JP6930862B2 - Client tampering judgment system and method - Google Patents

Description

The following description relates to a client tampering determination system and method.

In the case of a client file distributed to users for service provision in a server-client structure online environment, it may be modified or changed to be different from the original operation purpose, and it may be different from the original intended operation of the developer. The client program may work. Such tampering with the client program can affect the integrity of the entire system and the reliability of the entire service.

In the prior art, in order to determine whether or not such a client file (or client program) has been tampered with, a first identification value such as a hash for the original file is generated in advance before distribution of the client file. The process managed by the server had to be included. For example, at the time of execution of the client, the security module included in the client generates a second identification value for the client file, receives the first identification value managed by the server, and compares it with the second identification value. It is possible to determine whether or not the client program) has been tampered with, and if it is determined that the client has been tampered with, the execution of the client can be blocked. For example, Patent Document 1 relates to a method for preventing tampering with a client terminal, a monitoring server, and a monitoring area, and compares the information provided by the monitoring server with actual data to determine whether or not the memory or file has been tampered with. The client terminal to be judged is disclosed. However, in such a conventional technique, the reliability of the determination regarding the presence or absence of falsification is not high in that the client executes the final determination for the identification value.

As yet another conventional technique, there is a method in which the comparison of identification values is processed by the server to block the service access of the client. For example, Patent Document 2 relates to a tampering determination system for a downloaded application program, and the server compares the authentication key recorded in the application program with the authentication key stored in the server so that the terminal can be used. It discloses the technology that allows connection. However, such a conventional technique has a problem that the first identification value must be generated and managed by the server before distribution of the client file.

Korean Published Patent No. 10-2013-0078093 Korean Published Patent No. 10-2006-0125077 PCT / KR2014 / 010167 US2014 / 0019540A1 US2013 / 0332543A1 US2013 / 0260893A1

Allows the server to determine if a client file (or program) has been tampered with, without having to go through a process in which the identification value must be generated and managed in advance before distribution of the client, making it useful and reliable for the client program. Provide a client tampering determination system and method that can be improved.

A method for determining client tampering in a server-client environment, which is a method for determining client tampering, in which the identification value of the client program is received from each of a plurality of electronic devices in which the client program is installed, and the plurality of electronic devices. Provided is a client tampering determination method including a step of determining a tampered electronic device among the plurality of electronic devices by comparison between identification values received from the devices.

A client tampering determination system for a server that determines client tampering in a server-client environment, including at least one processor implemented to execute computer-readable instructions, said at least one processor being a client. The identification value of the client program is received from each of the plurality of electronic devices in which the program is installed, and the client is tampered with among the plurality of electronic devices by comparing the identification values received from the plurality of electronic devices. It provides a client tampering judgment system that determines the electronic device.

A computer program stored in a computer-readable recording medium in order to execute a client tampering determination method in combination with an electronic device realized by a computer, wherein the client tampering determination method is the electronic device. The server includes a step of extracting the identification value of the client program installed in the electronic device and a step of transmitting the extracted identification value to the server, and the server compares the identification values received from a plurality of electronic devices. Provided is a computer program in which a client determines an electronic device that has been tampered with among the plurality of electronic devices.

Usefulness for client programs by allowing the server to determine if a client file (or program) has been tampered with without having to go through the process of pre-generating and managing identification values prior to client distribution. Reliability can be improved.

It is a figure which showed the example of the network environment in one Embodiment of this invention. It is a block diagram for demonstrating the internal structure of an electronic device and a server in one Embodiment of this invention. It is a figure which showed the example of the whole system which determines the falsification of a client in one Embodiment of this invention. It is a figure which showed the example which extracts the identification value from the file in one Embodiment of this invention. It is a figure which showed the example which extracts the identification value from the memory in one Embodiment of this invention. It is a figure which showed the example of the client classified by the identification value in the server in one Embodiment of this invention. It is a block diagram which showed the example of the component which the processor of the server can include in one Embodiment of this invention. It is a flowchart which showed the example of the method which a server can execute in one Embodiment of this invention. It is a block diagram which showed the example of the component which can include the processor of the electronic device in one Embodiment of this invention. It is a flowchart which showed the example of the method which an electronic device can perform in one Embodiment of this invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

FIG. 1 is a diagram showing an example of a network environment according to an embodiment of the present invention. The network environment of FIG. 1 shows an example including a plurality of electronic devices 110, 120, 130, 140, a plurality of servers 150, 160, and a network 170. Such FIG. 1 is merely an example for explaining the invention, and the number of electronic devices and the number of servers are not limited as in FIG.

