KR100985047B1 - System and method for thread scheduling - Google Patents

Abstract

The present invention discloses a thread scheduling system for protecting user tasks in a computer operating environment. That is, a thread detection module that selects essential threads from all threads existing in the computer operating environment to protect the user task; And a thread execution module configured to stop execution of the entire thread excluding the selected essential thread and to execute only the selected essential thread as the user's work progresses. While performing certain tasks that need to be done, other programs that are not essential to the user's task are not distinguished from normal or not, and whether or not it is essential to the user can be suspended to suspend all that is not necessary.

Thread, Scheduling

Description

Thread Scheduling System and Its Method {SYSTEM AND METHOD FOR THREAD SCHEDULING}

The present invention is to protect user tasks in a computer operating environment, and more particularly, to suspend all processes except the essential processes required for user tasks to protect user tasks, and thus for user tasks including Internet banking. A thread scheduling system and method for enhancing security are provided.

Today, with the development of the Internet, information is exchanged in various ways through numerous homepages, internet search, internet community, online newspapers, and online games.

In recent years, beyond the exchange of information, many things that had to be done in person, such as Internet banking, Internet securities trading, and Internet offices, had to be handled in person by hand. Because of its direct connection, it has been the target of crackers for the purpose of increasing crime.

In this regard, various anti-hacking techniques are known as techniques for protecting user operations from the above-mentioned crackers attack.

For example, there is a signature-based method of detecting malicious codes such as keystrokes or spyware. This method is the same as the conventional method of responding to a virus. When a sample of an attack tool is obtained, the sample is almost completely completed. Can cope

In addition, a keyboard security program may be exemplified. This is a security program for disabling a key logger intercepting a user's ID and password, and protects a section between the keyboard and a protected program by an encryption method. .

In addition, another method commonly used in the financial sector is a personal firewall, which is used to identify externally connected programs and to block external attacks while the protected program is running.

On the other hand, there are other methods of process protection such as anti-debugging to protect limited programs such as games, and moreover, the above-mentioned measures are applied in combination to protect user operations related to money.

The prior art as described above applies signature-based and host-based protection schemes to find anomalies existing in the system or to respond to known vulnerabilities. do. However, it is difficult to respond to signature-based methods in the case of malicious codes that cause self-mutation or target specific people, and in the case of host-based protection methods, the attack method is slightly changed or newly discovered threats are difficult to cope with. There is.

Moreover, in the case of the other protection methods described above, it is virtually impossible to distinguish the normal state with respect to the operation occurring in the system, and thus, the application range is extremely limited. For example, there may be an attack that modifies the account number or recipient ID loaded in the memory during recently discovered Internet banking or game item transaction. That is, the conventional protection method is difficult to cope with the various problems caused by the attack, since it is not possible to distinguish whether or not the normal operation for the memory modification caused by such an attack.

In other words, the above-described prior art is a method of blacklist concept that individually corresponds to known security loopholes, and it is not possible to defend normally to unknown methods, difficult to identify similar to the normal flow of programs, and future cracking methods. There is a problem.

 The present invention was created to solve the problems inherent in the prior art as described above, and an object of the present invention is to select and control specific threads existing in a computer operating environment to classify processes essential for user operations, and to classify essential The present invention provides a thread scheduling system and a method for stopping all processes except user processes during user working hours.

According to an aspect of the present invention for achieving the above object, there is provided a thread scheduling system for protecting user work in a computer operating environment: the system is present in the computer operating environment for protecting the user work A thread detection module for selecting required threads among all the threads; And a thread execution module configured to stop execution of the entire thread excluding the selected essential thread and to execute only the selected essential thread as the user operation proceeds.

Preferably, the system further comprises a modulation confirmation module for identifying and restoring a modulated module from among a plurality of modules called by the selected essential thread;

Preferably, the thread detection module, characterized in that the selected thread, including the thread having the necessary process for providing the computer operating environment and the thread of the application for the user task of the searched total threads. do.

Preferably, the thread detection module includes a plurality of modules loaded into memory by the required process and the application and the white list based on a white list that previously stores a list of specific modules called by the required thread. The essential threads are selected by checking whether they match with a specific stored module list.

