JP7140581B2 - File protection method and system for protecting executable compressed files - Google Patents

Description

The following description includes a file protection method and system for protecting an executable compressed file, a computer program and recording stored in a computer readable recording medium for executing the file protection method in combination with a computer device. Regarding the medium.

JAR (Java Archiver) is a format that integrates a large number of class files into a single file for efficient distribution of class files. In addition to easy management, it is characterized in that it can be downloaded remotely through HTTP (Hyper Text Transfer Protocol) and used immediately while the Java program is running. For example, Patent Literature 1 discloses a method for generating a JAR file containing Java Apple.

As described above, the JAR file, in which the Java class file and related files are grouped together, is a compressed file configured by the ZIP file format, so that anyone can easily check the contents contained inside the JAR file. There is a characteristic that it will end up. For example, a class file contained in a JAR file can be extracted in the form of source code using a decompiler. In the case of a JAR file that can be executed by itself, there is a risk of theft or abuse, so there is a problem of low security.

For this reason, some prior art builds the JAR file after replacing the names of classes and internal variables with meaningless ones so that the extracted source code cannot be easily recognized by malicious users. Therefore, even if the class files included in the JAR file are decompiled, it takes time to analyze the source code.

However, such prior art only prolongs the time required to analyze the source code, but fundamentally blocks the confirmation of the internal contents contained in the JAR file, or extracts the class file from the JAR file and decompiles it. It has not been possible to block the process itself. Furthermore, the conventional technology as described above must be executed before building the JAR file, so every time the content to be protected is changed, a new build process must be performed. Files can still be stolen or misused.

Korean Patent No. 10-2007-0018956

When applying protection technology to executable compressed files such as JAR files, it can be easily applied to already built executable compressed files without the need to rebuild the executable compressed files to be protected. to make it impossible to attempt a series of processes in which class files are extracted and decompiled after the contents of the executable compressed file have been grasped, so that the contents of the executable compressed file itself cannot be grasped in the first place. A file protection method and system that can be blocked, a computer program stored in a computer-readable recording medium and a recording medium for executing the file protection method in combination with a computer device are provided.

modifying an executable original compressed file; generating restoration information for restoring the modified original compressed file; and creating a new executable compressed file containing the modified original compressed file and the restoration information. and changing the file name of the new compressed file to the file name of the original compressed file.

requesting an original executable compressed file from a server; receiving a new executable compressed file from the server according to the request; extracting factors transmitted in connection with execution of the new compressed file. decompressing a modified original compressed file further included in the new compressed file using decompression information included in the new compressed file; executing the decompressed original compressed file to perform the extracted factors; , and removing the restored original compressed file after the function is completed.

requesting an original executable compressed file from a server; receiving a new executable compressed file from the server according to the request; extracting factors transmitted in connection with execution of the new compressed file. decompressing a modified class file further included in the new compressed file in memory using decompression information included in the new compressed file; loading the decompressed class file in memory; and executing a function according to the original compressed file by calling a main function of a main class included in the restored class file loaded on the memory and transmitting the extracted factors. To provide a file protection method characterized by:

A computer-readable recording medium is provided, characterized by recording a program for causing a computer to execute the file protection method.

A computer program stored in a computer-readable recording medium is provided for coupling with a computer to cause the computer to execute the file protection method.

When applying protection technology to executable compressed files such as JAR files, it can be easily applied to already built executable compressed files without the need to rebuild the executable compressed files to be protected. to make it impossible to attempt a series of processes in which class files are extracted and decompiled after the contents of the executable compressed file have been grasped, so that the contents of the executable compressed file itself cannot be grasped in the first place. can be blocked.

1 is a diagram showing an example of a network environment in one embodiment of the present invention; FIG. 1 is a block diagram for explaining internal configurations of an electronic device and a server in one embodiment of the present invention; FIG. 4 is a flow chart showing an example of a file protection method in one embodiment of the present invention; 4 is a flow chart showing an example of a dismantling-type file protection method according to an embodiment of the present invention. 4 is a flow chart showing an example of a container-based file protection method in one embodiment of the present invention. FIG. 4 is a diagram showing an example of generating a new JAR file by changing an executable JAR file according to the dismantling method in one embodiment of the present invention; FIG. 4 is a diagram showing an example of generating a new JAR file by changing an executable JAR file according to the container method, in one embodiment of the present invention; 4 is a flow chart showing an example of a file protection method on a client based on a container scheme in one embodiment of the present invention. 4 is a flow chart showing an example of a method of protecting a file on a client by dismantling method in one embodiment of the present invention. FIG. 10 is a diagram showing an example of changing an original compressed file by dismantling in one embodiment of the present invention; FIG. 10 is a diagram showing an example of changing an original compressed file by a container method in one embodiment of the present invention; FIG. 4 illustrates an example of a method for protecting restoration information in one embodiment of the present invention;

Embodiments will be described in detail below with reference to the accompanying drawings.

