KR101265099B1 - A Method For Software Security Treatment And A Storage Medium - Google Patents

Abstract

The present invention relates to a software security processing method. Software security processing method according to the present invention comprises the steps of preparing the original code of the program for providing various services on the Internet; Translating the original code into machine language code; Marking a particular portion of the machine code translation; An obfuscation step of performing a code obfuscation for the translation of the machine code into itself, and performing a highly obfuscation process with a difference between other parts of the marking part; A test step of determining whether normal service provision can be made by testing the obfuscated program; In the test step, characterized in that it comprises a step of providing a service on the Internet by transmitting the distribution of the obfuscated file is completed on the distribution server on the Internet.

Description

A method for software security treatment and a storage medium

The present invention relates to a software security processing method, and more particularly, to provide a service by performing a highly obfuscated machine code of the source file itself for service provision, to obtain the original file by a malicious third party and The present invention relates to a software security processing method and a recording medium that can block the analysis in advance and improve the quality of service by minimizing the increase in the file size.

Hackers actively use technology called reverse engineering to search for vulnerabilities and find vulnerabilities by directly analyzing the original file, that is, the Windows executable, without source code.

In some cases, when a vulnerability of a program is analyzed, a hacker may modify the binary code of an executable program to change the control flow of the executable program so that the executable program operates as intended.

For example, if a hacker finds a password comparison code of an Internet banking certificate by reverse engineering and modifies the corresponding routine to skip the comparison part, the certificate certificate loses its meaning. On the other hand, in order to prevent the common PC security and illegal software installation, if you find and skip the system administrator's mode password check routine that resets the hardware when the system reboots, the security function is lost.

To counter the hackers' reverse engineering of software analysis, security experts are applying code obfuscation technology that makes it difficult to find the source code of an executable program.

1 is a diagram illustrating a state before and after general software obfuscation, and FIG. 2 shows each step of a software security method for performing conventional software code obfuscation.

In the conventional software code obfuscation, the original code of the executable file is decompiled in the machine language (step 1), encrypted for each code block (step 2), and the entire code is again encrypted ( Step 3). Translate the encrypted file back into machine language (step 4), obfuscate the decryption executable file that decrypts the password (step 5), and bring the encrypted original file together with the obfuscated decryption executable file to the service recipient. Deploy offline (step 6).

In addition, as shown in FIG. 2, after installing the obfuscation program CD for each developer computer 10 and operating the obfuscation system to perform obfuscation and testing, the obfuscation file is transmitted to the distribution server 20. The obfuscation program itself was distributed widely through the CD.

However, the conventional software security method of the above configuration has the following problems.

Due to the wide distribution of obfuscation program CD, the obfuscation algorithm by hackers has been almost analyzed, and since the original code is not obfuscated, only the original code is encrypted. There is a problem in that the encrypted file (that is, files including the original file are provided by default when the service is provided) can be easily obtained through online and offline. In this case, when a program for decryption is obtained, the original file is provided to the malicious third party as it is. In particular, the wide distribution of obfuscation programs has led to significant distribution of deobfuscation programs on the Internet by malicious third parties.

The object of the present invention is to prevent the acquisition and analysis of the original file by a malicious third party in advance by performing highly obfuscated machine code of the original source for service provision and using it for service provision. It is to implement a software security processing method and a recording medium that makes it possible to improve the quality of service by minimizing the increase in file size.

Software security processing method according to the present invention for achieving the above object comprises the steps of preparing the original code of the program for providing various services on the Internet; Translating the original code into machine language code; Marking a particular portion of the machine code translation; An obfuscation step of performing a code obfuscation for the translation of the machine code into itself, and performing a highly obfuscation process with a difference between other parts of the marking part; A test step of determining whether normal service provision can be made by testing the obfuscated program; In the test step, characterized in that it comprises a step of providing a service on the Internet by transmitting the distribution of the obfuscated file is completed on the distribution server on the Internet.