The plurality of electronic devices 110, 120, 130, 140 may be fixed terminals or mobile terminals realized by a computer device. Examples of a plurality of electronic devices 110, 120, 130, 140 include smartphones, mobile phones, navigation systems, computers, notebook computers, digital broadcasting terminals, PDAs (Personal Digital Assistants), PMPs (Portable Multimedia Players), and tablet PCs. and so on. As an example, FIG. 1 shows the shape of a smartphone as an example of the electronic device 1 (110), but in the embodiment of the present invention, a wireless or wired communication method is substantially used, via a network 170. It may mean one of a variety of devices capable of communicating with other electronic devices 120, 130, 140 and / or servers 150, 160.

The communication method is not limited, and not only the communication method utilizing the communication network (for example, mobile communication network, wired Internet, wireless Internet, broadcasting network) that can be included in the network 170, but also the short distance between devices. Wireless communication may be included. For example, the network 170 includes a PAN (personal area network), a LAN (local area network), a CAN (campus area network), a MAN (metropolitan area network), a WAN (wide area network), etc. It may include any one or more of the networks. In addition, network 170 may include any one or more of network topologies, including bus networks, star networks, ring networks, mesh networks, star-bus networks, tree or hierarchical networks, and the like. It is not limited to these.

Each of the servers 150 and 160 is realized by a computer device or a plurality of computer devices that communicate with a plurality of electronic devices 110, 120, 130, 140 via a network 170 to provide instructions, codes, files, contents, services, and the like. You can do it. For example, the server 150 may be a system that provides the first service to a plurality of electronic devices 110, 120, 130, 140 connected via the network 170, and the server 160 may also be a plurality of systems connected via the network 170. It may be a system that provides a second service to electronic devices 110, 120, 130, 140. As a more specific example, the server 150 may be a system that provides a game service in a server-client environment to a client as a first service, and the server 160 may provide a client program file for the first service to the client. It may be the provided system.

FIG. 2 is a block diagram for explaining the internal configurations of the electronic device and the server according to the embodiment of the present invention. In FIG. 2, the internal configuration of the electronic device 1 (110) will be described as an example for the electronic device, and the internal configuration of the server 150 will be described. Other electronic devices 120, 130, 140 and server 160 may also have the same or similar internal configuration as electronic device 1 (110) or server 150 described above.

Electronic device 1 (110) and server 150 may include memory 211,221, processor 212,222, communication modules 213,223, and input / output interfaces 214,224. The memories 211 and 221 are computer-readable recording media and include a RAM (random access memory), a ROM (read only memory), and a permanent mass storage device such as a disk drive. It's fine. Here, the ROM and the permanent large-capacity storage device may be included as another permanent storage device separated from the memories 211 and 221. Further, the memories 211 and 221 include an operating system, a browser installed and driven in the electric device 1 (110) as an example, and an electronic device 1 (110) for providing a specific service. Code for applications etc. installed in) may be stored. Such software components may be loaded from a computer-readable recording medium other than the memories 211 and 221. Such computer-readable recording media may include computer-readable recording media such as floppy® drives, disks, tapes, DVD / CD-ROM drives, and memory cards. In other embodiments, the software components may be loaded into memory 211,221 through communication modules 213, 223, which are not computer readable recording media. For example, at least one program is memory 211,221 based on a program (as an example, the application described above) installed by a file provided by a file distribution system that distributes a developer or application installation file over network 170. May be loaded into.

Processors 212 and 222 may be configured to process instructions in a computer program by performing basic arithmetic, logic, and input / output operations. Instructions may be provided to processors 212 and 222 by memory 211, 221 or communication modules 213 and 223. For example, processors 212 and 222 may be configured to execute instructions received according to program code stored in a recording device such as memory 211 and 221.