A file protection system according to embodiments of the present invention may be implemented by an electronic device or server described below, and a file protection method according to embodiments of the present invention may be implemented by such an electronic device or server. good. For example, a computer program according to an embodiment of the present invention may be installed and run on an electronic device or server, and the electronic device or server protects executable compressed files under the control of the computer program on which it runs. file protection method. Such a computer program may be stored in a computer-readable recording medium for executing the file protection method in combination with an electronic device or server.

FIG. 1 is a diagram showing an example of a network environment in one embodiment of the present invention. The network environment of FIG. 1 illustrates an example including multiple electronic devices 110 , 120 , 130 , 140 , multiple servers 150 , 160 , and a network 170 . Such FIG. 1 is merely an example for explaining the invention, and the number of electronic devices and the number of servers are not limited as in FIG.

The plurality of electronic devices 110, 120, 130, 140 may be fixed terminals or mobile terminals implemented by computing devices. Examples of the plurality of electronic devices 110, 120, 130, and 140 include smart phones, mobile phones, navigation systems, PCs (personal computers), notebook pan computers, digital broadcasting terminals, PDAs (Personal Digital Assistants), and PMPs (Portable Multimedia Players). ), tablets, etc. As an example, FIG. 1 shows the shape of a smartphone as an example of the electronic device 1 (110). may refer to one of a variety of devices capable of communicating with electronic devices 120, 130, 140 and/or servers 150, 160.

The communication method is not limited, and not only a communication method that utilizes a communication network that can be included in the network 170 (eg, a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network), but also a short distance between devices. Wireless communication may be included. For example, the network 170 includes a PAN (personal area network), a LAN (local area network), a CAN (campus area network), a MAN (metropolitan area network), a WAN (wide area network), a BBN (broadband network), and the Internet. Any one or more of the networks may be included. Additionally, network 170 may include any one or more of network topologies including bus networks, star networks, ring networks, mesh networks, star-bus networks, tree or hierarchical networks, etc. It is not limited to these.

Each of servers 150, 160 is implemented by a computer device or a plurality of computer devices that communicate with a plurality of electronic devices 110, 120, 130, 140 via network 170 to provide instructions, code, files, content, services, etc. you can For example, the server 150 may be a system that provides a first service to a plurality of electronic devices 110, 120, 130, 140 connected via the network 170, and the server 160 may also be a system that provides a plurality of electronic devices connected via the network 170. It may be a system that provides the second service to the electronic devices 110 , 120 , 130 , 140 . As a more specific example, the server 150, as a first service, generates a new compressed file containing a protection function by processing for protecting the executable original compressed file, and distributes it to the plurality of electronic devices 110, 120. , 130, 140. In addition, the server 160 may be a system for providing information for restoring modified compressed files to the plurality of electronic devices 110, 120, 130, and 140 as a second service.

Such services are merely one embodiment for describing the network environment, and the actual services provided by each of the servers 150, 160 in the network environment may vary greatly.

FIG. 2 is a block diagram for explaining internal configurations of an electronic device and a server in one embodiment of the present invention. In FIG. 2, the internal configuration of the electronic device 1 (110) will be described as an example of the electronic device, and the internal configuration of the server 150 will be described as an example of the server. Other electronic devices 120, 130, 140 and server 160 may also have the same or similar internal configurations as electronic device 1 (110) or server 150 described above.

Electronic device 1 (110) and server 150 may include memories 211, 221, processors 212, 222, communication modules 213, 223, and input/output interfaces 214, 224. The memories 211 and 221 are computer-readable recording media and include RAM (random access memory), ROM (read only memory), and permanent mass storage devices such as disk drives. OK. Here, permanent mass storage devices such as ROMs and disk drives may be included in electronic device 1 (110) and server 150 as separate permanent storage devices separate from memories 211 and 221. FIG. The memories 211 and 221 also store an operating system and at least one program code (for example, a browser installed and driven in the electronic device 1 (110), a browser installed in the electronic device 1 (110) to provide a specific service, may store code for applications installed in the . Such software components may be loaded from a computer-readable recording medium separate from the memories 211,221. Such another computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, disk, tape, DVD/CD-ROM drive, memory card, and the like. In other embodiments, the software components may be loaded into memory 211, 221 through communication modules 213, 223 that are not computer readable media. For example, at least one program is a program installed by a file provided by a developer or a file distribution system (server 150 as an example) that distributes an installation file of an application via the network 170 (the application described above as an example). may be loaded into memory 211, 221 based on.

Processors 212, 222 may be configured to process computer program instructions by performing basic arithmetic, logic, and input/output operations. Instructions may be provided to processors 212 , 222 by memory 211 , 221 or communication modules 213 , 223 . For example, processors 212 , 222 may be configured to execute received instructions according to program code stored in a storage device, such as memory 211 , 221 .