Software security processing method according to the present invention for achieving the above object comprises the steps of preparing the original code of the program for providing various services; Translating the original code into machine language code; Marking a specific portion of the translation into the machine code; An obfuscation step of performing code obfuscation on the translation into the machine language code itself, and performing a highly obfuscation process by putting a differential on the other parts of the marking part; A test step of determining whether normal service provision can be made by testing the obfuscated program; And transmitting the obfuscated file in which the test is completed in the test step to the distribution server.

The high obfuscation is characterized in that it includes an API address hiding function corresponding to the corresponding portion.

The highly obfuscation is characterized by including destruction of the IAT table corresponding to the corresponding portion.

The high obfuscation is characterized by the difficulty of disassembling the machine code by code virtualization.

In the obfuscating step, it is configured to be able to select and use a specific one among a plurality of encryption algorithms.

The recording medium according to the present invention for achieving the above object is characterized by recording a computer program for performing each step of the software security processing method on a computer system.

Since the present invention obfuscates the original file itself for the service provided on the Internet by the above configuration, it is difficult to secure the original file itself for the service from a malicious third party, and the original file is highly obfuscated. The system for obfuscation is possible by obfuscation by the method of obfuscation, so that it is possible to prevent software analysis and intrusion into the system by a malicious third party in advance, and it is possible to selectively obfuscate the part containing the main information. It is possible to minimize the load.

1 is a schematic diagram illustrating a state before and after obfuscation of general source code obfuscation.
2 is a flow chart illustrating a conventional code obfuscation process.
3A is a schematic diagram illustrating a configuration of a preferred embodiment of the software security processing system of one embodiment of the present invention.
Fig. 3B is a flowchart illustrating each step of the software security processing method of the embodiment of the present invention.
4 is a schematic diagram illustrating a configuration of a preferred embodiment of the software security processing system of one embodiment of the present invention.
5 is a schematic diagram illustrating a configuration of an obfuscation apparatus of an embodiment of the present invention.
6 is a diagram illustrating a function implemented in an executable file obfuscated by the obfuscation apparatus of the embodiment of the present invention.
Figure 7a is a schematic diagram illustrating a state before and after obfuscation by code virtualization by the obfuscation apparatus of the embodiment of the present invention.
Figure 7b is a schematic diagram illustrating the state before and after obfuscation by code virtualization by the obfuscation apparatus of the embodiment of the present invention.
8 is a flowchart illustrating an operation state of the device security means of the obfuscation device of the embodiment of the present invention.

Hereinafter, a configuration of a software security processing method and a recording medium according to the present invention having the above configuration will be described in detail with reference to the accompanying drawings.

3A and 3B, a software security processing system for performing a software security processing method according to an embodiment of the present invention includes a developer computer 110 on which source coding is performed, an obfuscation device 120 for performing code obfuscation, and And a security management server 130 which collects the source coded files from each developer computer 110 and inputs them to the obfuscation device 120 and receives the obfuscated files from the obfuscation device 120. It includes a testing server 160 that receives the completed file and is tested for the obfuscated file, and a distribution server 180 for distributing the tested software to the client.

The developer computer 110 of the present embodiment performs the source coding, and converts it to machine language and transmits it to the security management server 130. At this time, if the relevant program is 32Bit executable file such as EXE, DLL, OCX, BPL, etc., mark the important part that should not be exposed to the outside in machine language, that is, the part requiring high obfuscation, and transmit it to the security management server (Fig. 7a and 7b).

In this case, the marking is performed by a method and means discernible in the obfuscation apparatus 120, and it is possible to set such that the type and degree of obfuscation can be differentiated according to the method and means of marking. This can be.

In the present embodiment, the developer computer 110, the security management server 130, the obfuscation device 120, the testing server 160, and the distribution server 180 may transmit and receive files by TCP / IP protocol socket communication. For example, the socket is accessible to the obfuscation device 120 only by the DLL file provided by the security system of the present embodiment, and the security management server 130 and the obfuscation device 120 are used only for the obfuscation target file and the obfuscation file. The system setting of the obfuscation device 120 is made such that only exchange is possible and the other purpose access to the obfuscation device 120 in the network is not possible.

