KR100976961B1 - Security system for internet site and method thereof - Google Patents

Abstract

The present invention discloses an internet site security system and method thereof. That is, a browser execution module for executing a browser for providing a work execution environment on the Internet site according to a user selection; A memory protection module configured to prevent access from an external module to a memory area allocated to the browser according to the execution of the browser, and to detect whether the memory area has been tampered with and whether the execution code has been manipulated; And a browser protection module that prevents debugging from another process or module for the browser execution module according to the execution of the browser, and selects an allowable module and an unallowable module among a plurality of modules loaded in the memory area. By doing so, it is possible to provide an electronic transaction based environment that is safe from malicious attacks.

Browser, security

Description

Internet site security system and its method {SECURITY SYSTEM FOR INTERNET SITE AND METHOD THEREOF}

The present invention relates to the protection of a web-based e-commerce site, and more particularly, to block malicious access of hackers when executing an e-commerce program based on the Internet, and to modify specific data and processing methods of the e-commerce site. The present invention relates to an Internet site security system and a method thereof.

In general, tampering with executable image code in memory occurs in many cases as hooking, and some hacking tools use arbitrary code to randomly generate different behavior than the original behavior of the executable image. It is generated by manipulating.

This tampering behavior causes many security problems by making the executable image impossible to perform. For example, malicious programs conceal themselves by forming a rootkit that prevents them from being found by hooking and manipulating data on specific executable images, and continuously attempting to attack normal executable images. It may change the way or cause malfunction. Also, by modifying the code part related to authentication, it can be exploited in the reversing process such as crack, which allows a user without access authority to use the corresponding program even without the authentication process.

In this regard, programs currently used in the web-based electronic transaction system has a lot of security problems due to its generality and its own vulnerability in the Internet environment.

For example, a keyboard security product for protecting a user's keyboard input content, a PKI security product for protecting data transmitted and received through the Internet, and a user's integrity in electronic transactions can be verified. Various security products such as public digital certificates, firewalls, etc., which are used for verification are used together.

However, the above-mentioned security system provides security only for the part where the data moves, and directly accesses and manipulates the memory, accesses the web page source code or manipulates the electronic transaction program in which the actual data is processed, generated and processed. There is no protection against manipulation. As a result, it is expected that hackers will continue to attack the program itself, which conducts electronic transactions based on the Internet, and thus, malicious attacks and attacks by hackers, such as modifications of data and processing methods, on specific programs executed on the Internet. Defensive measures are really needed.

 The present invention was created in order to solve the problems inherent in the prior art as described above, the object of the present invention is to block the malicious access of hackers when executing the e-commerce program based on the Internet, the e-commerce An object of the present invention is to provide an Internet site security system and method for preventing modification of specific data and processing methods on an executable file or a memory of a program.

According to an aspect of the present invention for achieving the above object, there is provided an Internet site security system: a browser for executing a browser for providing a work performing environment on the Internet site according to user selection An execution module; A memory protection module configured to prevent access from an external module to a memory area allocated to the browser according to the execution of the browser, and to detect whether the memory area has been tampered with and whether the execution code has been manipulated; And a browser protection module that prevents debugging from another process or module for the browser execution module according to the execution of the browser, and selects an allowable module and an unallowable module among a plurality of modules loaded in the memory area. Characterized in that.

Preferably, the browser execution module is characterized in that for executing the browser in accordance with the user's selection in the user's connection to the Internet site.

Preferably, the browser execution module is characterized in that for executing the browser according to the user's selection before the user's access to the Internet site.

Advantageously, the memory protection module applies API hooking techniques on a user level and a kernel level to prevent access from other processes or modules to the memory area allocated to the browser. It is characterized by.

Advantageously, the memory protection module monitors a dictionary attack that includes process-wide access to the memory area allocated to the browser, according to a predetermined setting cycle, to thereby perform another process on the memory area allocated to the browser. Or preventing access from the module.

Preferably, the memory protection module performs file validation using an error verification algorithm on a plurality of modules loaded in a memory area allocated to the browser according to a predetermined setting period, thereby performing a file validation on the plurality of modules. It is characterized by detecting whether the modulation.