Communication modules 213 and 223 may provide functions for electronic device 1 (110) and server 150 to communicate with each other via network 170, and electronic device 1 (110) and/or server 150 may communicate with each other. may provide functionality for communicating with other electronic devices (eg, electronic device 2 (120)) or other servers (eg, server 160). As an example, a request generated by the processor 212 of the electronic device 1 (110) according to program code stored in a recording device such as the memory 211 is transmitted to the server 150 via the network 170 under the control of the communication module 213. you can Conversely, control signals, commands, contents, files, etc., provided under the control of the processor 222 of the server 150 are transmitted to the electronic device via the communication module 213 of the electronic device 1 (110) via the communication module 223 and the network 170. 1 (110). For example, control signals, instructions, content, files, etc. of the server 150 received through the communication module 213 may be transmitted to the processor 212 and the memory 211, and the content, files, etc. may be further included in the electronic device 1 (110). may be stored in any storage medium (permanent storage as described above).

Input/output interface 214 may be a means for interfacing with input/output devices 215 . For example, an input device may include a device such as a keyboard or mouse, and an output device may include a device such as a display. As another example, input/output interface 214 may be a means for interfacing with a device that integrates functionality for input and output, such as a touch screen. The input/output device 215 may be formed by electronic device 1 (110) and one device. Input/output interface 224 of server 150 may also be coupled to server 150 and is a means for interfacing with devices (not shown) for input or output that server 150 may include. may As a more specific example, the processor 212 of the electronic device 1 (110) uses data provided by the server 150 and the electronic device 2 (120) to process instructions of the computer program loaded in the memory 211. Configured service screens and content may be displayed on a display through input/output interface 214 .

Also, in other embodiments, electronic device 1 (110) and server 150 may include more components than those in FIG. However, most prior art components need not be explicitly shown in the figures. For example, electronic device 1 (110) may be implemented to include at least some of the input/output devices 215 described above, a transceiver, a GPS (Global Positioning System) module, a camera, various sensors, a database It may further include other components such as As a more specific example, when the electronic device 1 (110) is a smartphone, the acceleration sensor, gyro sensor, camera module, various physical buttons, buttons using a touch panel, input/ Various components such as an output port, a vibrator for vibration, etc. may be implemented to be further included in the electronic device 1 (110).

FIG. 3 is a flowchart illustrating an example of a file protection method according to one embodiment of the invention. The file protection method according to this embodiment may be executed by a computer device such as the server 150 described above. Processor 222 of server 150 may be implemented to execute operating system code and control instructions by at least one computer program code contained in memory 221 . Here, the processor 222 controls the server 150 so that the server 150 performs steps 310-340 included in the file protection method according to the embodiment of FIG. You can

At step 310, the server 150 may modify the executable original compressed file. Here, the executable original compressed file is, for example, in the form of a compressed file containing a plurality of files such as a JAR (Java Archiver) file, and may be an independently executable file such as an EXE file. is not restricted. The server 150 may modify the executable original compressed file in a variety of ways, and the various methods of modifying such original compressed files are described in more detail below.

At step 320, the server 150 may generate restoration information for restoring the modified original compressed file. The restoration information may also be generated in various ways by various methods of modifying the original compressed file. Such recovery information is also described in more detail below.

At step 330, server 150 may generate a new executable compressed file containing the modified original compressed file and decompression information. By decompressing such a new compressed file, it becomes possible to acquire the changed original compressed file and the restoration information. A malicious user can obtain the modified original compressed file and decompression information, but cannot decompress the modified original compressed file and cannot obtain the correct source code. , it does not know what the decompression information is or how to decompress the original compressed file that has been modified using the decompression information, so the original source file is not obtained from the new compressed file. cannot be analysed.

At step 340, server 150 may change the filename of the new compressed file to the filename of the original compressed file. As described above, the JAR file is characterized in that it can be used immediately after being remotely downloaded through HTTP (Hyper Text Transfer Protocol) or the like while a Java program is running. This means that the files that have to be downloaded have already been determined, and the server 150 uses the new compressed files to provide new compressed files instead of the original compressed files that have to be provided. The file name of the file may be changed to the file name of the original compressed file. For example, when an original compressed file is requested from a client-side device such as the electronic device 1 (110) described above, the server 150 provides a new compressed file instead of the original compressed file. To prevent a user who receives a file from acquiring or analyzing the source code of the original compressed file. Methods for enabling the new compressed file to perform the functions provided by the original compressed file are described in detail below.

Methods for modifying an executable original compressed file include a deconstruct method and a container method. The dismantling method is a method of changing the original compressed file by changing at least one class file included in the original compressed file, and the container method is a method of changing the original compressed file itself.

FIG. 4 is a flow chart showing an example of a dismantling-type file protection method according to an embodiment of the present invention. Steps 410 and 420 shown in FIG. 4 are examples of modifying the original compressed file by disassembling, and may be included in step 310 described with reference to FIG. Also, step 430 shown in FIG. 4 may be included in step 330 described with reference to FIG.

