KR100753798B1 - Method for restricting use of harmful multimedia file - Google Patents

Abstract

A method for restricting use of harmful moving picture files is provided to quickly block the use of the file if the file used in a user computer corresponds to the harmful moving picture file. A harmful moving picture database is construed by extracting/storing an identifier for discriminating the harmful moving picture file and meta information to a server. The harmful moving picture database is transmitted to the user computer. A blacklist, which is a list of the harmful moving picture files, is constructed by searching and comparing the moving picture files with the harmful moving picture database. If the moving picture file executed by the user corresponds to the harmful moving picture file by sequentially searching the blacklist of the user and the harmful moving picture database, the use of the executed file is blocked.

Description

How to restrict use of harmful video files {METHOD FOR RESTRICTING USE OF HARMFUL MULTIMEDIA FILE}

1a is a flow chart showing the overall configuration of a method invention according to the invention step by step.

FIG. 1B is a flowchart further showing a decoding reproduction step in the flowchart of FIG. 1A; FIG.

2 is a flow diagram illustrating an embodiment including a whitelist in a more preferred embodiment according to the present invention.

3 is a structural diagram showing a state in which a harmful video DB is built and updated in a server (remote system) and a blacklist and whitelist are constructed in a user computer in a preferred embodiment according to the present invention.

4 is a flowchart illustrating a process of determining whether a video file used in a user computer is harmful.

5 is a comprehensive flow diagram collectively illustrating various preferred embodiments of the present invention.

Explanation of symbols on the main parts of the drawings

  100: harmful video DB construction step 200: harmful video DB transmission step

  300W: Whitelist building step 400W: Harmless access to video files immediately

  300: blacklist building step 400: blocking harmful video files

  410: blacklist search step 410: file encryption check step

  420: Retrieval of harmful video DB step 500: File encryption step

  550: blacklist addition step 600: harmful video file decryption playback step

  700: file permission and verification data transfer step

  800: Parental Video DB and User Computer Update Steps

The present invention relates to a method for limiting the use of harmful video files, and more specifically, when using harmful video files in a user's computer, the harmful video DB or user-specific black list and white list are searched for and harmless. In the case of a video, it is possible to use it more quickly (playback, etc.). In contrast, in the case of a harmful video, it provides a function of restricting its use precisely. Furthermore, the harmful video registered in a blacklist is encrypted according to the present invention. It is intended to provide a way to prevent redistribution by making it unavailable to users' computers that do not have the system installed.

As a method of restricting the use of harmful video files by the user's computer, a specific operator or system collects harmful video files distributed on the Internet, extracts its own characteristic values, and builds a harmful video DB. If it is confirmed that a file used in the user's computer is a file registered in such a harmful video DB by installing the harmful video DB installed on the user's computer, a method of restricting its use is generally used. According to the technology, the DB can be built only on the harmful video files distributed on the Internet, and harmful video files that are not widely distributed through the Internet or harmful video files that are difficult to collect through the Internet can still be used on the user's computer. There was a problem.

Meanwhile, as a method for blocking harmful video use according to the prior art, for example, as disclosed in Korean Patent Publication No. 10-0517645, a harmful file file distributed on the Internet is searched for, and a harmful hash value is extracted from all or part of the harmful file. After constructing the pest DB, the extracted pest DB is sent to the user's computer to extract the extraction hash value for all or part of the files to be transmitted, edited, and played (executed) from the user's computer, and the pest is extracted from the pest DB. When the file to be transmitted or executed is harmful compared to a hash value, a technique of stopping transmission of the file, stopping execution of the file, or deleting the file is introduced. Run a process like a program In all cases of playing a file, an extracted hash value, which is considered unique in each file, is extracted from the played file, and the extracted hash value is compared with the harmful hash value of the entire harmful DB and registered in the harmful video DB. In addition, there is a problem that it should always be checked whether the file is a damaged file, and even if it is not a harmful video, there is always a certain time delay until the normal playback of the video file. Although there are many more harmless video files than video files and the frequency of their playback is harmless, even if the video files are played much more frequently, searching all the harmful video DBs in this way is quite effective in terms of efficiency. There is a big problem.