Preferably, the memory protection module detects whether a code is manipulated for a plurality of modules loaded in the memory area according to execution of the browser based on data that can be confirmed as an original and data that can be verified for authentication and integrity. It is characterized by.

Preferably, the memory protection module, the source code based on the data that can be confirmed that the original including the CRC, signature information and hash value for the plurality of modules loaded in the memory area and the data capable of authentication and integrity check And comparing code information of a plurality of modules loaded in the memory area according to execution of the browser, and detecting whether a code operation is performed on the plurality of modules.

Preferably, the browser protection module, in real time based on the allowable module of the plurality of modules loaded in the memory area on the basis of a white list that pre-stores a list of allowable modules among the plurality of modules loaded according to the execution of the browser. And if a specific module not included in the white list exists in the memory area, the user is notified of this.

Preferably, the browser protection module checks whether a specific module is included in the disallowable module list based on a black list that pre-stores a disallowable module list among a plurality of modules loaded according to the execution of the browser. Characterized in that the notification.

Preferably, the browser protection module checks whether a specific module is included in the unacceptable module list based on a black list that pre-stores the unacceptable module list among a plurality of modules loaded in real time according to the execution of the browser. It is characterized by blocking the module.

Preferably, the browser protection module inserts predetermined code inside the browser to prevent grasp of the data processing method of the browser, thereby making it difficult to debug from another process or module for the browser execution module. Characterized in that.

Preferably, the browser protection module performs a virtualization process on predetermined code executed in the browser to prevent debugging from another process or module for grasping the data processing method of the browser. .

Preferably, the browser protection module performs code virtualization and packing operations on the browser execution module to prevent reverse engineering of the browser execution module when the browser is executed.

According to yet another aspect of the present invention, there is provided a method for securing an Internet site, the method comprising: a) executing, by a browser execution module, a browser for providing a work performing environment on the Internet site according to user selection; b) in accordance with the browser execution, preventing the memory protection module from accessing another process or module to a memory area allocated to the browser; c) at the same time as the step b), checking, by the memory protection module, whether to modulate a plurality of modules loaded in the memory area according to performing a specific task on the Internet site; And d) at the same time as step c), the browser protection module prevents debugging from another process or module for the browser execution module, and real-time the allowable module and the unacceptable module among the plurality of modules loaded in the memory area. It characterized in that it comprises a step of screening.

Preferably, the step a) is characterized in that for executing the browser according to the user's selection in the user's access to the Internet site.

Preferably, the step a) is characterized in that the browser is executed according to the user's selection before the user accesses the Internet site.

Advantageously, step b) applies an API hooking technique on a user level and a kernel level to prevent access from other processes or modules to the memory area allocated to the browser. It is characterized by.

Advantageously, step b) monitors a dictionary attack that includes process-level access to the memory area allocated to the browser, according to a predetermined set period, to thereby perform another process on the memory area allocated to the browser. Or preventing access from the module.

Preferably, the step c) performs file validation using an error verification algorithm on a plurality of modules loaded in a memory area allocated to the browser according to a predetermined setting period, thereby performing It is characterized by detecting whether the modulation.

Preferably, step c) detects whether a code is manipulated for a plurality of modules loaded in the memory area according to execution of the browser based on data that can be confirmed as an original and data that can be authenticated and verified. It is characterized by.

Preferably, the step c) is based on the original data based on the data that can be confirmed that the original including the CRC, signature information and hash value for the plurality of modules loaded in the memory area and the data capable of authentication and integrity check And comparing code information of a plurality of modules loaded in the memory area according to execution of the browser, and detecting whether a code operation is performed on the plurality of modules.

Preferably, the step d) is to insert a predetermined code in the browser to prevent the grasp of the data processing method of the browser, to prevent debugging from another process or module for the browser execution module. It is characterized by.

Preferably, the step d) is to perform a virtualization process for a predetermined code executed in the browser, characterized in that to prevent debugging from another process or module for identifying the data processing method of the browser. .