The communication modules 213 and 223 may provide a function for the electronic device 1 (110) and the server 150 to communicate with each other via the network 170, and the electronic device 1 (110) and / or the server 150 may provide other functions. A function for communicating with an electronic device (for example, electronic device 2 (120)) or another server (for example, server 160) may be provided. As an example, a request generated by the processor 212 of the electronic device 1 (110) according to a program code stored in a recording device such as a memory 211 is transmitted to the server 150 via the network 170 under the control of the communication module 213. You can. On the contrary, the control signals, instructions, contents, files, etc. provided under the control of the processor 222 of the server 150 pass through the communication module 223 and the network 170, and pass through the communication module 213 of the electronic device 1 (110) to the electronic device. It may be received at 1 (110). For example, the control signals and instructions of the server 150 received through the communication module 213 may be transmitted to the processor 212 and the memory 211, and the contents and files may be further included in the electronic device 1 (110) as a storage medium. It may be stored in (permanent storage device described above).

The input / output interface 214 may be a means for an interface with the input / output device 215. For example, the input device may include a device such as a keyboard or mouse, and the output device may include a device such as a display. As another example, the input / output interface 214 may be a means for an interface with a device that integrates functions for input and output, such as a touch screen. The input / output device 215 may be composed of an electronic device 1 (110) and one device. Also, the input / output interface 224 of the server 150 may be a means for interfacing with a device (not shown) for input or output that can be linked to or included in the server 150. As a more specific example, the processor 212 of the electronic device 1 (110) utilizes the data provided by the server 150 and the electronic device 2 (120) in processing the instructions of the computer program loaded in the memory 211. The configured service screens and contents may be displayed on the display through the input / output interface 214.

Also, in other embodiments, the electronic device 1 (110) and the server 150 may include more components than the components of FIG. However, it is not necessary to clearly illustrate most of the prior art components. For example, the electronic device 1 (110) may be realized to include at least a part of the above-mentioned input / output device 215, a transceiver, a GPS (Global Positioning System) module, a camera, various sensors, and a database. It may further include other components such as. As a more specific example, when the electronic device 1 (110) is a smartphone, the acceleration sensor, gyro sensor, camera, various physical buttons, buttons using the touch panel, input / output, which are generally included in the smartphone. Various components such as ports and vibrators for vibration may be further implemented in electronic device 1 (110).

FIG. 3 is a diagram showing an example of the entire system for determining falsification of a client in one embodiment of the present invention. FIG. 3 shows N terminals 310 (where N is a natural number of 2 or more), a service server 320, and a file distribution server 330 that can communicate via the network 170.

Each of the N terminals 310 shown in FIG. 3 may be realized as in the electronic device 1 (110) described with reference to FIG. 2, and the service server 320 and the file distribution server 330 refer to FIG. However, it may be realized as in the server 150 described above. The service server 320 and the file distribution server 330 may be realized by different systems of different operators, but may be realized by the same system of the same operator depending on the embodiment.

Each of the N terminals 310 receives a file for installing and executing a client program by using the second service provided by the file distribution server 330 in order to receive the provision of the first service provided by the service server 320. You may install the client program.

At this time, the N terminals 310 store the identification value of the client program in the memory of the N terminals 310 for the installation and execution of the client program and the execution of the client program according to the control of the client program. A specific value may be extracted from the loaded data, and the extracted specific value or a hash value of the specific value may be transmitted to the service server 320 as an identification value. Here, a client tampering determination system may be realized in the service server 320, and an electronic device whose client has been tampered with among the N terminals 310 by using the identification value transmitted from the N terminals 310 is used. You may decide.

For example, the identification value may be a file or memory value that does not change when the client program is executed normally, and the extracted value may be preset. As a more specific example, let's assume that the first service is a game service. Further, let's assume that in the game service, the maximum physical strength value set equally for all user characters is "100", which is a value that does not change. The N terminals 310 may extract a value set as such a maximum physical strength value and transmit it to the service server 320 as an identification value. If the client has not been tampered with, all N terminals 310 will transmit the value "100" as an identification value to the service server 320. At this time, since the service server 320 transmits the same value as the identification value for all the N terminals 310, it may be determined that there is no terminal whose client has been tampered with.

If the first terminal 311 of the N terminals 310 changes the maximum physical strength value to "200", the service server 320 has an identification value of N-1 having a value of "100" and "200". It may be determined that the client has been tampered with at the first terminal 311 that has come to receive one identification value having a value of "200" and has transmitted one identification value having a value of "200".