According to the conventional technology described above, when using a harmful video file, as described above, a method of forcibly terminating a process such as a video player using the file or deleting the file is used. If the technology is implemented in the form of a commercial service, the type of killing process is preferred and used, which in the future, checks the record of access to harmful video files when appropriate authentication procedures are performed (e.g., guardian mode or administrator mode). In order to do so, it is common to allow the use of harmful video files. However, in this case, even if the harmful video file is verified, it is not deleted from the user's computer and remains in the user's computer. Therefore, the harmful video file is not installed through the physical disk copy. If it is moved to another computer, it can be used normally without any limitation, and thus, even if the file is verified as a harmful video file, there is a problem indicating a limitation in actively blocking redistribution.

The present invention is to solve the problems of the prior art, if the file used on the user's computer corresponds to a harmful video file, the use is blocked more quickly, the file used on the user's computer is harmless to the video file If applicable, it provides a verification method that can be used as soon as possible without excessive delay in verifying whether or not it is a harmful video file, and actively collects harmful video files that are not distributed through the Internet but exist in the user's computer in the central blocking system. It provides a way to do this, and once verified as harmful video files on the user's computer, it not only restricts or blocks the use on the user's computer, but also prevents the harmful video file from being used properly even if it is transferred to another computer. By preventing the spread and redistribute video files over the Internet is an object of the invention to provide a method for creating a pleasant environment of the Internet.

In order to achieve the above object, the present invention is a method for limiting the use of harmful videos on a user computer connected to the Internet,

A harmful video DB building step of verifying harmfulness of each video file collected through the Internet, extracting identifiers and meta information for identifying harmful video files, and storing the same in a DB of the server;

A harmful video DB transmitting step of transmitting the harmful video DB constructed in the harmful video DB building step to a user computer;

A user-specific blacklist building step of searching for a video file in a user computer and constructing a blacklist which is a list of harmful video files by comparing with the harmful video DB; And

And a harmful video file use blocking step of sequentially searching the user blacklist and the harmful video DB for the video file that the user intends to use on the user computer and blocking the use of the harmful video file if the video file is harmful.

In the user-specific blacklist building step or blocking the use of the harmful video, a harmful video file encryption step of encrypting the harmful video file to store on the user computer in order to prevent the harmful video file is distributed or used to other users It provides a method for restricting the use of harmful videos, characterized in that.

According to another aspect of the present invention, after the step of encrypting the harmful video file, if the user computer wants to play the harmful video file in the administrator mode that has undergone the authentication process, further comprising the step of decrypting and playing the encrypted file; Provides a method for restricting harmful video use.

According to a further aspect of the present invention, in addition to the user-by-user blacklist building step, further comprising a user-specific whitelist building step of searching for a video file in the user computer to build a whitelist which is a list of harmless video files, and used in the user computer. Prior to the use of a harmless video file allowing the use of the file in the case of a harmless video file by searching the user's white list before the blacklist search step by user of the harmful video file use blocking step for the video file to be attempted Provided is a method of limiting use of a harmful video file, further comprising: a.

According to still another aspect of the present invention, the verification data generation and transmission of the user computer extracts an identifier for identifying a file for a video file stored in the user computer, extracts a screen frame or meta information for harmfulness verification, and transmits it to a server. step; And

The harmful data of the user video file is verified from the verification data of the user video file transmitted from the user computer through the verification data generation and transmission step, and according to the harmfulness, the harmful video DB stored in the server is updated or the white list of the user computer is updated. There is provided a method of limiting use of a harmful video file, wherein the harmful video file is additionally included.

Hereinafter, preferred embodiments and embodiments of the present invention will be described with reference to the accompanying drawings.

First, referring to the overall configuration of the method invention according to the present invention as shown in Figure 1a step by step, each of the video files collected through the Internet to verify the harmfulness of the identifier to identify harmful video files and Harmful video DB construction step of extracting the meta information and stored in the DB of the server (100); A harmful video DB transmission step of transmitting the harmful video DB built in the harmful video DB building step to a user computer (200); A user-specific blacklist building step (300) of searching for a video file in a user computer and constructing a blacklist which is a list of harmful video files by comparing with the harmful video DB; And a harmful video file use blocking step (400) of sequentially searching the user blacklist and the harmful video DB for the video file that the user intends to use on the user's computer to block the use of the harmful video file. And in the user-specific blacklist building step 300 or the harmful video use blocking step 400, in order to prevent the harmful video file is distributed or used to other users to encrypt the harmful video file to the user's computer It provides a harmful video use restriction method comprising the step of encrypting the harmful video file 500 to store.