Preferably, the thread detection module is characterized in that to search the entire thread existing in the computer operating environment based on the list of threads provided by the kernel thread scheduler of the computer operating environment.

Preferably, the thread execution module calls a specific function provided by a computer operating system to stop execution of the entire thread except the selected required thread.

Preferably, the thread execution module is configured to suspend execution of all threads except the selected essential threads by excluding the thread list from the list of kernel thread schedulers.

Advantageously, the tamper check module identifies a modulated module based on the signature information and hash values of the plurality of modules invoked by the selected mandatory thread, and specifies a modulated module in memory as the user progresses. It is characterized in that whether the plurality of modules including the module is loaded in the same memory.

Preferably, the modulation confirmation module, if a particular module of the plurality of modules is not loaded in the memory, the module (Backup) is characterized in that for recovering the original module.

Preferably, the modulation confirmation module, checks the modulation state of the Interrupt Descriptor Table (IDT), the System Service Dispatch Table (SSDT), and the Driver 'I / O Request Packet Function Table (IRPFT) generated by the original module And restore the original table existing in the original module.

Preferably, the modulation confirmation module, when the user operation is stopped, characterized in that for converting the module restored to the original to the backup module.

According to another aspect of the present invention, there is provided a thread scheduling method for protecting a user's work in a computer operating environment, the method comprising: a) retrieving all threads present in the computer operating environment; b) selecting required threads among the searched total threads to protect the user task; c) stopping execution of the entire thread except the selected required thread; d) identifying a modulated module among a plurality of modules loaded in a memory as the user's work progresses and restoring the original; And e) re-running the thread whose execution has been stopped according to the stopping of the user's work.

Preferably, the step a) is characterized in that the search for the entire thread existing in the computer operating environment based on the thread list provided by the kernel thread scheduler of the computer operating environment.

Preferably, the step b) is characterized in that for selecting the required threads including the threads of the process for the computer operating environment and the thread for the user task of the searched total threads.

Preferably, the step b) is based on a white list pre-stored a list of specific modules called by the required thread, the plurality of modules and the white list loaded in the memory by the required process and the application. The essential threads are selected by checking whether they match with a specific stored module list.

Preferably, step c) is characterized in that, by calling a specific function provided by the computer operating system to stop the execution of the entire thread except the selected required thread.

Preferably, the step c) is to exclude the thread list from the list of kernel thread schedulers of the computer operating environment to stop execution of all threads except the selected essential threads.

Advantageously, step d) identifies a modulated module based on the signature information and hash values of the plurality of modules called by the selected mandatory thread and is loaded into the memory as the user progresses. It is characterized by checking whether a plurality of modules called by a specific module and a required thread are equally loaded in the memory.

Preferably, step d) is characterized in that, if a particular module of the plurality of modules is not loaded identically in the memory, the module is backed up and the original module is restored.

Preferably, the step d) is to check the modulation state of the Interrupt Descriptor Table (IDT), the System Service Dispatch Table (SSDT), and the Driver 'I / O Request Packet Function Table (IRPFT) generated by the original module. And restore the original table existing in the original module.

Preferably, the step e), as the user task is finished, characterized in that for converting the module restored to the original to the backup module.

According to yet another aspect of the present invention, there is provided a thread scheduling method for protecting a user's work in a computer operating environment, the method comprising: a) searching for an entire thread present in the computer operating environment; B) selecting a mandatory thread among the searched total threads to protect the user task; C) stopping execution of the entire thread and rerunning only the selected essential threads of the suspended total threads; Identifying a modulated module among a plurality of modules loaded in a memory as the user's work progresses and recovering the original module; And e) re-running the thread whose execution has been stopped according to the stopping of the user's work.

Preferably, the step a) includes searching for the entire thread existing in the computer operating environment based on a list of threads provided by a kernel thread scheduler of the computer operating environment.

Preferably, the step b) selects the mandatory threads including the threads of the found process and the threads of the application for the user's task.

Preferably, the step b) includes a plurality of modules and the white list loaded in the memory by the required process and the application based on a white list which previously stores a list of specific modules called by the required thread. The essential thread is selected by checking whether the list matches a specific module stored in the list.