Therefore, the service server 320 does not need to store and manage the identification value for the client program in advance, and receives the identification value periodically from the N terminals 310 or selectively receives the identification value as necessary. By requesting and receiving the N terminals 310, the client can determine which of the N terminals 310 has been tampered with. Alternatively, it is also possible to extract the identification value and send it to the service server 320 each time the client program is executed by the N terminals 310. In other words, the service server 320 can save the cost for generating, storing, and managing the identification value for each of the N terminals 310 in advance. Not only this, the service server 320 determines whether or not the client has been tampered with, instead of making a determination for tampering on the client side, so that higher reliability can be obtained with respect to the tampering of the client.

In the following, a more specific method for extracting the identification value and a more specific method for determining the falsification of the client by using the identification value will be described.

FIG. 4 is a diagram showing an example of extracting an identification value from a file in one embodiment of the present invention. FIG. 4 shows a plurality of clients 410 and servers 420. The plurality of clients 410 may correspond to the client programs installed on the plurality of terminals 310 described with reference to FIG. 3, and the server 420 may correspond to the service server 320 described with reference to FIG. ..

At this time, each of the plurality of clients 410 may include a plurality of executable files 411 and a plurality of data files 412. Here, the data file may mean a file of all forms for storing the data required for the client, and the executable file is an extension "exe", "dl", "so", "apk". It may mean all forms of files that can be executed on the client's operating system (Operating System).

Each of the plurality of clients 410 may extract identification values from all or part of the plurality of executable files 411 and the plurality of data files 412 at the request of the server 420 or periodically. Alternatively, it is also possible to extract the identification value at the time when each of the plurality of clients 410 is executed.

For example, one or more files for extracting the identification value may be preset, and an item (for example, the maximum physical strength value described above) or an interval for extracting the value from the preset file is preset. May be done. Each of the plurality of clients 410 extracts a preset item or interval value from a preset file and sends it to the server 420 as an identification value every specific cycle or each time a request is received from the server 420. It's okay. Here, the identification value extracted from the file may be data at a specific position capable of identifying the file. For example, a specific value that can be used only in the corresponding file may be extracted as an identification value. In this case, the server 420 may confirm from which file the identification value is extracted, and may determine whether or not the client has been tampered with by using the identification value extracted from the same file.

In addition, there may be a plurality of preset files, items, or sections. In this case, the identification value may include a plurality of values. In other embodiments, the identification value may include a value extracted repeatedly from a preset item or interval value. Further, the identification value may include a hash value of the extracted value. In yet other embodiments, the identification value may include a hash value for the entire file for the client program.

The server 420 may receive n (the n is a natural number of N or less) identification values 421 from the N clients 410. Since the power of the N clients 410 may be turned off, some clients may not be able to connect to the network 170, or some clients may not be able to execute on the corresponding terminal. The number of identification values 421 received by the server 420 may be N or less.

The identification values received from the untampered client have equal values under the same conditions (for example, the same operating system, the same client program, the same client program version). However, since the identification value received from the tampered client may have a value different from most normal identification values, the server 420 may determine the client tampering by comparing the identification values. You will be able to know which client has been tampered with.

FIG. 5 is a diagram showing an example of extracting an identification value from a memory in one embodiment of the present invention. FIG. 5 also shows N clients 410 and servers 420, as in FIG.

In the present embodiment, each of the N clients 410 may extract the identification value from the memory of the terminal instead of the file stored in the terminal. For example, when the client program is executed on the terminal corresponding to the client 1 (510), the code or data for executing the client program may be loaded into the memory 520. At this time, the client 1 (510) may extract the values of preset items and sections from the memory 520. For example, in the case of the executable file described with reference to FIG. 4, a fixed section such as ".text" or ".rodata" may be loaded on the memory 520 without being changed. In this case, the client 1 (510) may search for a necessary value by using the offset in which the data of the corresponding section is loaded and extract it as an identification value.

Client tampering may include tampering with the file itself, as well as tampering with a particular value loaded in memory 520. In this case, the server 420 can determine whether or not the memory has been tampered with for the client by receiving the identification values extracted from the memory by the N clients 410 and comparing the identification values.

