KR100994328B1 - Method and apparatus for program interception in using hash table - Google Patents

Abstract

Program blocking method using a hash table of the present invention, receiving the execution request signal of a specific program, if receiving the execution request signal, extracting the hash (HASH) information of the specific program, the extracted hash Determining whether the information is included in the pre-registered hash table, and if the extracted hash information is not included in the pre-registered hash table, blocking the execution of the specific program.

Hash, security, program blocking, hack

Description

Program blocking method and device using hash table {METHOD AND APPARATUS FOR PROGRAM INTERCEPTION IN USING HASH TABLE}

The present invention relates to a method and a device for blocking a program using a hash table, and more particularly, to determine whether or not the hash information of the program is included in a pre-registered hash table according to a request for executing a specific program to execute or block a program. The present invention relates to a method and apparatus for blocking a program using a hash table.

As the information age is accelerating today, computers are becoming the most important home appliances in our lives.

Due to the development of Internet technology, one or more computers can be shared and used, and a lot of interest is being amplified according to information sharing and blocking settings.

In particular, information stored on an individual's or company's computer may be leaked through hacking and exploiting complementary vulnerabilities in computer networks, and it often happens that users cannot use computers through viruses.

In recent years, in order to secure a problem, a security program or a blocking program is installed on a computer to prevent or block a hacking program or a virus program that is randomly performed.

The conventional blocking program or security program mainly uses a method of updating the blocking program information or the blocking site address, which stores the address of a site that is determined to be a hacking or a virus program or that is suspected to be a harmful site.

However, the above scheme has to store or update a very large amount in terms of the capacity of the blocking program, and there is a problem that a program desired by the user is randomly blocked.

The present invention has been made to solve the above problems of the prior art, and an object thereof is to provide a program blocking method and apparatus using a hash table that can block harmful programs or virus programs.

It is also an object of the present invention to provide a method capable of controlling to execute only a program registered in a hash table.

In addition, an object of the present invention is to provide a method that can be set in the hash table so that the user can block or execute the desired program.

In order to achieve the above object and to solve the above-mentioned problems of the prior art, the program blocking method using a hash table according to an embodiment of the present invention, receiving the execution request signal of a specific program, the execution request signal If received, extracting hash information of the specific program, determining whether the extracted hash information is included in a pre-registered hash table, and as a result of the determination, the extracted hash information is pre-registered. If not included in the hash table, the step of blocking the execution of the particular program.

The present invention may further include executing the specific program in response to a request for executing the specific program when the extracted hash information is included in a pre-registered hash table.

In order to achieve the above object and to solve the above-mentioned problems of the prior art, the program blocking method using a hash table according to an embodiment of the present invention, the receiving unit for receiving the execution request signal of a specific program, the execution request signal If received, the extraction unit for extracting the hash (HASH) information of the specific program, a determination unit for determining whether the extracted hash information is included in the pre-registered hash table and the extracted hash information as a result of the determination If it is not included in the registered hash table, the program execution control unit for blocking the execution of the specific program.

In addition, when the extracted hash information is included in a pre-registered hash table, the program execution control unit of the present invention executes the specific program according to the execution request of the specific program.

According to the present invention can block harmful programs or virus programs.

In addition, according to the present invention, it is possible to control to execute only a program registered in the hash table.

In addition, according to the present invention, the hash table may be set to block or execute a desired program.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings and the contents described in the accompanying drawings, but the present invention is not limited or limited to the embodiments.

On the other hand, in describing the present invention, when it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. Terminology used herein is a term used to properly express a preferred embodiment of the present invention, which may vary according to a user, an operator's intention, or a custom in the field to which the present invention belongs. Therefore, the definitions of the terms should be made based on the contents throughout the specification.

1 is a block diagram showing the configuration of a program blocking device using a hash table according to an embodiment of the present invention.

The program blocking device 100 using the hash table according to the present invention is based on a device using a hash function that converts a string into a value or key of a shorter length symbolizing the original one.

With reference to FIG. 1 and related exemplary drawings, the present invention will be described sequentially according to the flow of information.

First, the receiver 110 receives a signal for executing a specific program.

The user can execute various programs through the user terminal. In this case, the conventional blocking program blocks the registered harmful programs, whereas in the present invention, only the programs registered in the hash table can be executed.

That is, the program blocking device 100 of the present invention receives an execution request signal of a specific program that a user wants to execute among arbitrary programs.

