KR100953355B1 - Method for protecting on-line electronic transaction program - Google Patents

Abstract

The present invention relates to a method for protecting an online e-commerce program. That is, in the present invention, in the method of protecting an electronic transaction program for performing financial transactions online, when the electronic transaction program is executed on a computer for the online financial transaction, various kinds of malicious codes for the electronic transaction program may be used. By blocking hacking attempts by detecting and restoring API hooking, preventing debugging, and preventing access to memory, it is possible to prevent illegal leakage or manipulation of user's account information and transaction information sent / received through online electronic transactions. To increase the reliability of electronic transactions.

ECommerce, Stocks, Online, Hacking, API, Debugging

Description

How to protect your online e-commerce program {METHOD FOR PROTECTING ON-LINE ELECTRONIC TRANSACTION PROGRAM}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for protecting an online e-commerce program. In particular, the present invention relates to the processing of financial affairs in the case of performing financial affairs such as stock trading, internet banking, etc. by using a computer on the internet connected online. The present invention relates to a method for protecting an online e-commerce program, which can enhance the reliability by protecting the executed e-commerce program from hacking.

In recent years, due to the development of the Internet communication network, it is easier to use a computer online without having to visit a bank or a stock exchange, such as a bank or stock exchange, to perform financial transactions such as stock trading. It becomes possible to sell stocks and to handle various bank transactions.

In addition, due to the rapid spread and convenience of the high-speed Internet communication network and the Internet-accessible personal computer, the use of online financial-related business is rapidly increasing, and now it is becoming a service commonly used by almost everyone.

In other words, in the case of online stock trading, stock trading can be performed simply by interworking with individual stock account information through a computer based on various stock quote information provided from a securities company through the Internet. As mentioned above, online stock trading through the Internet can collect domestic and foreign securities information in real time without spatial constraints and reflect it in investment, compared to offline stock trading, and offers quick convenience of stock trading. In addition, in the case of online banking, if you access your bank's Internet website and use your account information and personal password, you can conveniently use your computer to go to the bank offline without having to go directly to the bank. Can be seen.

However, in the above-mentioned use of online financial related business, contrary to the convenience of use described above, personal information leakage, manipulation, etc. due to hacking into stock trading program by various malicious codes or stock trading program using a browser You are at risk.

In other words, if a stock trading program running on a user's computer or a stock trading program using a browser is attacked by a hacker or malicious code, specific data and processing methods of the program are leaked regardless of the user's intention and the user's account There was a problem of causing a great damage to the user, such as information or trading information can be manipulated, changed.

Therefore, in performing financial-related work online, there is a continuous demand for the development of reliable electronic transaction security methods that enable users to use them more reliably.

According to an aspect of the present invention, there is provided a method for protecting an online electronic transaction program, the method comprising: monitoring an attempt to access process handle information of the electronic transaction program when the electronic transaction program is executed on a computer, and accessing the process handle information; Checking whether the process is allowed by checking the ID of the corresponding process when detecting another process, and hooking an API that generates the process handle when attempting to access process handle information by a process that is not allowed access. Blocking access.

In addition, the present invention provides a method for protecting an online e-commerce program, the method comprising: monitoring an access attempt on a memory of the e-commerce program when the e-commerce program is executed on a computer; and checking an ID of the corresponding process when detecting another process accessing the memory. And checking whether the process is allowed to access, and blocking access by hooking the memory access and modification API when an attempt is made to access the memory by the process in which the access is not permitted.

The present invention also provides a method for protecting an online electronic transaction program, the method comprising: checking whether an API used by the electronic transaction program is hooked when the electronic transaction program is executed on a computer, and restoring the hooked API when the API is hooked And checking whether the check result is restored, and restoring access to the malicious process by restoring the hooked API.

In addition, the present invention provides a method for protecting an online e-commerce program, the method comprising: compressing a driving file of the e-commerce program when a request is made to execute an e-commerce program on a computer, virtualizing codes executed by the e-commerce program on a memory; Detecting a debugger attempting to debug the e-commerce program, and blocking access to the debugger when the debugger is an abnormal process that is not allowed to be debugged.