FIG. 6 is a diagram showing an example of clients classified by identification values on the server in one embodiment of the present invention. In Table 600 of FIG. 6, the client item 610 indicates the client, and the identification value item 620 indicates the identification value corresponding to the client. The server 420 described above with reference to FIGS. 4 and 5 may classify the clients into a plurality of groups according to the identification values, and may determine the falsification of the clients based on the number of members belonging to the plurality of groups.

For example, in Table 600, the client 1, the client 2, the client 3, and the client 5 corresponding to the identification value “100” may be classified into one group (hereinafter, “group 1”), and the identification value “200” may be used. The corresponding client 4 may be classified into another one group (hereinafter, “group 3”), and the client 6 corresponding to the identification value “300” is further one other group (hereinafter, “group 3”). It may be classified into. In this case, the server 420 may determine that the identification value "100" of the group 1 including the largest number of members is a normal identification value, and the client 4 belonging to the group 2 and the client 6 belonging to the group 3 have been tampered with. You may decide as a client.

In the above example, six clients are given as an example for convenience of explanation, but depending on the service, the identification values of an extremely large number of clients may be compared. For example, if the identification values of 998 clients out of 1000 clients are equal, it may be determined that the remaining two clients have been tampered with.

Also, depending on the embodiment, the client belonging to the group containing the fewest members may be determined as the tampered client.

Further, as shown in Table 600 of FIG. 6, for more accurate judgment, clients can be further classified by conditions other than the discriminant value. Table 600 in FIG. 6 shows an example in which clients are further classified by various types, such as operating system item 630, application type item 640, application version item 650, and extraction target item 660. In other words, it can be said that the above-mentioned other conditions mean conditions in which the identification value may differ depending on the corresponding conditions. For example, the identification value may differ depending on which target (executable file, data file, and memory) the identification value is extracted from, and the identification value extracted because the value set for each application version may differ. May also be different. Further, in some embodiments, the server 420 may determine client tampering with a number of different types of services. For example, suppose that the server 420 determines tampering with each of the client for the service corresponding to the first game and the client for the service corresponding to the second game. In this case, since the identification value may differ for each service, the clients can be classified according to the type of application.

In this way, the server 420 can further classify the clients by further utilizing at least one of the conditions in which the discriminant values can differ, and determines the tampered client by comparing the discriminant values of the classified clients. can do.

FIG. 7 is a block diagram showing an example of components that can be included in the processor of the server in one embodiment of the present invention, and FIG. 8 is a block diagram of what the server executes in one embodiment of the present invention. It is a flowchart which showed the example of the possible method.

The server 150 may correspond to the service server 320 or the server 420 described above, and the processor 222 of the server 150 shown in FIG. 7 is a reading unit 710 as a component for realizing the client tampering determination system according to the present embodiment. , The identification value receiving unit 720, and the determining unit 730 may be included. Such processors 222 and components of processor 222 may control the server 150 to perform steps 810, 820, 830, 831, 832, 833, 834 included in the client tampering determination method of FIG. At this time, the processor 222 and the components of the processor 222 may be realized to execute an instruction by the code of the operating system included in the memory 221 or the code of at least one program. Here, the components of the processor 222 may be representations of different functions of the processor 222 that are executed by the processor 222 according to the control instructions provided by the code stored in the server 150. For example, the reading unit 710 may be used as a functional representation of the processor 222 that controls the server 150 so that the processor 222 reads the instructions loaded into the memory 221 in accordance with the control instructions described above.

In step 810, the reading unit 710 may read the required instructions from the memory 221 loaded with the instructions associated with the control of the server 150. In this case, the read instruction may include an instruction for controlling the processor 222 to execute steps 820, 830, 831, 832, 833, 834 described later.

In step 820, the identification value receiving unit 720 may receive the identification value of the client program from each of the plurality of electronic devices in which the client program is installed. As an example, the identification value of the client program may include a value extracted by the client program from a data file or executable file stored in an electronic device for installation and execution of the client program, or a hash of the extracted value. It may contain a value. As another example, the identification value of the client program may include a value extracted by the client program from the data loaded into the memory of the electronic device for execution of the client program, or a hash value of the extracted value. It may be included. At this time, the identification value may include a fixed value of the client program, which is not changed during normal execution of the client program. Each of the plurality of electronic devices may extract the identification value periodically or in response to a request from the server 150, or may extract the identification value each time the client program is executed. The extracted identification value may be transmitted to the server 150, and the identification value receiving unit 720 may control the server 150 so as to receive the identification value transmitted by each of the plurality of electronic devices.