Next, the extraction unit 120, when receiving the execution request signal, extracts the hash (HASH) information of the specific program.

Since the present invention determines whether to block or execute a specific program using a hash table in which hash information is stored, when a program execution request signal is received, hash information of the corresponding program is extracted.

This hash information may be that each of the sorted names is a key of individuals data in the database. The database search technique must start checking each name character by character until a match is found first. However, if each of the names is hashed, it is possible to generate a unique key, for example four digits for each name.

In this case, the user may pre-register one or more hash information in the hash table using the information register 150. That is, in the case of a frequently used program as in the previous example, the hash information may be registered in the hash table, so that the program may not be recognized as a blocking program later.

Next, the determination unit 130 determines whether the extracted hash information is included in the pre-registered hash table.

In the present invention, as described above, hash information of a non-harmful program that a user wants to execute without blocking is registered in a hash table inside the device, and hash information of the specific program extracted by the extracting unit 120. Determine whether it is included in the hash table.

Next, the program execution control unit 140 blocks the execution of the specific program when the extracted hash information is not included in the pre-registered hash table.

That is, the present invention extracts the hash information of the specific program from which the execution request signal is received through the extractor 120, and determines whether the extracted hash information exists in the hash table through the determiner 130. If not, the program execution control unit 140 may block the specific program.

In addition, when the extracted hash information is included in a pre-registered hash table, the program execution control unit 140 executes the specific program according to the execution request of the specific program.

To help understand the present invention, it will be described below with reference to FIGS.

2 is a diagram illustrating an example of determining whether a specific program is blocked according to an embodiment of the present invention.

As shown in FIG. 2, when the user receives the execution request signal for executing a specific program such as CMD or Explorer, a user API CreateProcess is called in the OS. At this time, the process intercepts and waits for the CreateProcess in the processor and extracts the hash information of the program based on the contents of the file that is actually requested.

That is, the user API may be in the form of a create process, but is not limited to the form.

Next, it is determined whether the extracted hash information is included in a pre-registered hash table, which may be performed through a kernel mode, which is a central execution control unit of the processor.

Next, the present invention may determine whether the extracted hash information is included in the pre-registered hash table of the processor, and execute only if present, and block if not present.

3 to 4, which is a related embodiment drawing of the present invention, it is easier to understand.

3 is a diagram illustrating an example in which a program is executed according to an embodiment of the present invention, and FIG. 4 is a diagram illustrating an example in which a program is blocked according to an embodiment of the present invention.

For example, when the execution request signal of the program 'test1.exe' is received as illustrated in FIG. 3, the present invention searches the hash table of the processor to determine whether the hash information of 'test1.exe' exists. Judge.

Next, the present invention allows and executes 'test1.exe' when the hash information of 'test1.exe' exists in the hash table as shown in FIG.

However, as shown in FIG. 4, when the execution request signal of the program 'test2.exe' is received, the execution of 'test2.exe' is blocked because the 'test2.exe' does not exist in the hash table. do.

Also, when the extracted hash information is not included in the registered hash table as a result of the determination by the determination unit 120 through the message output unit 160, whether the extracted hash information is registered in the hash table. You can also output a message to query whether or not.

5 is a diagram illustrating a screen on which a message for determining whether to register hash information is sent according to an embodiment of the present invention.

For example, in the present invention, if the program is blocked because the hash information of the specific program is not registered in the hash table, as shown in FIG. 5, a message is transmitted to ask whether to register the hash information of the blocked program. do.

At this time, if the user wants to register the blocked program, the user may register by pressing a confirmation button.

That is, when the user determines to register, the receiver 110 receives a signal for requesting registration of the extracted hash information in the hash table according to the query message, and the information register 150 receives the signal according to the registration request signal. The extracted hash information may be registered in the hash table.

The present invention provides a method of determining whether to block a program using a hash table, which will be described sequentially with reference to FIGS. 6 to 7.

In this case, since the method corresponds to a program blocking device using a hash table, since the method includes all the functional elements of the device, a detailed description thereof will be omitted.

6 is a flowchart illustrating a program blocking method using a hash table according to an embodiment of the present invention.

First, the receiver 110 receives an execution request signal of a specific program (S610).

Next, when receiving the execution request signal, the extraction unit 120 extracts the hash (HASH) information of the specific program (S620).

Next, the determination unit 130 determines whether the extracted hash information is included in the pre-registered hash table (S630).