Preferably, the step c) includes calling a specific function provided by a computer operating system to stop execution of the entire thread, and re-executing only the selected essential threads among all the threads that are suspended. .

Preferably, the step c) stops the execution of the entire thread by excluding the thread list from the list of kernel thread schedulers of the computer operating environment, and adds only the selected required thread list to the kernel thread scheduler list. It is characterized by re-execution.

Preferably, the step d) identifies a modulated module based on the signature information and the hash value of the plurality of modules called by the selected required thread, and is loaded into memory according to the progress of the user operation. It is characterized by checking whether a module and a plurality of modules called by the required thread are loaded in the same memory.

Preferably, the step d) may include backing up the corresponding module and restoring the original module when a particular module of the plurality of modules is not loaded in the memory.

Preferably, the step d) confirms a modulation state of an Interrupt Descriptor Table (IDT), a System Service Dispatch Table (SSDT), and a Driver 'I / O Request Packet Function Table (IRPFT) generated by the original module. And restore the original table existing in the original module.

Preferably, the step e), as the user task is terminated, converts the corresponding module restored to the original into the backed up module.

The thread scheduling system and method thereof according to the present invention do not distinguish whether other programs that are not essential to user tasks are normal while the user performs a specific task requiring high security such as Internet banking. In addition, it can remove all hooks such as SDT and IDT installed by the cracking code by activating the protection function just before starting the user work by pausing all the non-essentials by distinguishing whether it is essential to the user or not.

Also, because all threads are suspended, the cracking code won't even get a chance to reinstall the hook. Thus, it is possible to ensure that unreliable hooks do not work while a user operation is taking place.

In addition, by executing only the threads necessary for the user's work, it can block attacks by hacking code that is virtually impossible to identify and operate similar to the operation of general programs such as memory manipulation.

In addition, even if malicious code that is prepared to attack a protected process, such as spyware or keylogger, is executed in the system, the execution is stopped while the user's work is performed, thereby protecting the user's work.

In addition, by suspending all non-essential programs, the cracking code is also paused, and the user's work such as Internet banking is secured while this state is maintained.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a schematic structural diagram of a thread scheduling system according to an embodiment of the present invention.

As shown in FIG. 1, the system includes a thread detection module 100 for selecting a specific thread among all threads allocated to a plurality of processes created in a computer operating environment; A thread execution module 200 for determining an execution state of a specific thread selected by the thread detection module 100; And a modulation confirmation module 300 for identifying a modulated module among a plurality of modules called by the required threads selected by the thread detection module 100. For reference, all threads existing in the computer operating environment are generated by being allocated to a plurality of processes created for various purposes by the operating system, and are mixed with threads generated by a general application and managed as a single queue. In addition, a thread corresponding to a specific process is allocated a processing time of a CPU according to the quantity, and is processed in a multi-task format.

The thread detection module 100 selects an essential thread from all the threads present in the computer operating environment in order to protect a user operation in a computer operating environment, for example, a specific job requiring high security such as Internet banking. That is, the thread detection module 100 searches the entire threads allocated to a plurality of processes created for various purposes in the computer operating environment, and selects only the necessary threads necessary for the user's work among the found total threads.

To this end, the thread detection module 100 enumerates all the threads present in the computer operating environment by using a specific function provided by the computer operating system, for example, an API (Application Programming Interface) function. Preferably, the thread detection module 100 searches the entire thread by directly searching the list provided by the kernel thread scheduler, instead of the specific function provided by the operating system, to find the hidden thread.

In addition, the thread detection module 100 refers to a white list that previously stores a list of specific modules called by the required threads, and selects only the necessary threads required for user operations among all threads existing in the computer operating environment. More specifically, the thread detection module 100 selects a mandatory thread from all threads by checking whether the plurality of modules loaded into the memory by the mandatory thread matches a specific module list previously stored in the white list. At this time, the required threads to be selected include a thread of the essential process for providing the computer operating environment and a thread of the application for the user task.

The thread execution module 200 suspends execution of the entire thread excluding the required thread selected by the thread detection module 100, and executes only the selected required thread as the user task progresses. Only when it stops or terminates will the thread resume execution.