The present invention relates to a method for protecting an electronic transaction program for performing financial related tasks online, wherein a variety of hacking from malicious code for the electronic transaction program is executed when the electronic transaction program is executed on a computer for the online financial transaction. By preventing attempts to detect and restore API hooking, preventing debugging, and preventing memory access, the online electronic transaction can be prevented from illegally leaking or tampering with the user's account information and transaction information transmitted / received through online electronic transactions. There is an advantage to increase the reliability of the transaction.

Therefore, the present invention, when performing a financial business such as stock trading, Internet banking, etc. using a computer on the Internet connected to the Internet to protect the electronic transaction program executed for the processing of the financial business safely from hacking to improve the reliability It aims to provide a way to protect online e-commerce programs.

Hereinafter, with reference to the accompanying drawings will be described in detail the operating principle of the present invention. In the following description of the present invention, detailed descriptions of well-known functions or configurations will be omitted when it is determined that the detailed description of the present invention may unnecessarily obscure the subject matter of the present invention. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intentions or customs of the user, the operator, and the like. Therefore, the definition should be made based on the contents throughout the specification.

1 illustrates a schematic network configuration of a stock trading system using the Internet among online e-commerce services according to an embodiment of the present invention. The embodiment of the present invention describes a method of protecting an online stock trading program for convenience of description. One is equally applicable to electronic trading programs that use online for various financial related tasks.

1, the online stock trading system of the present invention, the Securities Computerization Center server 100, securities company server 106, database (DB) 108, the Internet 104, the user terminal 102 It includes.

First, the Securities Computer Network server 100 is a server that supports stock trading orders, and provides information on stock quotes to a user terminal 102 that wants to sell stocks online by accessing a securities firm server 106.

The securities firm server 106 checks the identity of the individual user with respect to the user terminal 102 requesting the online stock sale through the Internet 104, and refers to the securities information stored in the database 108 from the user. Provide information on data processing of requested stock trading orders and requests for information related to stock trading.

The user terminal 102 is a computer that can be connected to the Internet 104, and is equipped with a stock trading program provided by the securities company for online stock trading, and the securities company server 106 when the stock trading program is executed from the user. (C) download various stock quote information for online stock trading and provide it to the user, and send a stock trading request input from the user to the securities firm server 106 to enable stock trading online.

FIG. 2 illustrates a concept of an internal process on a computer executed for an online electronic transaction and an electronic transaction security module protecting the same according to an embodiment of the present invention.

Hereinafter, referring to FIG. 2 above, an operation of an internal process for online stock trading, in particular, for online stock trading, and an operation of an electronic transaction security module for protecting personal information transmitted / received during operation of the above process will be described in detail. Let's explain.

First, the process A (200) configures various menu screens for stock trading when the stock trading program, for example, is executed on a computer among electronic trading programs, and receives various key inputs from a user related to stock trading to request an order. To process.

Process B 202 receives various information related to stock trading, such as stock quote, through communication with securities company server 106 connected to the Internet 104 and provides it to Process A 200, and from Process A 200. The order sales information entered is sent to the securities company server 106 so that online stock trading is performed. The memory A 206 and the memory B 208 store data processed according to the execution of the process A 200 and the process B 202 when the stock trading program is executed.

The hacking module 210 refers to malicious code inserted for the purpose of hacking an electronic transaction program executed on a user's computer, such as a stock trading program. When the stock trading program is executed, a process handle accessible to the stock trading program. Hacking is performed by hooking (process handle) information, hooking an API (Application Programming Interface) used in stock trading programs, or debugging to understand how a stock trading program works or principles. .

In addition, the hacking module 210 accesses, for example, the memory A 206 or the memory B 208 referenced by the process A 200 and the process B 202 which are operated when the stock trading program is executed. The hacking is performed by attacking the memory A 206 which processes data according to the processing of the order of the process A 200, changing the order name, or modifying the order number, or, for example, the process B 202. The hacking is performed by attacking the memory B 208 that processes the stock quote data of the parent) and displaying the stock which is the lower limit as the upper limit.

When the stock trading program is executed on a computer by a user, the electronic transaction security module 204 blocks various attempts of the hacking module 210 to attack the stock information program to attack personal information, thereby safely storing the stock trading program. Enable online electronic transactions through

Hereinafter, various operations for preventing access to the stock trading program by the hacking module 210 in the electronic transaction security module 204 will be described in detail.