In step 830, the determination unit 730 may determine which electronic device the client has tampered with among the plurality of electronic devices by comparing the identification values received from the plurality of electronic devices. As described above, the identification value received from the electronic device in which the tampered client operates may include a value different from the identification value received from the electronic device in which the client operates normally. Therefore, the determination unit 730 may determine an electronic device whose client has been tampered with based on a small number of identification values having different values from a large number of equal identification values due to such characteristics.

To this end, the determination unit 730 may further perform steps 831 to 834 shown in FIG.

At step 831, the determination unit 730 primarily classifies the plurality of electronic devices according to the type of client program installed on the plurality of electronic devices, the version of the client program, and at least one of the operating systems of the plurality of electronic devices. You can do it. For example, the determination unit 730 may first classify a plurality of electronic devices according to the operating systems of the plurality of electronic devices. The primary classification of such electronic devices may correspond to the classification of clients by operating system item 630, application type item 640, and application version item 650 of FIG.

In step 832, the determination unit 730 may secondary classify a plurality of electronic devices according to the target from which the identification value has been extracted. Here, the target may include a file (executable file and data file described above) stored in the electronic device and a memory of the electronic device. In other words, the determination unit 730 may secondarily classify the plurality of electronic devices according to where the identification value received from the specific electronic device is extracted from the executable file, the data file, and the memory. The secondary classification of such electronic devices may correspond to the classification of clients according to the extraction target item 660 in FIG.

At step 833, the determination unit 730 may tertiary classify the plurality of electronic devices into a plurality of groups according to the received identification values. The tertiary classification of such electronic devices may correspond to the classification of clients according to the identification value item 620 of FIG. When step 831 is omitted, the classification of step 832 may be the primary classification and the classification of step 833 may be the secondary classification. When step 832 is omitted, the classification of step 831 may be the primary classification, and the classification of step 833 may be the secondary classification. Depending on the embodiment, steps 831 and 832 may be omitted altogether. For example, if the extraction target is fixed as an executable file, step 832 may be omitted. Further, when the same value is used as the identification value regardless of the operating system of the electronic device, the type / version of the application, or the like, step 831 may be omitted. In other words, whether or not the steps 831 and 832 are executed may be determined depending on what kind of value is extracted and used as the identification value.

At step 834, the determination unit 730 determines that the client of the electronic device belonging to at least one group among the plurality of groups has been tampered with based on the number of electronic devices included in each of the plurality of classified groups. good. As mentioned above, the majority of identification values sent by client programs that work well under the same conditions should have equal values, so the electronic tampered with the client based on the number of members in the group. The equipment may be determined. For example, the determination unit 730 may select the electronic device of the group having the smallest number of electronic devices belonging to the group among the plurality of groups as the electronic device that has been tampered with by the client. As another example, the determination unit 730 selects the electronic devices of the remaining groups excluding the group having the largest number of electronic devices belonging to the group among the groups with the same conditions as the electronic devices tampered with by the client. good.

Hereinafter, embodiments from the viewpoint of an electronic device in which a client program is installed will be described.

FIG. 9 is a block diagram showing an example of components that can be included in the processor of the electronic device according to the embodiment of the present invention, and FIG. 10 is a block diagram shown by the electronic device according to the embodiment of the present invention. It is a flowchart which showed the example of the possible method.

The electronic device 1 (110) may correspond to a device for one of the plurality of terminals 310 described above or one of the N clients 410, and the electronic device 1 (110) shown in FIG. 9 may correspond to the device. The processor 212 of the above may include a reading unit 910, an identification value extraction unit 920, and an identification value transmission unit 930 as components for realizing the client tampering determination system according to the present embodiment. Such a processor 212 and components of the processor 212 may control the electronic device 1 (110) to perform steps 1010-1030 included in the client tampering determination method of FIG. At this time, the processor 212 and the components of the processor 212 may be realized to execute an instruction by the code of the operating system included in the memory 211 or the code of at least one program. Here, the component of the processor 212 may be a representation of different functions of the processor 212 executed by the processor 212 according to a control instruction provided by a code stored in the electronic device 1 (110). .. For example, the reading unit 910 may be used as a functional representation of the processor 212 that controls the electronic device 1 (110) so that the processor 212 reads the instructions loaded into the memory 211 in accordance with the control instructions described above.