The security management server 130 according to the embodiment of the present invention is connected to a plurality of developer computers 110 in a network, receives a file that has been source coded and machine-translated, inputs it to the obfuscation device 120, and the obfuscation file is completed. Received from the obfuscation device 120, by inputting the returned file to the testing server 160 can be tested for normal operation.

 In addition, the security management server 130 receives the file obfuscated and tested from the testing server 160, and transmits to the distribution server 180, the file that needs to be modified / supplemented returns to the developer computer (110).

As shown in FIG. 4, in another embodiment of the present invention, the obfuscated file testing returned from the obfuscation device 120 may be configured to be directly performed by the security management server 130. 130 may be configured to directly transmit the obfuscated and tested files to the distribution server 180.

In addition, in another embodiment of the present invention, the developer computer 110 and the obfuscation device 120 are connected by a socket communication on a network, and the obfuscation in which source coding and machine language translation and marking are performed on the developer computer 110. The target file is delivered to the obfuscation device 120 by the dll file provided by the system, the obfuscation device 120 is passed to the developer computer 110 or the testing server 160 to complete the obfuscation testing It can be made by the configuration made and delivered back to the distribution server 180.

Security management server 130 and obfuscation device 120 of the embodiment of the present invention is preferably located in the internal network that can be secured.

The obfuscating device 120 socket of this embodiment communicates with the security management server 130, the testing server 160, or the developer computer 110 through a DLL file provided by the security system and receives or obfuscates a file to be obfuscated. Send the complete file.

In FIG. 5, the obfuscation device 120 according to the present embodiment includes a main device 121, a storage device 125 that stores its own security means 122, and an obfuscation program 123, an obfuscation target file, and an obfuscation. Database 126 for storing the completed files, communication means 127 for socket communication with the security management server, data input and output means 128 and display means 129 for modifying or updating the obfuscation program do.

Self-securing means 122 of the present embodiment is a program security means (122a) for pre-blocking unauthorized third party access to the internal file system built in the obfuscation device 120, and the hard-coded obfuscation program The device security means 122b for breaking the file system including the obfuscation program stored in the hard disk and formatting the hard disk when the disk is removed and executed on another device.

Since the program security means 122a of the obfuscation device 120 of the present embodiment can access the obfuscation device 120 only by a password generated by a high security algorithm, the obfuscation device other than the obfuscation device manager ( No operation for the operation 120 may be performed. When accessing the file system by reverse engineering or the like, the obfuscation device 120 may deny the service and perform an operation such as rebooting the system or deleting the file system in some cases. have.

On the other hand, in the embodiment of the present invention, the device security means 122b is the CPU of the existing obfuscation device when the storage device of the obfuscation device 120 (the hard disk is taken out and operated in the third device) by physical decomposition. Since the device is identified by the unique number of the component hardware including the network card and the developer's unique algorithm and security table, it is impossible to operate the hard disk in a third device other than the original device.

For example, when hardware is operated as shown in FIG. 8, a key value of the system is first generated from a unique number of hardware such as a CPU unique number and a network card of the operating system. The service can be started only in the same cases compared with the key value of the installed software security processing system program installation (steps 60 to 63).

In addition, it stores the authority group data value (Admin Group Data Value) and the authority user data value (Admin User Data Value) corresponding to the corresponding key value, and monitors the change of the authority group or the information on user authority. If a mismatch occurs with the stored value, the system intrusion response system is driven (steps 64 to 80). For example, the service may be terminated, all file systems of the hard disk may be deleted, and the system may be rebooted. In addition, before the file system is deleted, the file system is destroyed to prevent restoration of the file system, thereby preventing access to the security algorithm and the obfuscation program of the hard disk by an unauthorized third party in advance (steps 81 to 81). Step 83).