To this end, the thread execution module 200 calls a function included in an API function provided by the computer operating system, for example, a 'Suspend Thread' function, so that the operating system includes all of the threads except the required threads selected by the thread detection module 100. Suspend execution of a thread.

Alternatively, the thread execution module 200 excludes the thread list from the list of kernel thread schedulers to prevent the hacking operation of a specific hacking program that recognizes the call of the 'Suspend Thread' function. Stop execution of all threads except.

On the other hand, the thread execution module 200, unlike stopping the execution of all the threads except the selected mandatory thread, the execution of the entire thread, the method of re-executing only the selected mandatory thread of the suspended all threads Application is also possible.

The modulation confirmation module 300 checks the modulated module among the plurality of modules called by the selected essential thread and restores it to the original.

More specifically, the modulation verification module 300 identifies the modulated module based on the signature information and hash values of the plurality of modules loaded in the system or called by the selected mandatory thread.

In addition, the modulation check module 300 checks whether the plurality of modules are identically loaded in the memory as the user progresses, and if a specific module among the plurality of modules is not identically loaded in the memory, the corresponding module Backup and restore the original module. In this case, specific modules that are not identical may be changed by a normal program such as a security program or an operating system, but are not related to the user's work to be protected, but even if the change is temporarily restored, the user's work is not affected.

In addition, the modulation check module 300 checks the modulation state of the Interrupt Descriptor Table (IDT), the System Service Dispatch Table (SSDT), and the Driver 'I / O Request Packet Function Table (IRPFT) generated by the original module, If a specific table has been tampered with, the table is restored to the original existing in the original module.

On the other hand, the tamper check module 300 waits for the execution of the user task, and when the user task is stopped, by converting the module restored to the original into a backup module, the computer operating environment before protecting the user task To recover.

Hereinafter, a method of generating original code of an execution image according to an embodiment of the present invention will be described with reference to FIG. 2. 2 is a schematic flowchart illustrating a method of generating original code of an execution image according to a first embodiment of the present invention.

First, the entire thread existing in the computer operating environment is searched for (S110). Preferably, the thread detection module 100 enumerates all the threads present in the computer operating environment using a specific function provided by the computer operating system, such as an API function, or the thread detection module 100 searches for a concealed thread. Instead of a specific function provided by the operating system, the entire thread is searched directly by searching the list provided by the kernel thread scheduler.

Then, the required thread is selected from all the searched threads to protect the user's work (S110). Preferably, the thread detection module 100 selects only the necessary threads required for the user's work among all the threads existing in the computer operating environment with reference to a white list which previously stores a list of specific modules called by the required threads. . More specifically, the thread detection module 100 selects required threads from all threads by checking whether the plurality of modules loaded in the memory by the required threads match a specific module list previously stored in the white list. At this time, the required threads to be selected include a thread of the essential process for providing the computer operating environment and a thread of the application for the user task.

Then, the execution of the entire thread except the selected required thread is stopped (S130). Preferably, the thread execution module 200 calls the 'Suspend Thread' function included in the API function provided by the computer operating system, for example, to execute the entire thread except the required threads selected by the thread detection module 100. Pause In addition, by excluding the thread list from the list of kernel thread schedulers in order to prevent a specific hacking program from recognizing the call of the 'Suspend Thread' function, the entire thread execution except the selected required threads is executed. Stops. On the other hand, the thread execution module 200 stops the execution of the entire thread, unlike stopping the entire thread except the essential thread selected as step 'S130', the selected required thread of the suspended all threads It is also possible to apply the method to rerun only. That is, the API function provided by the computer operating system is called to stop the execution of all threads, to re-execute only the selected required threads among all the threads that are stopped, or to list the threads in the list of kernel thread schedulers. By removing the entire thread, the execution of the entire thread can be stopped, and only the selected essential thread list can be added to the kernel thread scheduler list and executed again.