In step 1010, the reading unit 910 may read the necessary instructions from the memory 211 loaded with the instructions related to the control of the electronic device 1 (110). In this case, the read instruction may include an instruction for controlling the processor 212 to execute steps 820 and 830 described later.

In step 1020, the identification value extraction unit 920 may extract the identification value of the client program installed in the electronic device 1 (110). For example, the identification value extraction unit 920 accesses a file (executable file and / or data file) for the client program stored in the permanent storage device of the electronic device 1 (110) to extract the identification value, or extracts the identification value. The electronic device 1 (110) may be controlled so as to access the memory 211 in which the code or data for the program is loaded and extract the identification value.

At step 1030, the identification value transmission unit 930 may transmit the extracted identification value to the server. Here, the server may correspond to the server 150 described with reference to FIGS. 7 and 8. Since the method of determining the falsification of the client by using the identification values received from the plurality of electronic devices by the server 150 has already been described in detail, the repeated description will be omitted.

As described above, according to the embodiment of the present invention, the server can determine whether or not the client file (or program) has been tampered with without going through the process in which the identification value must be generated and managed in advance before distribution of the client. By doing so, the usefulness and reliability of the client program can be improved.

The system or device described above may be implemented by a hardware component, a software component, or a combination of the hardware component and the software component. For example, the apparatus and components described in the embodiments include, for example, a processor, a controller, an ALU (arithmetic logic unit), a digital signal processor, a microprocessor, an FPGA (field programmable gate array), a PLU (programmable log unit), and a micro. It may be implemented utilizing one or more general purpose computers or special purpose computers, such as a processor or various devices capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on said OS. The processing device may also respond to the execution of the software, access the data, store, manipulate, process, and generate the data. For convenience of understanding, one processing device may be described as being used, but one of ordinary skill in the art may indicate that the processing device may include a plurality of processing elements and / or a plurality of types of processing elements. You can understand. For example, the processing device may include multiple processors or one processor and one controller. Other processing configurations, such as parallel processors, are also possible.

The software may include computer programs, code, instructions, or a combination of one or more of these, configuring the processing equipment to operate at will, or instructing the processing equipment independently or collectively. You may do it. The software and / or data may be interpreted on the basis of a processor or provide instructions or data to a processor of any kind of machine, component, physical device, virtual device, computer storage medium or device, or It may be permanently or temporarily embodied in the transmitted signal wave. The software is distributed on a networked computer system and may be stored or executed in a distributed state. The software and data may be stored on a recording medium readable by one or more computers.

The method according to the embodiment may be realized in the form of program instructions that can be executed by various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and configured for the embodiment, or may be usable known to those skilled in the art of computer software. Examples of computer-readable recording media include hard disks, floppy (registered trademark) disks, magnetic media such as magnetic tapes, optical media such as CD-ROMs and DVDs, and floptic disks. Optical magnetic media such as, and hardware devices specially configured to store and execute program instructions such as ROM, RAM, flash memory, etc. are included. Examples of program instructions include not only machine language code, such as those generated by a compiler, but also high-level language code, which is executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, the embodiments have been described based on the limited embodiments and drawings, but those skilled in the art will be able to make various modifications and modifications from the above description. For example, the techniques described may be performed in a different order than the methods described, and / or components such as the systems, structures, devices, circuits described may be in a form different from the methods described. Appropriate results can be achieved even if they are combined or combined, or confronted or replaced by other components or equivalents.

Therefore, even if the embodiments are different, they belong to the attached claims as long as they are equal to the claims.