At step 410, the server 150 may extract internal files contained in the original compressed file by decompressing the original compressed file. As noted above, a compressed file, such as a JAR file, is a file created by compressing multiple files and may be decompressed to extract the contained internal files.

At step 420, the server 150 may modify the original compressed file by modifying at least one class file of the extracted internal files into an unrecognizable form. The server 150 may check all class files (as an example, files with the extension “.class”) and modify at least one class file among all the checked class files. For example, the server 150 encrypts the class file to be modified by using a preset key (symmetric key or asymmetric key) so that the class file to be modified cannot be recognized. Alternatively, the original compressed file may be modified by encoding the class file to be modified according to a preset method.

At this time, the restoration information may be generated in various ways. For example, server 150 may directly generate as restore information a restore code for controlling a client to restore modified class files. Alternatively, the server 150 may generate, as restoration information, restoration explanation information for explaining a restoration method corresponding to the modification method of the modified class file. The restoration information that is generated can, by itself, prevent a malicious user from being able to restore modified class files until the restoration information is analyzed. In addition to this, recovery information may also be protected by various schemes, as described below.

At step 430, server 150 may generate a new compressed file containing the remaining files excluding at least one of the modified class files, restoration information, and internal files. In other words, the new compressed file according to the present embodiment may include the original compressed file with at least one modified class file and the restoration information.

FIG. 5 is a flow chart showing an example of a container-based file protection method according to an embodiment of the present invention. Step 510 shown in FIG. 5 is an example of changing the original compressed file according to the container method, and may be included in step 310 described with reference to FIG.

In step 510, the server 150 may encrypt the original compressed file using a preset key or encode the original compressed file according to a preset scheme to change the original compressed file. In this way, the container method may be a method for changing the original compressed file itself so that it cannot be recognized, and in this case, the modified original compressed file cannot be decompressed itself. becomes.

Even in such a container method, restoration information may be generated in various ways. For example, the server 150 may directly generate a decompression code as decompression information for controlling the client to decompress the modified original compressed file. Alternatively, the server 150 may generate, as the restoration information, restoration explanation information for explaining a restoration method corresponding to the changed method of the original compressed file. In this case, the client obtains the original compressed file by restoring the modified original compressed file according to the restoration explanation information. As noted above, the generated decompression information can itself prevent a malicious user from decompressing a modified original compressed file until the decompression information is analyzed. In addition to this, recovery information may also be protected by various schemes, as described below.

Also, both the dismantling method and the container method may be used. For example, suppose a new compressed file is generated containing modified class files, as described in the embodiment of FIG. At this time, the server 150 may encrypt the generated new compressed file using a preset key, or may encode and change it according to a preset scheme. Also, the server 150 may generate additional decompression information for decompressing the changed new compressed file. In this case, server 150 may generate a new modified compressed file and an additional compressed file containing the additional decompression information. In other words, after changing a new compressed file generated using the dismantling method according to the container method, an additional compressed file containing the modified new compressed file and additional restoration information for restoring it is generated. It becomes possible to Such additional compressed files may be provided in place of the original compressed file. For this purpose, the file name of the additional compressed file may be changed to the file name of the original compressed file. For example, in step 340 of FIG. 3, the new compressed file is an intermediate compressed file, so in embodiments where both the demolition and container methods are utilized, server 150 adds The file name of the compressed file may be changed to the file name of the original compressed file.

FIG. 6 is a diagram showing an example of generating a new JAR file by changing an executable JAR file according to the dismantling method in one embodiment of the present invention. For example, server 150 may decompress executable JAR file 610 to extract class file 620 and remaining files 630 . At this time, server 150 may modify extracted class file 620 to generate modified class file 640 . As described above, the server 150 may modify the class files 620 by encrypting each of the class files 620 with a preset key or encoding them according to a preset scheme. Also, the server 150 may generate the restoration information 650 according to a restoration scheme corresponding to the modification scheme used. At this time, the server 150 may generate a new executable JAR file 660 containing the modified class files 640 and restore information 650 or the remaining files 630 . The server 150 may also change the filename of the generated new executable JAR file 660 to the filename of the executable JAR file 610 and execute the new executable according to the request for the executable JAR file 610 . By providing a valid JAR file 660, it is possible to prevent the executable JAR file 610 from being analyzed. On the other hand, the new executable JAR file 660 may be executed based on the client's memory when executed on the client. The execution of such a new executable JAR file 660 is described in more detail below.

On the other hand, although FIG. 6 describes an example of modifying all of the extracted class files 620, in some embodiments at least one of the extracted class files 620 is selectively modified. good too. For example, the class file containing the main function of the main class that is first called to perform the function by the executable JAR file 610 or the class file containing the main source code may be selectively modified.