Then, the modulated module of the plurality of modules loaded into the memory is identified as the user's work progresses and is restored to the original (S140). Preferably, the modulation verification module 300 identifies the modulated module based on the signature information and hash values of the plurality of modules called by the selected mandatory thread. In addition, as a user progresses, it is checked whether a specific module loaded in the memory and a plurality of modules called by the required thread are loaded in the same memory. If it is not loaded, back up the module and restore the original module. In this case, specific modules that are not identical may be changed by a normal program such as a security program or an operating system, but are not related to the user's work to be protected, but even if the change is temporarily restored, the user's work is not affected. In addition, the modulation check module 300 checks the modulation state of the Interrupt Descriptor Table (IDT), the System Service Dispatch Table (SSDT), and the Driver 'I / O Request Packet Function Table (IRPFT) generated by the original module, If a specific table has been tampered with, the table is restored to the original existing in the original module.

Thereafter, the thread which is stopped in response to the user's work stop is re-executed (S150-S160). Preferably, the thread detection module 100 re-executes the entire thread excluding selected essential threads that are in the suspended state. In addition, the tamper check module 300 converts the module restored to the original into a backed up module, thereby restoring to the normal computer operating environment before the user's work.

Although the present invention has been described in detail with reference to the preferred embodiments, the present invention is not limited to the above-described embodiments, and the present invention belongs to the present invention without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

The thread scheduling system and method thereof according to the present invention do not need to identify hacking codes to protect the target, and can cope with unknown future hacking in that it overcomes the limitations of the existing technology. It is an invention that is industrially applicable because not only the use but also the possibility of commercialization or operation of the applied device is not only sufficient, but also practically obvious.

The following drawings, which are attached in this specification, illustrate preferred embodiments of the present invention, and together with the detailed description of the present invention, serve to further understand the technical spirit of the present invention. It should not be construed as limited to.

1 is a schematic block diagram of a thread scheduling system according to an embodiment of the present invention.

2 is a schematic flowchart illustrating a thread scheduling method according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

100: thread detection module

200: thread execution module

300: modulation check module

Claims (31)

