KR101512418B1 - tampered position detection - Google Patents

Abstract

The present invention relates to a system and a method for detecting, quickly, whether a protecting object code (original file or original process loaded in memory) is altered by a malicious code and the altered part thereby. The system for altered part detection according to the present invention comprises: a saving part saving eigen values of multiple row blocks and column blocks of the original protecting object code; a matching part matching blocks of an execution protecting object code and blocks of the original file protecting object code by obtaining eigen values of multiple column blocks and row blocks of the execution protecting object code corresponding to the original file protecting object code; and a comparison part detecting altered parts in each block by comparing the eigen values of the original protecting object code and execution protecting object code to the blocks matched by the matching part, and determining the altered parts by the altered row and column blocks, wherein the original file protecting object code and the execution protecting object code are distinguished into multiple small blocks, respectively, and each small block is determined by one column block and one row block.

Description

[0001] The present invention relates to a tampered position detection system,

The present invention relates to a file or memory security technology, and more particularly, to a system and method for rapidly detecting a protected code (original file or original process loaded in memory) by malicious code and its modulation location .

A plurality of programs are installed and executed in a computer system. A program (also referred to as a file) refers to a set of instructions that are created in order for a computer to run, and a state in which a program is loaded into memory and running is called a process. As the computer system performs various tasks, various personal information is stored in the computer system and various tasks are performed.

The malicious code exploits personal information stored in a computer system by forgery or forgery programs, processes, documents, etc., or manipulates the transfer target account number or transfer amount by forging or falsifying the financial data stored in the address in a specific memory . In addition, a game nucleus, which is a hacking program in a game, is a program for manipulating a specific game program or a memory loaded with a specific game process. The game nucleus manipulates the memory of the game to change specific data such as a stamina or physical strength, Increase speed or hit counts, or add macros to allow gamers to easily beat the game.

As described above, technologies for protecting a program installed in a computer system or a process loaded in a memory from malicious code such as a game nucleus are proposed.

As a conventional technique for program or file security, Korean Patent Laid-Open Publication No. 2013-0008119, "File Modulation Detection Method" In the prior art, the security symbol server stores the file index information of the original inspection target file and the original hash value in correspondence with each other in the database, and a second step of storing the query file index information of the execution inspection object file and the query hash value A second step of the security symbol server retrieving the database with the inquiry file index information when the included file modulating query is received; and a second step of retrieving the original hash value stored in the database and the query hash And providing the comparison result to the client computer to cause the client computer to detect whether or not the file to be tested is modulated.

On the other hand, Korean Patent Registration No. 1052735, " Method for detecting presence / absence of memory manipulation and apparatus using the same, " This prior patent discloses a method comprising: generating an original verification code for a file to be protected; Storing the generated original verification code in the protection target file; Loading the protected object file into which the original confirmation code is inserted; Generating a memory verification code for the memory-based code loaded on the memory using the CRC algorithm according to a predetermined cycle; And comparing the original verification code with the memory verification code.

The above-mentioned prior patents store a unique value (hash value or CRC value) for the original file or the original process and then calculate a unique value for the executable file or the execution process and compare the original value with the original value of the original file or original process, And detects whether the executable file or the executable process is forged or falsified from the original file or the original process. These prior patents can detect whether an executable file or an execution process is forged or falsified, but can not detect the fake location.

On the other hand, as mobile devices such as smart phones and tablet PCs have become widespread in recent years, interest in various applications available in such mobile devices is increasing. A mobile device user connects his or her mobile device to a predetermined application providing server to download and use various applications such as a game or an online financial service. As the use of various applications increases, the number of illegal forgery of applications is increased. When the application is illegally forged, the personal information of the mobile device user may be exposed with no protection and the copyright of the application may be infringed. Lt; / RTI >

As a conventional technique for preventing forgery and falsification of such applications, Korean Patent Registration No. 1273370, " Apparatus and Method for Preventing Forgery of Application Forbidden " In this prior patent, when a client terminal desires to execute an application, the application providing server receives a predetermined hash value from the client terminal, the hash value being a data code value constituting the application, And permits access for execution of the application only when it coincides with a previously stored hash value, thereby preventing falsified or modulated applications from being used. This prior patent also has a problem that it is impossible to detect whether the application is forged or falsed, but the fake and falsified position can not be detected.