FIG. 7 is a diagram showing an example of generating a new JAR file by changing an executable JAR file according to the container method according to one embodiment of the present invention. For example, server 150 may modify executable JAR file 710 to produce modified executable JAR file 720 . As a more specific example, the server 150 encrypts the executable JAR file 710 with a preset key or encodes it according to a preset scheme, thereby creating a modified executable JAR file 710 . File 720 may be generated. A modified executable JAR file 720 cannot be executed or decompressed. In addition, the server 150 may generate the restoration information 730 according to a restoration scheme corresponding to the modification scheme of the executable JAR file 710 , and an execution file including the modified executable JAR file 720 and the generated restoration information 730 . A possible new JAR file 740 may be generated. A malicious user can obtain the modified executable JAR file 720 and the restoration information 730 by uncompressing the new executable JAR file 740, but until the restoration information 730 is fully analyzed. cannot uncompress or execute the modified executable JAR file 720. Such a new executable JAR file 740 may be executed on a file basis. Execution of such a new executable JAR file 740 is described in more detail below.

Also, as described above, both the dismantling method and the container method may be used. For example, the new executable JAR file 660 generated by the dismantling method in FIG. 6 becomes the executable JAR file 710 in FIG. may be generated. At this time, the file name of the new executable JAR file 740 may be changed to the file name of the first executable JAR file 610 , and the new executable file according to the request for the first executable JAR file 610 . A JAR file 740 may be provided. In this case, in order to obtain the executable JAR file 610 of FIG. File 660 becomes available. Also, by restoring the modified class file 640 containing the new executable JAR file 660 according to the dismantling method using the restoration information 650, the function by the first executable JAR file 610 is executed. good.

The process of executing the generated new compressed file will now be described. The generated new compressed file may be executed on the server 150, but is generally transmitted from the server 150 to the client (eg, the electronic device 1 (110 )) and executed on the client.

FIG. 8 is a flow chart showing an example of a file protection method on a client using a container scheme in one embodiment of the present invention. The file protection method according to this embodiment may be executed by a client-side computer device such as the electronic device 1 (110) described above. The processor 212 of the electronic device 1 (110) may be implemented to execute control instructions according to the code of the operating system contained in the memory 211 and the code of at least one computer program. Here, the processor 212 causes the electronic device 1 (110) to execute steps 810 to 860 included in the file protection method according to the embodiment of FIG. The electronic device 1 (110) may be controlled so as to do so.

At step 810, the electronic device 1 (110) may request the executable original compressed file from the server. Here, the server may correspond to the server 150 described above. As described above, the server 150 may generate a new compressed file based on the original compressed file, change the file name of the new compressed file to the file name of the original compressed file, and store the new compressed file. The server 150 may send the new compressed file to the electronic device 1 (110) at the request of the electronic device 1 (110).

At step 820, electronic device 1 (110) may receive a new executable compressed file from the server upon request. As described above, the server 150 may send a new compressed file instead of the original compressed file according to the request for the original compressed file, and the electronic device 1 (110) receives the You may receive new compressed files.

At step 830, electronic device 1 (110) may extract the factors communicated in connection with executing the new compressed file. Here, the factors may include factors transmitted as the original compressed file when the original compressed file is executed. As described above, the JAR file can be conveniently managed locally and can be used immediately after being downloaded remotely through HTTP (Hyper Text Transfer Protocol) while a Java program is running. There is a feature. At this time, the already-running Java program may pass in the JAR file factors that may be initial parameters when executing the function by the JAR file. The electronic device 1 (110) may extract factors corresponding to such initial parameters.

In step 840, the electronic device 1 (110) may restore the modified original compressed file further included in the new compressed file using the restoration information included in the new compressed file. Decompression of the original compressed file is performed only when a new compressed file is executed. In other words, when the new compressed file is not executed, since the original compressed file is included in the new compressed file in a modified state, a malicious user analyzes the restoration information and finds the changed original compressed file. It cannot be run or uncompressed until the file is restored. In addition to this, as described below, the recovery information is protected according to various schemes to prevent malicious users from obtaining and analyzing the recovery information.

At step 850, the electronic device 1 (110) may perform functions according to the original compressed file by executing the restored original compressed file and transferring the extracted factors. In this way, functions based on the original compressed file may be performed on a file basis. The transferred factor may be transferred as a main function of a main class included in the restored original compressed file, and the original compressed file may be executed by calling the main function.

At step 860, the electronic device 1 (110) may remove the restored original compressed file after the function ends. In this way, the original compressed file is removed after being decompressed only when a new compressed file is executed, so that a malicious user cannot obtain and analyze the original compressed file. can do. In addition, the fact that the original compressed file can be obtained only when the new compressed file is executed means that the restored original compressed file can be additionally restored by inserting various additional protection modules into the new compressed file. means that it can be protected against

FIG. 9 is a flow chart showing an example of a method of protecting a file on a client by dismantling method in one embodiment of the present invention. The file protection method according to this embodiment may also be executed by a client-side computer device such as the electronic device 1 (110) described above. The processor 212 of the electronic device 1 (110) may be implemented to execute control instructions according to the code of the operating system contained in the memory 211 and the code of at least one computer program. Here, the processor 212 causes the electronic device 1 (110) to perform steps 910 to 960 included in the file protection method according to the embodiment of FIG. 9 according to control instructions provided by the code stored in the electronic device 1 (110). Electronic device 1 (110) may be controlled to execute.