A thread scheduling system for protecting user tasks in a computer operating environment, A thread detection module for selecting essential threads among all threads existing in the computer operating environment to protect the user work; And And a thread execution module configured to stop execution of the entire thread except the selected essential thread and to execute only the selected essential thread as the user operation proceeds. The thread detection module, Based on a white list which previously stores a list of specific modules called by the required thread, the required threads are selected from all threads by checking whether a plurality of modules loaded in the memory matches a list of modules stored in the white list. Thread scheduling system, characterized in that. The system of claim 1, wherein the system is And a modulation check module for checking a modulated module among the plurality of modules called by the selected essential thread and restoring it to the original. The method of claim 1, wherein the thread detection module, And selecting the required threads including the threads of the found process and the threads of the application for the user's work. delete The method of claim 3, wherein the thread detection module, And retrieving the entire thread existing in the computer operating environment based on a list of threads provided by a kernel thread scheduler of a computer operating environment. The method of claim 1, wherein the thread execution module, And calling a specific function provided by a computer operating system to stop execution of the entire thread except the selected required thread. The method of claim 1, wherein the thread execution module, The thread scheduling system of claim 1, wherein the thread list scheduler excludes the thread list from the kernel thread scheduler and stops the execution of all threads except the selected required threads. The method of claim 2, wherein the modulation confirmation module, The plurality of modules including a specific module is identified as a module modulated on the basis of the signature information and the hash value of the plurality of modules called by the selected mandatory thread, and is loaded into the memory as the user's operation proceeds. Thread scheduling system, characterized in that to check whether the same loading. The method of claim 8, wherein the modulation confirmation module, And if a particular module of the plurality of modules is not loaded in the memory identically, back up the corresponding module and restore the original module. 10. The method of claim 9, wherein the modulation confirmation module, An original table existing in the original module by checking the modulation state of an interrupt descriptor table (IDT), a system service dispatch table (SSDT), and a driver 'I / O request packet function table (IRPFT) generated by the original module. Thread scheduling system, characterized in that the recovery. The method of claim 10, wherein the modulation confirmation module, And when the user task is suspended, converting the corresponding module restored to the original into the backed up module. In the thread scheduling method for protecting user operations in a computer operating environment, a) retrieving entire threads residing in the computer operating environment; b) selecting required threads among the searched total threads to protect the user task; c) stopping execution of the entire thread except the selected required thread; d) identifying a modulated module among a plurality of modules loaded in a memory as the user's work progresses and restoring the original; And e) re-running the thread where execution has been suspended according to the stopping of the user's work; Step b) Based on a white list that stores a list of specific modules called by the required threads, the required threads are selected from all the threads by checking whether among the modules loaded in the memory match the list of specific modules already stored in the white list. Thread scheduling method, characterized in that. The method of claim 12, wherein step a) comprises: And retrieving the entire thread existing in the computer operating environment based on a list of threads provided by a kernel thread scheduler of a computer operating environment. The method of claim 12, wherein b), And selecting the mandatory threads among the searched total threads including the thread owned by an essential process for the computer operating environment and a thread included in an application for the user task. delete The method of claim 12, wherein step c) And calling a specific function provided by a computer operating system to stop execution of the entire thread except the selected required thread. The method of claim 12, wherein step c) Threading schedule method, characterized in that to stop the execution of the entire thread except the selected required thread by excluding the thread list from the list of kernel thread scheduler of the computer operating environment. The method of claim 12, wherein d) Identify the modulated module based on the signature information and the hash value of the plurality of modules called by the selected mandatory thread, and the number of called by the particular module and mandatory thread preloaded in the memory as the user progresses. Checking whether a module of the same is loaded in the memory. The method of claim 18, wherein the d) step, If a particular module of the plurality of modules is not the same in the memory, the thread scheduling method characterized in that the backup (Backup) the module and restore the original module. The method of claim 19, wherein step d) An original table existing in the original module by checking the modulation state of an interrupt descriptor table (IDT), a system service dispatch table (SSDT), and a driver 'I / O request packet function table (IRPFT) generated by the original module. Thread scheduling method characterized in that the recovery. The method of claim 20, wherein step e) And changing the module restored to the original to the backed up module as the user task ends. In the thread scheduling method for protecting user operations in a computer operating environment, A) searching for all threads that exist in the computer operating environment; B) selecting a mandatory thread among the searched total threads to protect the user task; C) stopping execution of the entire thread and rerunning only the selected essential threads of the suspended total threads; Identifying a modulated module among a plurality of modules loaded in a memory as the user's work progresses and recovering the original module; And E) re-running the thread where execution is suspended according to the user task suspension; Step b) above Based on a white list that stores a list of specific modules called by the required threads, the required threads are selected from all the threads by checking whether among the modules loaded in the memory match the list of specific modules already stored in the white list. Thread scheduling method, characterized in that. The method of claim 22, wherein the step a) And retrieving the entire thread existing in the computer operating environment based on a list of threads provided by a kernel thread scheduler of a computer operating environment. The method of claim 22, wherein b), And selecting the mandatory threads among the searched total threads including the thread owned by an essential process for the computer operating environment and a thread included in an application for the user task. delete The method of claim 22, wherein the step c) Calling a specific function provided by a computer operating system to stop execution of the entire thread, and re-executing only the selected essential thread among all the threads that are suspended. The method of claim 22, wherein the step c) Stopping the execution of the entire thread by excluding the thread list from the list of kernel thread scheduler of the computer operating environment, and re-running by adding only the selected list of essential threads to the kernel thread scheduler list. The method of claim 22, wherein the step d) Identify the modulated module based on the signature information and the hash value of the plurality of modules called by the selected required thread, and the specific module loaded in memory as the user's work progresses and the number called by the required thread Thread scheduling method, characterized in that to ensure that the module of the same is loaded in the memory. The method of claim 28, wherein step d) If a particular module of the plurality of modules is not the same in the memory, the thread scheduling method characterized in that the backup (Backup) the module and restore the original module. The method of claim 29, wherein the step d) An original table existing in the original module by checking the modulation state of an interrupt descriptor table (IDT), a system service dispatch table (SSDT), and a driver 'I / O request packet function table (IRPFT) generated by the original module. Thread scheduling method characterized in that the recovery. The method of claim 30, wherein the step e) And changing the module restored to the original to the backed up module as the user task ends.

Images