110, 120, 130, 140 Electronic equipment 150, 160 Server 170 Network

Claims (18)

A method for determining client tampering on a server in a server-client environment.
By the stage of receiving the identification value of the client program from each of the plurality of electronic devices in which the client program is installed and the comparison between the identification values received from the plurality of electronic devices, the client among the plurality of electronic devices A client tampering determination method, including the step of determining which electronic device has been tampered with. The identification value of the client program includes a value extracted by the client program from a data file or an executable file stored in an electronic device for installation and execution of the client program, or a hash of the extracted value. The client tampering determination method according to claim 1, which includes a value. The identification value of the client program includes a value extracted by the client program from the data loaded into the memory of the electronic device for execution of the client program, or includes a hash value of the extracted value. , The client tampering determination method according to claim 1. The client tampering determination method according to claim 1, wherein the identification value of the client program includes a fixed value of the client program that is not changed during normal execution of the client program. The stage at which the client determines the tampered electronic device is
At least one of the plurality of groups based on the step of classifying the plurality of electronic devices into a plurality of groups according to the received identification value and the number of electronic devices included in each of the plurality of classified groups. The client tampering determination method according to claim 1, which comprises a step of determining that a client of an electronic device belonging to one group has been tampered with. The stage at which the client determines the tampered electronic device is
It further includes the step of classifying the plurality of electronic devices according to the object from which the identification value is extracted.
The client tampering determination method according to claim 5, wherein the target includes a file stored in the electronic device and a memory of the electronic device. The stage of classifying into multiple groups according to the received identification value is
The client falsification determination method according to claim 6, wherein a plurality of electronic devices primaryly classified according to the target from which the identification value is extracted are secondarily classified according to the received identification value. The stage at which the client determines the tampered electronic device is
A claim further comprising the steps of classifying the plurality of electronic devices according to the type of client program installed on the plurality of electronic devices, the version of the client program, and the operating system (OS) of the plurality of electronic devices. Item 5. The client tampering determination method according to Item 5. The stage of classifying into multiple groups according to the received identification value is
8. The eighth aspect of the invention, wherein the plurality of electronic devices primaryly classified according to the type of the client program, the version of the client program, and the operating systems of the plurality of electronic devices are secondarily classified according to the received identification value. Client tampering judgment method. The stage at which a client of an electronic device belonging to at least one group determines that it has been tampered with is
The client tampering determination method according to claim 5, wherein the client selects the electronic device of the group having the smallest number of electronic devices belonging to the group as the tampered electronic device among the plurality of groups. A server-client tampering judgment system that determines client tampering in a server-client environment.
Includes at least one processor implemented to execute computer-readable instructions
The at least one processor
The identification value of the client program is received from each of the plurality of electronic devices in which the client program is installed, and the identification value of the client program is received.
By comparing the identification values received from the plurality of electronic devices, the client determines the tampered electronic device among the plurality of electronic devices.
Client tampering judgment system. The at least one processor allows the client to determine which electronic device has been tampered with.
The plurality of electronic devices are classified into a plurality of groups according to the received identification value, and the plurality of electronic devices are classified into a plurality of groups.
11. A claim, wherein a client of an electronic device belonging to at least one of the plurality of groups is determined to have been tampered with based on the number of electronic devices included in each of the plurality of classified groups. Client tampering judgment system. The at least one processor
The plurality of electronic devices are classified according to the target from which the identification value is extracted, and the electronic devices are classified.
The client tampering determination system according to claim 12, wherein the object includes a file stored in the electronic device and a memory of the electronic device. The at least one processor
The client falsification determination system according to claim 13, wherein a plurality of electronic devices primaryly classified according to the object from which the identification value has been extracted are secondarily classified according to the received identification value. The at least one processor
The client tampering determination system according to claim 12, wherein the plurality of electronic devices are classified according to the type of the client program installed on the plurality of electronic devices, the version of the client program, and the operating systems of the plurality of electronic devices. The at least one processor
15. The 15. 6. Client tampering judgment system. The at least one processor
The client tampering determination system according to claim 12, wherein the client selects the electronic device of the group having the smallest number of electronic devices belonging to the group as the tampered electronic device among the plurality of groups. Server-To the server computer that determines client tampering in a client environment
A function to receive the identification value of the client program from each of a plurality of electronic devices in which the client program is installed, and
A function in which a client determines an electronic device that has been tampered with among the plurality of electronic devices by comparing the identification values received from the plurality of electronic devices.
A client tampering judgment program that realizes.

Images