At step 910, the electronic device 1 (110) may request the executable original compressed file from the server. Here, the server may correspond to the server 150 described above. As described above, the server 150 may generate a new compressed file based on the original compressed file, change the file name of the new compressed file to the file name of the original compressed file, and store the new compressed file. The server 150 may send the new compressed file to the electronic device 1 (110) at the request of the electronic device 1 (110).

At step 920, electronic device 1 (110) may receive a new executable compressed file from the server upon request. As described above, the server 150 may send a new compressed file instead of the original compressed file according to the request for the original compressed file, and the electronic device 1 (110) receives the You may receive new compressed files.

At step 930, electronic device 1 (110) may extract the factors conveyed in connection with executing the new compressed file. Here, the factors may include factors transmitted as the original compressed file when the original compressed file is executed. As described above, the JAR file can be conveniently managed locally and can be used immediately after being downloaded remotely through HTTP (Hyper Text Transfer Protocol) while a Java program is running. There is a feature. At this time, the already-running Java program may pass in the JAR file factors that may be initial parameters when executing the function by the JAR file. The electronic device 1 (110) may extract factors corresponding to such initial parameters.

At step 940, the electronic device 1 (110) may restore the modified class file further included in the new compressed file on the memory using the restoration information contained in the new compressed file.

At step 950, electronic device 1 (110) may load the restored class file onto memory. In this way, class files are restored in memory, and since the restored class files are also loaded in memory and used, the restored class files are obtained only when a new compressed file is executed. will be available. The fact that the restored class files reside only in memory, which is a volatile storage, means that analysis of the restored class files can be made more difficult. Also, as noted above, the fact that the class files are only decompressed when the new compressed file is executed means that inserting an additional protection module into the new compressed file makes the decompressed class files additionally It means that you can protect

In step 960, the electronic device 1 (110) calls the main function of the main class included in the restored class file loaded on the memory and transmits the extracted factor, thereby executing the function according to the original compressed file. may be executed.

In this way, the new compressed file can block the original compressed file from being decompressed or executed, or the source code extracted and analyzed, and restore the modified original compressed file. can be restricted during execution of uncompressed compressed files, providing additional protection.

In the following, by modifying the original compressed file in a more complicated way, even if a malicious user obtains the restoration information, we will explain how to make it difficult to analyze the restoration method, and to protect the restoration information itself more safely. I will explain how to

FIG. 10 is a diagram showing an example of changing an original compressed file by dismantling in one embodiment of the present invention. Steps 1010 - 1040 of FIG. 10 may be included in step 310 described with reference to FIG. 3 and performed by server 150 .

At step 1010, the server 150 may extract internal files contained in the original compressed file by decompressing the original compressed file. As noted above, a compressed file, such as a JAR file, is a file created by compressing multiple files and may extract the contained internal files by decompressing.

At step 1020, the server 150 may modify the original compressed file by modifying at least one class file of the extracted internal files into an unrecognizable form. The server 150 may check all class files (as an example, files with the extension “.class”) and modify at least one class file among all the checked class files. For example, the server 150 encrypts the class file to be modified using a preset key (symmetric key or asymmetric key) so that the class file to be modified cannot be recognized, or The original compressed file may be modified by encoding the class files to be modified according to a preset scheme.

At step 1030, server 150 may compress the modified class files. Compression of such modified class files can reduce the size of the class files while allowing more complex modifications to the class files.

At step 1040, the server 150 may repeat steps 1020 and 1030 a preset number of times. For example, even if a client obtains the key needed to decrypt an encrypted class file, it does not know how many times this encryption and compression process has been repeated, or if the class file has changed. If you don't know how the file was compressed, you can't restore the modified class file. Information regarding the number of such modifications and compressions, as well as the compression scheme, etc. may be provided to the client based on the decompression information, which may be protected by a variety of methods, as described below, or Even if restoration information can be obtained, it is difficult to analyze its meaning. For example, in order to know what the above preset number of times provided as a specific item means, it is necessary to check how the restoration information is used in the client. Information about how the decompression information is used is only available when the new compressed file is executed. Analyzing the code by analyzing the file itself and analyzing the memory while the file is running are entirely different problems, and embodiments of the present invention can decompress or execute the original compressed file, or It turns out that the acquisition and analysis of the source code of the file can be blocked.