According to a more preferred embodiment of the present invention, after the harmful video file encryption step 500 as shown in Figure 1b, if the user computer is to play the harmful video file in the administrator mode has undergone the authentication procedure, More preferably, the method further includes a harmful video file decryption playback step 600 for decrypting and playing back the file.

According to a preferred embodiment provided in another aspect of the present invention, as shown in Figure 2, in addition to the user-specific blacklist building step 300 to search for a video file in the user computer whitelist which is a list of harmless video files And a user-specific whitelist building step (300W) for constructing the user's whitelist, and before the user's blacklist search step of the harmful video file use blocking step for a video file to be used on a user's computer. Use a harmless video file to search by file identifier, but search by file name, file size or file meta information without extracting the identifier. Additionally includes an immediate permit step (400W) A harmful video use restriction method is provided.

Referring to the accompanying drawings showing preferred embodiments forming the respective steps constituting the method invention according to the invention described above with reference to Figures 3 to 5 in more detail as follows.

First, an operator providing a computer software program that can be a general means for implementing the method invention according to the present invention on a user computer, and providing a service provided to the user computer by constructing a harmful video DB. Looking at the step (100) of building a harmful video DB in the server (remote system from the user's computer) operating in, as shown in Figure 3 by the method of automatic collection or manual collection of video files distributed on the server A method of constructing a harmful video DB by directly collecting and generating (extracting) verification data from the collected video file may be used. The key value of the file stored in the harmful video DB may be extracted from each file. Use message digest values to minimize conflicts Extracts the file identifier from the appropriate regions in order to accurately identify. The message digest is a unique value of a fixed length obtained by applying a one-way hash function to a given input data. It is a kind of checksum that can be used to check forgery of the original file. In the present invention, such a message digest value is used as an identifier of a file, and generally known message digest hash functions include MD5, SHA-1, and HAS-160, and any of these functions can be selected.

In the method 100 of constructing a harmful video DB in the method according to the present invention, a user computer (PC, etc.) as illustrated in FIG. The method according to the present invention generates (extracts) verification data such as identifiers and meta information from a video file stored in a user's computer (ie, a video file not determined to be a harmful video) when the program is implemented. It is transmitted to the server in real time through the server, and the server can verify whether the video file determined to be potentially harmless on the user PC is harmless by verifying the verification data.

According to the verification result, when the harmfulness of the video file which is not identified as the harmful video is detected through the harmful video DB existing in the user's PC, the harmful video file DB currently maintained by the server can be updated with higher reliability. In addition, in the steps constituting the embodiment of the present invention described above, additional data about the harmful video file extracted from the user computer is included in the harmful video DB so that the harmful video DB is updated (updated). It can be implemented by inclusion. That is, the step of generating the verification data of the video file determined to be not harmful video on the user computer as identified in the file access permission and verification data transmission step 700 in FIG. 5, and As the update step 800 of the harmful video DB and the user PC, the verification data of the video file transmitted to the server is verified, and if it is not the harmful video, the whitelist of the user's computer is updated (updated). By adding the information to the harmful video DB, a step of updating the harmful video DB and transferring (downloading) the updated harmful video DB to the user's computer may be additionally provided. Thus, the harmful video is not distributed through the Internet. Even files are recorded in harmful video DB It can will have the effect of allowing.

In the present invention, as shown in FIG. 2, the steps 300 and 300W of constructing the black list BL and the white list WL for each user computer may be implemented using, for example, a caching technique. The black list BL is a list of harmful video files in the user's computer, and the white list WL corresponds to a list of harmless video files in the user's computer, and the list is preferably made of a hash table data structure. In the present invention, by using the fact that the harmful video files on the user's computer is much smaller than the entire video file to build a black list for the harmful video file and a white list for the harmless video file before the search of the harmful video DB Adopt a method that uses these lists first.