As shown in FIG. 6, the obfuscation device 120 of the present embodiment includes obfuscation means for obfuscating machine code, and the obfuscation means of the present embodiment has an original code for the obfuscated executable file. It has an obfuscation program for adding a tracking obstacle function, an anti-debugging function, an antipatch function, an encryption function, etc., and in case of improper access such as reverse engineering of a third party to a file that has been obfuscated by the obfuscation program. The function implemented by obfuscation prevents third party system decryption in advance, thereby maintaining enhanced software security.

For example, in the present embodiment, the original code tracking interruption function includes an API (Application Programming Interface) wrapper function, an API address hiding, an IAT (Import Address Table) table destruction, and a flow modification function.

In this embodiment, the API wrapper function means inserting various dummy codes into the normal API code to make analysis and tracking through the debugger difficult. Hiding an API address means changing the address so that the debugger doesn't recognize the address at all, because if the debugger points to the Windows API in memory, it can be replaced with a string to facilitate code analysis.

Destroying the IAT table means that the disassembler can't find the window API by destroying the IAT table that the disassembler references to find the window API so that backtracking through disassembly is not possible. Flow modification means to modify the flow of simple code by changing the flow of execution code to make code analysis difficult.

In the present embodiment, the anti-debugging function is a debugger detection function for detecting and blocking the operation of various debugger tools to block software analysis through a debugger, a monitoring tool detection function for blocking software analysis through a monitoring tool, and a virtual environment. It includes a virtual environment detection function that detects and blocks the act of copying the software and then running and analyzing it.

The anti-patch function of the present embodiment modifies various files constituting the software product to check whether the file is modified or not to bypass the security function of the product, and checks the code by hacking the memory of the executed software. It includes a memory variant that detects behavior changes to the execution structure.

The encryption function of the present embodiment refers to an encryption function that encrypts a code area of software to block backtracking through disassembly in advance, and includes various algorithms such as AES and ARIA, and allows a user to select a desired algorithm. It is configured to be.

On the other hand, the obfuscation apparatus of the present embodiment is equipped with a variety of existing techniques of software obfuscation, for example, obfuscation such as partition obfuscation, data obfuscation, aggregate obfuscation, control obfuscation, so as to insert a dummy code, generate a variable code, Obfuscate executables by transforming control flows, virtualizing code, and so on.

In addition, the obfuscation apparatus 120 according to the present embodiment further performs a highly virtualized obfuscation process by code virtualization and a unique special code for a specific part of the machine code marked by the developer in the developer computer.

For example, as illustrated in FIGS. 7A and 7B, the machine language portion of the area marked by the developer converts the instructions into instructions composed of special codes unique to the device or company, and configures a virtual CPU capable of interpreting them. In some cases, it is configured by multiple virtual CPUs so that the program cannot be decoded before the hacker analyzes the special meaning of the special code and virtual CPU. Therefore, it is very difficult for the hacker to analyze the system and prevent attack by hackers. You can block in advance.

Meanwhile, in a preferred embodiment of the present invention, the obfuscation programs embedded in the obfuscation device 120 are the same obfuscation as implemented in the executable file obfuscated by the obfuscation program in response to unauthorized access by an unauthorized third party. It is possible to be obfuscated by the digestion techniques and functions.

Next, each step of the software security processing method performed by the software security processing system according to the embodiment of the present invention having the above configuration will be described with reference to FIG. 3B.

When the obfuscation device 120 of the present embodiment is installed on the network internal network, the final setting for the type and order of the obfuscation performed by the obfuscation device 120 is made, and the process is the obfuscation. In order to guarantee the security policy of the executable file to be obfuscated for the device 120 and the execution speed of the executable file, a combination of an appropriate obfuscation method, recovery, and order is determined, thereby determining the difficulty of obfuscation.

In the user computer 110, coding of an original code for providing an on-line service is performed, and when the creation and testing of the original code by the user is completed, the original code is translated into machine language (steps 50 and 51). ).

The user computer 110 of the present embodiment sets the range in which the contents of the original code should not be leaked to the outside, and performs marking on the range according to the method provided by the software security processing system of the present embodiment. On the other hand, in the preferred embodiment of the present invention it is also possible to be configured to vary the degree of obfuscation by varying the type and type of marking (step 53).