Preferably, the step d), d-1) the allowable target among the plurality of modules loaded in the memory area based on a white list which previously stores a list of allowable target modules among the plurality of modules loaded according to the execution of the browser. Selecting a module in real time; d-2) notifying the user of a specific module that is not included in the white list in the memory area; d-3) checking whether a specific module not included in the white list is included in the unacceptable module list based on a black list that pre-stores a list of unacceptable modules among a plurality of modules loaded according to execution of the browser; ; And d-4) notifying the user when the specific module is included in the disallowable module list and terminating the browser.

Preferably, the step d), d-5) if the specific module included in the unacceptable module is loaded in real time, further comprising the step of blocking the specific module loaded in real time; .

The Internet site security system and method according to the present invention manages a list allowing or blocking a load on its own process, and inspects the list during execution to provide reliability for the operation of the process. It can provide an electronic transaction based environment.

In addition, the Internet site security system and method according to the present invention provides an electronic transaction-based environment that is safe from external script manipulation and attack by blocking without providing an interface to scripts generally provided in an electronic transaction system of a web environment. Can provide.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a schematic structural diagram of an Internet site security system according to an embodiment of the present invention.

As shown in FIG. 1, the system includes a browser execution module 100 that provides a browser for a web-based electronic transaction; A memory protection module 200 for protecting a memory area allocated to the browser; And a browser protection module 300 for selecting a target module to be loaded according to the protection of the browser execution module 100 and the browser execution.

The browser execution module 100 executes a browser that provides a work execution environment on an Internet site for electronic transactions according to user selection. At this time, the browser execution module 100 executes the browser according to the user's selection in the state of accessing the Internet site of the user, or executes the browser according to the user's selection after accessing the Internet site of the user.

The memory protection module 200 prevents access from another process or module to a memory area allocated to the browser according to browser execution through the browser execution module 100. More specifically, the memory protection module 200 applies an API hooking technique on a user level and a kernel level to prevent access from other processes or modules to a memory area allocated to the browser. do. In addition, the memory protection module 200 monitors the memory area allocated to the browser according to a predetermined setting period and monitors whether there is a dictionary attack from an external module including an open process hooking and a service table entry change. To prevent access.

In addition, the memory protection module 200 detects whether a plurality of modules loaded in the memory area are tampered with and execution code manipulation according to a user's specific work on the Internet site. More specifically, the memory protection module 200 performs file validation using an error verification algorithm on a plurality of modules loaded in the memory area allocated to the browser according to a predetermined setting period, thereby loading the memory area in the memory area. Detect whether to modulate multiple modules. In addition, the memory protection module 200 detects whether a code is manipulated for a plurality of modules loaded in the memory area according to the execution of the browser based on data that can be confirmed as an original and data information that can be authenticated and integrity checked. do. For example, based on data that can be identified as an original including CRC, signature information, hash values, etc. of a plurality of modules loaded in a memory area, and data capable of authentication and integrity verification, By comparing the code information of the plurality of modules loaded in the memory area, it is possible to detect whether the code operation for the plurality of modules loaded in the memory area.

The browser protection module 300 prevents another process or module from attempting to debug the browser execution module 100 when the browser is executed through a debugging protection function. For example, the browser protection module 300 adds predetermined code to prevent or make debugging difficult in the browser, so as to understand the data processing method of the browser through debugging during or before the electronic transaction through the browser. Makes it difficult. In addition, the browser protection module 300 performs virtualization on all or some important codes executed in the browser, so that the browser does not check the original code of the important browser so as to grasp the data processing method of the browser. Can be prevented.

In addition, the browser protection module 300 performs a code virtualization and packing operation on the browser execution module, thereby attempting to analyze the module according to reverse engineering of the browser execution module 100 when the browser is executed. prevent.