In this case, when the extracted hash information is not included in the pre-registered hash table, the program execution control unit 140 blocks the execution of the specific program (S640).

However, when the extracted hash information is included in the pre-registered hash table, the program execution control unit 140 executes the specific program according to the execution request of the specific program (S650).

However, in the present invention, when a specific program is blocked as described above, the blocked program may be registered so as not to be blocked later.

7 is a flowchart illustrating a method of registering hash information of a blocking program in a hash table when a specific program is blocked according to an embodiment of the present invention.

For example, when the extracted hash information is not included in the registered hash table as a result of the determination using the message output unit 160 as shown in FIG. 7, the extracted hash information is stored. A message for querying whether to register the hash table is output (S710).

Next, the receiving unit 110 receives a signal for requesting registration of the extracted hash information in the hash table according to the query message (S720). Next, the information registration unit 150 may register the extracted hash information in the hash table according to the registration request signal (S730).

Embodiments according to the present invention can be implemented in the form of program instructions that can be executed by various computer means can be recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of the computer-readable recording medium include magnetic media such as a hard disk, a floppy disk, and a magnetic tape; optical media such as CD-ROM and DVD; magnetic recording media such as a floppy disk; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

1 is a block diagram showing the configuration of a program blocking device using a hash table according to an embodiment of the present invention.

2 is a diagram illustrating an example of determining whether a specific program is blocked according to an embodiment of the present invention.

3 is a diagram illustrating an example of executing a program according to an embodiment of the present invention.

4 is a diagram illustrating an example in which a program is blocked according to an embodiment of the present invention.

5 is a diagram illustrating a screen on which a message for determining whether to register hash information is sent according to an embodiment of the present invention.

6 is a flowchart illustrating a program blocking method using a hash table according to an embodiment of the present invention.

7 is a flowchart illustrating a method of registering hash information of a blocking program in a hash table when a specific program is blocked according to an embodiment of the present invention.

<Explanation of symbols for main parts of the drawings>

110: receiver

120: extraction unit

130: judgment

140: program execution control unit

150: information register

160: message output unit

Claims (12)

Receiving a signal for executing a specific program; Extracting hash information of the specific program when the execution request signal is received; Determining whether the extracted hash information is included in a pre-registered hash table through a kernel mode of a processor; And Blocking execution of the specific program when the extracted hash information is not included in a pre-registered hash table as a result of the determination; Program blocking method using a hash table comprising a. The method of claim 1, If the extracted hash information is included in a pre-registered hash table, executing the specific program according to a request for executing the specific program; Program blocking method using a hash table further comprising a. The method of claim 1, Registering one or more hash information to the hash table Program blocking method using a hash table characterized in that it further comprises. delete The method of claim 1, When receiving the execution request signal, extracting the hash (HASH) information of the specific program, A method for blocking a program using a hash table, comprising: extracting hash information of the specific program by calling a user API inside a processor. The method of claim 5, The user API is a program blocking method using a hash table, characterized in that the Create Process (CreateProcess) type. The method of claim 1, Outputting a message inquiring whether to register the extracted hash information in the hash table when the extracted hash information is not included in a pre-registered hash table; Receiving a signal for requesting registration of the extracted hash information in the hash table according to the query message; And Registering the extracted hash information in the hash table according to the registration request signal. Program blocking method using a hash table further comprising a. A computer-readable recording medium in which a program for executing the method of any one of claims 1 to 3 or 5 to 7 is recorded. A receiver which receives a signal for requesting execution of a specific program; An extraction unit configured to extract hash information of the specific program when the execution request signal is received; A determination unit determining whether the extracted hash information is included in a pre-registered hash table through a kernel mode of a processor; And A program execution control unit for blocking execution of the specific program when the extracted hash information is not included in a pre-registered hash table as a result of the determination; Program blocking device using a hash table comprising a. 10. The method of claim 9, When the extracted hash information is included in the pre-registered hash table as a result of the determination, the program execution control unit executes the specific program according to the execution request of the specific program. . 10. The method of claim 9, An information register for registering one or more hash information into the hash table Program blocking device using a hash table, characterized in that it further comprises. The method of claim 11, If the extracted hash information is not included in the pre-registered hash table as a result of the determination, a message output unit outputs a message inquiring whether to register the extracted hash information in the hash table. More, The receiving unit receives a signal for requesting registration of the extracted hash information in the hash table according to the query message, And the information registration unit registers the extracted hash information in the hash table according to the registration request signal.

Images