As shown in FIGS. 4 and 5, when a user wants to use a video file on a user's computer, a white list (WL) search step (indicated by reference numeral '400W' in FIG. 5) is first performed. For harmless video files determined to be contained in the WL), adopting a method of immediately terminating and allowing the use of the file without the need for executing the harmful video file blocking process any more, thereby ensuring faster usage time for the harmless video files. , And for a harmful video, a separate systematic process, that is, a blacklist search step for determining whether a target file is a file in a blacklist (BL) (denoted by 410 in FIG. 5), and the target file itself is secret. File encryption check step to determine whether or not the key is encrypted (refer to the ' 420 '), and through the harmful video DB search step (marked with reference numeral' 430 'in FIG. 5) to determine whether the target file is finally included in the harmful video DB, the harmfulness is sequentially verified and harmful. In the case of a video, the use of the file is blocked, and more preferably, such a blocking history is recorded on the user's computer, thereby providing a more accurate and efficient use of harmful video file restriction. In the case where it is determined that the harmful video is detected in the harmful video DB search step 430, the file is not only blocked but is not yet encrypted, so branched to (F) branching point as shown in FIG. A separate file encryption step 500 is performed.

Meanwhile, as shown in FIG. 5, after the file encryption step 500 of encrypting the harmful video file, the blacklist BL is updated by adding data of the target file to the blacklist BL that exists separately on the user's computer. It is desirable to go through the blacklist addition step 550 so that if such a file is reused it can be blocked in the fastest possible way.

4 and 5, the white list search step 400W and the black list search step 410 are described and shown to be performed in sequence, but it is obvious that they may be performed in parallel at the same time.

Looking at the file encryption step in more detail, for a harmful video file on the user's computer, it is recommended to encrypt the target file in the kernel mode using the file system filter driver (FSFD), a driver that can control the file system immediately after the harmfulness determination. In addition, in the case of using a secret key method so that decryption cannot be performed on a computer that does not have a system (program or the like) implementing the method according to the present invention, an encrypted file cannot be used on a computer that does not have the system installed. Therefore, even if it is moved to another user's computer is not available, it will provide an effect to prevent redistribution.

 In addition, in a computer on which a system in which the method according to the present invention is implemented is used, the permission is determined through an authentication code, and when an authorized user (eg, a guardian such as a parent logged in administrator mode) uses an encrypted harmful video file. As shown in FIG. 2, it is preferable to proceed with the real-time decryption and playback step 600 so that the target file can be normally used. Such a function blocks the use of the harmful video file when the youth wants to use it. After the blocking history is recorded, when the parental guard or the like wants to check the blocking history, it provides an effect of confirming what kind of file was specifically blocked as a harmful video file. This verification process is performed through real-time decryption and decrypts in kernel mode using FSFD, a driver that can control the file system in the same way as file encryption.

As another preferred embodiment of the present invention, the present invention may include a feature of inserting a predetermined recognition code such as a watermark into the encrypted file when encrypting the harmful video file. The identification code may also be used to determine whether to encrypt the harmful video file in the inspection step, by identifying the harmful video file on the communication line by installing a recognition code discrimination unit (not shown) in the server on the network instead of the user computer. In the case of inserting a plurality of recognition codes into a single file, even if the file is divided and transmitted in units of segments, the recognition code determination unit detects the transmission state of the harmful video file. Can be discriminated so that a good blocking function can be provided.

Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art to which the present invention pertains can implement the present invention in other specific forms without changing the technical spirit or essential features, The examples are to be understood in all respects as illustrative and not restrictive.

In addition, the scope of the present invention is specified by the appended claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts are included in the scope of the present invention. Should be interpreted.

According to the present invention, by overcoming the limitations of collecting harmful video files, harmful video files that are not distributed on the Internet but only stored on the user's computer are additionally updated in the harmful video DB, thereby providing a more effective harmful video use restriction function. can do.

As another effect of the present invention, it is possible to minimize the performance degradation of the user's computer due to the installation of the harmful video file restriction system through the establishment and operation of blacklist and whitelist for each user, and furthermore, Harmful video files are encrypted so that they cannot be used even if they are redistributed to another computer through the Internet or another physical method, thereby preventing the spread of harmful video files. It also provides the ability to actively control the transmission of these encrypted files on the track.

By the above effects, parents with minor children can reassure their children to use the Internet, and children can have healthy and healthy thoughts free from the damage of indiscriminate harmful video files. In addition, the traffic of harmful video files that occupy a large network bandwidth can be reduced, thereby securing an efficient and productive network infrastructure nationally.

