be executed by the user in the process suspend module 122c, to add itself to the white list local database 123a for updating and to forward it to the process report sending module 125. Can be.

On the other hand, the blacklist adding module 124b adds the process to the blacklist local database 123b by itself when the process suspend module 122c adds the blacklist to the blacklist among the processes blocked by the user. Can be configured to update and forward to process report transmission module 125.

The process report transmission module 125 sends the white list process and the black list process added by the white list adding module 124a and the black list adding module 124b to the process report receiving module 111 of the list patch server 110 in real time. Can be configured to transmit.

The process report receiving module 111 receives the white list process and the black list process from the process report transmitting module 125 of the user terminal 110 and sends them to the white list patch generating module 112a and the black list patch generating module 112b. Each may be configured to deliver.

The white list patch generation module 112a may be configured to add and update the white list process received from the user terminal 120 to the white list online database 113a. At this time, the white list patch generation module 112a checks in real time whether the white list process allowed by the user terminal 120 is in conflict with the black list process of the black list online database 113b, and then the white list when not conflicted. It may be configured to add to the online database 113a.

The white list patch generation module 112a may be configured to directly receive a patch program of an application or a mobile application from a manufacturer of an application such as MS (Microsoft) or Adobe or a mobile application to generate a white list patch. have. In order to smooth the program patch automatically, the user terminal 120 can automate patch updates without additional verification.

The black list patch generation module 112b may be configured to add and update the black list process received from the user terminal 120 to the black list online database 113b.

The terminal updater program generating module 114 may be configured to generate a terminal updater program for automatically updating the white list in the user terminal 120 without additional forgery verification. The user terminal 120 may be configured to update a white list patch that has not yet been updated or to update a patch program of an individual application or an individual mobile application.

The white list package generation module 115 may be configured to generate the white list patch generated by the white list patch generation module 112a and the terminal updater program generated by the terminal updater program generation module 114 into one white list package. have.

Here, the white list patch included in the white list package as well as the terminal updater program may be configured to be automatically executed in the user terminal 120 to update the white list without forgery verification using a hash function or forgery verification using a public certificate. . The terminal updater program may be configured to perform such white list update at the user terminal 120.

The white list package generation module 115 may register the terminal updater program on the white list patch as it is so as to allow execution as it is in the user terminal 120 and to be automatically executed.

The white list package transmitting module 116a may be configured to transmit a white list patch registered with the white list package or the terminal updater program generated by the white list package generating module 115 to the user terminal 120.

The black list package transmission module 116b may be configured to transmit the black list patch generated by the black list patch generation module 112b to the user terminal 120.

The white list package download module 126a of the user terminal 120 downloads the white list patch in which the white list package or the terminal updater program is registered from the white list package transmitting module 116a, and converts the white list patch into a white list local database ( 123a).

The black list patch download module 126b of the user terminal 120 may be configured to download the black list patch from the black list patch transmission module 116b and update the black list patch to the black list local database 123b.

The terminal update data program execution module 127 may be configured to automatically execute the terminal updater program downloaded from the white list package download module 126a. Since the terminal updater program is registered in the white list package or the white list patch, the terminal updater program may be configured to execute immediately without undergoing a forgery verification process using a hash function or a public certificate. It can be configured to run automatically without asking the user whether to allow execution.

The terminal updater program is configured to update various data or processes included in the white list patch in real time. When updating a specific application or mobile application, the terminal updater program can be updated very conveniently and quickly without contamination of the process without forgery.

Here, the terminal updater program allows the event (modification or deletion, etc.) for the processes included in the white list package only, and blocks all events for the processes included in the white list package by other processes to block the white list package. The process involved can be configured to prevent contamination or forgery.

Here, even when updating by a method downloaded by the program downloaded in the update process by the terminal updater program or by decompressing the update, it may be configured to allow an event for the process.

2 is a flowchart illustrating a safety patch method of a white list according to an embodiment of the present invention.

Referring to FIG. 2, the list patch server 110 includes a white list patch for allowing execution of a predetermined process and a terminal updater program for installing a white list patch. One white list package is generated (S101).

Next, the list patch server 110 transmits the generated white list package to the user terminal 120 (S102).

Next, the user terminal 120 receives a white list package from the list patch server 110 (S103).

Next, the user terminal 120 executes the terminal updater program included in the received white list package without checking forgery (S104).

Here, the user terminal 120 may be configured to execute the terminal updater program included in the white list package without verification by a hash function or verification by an authentication signature.

Next, the terminal updater program executed in the user terminal 120 updates the white list patch included in the received white list package to the existing white list without checking forgery (S105).

In this case, the white list patch included in the white list package may be updated by the terminal updater executed in the user terminal 120 to the existing white list without verification by the hash function or verification by the authentication signature.