FIG. 11 is a diagram showing an example of changing an original compressed file using a container method in one embodiment of the present invention. Steps 1110 - 1130 of FIG. 11 may be included in step 310 described with reference to FIG. 3 and performed by server 150 .

In step 1110, the server 150 encrypts the original compressed file with a preset key or encodes the original compressed file according to a preset scheme, thereby making the original compressed file unrecognizable. good. As described above, the container method is a method for changing the original compressed file itself so that it cannot be recognized. In this case, the modified original compressed file cannot be decompressed itself. .

At step 1120, the server 150 may compress the modified original compressed file. By compressing such a modified original compressed file, the size of the compressed file can be reduced while at the same time allowing more complex changes to the compressed file.

At step 1130, the server 150 may repeat steps 1110 and 1120 a preset number of times. As described above, if the client does not know the compression method or the preset number of times, even if the client obtains the key for decrypting the encrypted original compressed file, it cannot obtain the original compressed file. can't.

Even in this case, a malicious user may still be able to analyze the memory and retrieve the original compressed file while the new compressed file is running.

FIG. 12 is a diagram illustrating an example method of protecting restoration information in one embodiment of the present invention. Recovery information 1210 may correspond to recovery information in various embodiments described above.

In one embodiment, the restoration information 1210 includes a restoration code for restoring the modified original compressed file to the original original compressed file, or restoration method information describing a restoration method corresponding to the modification method of the original compressed file. OK. At this time, decompression information 1210 may be modified by encryption and/or encoding, and may be included in new compressed file 1220 in an encrypted and/or encoded state. For example, the decompression information may be included as part of the code inside the class files that the new compressed file 1220 contains. As another example, the decompression information may be generated in the form of a file and included as a separate file inside the new compressed file 1220 . At this time, relevant information for decompressing the encrypted and/or encoded decompression information may be stored on the client, the new compressed file 1220, or the server 1230. FIG. Even if such relevant information is stored in the client or the new compressed file 1220, it will be more difficult for a malicious user to obtain the original compressed file, as those skilled in the art will readily understand. would be possible. Also, if the relevant information is stored on the server 1230, the client restores the encrypted and/or encoded decompression information to the server 1230 when the provided new compressed file 1220 is run on the client. You may request relevant information for At this time, the server 1230 determines whether the new compressed file 1220 or the protection module it contains is currently running, and only if the new compressed file 1220 or the protection module is currently running. Information may be provided to the client. Here, the server 1230 may be the server 150 described above or another server different from the server 150 .

In other embodiments, restore information 1210 may only include connection information to server 1230 . For example, the recovery code and recovery method information described above may be stored in server 1230 as is or after being encrypted and/or encoded. At this time, the client may connect to the server 1230 using the connection information included in the new compressed file 1220 as the restoration information 1210 and request the restoration code and restoration method information. A decompression code or decompression method information may be provided to the client based on whether or not the compressed file 1220 or the protection module is executed. If the recovery code or recovery scheme information is encrypted and/or encoded, the server 1230 may send the encrypted and/or encoded recovery code or recovery scheme information to the client, and the client may: The restoration code and restoration method information may be restored according to a method preset with the server 150 . For example, a recovery code encrypted by a symmetric key shared by server 150 and a client according to a secure method may be decrypted as the symmetric key shared by the client.

As described above, according to the embodiment of the present invention, when applying the protection technology to an executable compressed file such as a JAR file, there is no need to re-build the executable compressed file to be protected. It can be easily applied to any compressed executable file, making it impossible to attempt a series of steps in which the class files are extracted and decompiled after the contents of the executable compressed file are known, and It can be blocked so that the contents of the executable compressed file itself cannot be grasped.

A malicious user cannot immediately obtain the restored original compressed file from the new compressed file. In other words, a malicious user trying to obtain the original compressed file can be forced to be able to obtain the original compressed file by analyzing memory while the new compressed file is running. However, newly compressed files can be protected by a variety of well-known prior art techniques that allow protection of memory and files by running protection modules while the files are running, thus preventing malicious users from You can now block access to compressed files.

The systems or devices described above may be realized by hardware components, software components, or a combination of hardware and software components. For example, the devices and components described in the embodiments may include, for example, processors, controllers, ALUs (arithmetic logic units), digital signal processors, microcomputers, FPGAs (field programmable gate arrays), PLUs (programmable logic units), microcontrollers, It may be implemented using one or more general purpose or special purpose computers, such as a processor or various devices capable of executing instructions and responding to instructions. A processing unit may run an operating system (OS) and one or more software applications that run on the OS. The processing unit may also access, store, manipulate, process, and generate data in response to executing software. For convenience of understanding, one processing device may be described as being used, but those skilled in the art will appreciate that the processing device may include multiple processing elements and/or multiple types of processing elements. You can understand. For example, a processing unit may include multiple processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include computer programs, code, instructions, or a combination of one or more of these, to configure a processor to operate at its discretion or to independently or collectively instruct a processor. You can Software and/or data may reside permanently in any kind of machine, component, physical device, virtual device, computer storage medium or device for interpretation on or for providing instructions or data to a processing device. may be embodied permanently or temporarily. The software may be distributed over computer systems connected by a network so that they are stored and executed in a distributed fashion. The software and data may be stored on one or more computer readable media.