First, when the electronic transaction security module 204 detects that the hacking module 210 attempts to access process handle information for hacking the stock trading program, the hacking module 210 processes the stock trading program. In order to prevent access to the handle information, hooking the handle generation APIs of the process used in user mode or kernel mode to allow access by other processes such as hacking modules is not allowed. Block access to handle information. At this time, the electronic transaction security module 204 checks the ID (ID) of the process in the determination of the disallowed process, and determines whether the process is allowed to access the process handle information.

In addition, when the electronic transaction security module 204 detects that the hacking module 210 attempts to access the memories 206 and 208 for the hacking of the stock trading program, the stock trading program by the hacking module 210. In order to prevent the memory access of the memory access, the memory access and modification APIs used in user mode or kernel mode are hooked to prevent access to the memory 206 and 208 by other unauthorized processes such as the hacking module 210. Let's do it.

Meanwhile, the hacking module 210 may be hacked by hooking APIs used by the stock trading program for the stock trading program. Accordingly, the electronic transaction security module 204 changes the operation of the stock trading program by a hacking module such as malicious code which is not allowed, or prevents the leakage and manipulation of important data. It determines whether the APIs used in the program are hooked and if it is hooked, it stops the execution of the program or informs the user of the risk of hacking, or restores the API manipulated by hooking and restores the normal API to be called. do.

In addition, the hacking module 210 may hack through the debugging of the stock trading program for the stock trading program as described above. Accordingly, in order to prevent reverse engineering through debugging analysis of the stock trading program, the electronic transaction security module 204 virtualizes the code executed in memory to check the code being executed. Debugging can be prevented by making the command unverifiable and compressing the file against the executables used to run the stock trading program so that the composition of the original file is unknown. It also monitors the existence of unacceptable debuggers attempting to debug stock trading programs, notifying users of hacking risks when debugging is detected, or interrupting the execution of such programs to understand how stock trading programs operate. Prevent it.

3 is a flowchart illustrating an operation control flow for protecting an electronic transaction program executed in a user computer terminal according to an embodiment of the present invention. For convenience of description, a method of protecting an online stock trading program among electronic transaction programs will be described. It is equally applicable to various electronic trading programs used for financial related work online. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1, 2, and 3.

First, when a user requests execution of an online stock trading program through a key input, the process of the corresponding stock trading program is executed by the OS operating system at step S300.

Then, the electronic transaction security module 204 recognizes the execution of the stock trading program to be protected, and blocks process handle information access or process memory access by an abnormal process such as the hacking module 210 to hack the stock trading program. In step (S302) to (S304) to hook the API for creating a process handle of the stock trading program, and hooks the memory access and modification API that can access and modify the memory used by the processes of the stock trading program.

That is, the electronic transaction security module 204 generates the process handle in the user mode or the kernel mode to prevent another process that is not allowed in step S302 from taking the process handle information to access the stock trading program. Hooking the process handle generation API used for blocking to block access to the process handle information by the abnormal process, such as hacking module (210).

In addition, the electronic transaction security module 204 is a user mode or kernel to block the operation of accessing or manipulating the contents of the memory used by the processes of the stock trading program is not allowed to access in step (S304) In this mode, the memory access and modification API used for access and modification of the memory 206 and 208 is hooked to block the memory access of the stock trading program by an abnormal process such as the hacking module 210.

Subsequently, the electronic transaction security module 204 checks whether there is an access attempt from another process to obtain process handle information for accessing the stock trading program executed in step S306 or to access process memory. Watch.

At this time, if it is determined that there is an access attempt from another process for process handle information or process memory for accessing the stock trading program running on the computer of the user terminal, the electronic transaction security module 204 may process the process handle information. Alternatively, the process proceeds from step S308 to step S310, which is a memory access determination step, to detect process handle information of the stock trading program or ID information of another process that attempted to access the memory, thereby validating the process handle information or access to the memory. Check for availability. That is, it checks whether the process is allowed access by comparing process handle information or ID information of the process attempting to access the memory with previously registered access allowed process ID information.

Subsequently, when another process that attempts to access the process handle information or the memory in the legitimacy check of the process access in step (S310) is a normal process allowed access to the stock trading program, the electronic transaction security module 204 (S310) In step S314, access to the process handle information or the memory of the stock trading program is normally permitted.

However, in contrast, in the legitimacy check of the process access in the step (S306), the process handle information or another process that attempts to access the memory is checked as an abnormal process, such as hacking module 210 is not allowed to access the stock trading program If so, the electronic transaction security module 204 proceeds from step S310 to step S316 to block access attempts to process handle information or memory.