Specifically, it may be configured to allow an event for a process included in the white list patch by the terminal updater program, and block an event for the process included in the white list patch by another program.

Although described with reference to the above embodiments, those skilled in the art will understand that the present invention can be variously modified and changed without departing from the spirit and scope of the invention described in the claims below. Could be.

110: list patch server
111: process report receiving module
112a: whitelist patch generation module
112b: Blacklist Patch Generation Module
113a: White List Online Database
113b: Blacklist Online Database
114: terminal updater program generation module
115: white list package generation module
116a: white list package sending module
116b: blacklist package sending module
120: user terminal
121: event detection module
122a: whitelist process permission module
122b: Blacklist Process Interception Module
122c: process pause module
123a: White List Local Database
123b: Blacklist local database
124a: White List Addition Module
124b: Add Blacklist Module
125: process report sending module
126a: White List Package Download Module
126b: Blacklist Patch Download Module
127: terminal updater program automatic execution module

Claims (4)

Create one white list package including a white list patch to allow execution of a predetermined process and a terminal updater program for installing the white list patch. A list patch server for transmitting the generated white list package;
Receiving a white list package from the list patch server, and executes the terminal updater program included in the received white list package without confirmation of forgery, the existing white list patch included in the white list package without confirmation of forgery A user terminal to be updated in the list,
The user terminal,
Allow an event for a process included in the white list patch by the terminal updater program, and block an event for a process included in the white list patch by another program;
The user terminal,
The terminal updater program included in the white list package is executed without verification by a hash function or verification signature, and the white list patch included in the white list package is executed by the executed terminal updater. Configured to update to an existing white list without verification by or by signature verification,
The list patch server,
A process report receiving module which receives a white list process and a black list process from the user terminal and delivers the received white list process and the black list process, respectively;
A white list patch generation module for adding and updating a white list process delivered from the process report receiving module;
A black list patch generation module for adding and updating a black list process delivered from the process report receiving module;
A white list online database in which a white list is stored in advance, and a white list process added in the white list patch generation module is updated in the white list;
A blacklist online database in which a blacklist is stored in advance and a blacklist process added in the blacklist patch generation module is updated in the blacklist;
A terminal updater program generation module for generating a terminal updater program for automatically updating a white list in the user terminal without additional forgery verification;
A white list package generation module generating the white list patch generated by the white list patch generation module and the terminal updater program generated by the terminal updater program generation module as one white list package;
A white list package transmitting module configured to transmit a white list package generated by the white list package generating module;
It is configured to include a black list package sending module for transmitting a black list generated in the black list patch generation module,
The white list patch generation module,
After checking in real time whether the white list process allowed by the user terminal is in conflict with the black list of the black list online database, and if the result is not in conflict, adds to the white list of the white list online database;
The white list patch generation module,
It is configured to receive a patch program of the PC application or mobile application directly from the PC application manufacturer or the manufacturer of the mobile application to generate a white list patch,
The user terminal,
An event detection module for detecting an event including deleting, changing, creating, and copying a predetermined file generated in an operating system;
A white list process permission module for calculating a hash function value for the process of the event detected by the event detection module, and allowing the process if the calculated hash function value matches the hash function value of the white list;
A black list process blocking module for calculating a hash function value for the process of the event detected by the event detection module and blocking the process if the calculated hash function value matches the hash function value of the black list;
If the process of the event detected by the event detection module does not correspond to both the white list and the black list, the execution of the process is paused and whether or not the process is executed is displayed on the display of the user terminal to query. And a process pause module to execute the process when a user's permission response is input to the query;
A white list local database in which the white list is stored in advance;
A black list local database in which the black list is stored in advance;
A white list adding module for adding and updating a process in which a permission response is input by the user to the white list local database in the process pause module, and delivering the white list process;
A blacklist adding module for adding and updating a process in which the permission response is not input by the user in the blacklist local database in the process pause module, and delivering the blacklist process;
Receives the white list process added from the white list adding module, receives the black list process added from the black list adding module, and transfers the received white list process and the black list process to the process report receiving module of the list patch server in real time. A process report sending module for transmitting;
A white list package download module for downloading a white list patch to which a terminal updater program is registered from the white list package transmitting module of the list patch server and updating the white list patch to the white list local database;
A black list patch download module which downloads a black list patch from the black list patch transmission module of the list patch server, updates and stores the black list patch in the black list local database;
And a terminal updater program automatic execution module for automatically executing the terminal updater program downloaded from the white list package download module without undergoing forgery verification using a hash function or a public certificate.
The black list process blocking module,
And if it is determined that the process is not registered in the black list after executing before the white list process permission module, the white list process permission module is configured to be executed.
delete delete delete

Images