The method according to the embodiments may be embodied in the form of program instructions executable by various computer means and recorded on a computer readable medium. The computer-readable media may include program instructions, data files, data structures, etc. singly or in combination. The program instructions recorded on the medium may be those specially designed and constructed for an embodiment, or they may be of the kind known and available to those of skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and floptical disks. and magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language code that is executed by a computer, such as using an interpreter, as well as machine language code, such as that generated by a compiler.

As described above, the embodiments have been described based on the limited embodiments and drawings, but those skilled in the art will be able to make various modifications and variations based on the above description. For example, the techniques described may be performed in a different order than in the manner described and/or components such as systems, structures, devices, circuits, etc. described may be performed in a manner different from the manner described. Appropriate results may be achieved when combined or combined, opposed or substituted by other elements or equivalents.

Accordingly, different embodiments that are equivalent to the claims should still fall within the scope of the appended claims.

110, 120, 130, 140: electronic equipment 150, 160: server 170: network

Claims (9)

A file protection method performed by a computer device, comprising:
generating an intermediate file by modifying the original executable compressed file by the computer device ;
generating restoration information for restoring the original compressed file from the intermediate file by the computer device ;
generating , by the computing device, a new executable compressed file containing the intermediate file and the decompressed information; and
changing the file name of the new compressed file to the file name of the original compressed file by the computer device ;
The step of generating the intermediate file includes:
a first step of extracting internal files contained in the original compressed file by decompressing the original compressed file by the computer device;
a second step of modifying at least one class file of the extracted internal files into an unrecognizable form by the computing device;
a third step of compressing, by the computing device, the modified class files; and
A fourth step of repeatedly executing the second step and the third step by the computer device for a preset number of times
including
The step of generating the new compressed file includes:
The modified class file includes the compressed file, the restoration information, and the remaining files of the internal files excluding the target class files of the second step, the third step, and the fourth step. A file protection method characterized by generating a new compressed file . The computer device encrypts the file in which the modified class file is compressed and a new compressed file containing the restoration information using a preset key or according to a preset scheme. encoding and modifying;
generating , by the computer device, additional decompression information for decompressing the modified new compressed file; and
generating , by the computing device, an additional compressed file containing the modified new compressed file and the additional restoration information;
changing the file name of the new compressed file to the file name of the original compressed file;
2. The file protection method according to claim 1 , wherein the file name of said additional compressed file is changed to the file name of said original compressed file instead of the file name of said new compressed file. providing the new compressed file to the client by the computer device according to the client's request for the original compressed file;
In response to executing the new compressed file on the client , the client computing device :
extracting factors that are transmitted in connection with execution of the new compressed file;
restoring the modified class file on the memory of the client using the restoration information contained in the new compressed file;
loading the restored class file onto the memory of the client;
A function according to the original compressed file is executed by calling a main function of a main class included in the restored class file loaded on the memory and transferring the extracted factor. A file protection method according to claim 1 . providing the new compressed file to the client by the computer device according to the client's request for the original compressed file;
In response to executing the new compressed file on the client , the client computing device :
extracting factors that are transmitted in connection with execution of the new compressed file;
restoring the original compressed file from the intermediate file using the restoration information contained in the new compressed file;
executing the restored original compressed file and transferring the extracted factor to perform a function according to the original compressed file;
2. The file protection method according to claim 1, wherein said restored original compressed file is removed after said function is finished. The step of generating the restoration information includes:
A decompression code for decompressing the intermediate file into the original compressed file is generated, or decompression method information describing a decompression method corresponding to a modification method of the original compressed file is generated as the decompression information. The file protection method according to claim 1, wherein The step of generating the new compressed file includes:
The decompression information is encrypted using a key, encoded according to a preset scheme and included in another file inside the new compressed file, or inside a class file inside the new compressed file. 2. The file protection method of claim 1, wherein the file protection method comprises: The step of generating the restoration information includes:
generating a decompression code for decompressing the intermediate file into the original compressed file, or generating decompression method information describing a decompression method corresponding to a modification method of the original compressed file, using the computer device ;
storing the recovery code or the recovery method information in a preset server by the computing device ; and
generating, as the restoration information, connection information for connecting to the preset server and acquiring the restoration code or the restoration method information by the computer device when the new compressed file is executed. File protection method according to claim 1, characterized in that. A computer-readable recording medium, characterized in that a program for causing a computer to execute the method according to any one of claims 1 to 7 is recorded. A computer program stored in a computer-readable recording medium for causing a computer to execute the method according to any one of claims 1 to 7 in combination with a computer.

Images