4 is a flowchart illustrating an operation control flow for protecting an electronic transaction program executed in a user computer terminal according to another embodiment of the present invention. For convenience of description, a method of protecting an online stock trading program among electronic transaction programs will be described. It is equally applicable to various electronic trading programs used for financial related work online. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1, 2, and 4.

First, when a user requests execution of an online stock trading program through a key input, the process of the corresponding stock trading program is executed by the OS operating system at step S400.

Then, the electronic transaction security module 204 recognizes the execution of the stock trading program to be protected, and checks whether the APIs used in the stock trading program executed above are hooked in step S402.

In other words, in the case of a stock trading program where money is transmitted / received between an individual and a securities firm, the hacking module such as a malicious code that attempts to hack it changes the operation of the stock trading program or leaks or modifies important data. The electronic transaction security module 204 may check whether the APIs used in the stock trading program executed to prevent an attack on such a stock trading program are hooked.

In this case, if it is determined that the APIs used in the stock trading program are hooked by the hacking module, the electronic transaction security module 204 proceeds from step S404 to step S406 and is hooked by the hacking module 201. Checks for recoverability of compiled APIs.

On the other hand, in determining the hooking of the above API, the electronic transaction security module 204, for example, there is an instruction to move the flow to an abnormal external code area in the execution code inside the API or to store the location of the API. If it detects that the address of the function indicated by IAT (Import Address Table), EAT, and SDT of the module being changed is different from the actual address value, it determines that the API is hooked.

Subsequently, in step S406, when the restoration possibility of the APIs hooked by the hacking module, such as malicious code, is restored, the electronic transaction security module 204 may restore the hooked APIs (S408). In step S410, the hooked APIs are restored normally.

At this time, in restoring the API, the electronic transaction security module, for example, loads the original execution code into memory using data that can identify the original file or the original code of the API, and instead calls a hooked or manipulated API. Restore the API by calling code that exists separately on the Alternatively, the API is restored by overwriting the code area of the API with the original code before the API is called.

However, in contrast, in the step (S406), when the restoration possibility for the APIs hooked by the hacking module 210 such as malicious code, the restoration of the hooked APIs is impossible, the electronic transaction security module ( 204) proceeds from step S408 to step S412 to inform the user of the risk of hacking into the stock trading program, and stops the execution of the corresponding stock trading program in step S414.

FIG. 5 is a flowchart illustrating an operation control flow for protecting an electronic transaction program executed in a user computer terminal according to another embodiment of the present invention. For convenience of description, a method of protecting an online stock trading program among electronic transaction programs will be described. It is equally applicable to various electronic trading programs used for financial related work online. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1, 2, and 5.

First, when a user requests execution of an online stock trading program through a key input, the process of the corresponding stock trading program is executed by the OS operating system at step S500.

Then, the electronic transaction security module 204 recognizes the execution of the stock trading program to be protected, and in order to prevent debugging from the hacking module 210 such as malicious code for the stock trading program (S502), For the files used to run the trading program, the composition and contents of the original file are changed using the execution compression method.

Accordingly, the original driving file contents of the stock trading program may be prevented from being grasped by the hacking module 210 such as malicious code, thereby preventing direct modification or modification of the driving file of the stock trading program.

Subsequently, the electronic transaction security module 204 virtualizes codes performed by the stock trading program on the memory at step S504 to prevent debugging from the malicious code for the stock trading program or the hacking module 210.

Accordingly, by allowing the code instruction of the stock trading program to be in an undeterminable state, the operation method and principle of the stock trading program can be prevented from being caught by the hacking module 210 such as malicious code. Subsequently, the electronic transaction security module 204 checks whether there is an attempt to debug the stock trading program currently being executed in step S506.

At this time, if the debugging attempt for the stock trading program running on the user computer is detected, the electronic transaction security module 204 proceeds from the step (S508) to the step (S510) and is currently operating for debugging the stock trading program. Detects the ID of another debugger process to check whether debugging is allowed.

At this time, if the debugger process for debugging the stock trading program is an abnormal process such as malicious code which is not allowed to be debugged, the electronic transaction security module 204 proceeds from step S512 to step S514. Informs that the stock trading program is being debugged by an abnormal process, and the execution of the stock trading program is stopped at step S516.