In addition, the browser protection module 300 sorts in real time the allowable module and the disallowable module among modules loaded while the browser is running. More specifically, the browser protection module 300 includes a white list which pre-stores a list of allowable modules among modules loaded in real time according to execution of the browser, and compares the white list with modules loaded in the memory area. In addition, the allowable modules are screened in real time. In this case, the browser protection module 300 notifies the user of a specific module not included in the white list in the memory area, thereby notifying that a module other than the allowable module among the modules loaded in the memory area exists. In addition to the white list, the browser protection module 300 further includes a black list that pre-stores a list of unacceptable modules among modules loaded according to the execution of the browser. Based on this, the browser protection module 300 compares a black list with a module other than the selected allowable module to check whether the module is applicable to the unacceptable module, and warns the user if it is included in the unacceptable module list. , And quit any running browsers. In addition, the browser protection module 300 blocks a specific module loaded in the memory area in real time when it corresponds to an unacceptable list.

In addition, the browser protection module 300 further includes a web page manipulation prevention function in addition to the above-described protection function for the browser execution module 100, thereby preventing another process or module from manipulating the web page being accessed by the user. .

Hereinafter, a method for securing an Internet site according to an embodiment of the present invention will be described with reference to FIG. 2. 2 is a schematic flowchart illustrating an internet site security method according to an embodiment of the present invention.

First, a browser for providing a work execution environment on the Internet site is executed according to a user's selection (S100). Preferably, the browser execution module 100 executes a browser that provides a work execution environment on an Internet site for electronic transactions according to user selection. At this time, the browser execution module 100 executes the browser according to the user's selection in the state of accessing the Internet site of the user, or executes the browser according to the user's selection after accessing the Internet site of the user. Here, when the user does not choose to run the browser, it is preferable to provide an environment for performing work on an Internet site through an existing general browser.

Thereafter, according to the execution of the browser, access from another process or a module to the memory area allocated to the browser is prevented (S200). Preferably, the memory protection module 200 prevents access from other processes or modules to the memory area allocated to the browser as the browser executes through the browser execution module 100. More specifically, the memory protection module 200 applies an API hooking technique on a user level and a kernel level to prevent access from other processes or modules to a memory area allocated to the browser. do. In addition, the memory protection module 200 monitors whether a process-level dictionary attack including an Open Process hooking and a service table entry change is performed on a memory area allocated to the browser according to a predetermined setting period, thereby allowing other processes or modules to be monitored. Access from can be prevented.

In addition, as a specific task performed on the Internet site, it is checked whether the plurality of modules loaded in the memory area is modulated (S300). Preferably, the memory protection module 200 checks whether or not the plurality of modules loaded in the memory area is modulated according to a user's specific work on the Internet site. More specifically, the memory protection module 200 performs file validation using an error verification algorithm on a plurality of modules loaded in the memory area allocated to the browser according to a predetermined setting period, thereby loading the memory area in the memory area. Detect whether to modulate multiple modules. In addition, the memory protection module 200 detects whether a code is manipulated for a plurality of modules loaded in the memory area according to the execution of the browser based on data that can be confirmed as an original and data that can be verified for authentication and integrity. do. For example, based on data that can be identified as an original including CRC, signature information, hash values, etc. of a plurality of modules loaded in a memory area, and data capable of authentication and integrity verification, By comparing the code information of the plurality of modules loaded in the memory area, it is possible to detect whether the code operation for the plurality of modules loaded in the memory area.

In addition, according to the browser execution, debugging from other processes or modules for the browser execution module 100 is prevented (S400). Preferably, the browser protection module 300 prevents another process or module from attempting to debug the browser execution module 100 when the browser is executed through the debugging protection function. For example, the browser protection module 300 adds some code inside the browser to prevent or make debugging difficult, thereby making it difficult to understand the data processing method of the browser through debugging before or during the execution of the browser. In addition, the browser protection module 300 performs virtualization on all or some important codes executed in the browser, so that the browser does not check the original code of the important browser so as to grasp the data processing method of the browser. Can be prevented.