Claims (20)

delete delete delete delete delete delete A harmful video DB building step of verifying harmfulness of each video file collected through the Internet, extracting identifiers and meta information for identifying harmful video files, and storing the same in a DB of the server; A harmful video DB transmitting step of transmitting the harmful video DB constructed in the harmful video DB building step to a user computer; A blacklist building step for each user, searching for a video file in a user computer and constructing a blacklist which is a list of harmful video files by comparing with the harmful video DB; And And a harmful video file use blocking step of sequentially searching the user blacklist and the harmful video DB for the video file that the user intends to use on the user computer and blocking the use of the harmful video file. In the user-specific blacklist building step or blocking the use of the harmful video, a harmful video file encryption step of encrypting the harmful video file to store on the user computer in order to prevent the harmful video file is distributed or used to other users And In addition to the user-by-user blacklist building step, the user may further include a user-specific whitelist building step of searching for video files in the user's computer and building a white list which is a list of harmless video files. The method may further include a step of immediately allowing use of a harmless video file to allow the user to use the file in the case of a harmless video file by searching the user white list before the user blacklist search step of the video file use blocking step. How to restrict the use of harmful video files. The apparatus of claim 7, further comprising a file encryption test step of checking whether a file to be inspected is encrypted between the blacklist search step and the harmful video DB search step constituting the harmful video file use blocking step. How to restrict use of video files. The method of claim 7, further comprising inserting a recognition code into the encrypted file in the encrypting of the harmful video file. 10. The method of claim 9, wherein an identification code discriminating unit capable of discriminating the identification code is provided on a file transmission line. The method of claim 7, further comprising, after the encrypting of the harmful video file, decrypting the encrypted file and playing the encrypted file when the user computer attempts to play the harmful video file in an administrator mode that has undergone an authentication procedure. How to restrict use of video files. The method of claim 7, wherein the encryption of the harmful video file in the harmful video file encryption step is performed by a file system filter driver (FSFD) in kernel mode. How to use the harmful video file, characterized in that using the. 12. The method of claim 11, wherein the harmful video file encryption in the harmful video file encryption step and the decryption in the harmful video file decryption reproduction step are performed by a File System Filter Driver (FSFD) in kernel mode and decrypts the encrypted file. And a secret key is used as the encryption and decryption method. A harmful video DB building step of verifying harmfulness of each video file collected through the Internet, extracting identifiers and meta information for identifying harmful video files, and storing the same in a DB of the server; A harmful video DB transmitting step of transmitting the harmful video DB constructed in the harmful video DB building step to a user computer; A blacklist building step for each user, searching for a video file in a user computer and constructing a blacklist which is a list of harmful video files by comparing with the harmful video DB; And And a harmful video use blocking step of sequentially searching the user blacklist and the harmful video DB for the video file that the user intends to use on the user computer, and blocking the use of the harmful video file. In the user-specific blacklist building step or blocking the use of the harmful video, a harmful video file encryption step of encrypting the harmful video file to store on the user computer in order to prevent the harmful video file is distributed or used to other users And Generating and transmitting verification data by the user computer extracting an identifier for identifying a file from a video file stored in the user computer, extracting a screen frame or meta information for harmfulness verification, and transmitting the same to a server; And The harmful data of the user video file is verified from the verification data of the user video file transmitted from the user computer through the verification data generation and transmission step, and according to the harmfulness, the harmful video DB stored in the server is updated or the white list of the user computer is updated. Method for limiting the use of harmful video files, characterized in that further comprises the step of updating the harmful video DB and user computer update. 15. The harmful apparatus of claim 14, further comprising a file encryption test step of checking whether a file to be scanned is encrypted between the blacklist search step and the harmful video DB search step constituting the harmful video file use blocking step. How to restrict use of video files. 15. The method of claim 14, further comprising inserting a recognition code in the encrypted file in the encrypting of the harmful video file. 17. The method of claim 16, wherein an identification code discriminating unit capable of discriminating the identification code is provided on a file transmission line. 15. The harmful video of claim 14, further comprising, after the encrypting of the harmful video file, decrypting and playing the encrypted file when the user computer intends to play the harmful video file in an administrator mode that has undergone an authentication procedure. How to restrict file use. 18. The method according to any one of claims 14 to 17, wherein the harmful video file encryption in the harmful video file encryption step is encrypted by a file system filter driver (FSFD) in kernel mode, and the encryption method is a secret key. How to use the harmful video file, characterized in that using the. 19. The method of claim 18, wherein the harmful video file encryption in the harmful video file encryption step and the decryption in the harmful video file decryption reproduction step are performed by a File System Filter Driver (FSFD) in kernel mode and decrypts the encrypted file. And a secret key is used as the encryption and decryption method.

Images