As described above, in the present invention, a method for protecting an electronic transaction program for performing online financial transactions, wherein the electronic transaction program on the computer for the online financial transaction is malicious By blocking various hacking attempts from the code through API hooking detection and restoration, debugging prevention, memory access prevention, etc., user's account information and transaction information transmitted / received through online electronic transaction are illegally leaked or manipulated. It helps to increase the credibility of online e-commerce.

Meanwhile, in the above description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the invention should be determined by the claims rather than by the described embodiments.

1 is a schematic network diagram of an online stock trading system,

2 is a conceptual diagram of an internal process of an electronic transaction program according to an embodiment of the present invention;

3 is an operation control flowchart for protecting an electronic transaction program according to an embodiment of the present invention;

4 is an operation control flowchart for protecting an electronic transaction program according to another embodiment of the present invention;

5 is an operation control flowchart for protecting an electronic transaction program according to another embodiment of the present invention.

<Brief description of the major symbols in the drawings>

200, 202: process 206, 208: memory

204: Electronic transaction security module 210: Hacking module

Claims (14)

As a way to protect your online e-commerce program, Hooking the process handle generation API of the electronic transaction program when the electronic transaction program is executed on a computer; Monitoring access attempts to the process handle information; Checking whether the process is allowed access by checking the ID of the corresponding process when detecting another process accessing the process handle information; Blocking access to the process handle information when the check result indicates that the other process is not an accessible process; Online e-commerce program protection method comprising a. As a way to protect your online e-commerce program, Hooking an API to access the process memory of the electronic transaction program when the electronic transaction program is executed on a computer; Monitoring access attempts to the process memory; Checking whether the process is permitted by checking an ID of a corresponding process when detecting another process accessing the process memory; Blocking the process memory access when the check result indicates that the other process is not an accessible process Online e-commerce program protection method comprising a. The method according to claim 1 or 2, The electronic trading program is a stock trading program or a stock trading program using a browser. As a way to protect your online e-commerce program, Checking whether the API used in the electronic transaction program is hooked when the electronic transaction program is executed on a computer; Checking whether the hooked API can be restored if the API is hooked; Restoring access to a malicious process by restoring the hooked API when restoring the inspection result; Online e-commerce program protection method comprising a. The method of claim 4, wherein The API hooking check step, The method of protecting an online e-commerce program, characterized in that it checks whether there is an instruction for moving the flow of the internal execution code of the e-commerce program to an abnormal external code region and determines that the instruction is an API hooking. The method of claim 4, wherein The API hooking check step, Change the address by checking whether the API address indicated by the table that stores the IAT, EAT, SDT or IDT function location of the module that stores the API location among the internal execution codes of the electronic transaction program is different from the actual address value. Online e-commerce program protection method characterized in that it is determined by the API hooking. The method of claim 4, wherein The API restore, Put the original execution code in the memory using the electronic transaction program source file or the data that can identify the original code of the API, and then call a code existing separately in the memory, without calling a hooked or manipulated API. A method for protecting an online e-commerce program, comprising: The method of claim 4, wherein The API restore, And overwriting the code area of the corresponding API with the original source code of the electronic transaction program before the API is called. The method of claim 4, wherein The protection method, Notifying the user of a hacking risk of the electronic transaction program when the hooked API is not possible to be restored; Online e-commerce program protection method characterized in that it further comprises. The method of claim 4, wherein The protection method, Stopping execution of the electronic transaction program when the hooked API cannot be restored Online e-commerce program protection method characterized in that it further comprises. The method of claim 4, wherein The electronic trading program is a stock trading program or a stock trading program using a browser. As a way to protect your online e-commerce program, Compressing a driving file of the electronic transaction program when the electronic transaction program is executed on a computer; The electronic transaction program virtualizing codes executed on a memory; Detecting a debugger attempting to debug the e-commerce program; Blocking access to the debugger if the debugger is an abnormal process that is not allowed to be debugged Online e-commerce program protection method comprising a. The method of claim 12, The debugger access blocking step, Detecting a debug attempt by the debugger to notify that there is a debug attempt for the electronic transaction program; Interrupting execution of the e-commerce program when the debugging attempt is detected to block access to the debugger; Online e-commerce program protection method comprising a. The method of claim 12, The electronic trading program is a stock trading program or a stock trading program using a browser.

Images