In addition, according to the execution of the browser, the allowable module and the unacceptable module are selected in real time from the plurality of modules loaded in the memory area (S500). Preferably, the browser protection module 300 identifies the modules loaded while the browser is running, and selects the allowable and unacceptable modules in real time from among the plurality of modules loaded in the memory area. That is, as shown in FIG. 3, the browser protection module 300 is based on the white list which stores a list of allowable modules among a plurality of modules loaded in real time according to the execution of the browser. By comparing a plurality of modules loaded in the area, the allowable module is selected in real time (S510-S530). In this case, if all of the modules loaded in real time are all the allowable modules, the execution of the browser is continued (S540), and the browser protection module 300 does this when a specific module not included in the white list exists in the memory area. By notifying the user, it informs that a module other than the allowable module exists among the modules loaded in the memory area. In addition, the browser protection module 300 compares the black list and the module based on a black list which previously stores a list of the unacceptable modules among the plurality of modules loaded according to the execution of the browser, thereby determining whether the module corresponds to the unacceptable module. Check (S550). At this time, if a module other than the allowable module is included in the list of unacceptable modules, the user is warned of this and the running browser is terminated and the module is blocked from being loaded into the memory area (S560-S570).

Although the present invention has been described in detail with reference to the preferred embodiments, the present invention is not limited to the above-described embodiments, and the present invention belongs to the present invention without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

Internet site security system and method according to the present invention is to overcome the disadvantages of the existing e-commerce environment that had to be vulnerable to security due to the openness and vulnerability of the program in the existing web environment in that it provides a secure e-commerce system It is an invention that has industrial applicability because not only the use of the related technology but also the possibility of marketing or operating the applied device as well as the practically obvious implementation can be achieved by exceeding the limitation of the existing technology.

The following drawings, which are attached in this specification, illustrate preferred embodiments of the present invention, and together with the detailed description of the present invention, serve to further understand the technical spirit of the present invention. It should not be construed as limited to.

1 is a schematic configuration diagram of an Internet site security system according to an embodiment of the present invention.

2 and 3 is a schematic flowchart illustrating a method for securing an Internet site according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

100: browser execution module

200: memory protection module

300: browser protection module

Claims (26)