Machine language translation and marking of the executable file created in the user computer 110 of the present embodiment is input to the security management server 130 through the network socket.

The security management server 130 of the present embodiment collects the obfuscation target file from each user computer 120 and delivers the obfuscation target file to the obfuscation device 120 through the dll file provided by the software security processing system. (Step 53).

The obfuscation device 120 stores the obfuscation target file received from the security management server 130 in the database 126, and stores the obfuscation device 120 in the storage device 125 according to a combination of pre-set obfuscation method, recovery, and order. The stored obfuscation program is called to perform obfuscation on the obfuscation target file (step 54).

In addition, in the portion where the marking is performed in the user's computer 110, the obfuscation target file is obfuscated by a highly obfuscated process including conversion of the machine code into special codes by code virtualization and obfuscation by a virtual CPU. In step 55, the obfuscated file is stored in the database.

The obfuscation device 120 of the present embodiment returns the obfuscated execution file to the security management server 130, and the security management server 130 inputs the obfuscated file to the testing server 160 (step 56). ).

In the testing server 160, whether the obfuscated file implements the same function as the original code, and the debugger detection function implemented by the obfuscation, the monitor tool detection function for blocking software analysis through the monitoring tool, and the virtual environment The operation of copying the software is performed to test whether the proper operation such as the virtual environment detection function that detects and blocks the analysis and the execution file implement the proper operation speed (step 57).

In the present embodiment, the file that does not meet the setting criteria in the testing process is returned to the user computer 110 through the security management server 130, the file matching the criteria is distributed through the distribution server (through the security management server 130 ( 180, the service can be provided to the customer through the Internet or distributed to the customer offline (step 58).

In the present embodiment, since the original code is translated into machine language and the machine code itself is obfuscated, it is difficult for the original machine code to be secured to a third party, and the original code can be reproduced even by reverse engineering. Since it is impossible to do this, it is possible to prevent a third party from knowing the configuration of the system before the system can be hacked.

It is obvious that the scope of the present invention is not limited to the above embodiments but is defined by the matters defined in the claims of the present invention and includes various modifications and alterations made by those skilled in the art within the scope of the claims.

110 ....... Developer Computer 120 ........ Obstacle
122 ............ Self security measures 122a ....... Program security measures
122b ........ device security measures 123 ........ obfuscation programs
125 ....... Storage Device 130 ........ Security Management Server
160 ......... Testing Server 180 ........ Deployment Server

Claims (7)

Creating original code of a program for providing various services on the Internet;
Translating the original code into machine language code;
Marking a particular portion of the machine code translation;
An obfuscation step of performing a code obfuscation for the translation into the machine code, and performing a highly advanced obfuscation process with a difference between other parts of the marking part;
A test step of determining whether normal service provision such as by the original code can be made by testing the obfuscated program in the obfuscating step;
And providing a service on the Internet by transmitting the obfuscated file which has been tested in the test step to a distribution server and distributing it on the Internet.
Creating original code of a program for providing various services;
Translating the original code into machine language code;
Marking a specific portion of the translation into the machine code;
An obfuscation step of performing code obfuscation on the translation into the machine code, and performing a highly advanced obfuscation process with a difference between other parts of the marking part;
A test step of determining whether normal service provision such as by the original code can be made by testing the obfuscated program in the obfuscating step;
And transmitting the completed obfuscated file in the test step to the distribution server.
The software security processing method of claim 1 or 2, wherein the highly obfuscating includes an API (application programming interface) address hiding function corresponding to the corresponding part.
The software security processing method according to claim 1 or 2, wherein the high obfuscation includes destruction of an import address table (IAT) table corresponding to the corresponding portion.
The software security processing method according to claim 1 or 2, wherein the high obfuscation comprises a hard decomposition of machine code by code virtualization.
The method of claim 1 or 2, wherein in the obfuscating step, a specific one of a plurality of encryption algorithms is configured to be selected and used by a user.
A recording medium which records a computer program for performing each step of the software security processing method according to claim 1 on a computer system.

Images