In the Internet site security system, A browser execution module for executing a browser for providing a work execution environment on the Internet site according to a user selection; A memory protection module configured to prevent access from an external module to a memory area allocated to the browser according to the execution of the browser, and to detect whether the memory area has been tampered with and whether the execution code has been manipulated; And A browser protection module that prevents debugging from another process or module for the browser execution module according to the execution of the browser, and selects an allowable module and an unallowable module among a plurality of modules loaded in the memory area; Internet site security system, characterized in that. The method of claim 1, wherein the browser execution module, And launching the browser according to the user's selection while the user is connected to the internet site. The method of claim 1, wherein the browser execution module, And launching the browser according to the user's selection prior to the user's access to the internet site. The memory protection module of claim 1, wherein Applying an API hooking technique on a user level and a kernel level to prevent access from other processes or modules to the memory area allocated to the browser. The memory protection module of claim 1, wherein In accordance with a predetermined setting period, a dictionary attack including process-level access to the memory area allocated to the browser is monitored to prevent access from other processes or modules to the memory area allocated to the browser. Internet site security system. The memory protection module of claim 1, wherein According to a predetermined setting period, the file validation using an error verification algorithm is performed on a plurality of modules loaded in the memory area allocated to the browser to detect whether the plurality of modules have been tampered with. Security system. The memory protection module of claim 1, wherein And detecting code manipulation for a plurality of modules loaded in the memory area according to execution of the browser, based on data that can be verified as an original and data that can be authenticated and verified. The method of claim 7, wherein the memory protection module, The memory area according to the execution of the original code and the browser based on data that can be identified as an original including CRC, signature information, and hash values for a plurality of modules loaded in the memory area, and data that can be authenticated and integrity verified And comparing code information of a plurality of modules loaded on the module, and detecting whether the code has been manipulated for the plurality of modules. The method of claim 1, wherein the browser protection module, Based on the white list which previously stores a list of allowable modules among the plurality of modules loaded according to the execution of the browser, the allowable modules among the plurality of modules loaded in the memory area are selected in real time, and the white list is displayed in the memory area. If there is a specific module that is not included in the Internet site security system, characterized in that notifying the user. The method of claim 9, wherein the browser protection module, Internet site security system, characterized in that notified to the user by checking whether a specific module is included in the list of unacceptable modules based on a black list that pre-stores a list of unacceptable modules among the plurality of modules loaded according to the execution of the browser . The method of claim 9, wherein the browser protection module, Based on a black list that stores a list of the disallowable modules among a plurality of modules loaded in real time according to the execution of the browser, the Internet checks whether a specific module is included in the disallowable module list and blocks the module. Site security system. The method of claim 1, wherein the browser protection module, And inserting predetermined code into the browser to prevent grasp of the data processing method of the browser, making debugging from other processes or modules of the browser execution module difficult. The method of claim 1, wherein the browser protection module, And performing virtualization processing on predetermined code executed in the browser to prevent debugging from another process or module for identifying a data processing method of the browser. The method of claim 1, wherein the browser protection module, Performing code virtualization and packing operations on the browser execution module to prevent reverse engineering of the browser execution module when the browser is executed. In the Internet site security method, a) executing, by the browser execution module, a browser for providing a work performing environment on the Internet site according to a user selection; b) in accordance with the browser execution, preventing the memory protection module from accessing another process or module to a memory area allocated to the browser; c) at the same time as the step b), checking, by the memory protection module, whether to modulate a plurality of modules loaded in the memory area according to performing a specific task on the Internet site; And d) At the same time as step c), the browser protection module prevents debugging from other processes or modules for the browser execution module, and in real time the allowable module and the unacceptable module among the plurality of modules loaded in the memory area. Selecting; Internet site security method comprising a. The method of claim 15, wherein step a) And executing the browser according to the user's selection while the user is connected to the internet site. The method of claim 15, wherein step a) And executing the browser according to the user's selection before the user accesses the internet site. The method of claim 15, wherein b), Applying an API hooking technique on a user level and a kernel level to prevent access from other processes or modules to the memory area allocated to the browser. The method of claim 15, wherein b), In accordance with a predetermined setting period, a dictionary attack including process-level access to the memory area allocated to the browser is monitored to prevent access from other processes or modules to the memory area allocated to the browser. How to secure your Internet site. The method of claim 15, wherein step c) According to a predetermined setting period, the file validation using an error verification algorithm is performed on a plurality of modules loaded in the memory area allocated to the browser to detect whether the plurality of modules have been tampered with. Security method. The method of claim 15, wherein step c) And detecting code manipulation for a plurality of modules loaded in the memory area according to execution of the browser based on data that can be identified as an original and data that can be authenticated and verified. The method of claim 21, wherein step c) The memory area according to the execution of the original code and the browser based on data that can be identified as an original including CRC, signature information, and hash values for a plurality of modules loaded in the memory area, and data that can be authenticated and integrity verified And comparing code information of a plurality of modules loaded on the module, and detecting whether the code has been manipulated for the plurality of modules. The method of claim 15, wherein the d) step, And inserting predetermined code into the browser to prevent grasp of the data processing method of the browser, thereby preventing debugging from another process or module for the browser execution module. The method of claim 15, wherein the d) step, Performing a virtualization process on predetermined code executed in the browser to prevent debugging from another process or module for identifying a data processing method of the browser. The method of claim 15, wherein the d) step, d-1) selecting, in real time, an allowable module of a plurality of modules loaded in the memory area based on a white list which previously stores a list of allowable modules among a plurality of modules loaded according to execution of the browser; d-2) notifying the user of a specific module that is not included in the white list in the memory area; d-3) checking whether a specific module not included in the white list is included in the unacceptable module list based on a black list that pre-stores a list of disallowable modules among a plurality of modules loaded according to execution of the browser; And d-4) if the specific module is included in the disallowable module list, notifying the user and terminating the browser. The method of claim 25, wherein step d) d-5) when the specific module included in the disallowable module is loaded in real time, blocking the specific module loaded in real time.

Images