Of course, if the code of the original file and the code of the executable file, the code of the original process and the code of the execution process, and the code of the original application and the code of the execution application are compared one by one, the fake and falsified position can be detected. The detection time is long. In addition, when the client queries the server whether a file, a process or an application is forged or falsified, and when the server detects the forgery or falsification and applies the result to the server-client environment in which the result is returned to the client, the network traffic is excessively increased .

SUMMARY OF THE INVENTION An object of the present invention is to provide a system and method for quickly detecting whether or not a protected code of a computer terminal or a mobile device has been modulated by a malicious code and its modulation position.

According to another aspect of the present invention, there is provided a modulation position detection system comprising: a storage unit for storing eigenvalues of blocks in a plurality of rows of an original protection target code and eigenvalues of blocks in a plurality of rows; A matching unit for acquiring eigenvalues of blocks in the plurality of rows of the corresponding execution protection target code and eigenvalues of the blocks in the plurality of rows to match the blocks of the execution protection target code and the blocks of the source protection target code, Comparing the eigenvalue of the execution protection target code with the eigenvalue of the original protection target code for the middle block matched by the matching unit to detect whether the modulation is performed for each of the blocks, Wherein the source protection target code and the execution protection target code are divided into a plurality of small blocks, And is determined by a block in a row and a block in a row.

The modulation position detection method according to the present invention includes a first step of obtaining eigenvalues of blocks in a plurality of rows of an execution protection target code corresponding to an original protection target code and eigenvalues of a plurality of blocks in a row, A second step of matching the blocks of the target code with the middle blocks of the original protection target code, and a second step of matching the original value of the execution protection target code with the original protection target code And a third step of detecting modulation of each of the blocks and determining a modulation position by using the modulated row block and the heat block, wherein the original protection target code and the execution protection target code are respectively Wherein each of the small blocks is divided into a plurality of small blocks and each small block is determined by one row block and one column block.

As described above, according to the present invention, the protection code is divided into a plurality of blocks in a row and a plurality of blocks in a row, and the eigenvalues of the blocks and the blocks in each row are calculated to verify whether the blocks are modulated and a small block The modulation position and the displacement position of the protection object code can be accurately detected even with a small amount of data.

1 is a block diagram showing a configuration of a modulation position detecting system according to the present invention.
FIG. 2 is a view briefly showing a principle of detecting a modulated small block by dividing a protection object code according to the present invention into a plurality of blocks in a row and a plurality of blocks in a column.
3 is an operational flowchart showing the modulation position detection method according to the present invention.

Hereinafter, a modulation position detection system and method according to the present invention will be described in more detail with reference to the accompanying drawings.

The source of the protection target code is installed and executed in each terminal. The original protected code may be modulated at various moments, such as when the protected code is stored in the terminal, loaded into memory, or downloaded to the terminal, such as in an app store. Therefore, it is necessary to verify whether the corresponding protection target code (referred to as the execution protection target code) is the same as the original protection target code, that is, integrity, when the protection target code is executed or stored in the terminal.

Integrity verification that verifies that the execution protection target code is the same as the original protection target code may be physically performed by one terminal itself or may be performed in a physically remote and remote server-client environment.

1 is a block diagram showing a configuration of a modulation position detecting system according to the present invention.

A block setting unit 11 for dividing the execution protection target code into a plurality of blocks in a row and a plurality of blocks in a row; Block eigenvalue calculator 12 for calculating the eigenvalues of each of the blocks, and a block eigenvalue calculator 12 for storing eigenvalues of a plurality of blocks in the row and a plurality of blocks in the column of the original protection target code corresponding to the execution protection target code And the block of the original protection target code stored in the storage unit 13 are matched with the blocks of the execution protection target code calculated by the middle block eigenvalue calculation unit 12 A comparison unit for comparing the eigenvalues of the execution protection target code with the eigenvalues of the original value of the original protection target code with respect to the middle block matched by the matching unit, (15), a comparison result of the comparison unit (15) That senses when a modulation position detector (16) for determining a small block in a location determined by the modulation on the modulated haengjung blocks and lost block.

The middle block setting unit 11 sets the number of blocks and the plurality of blocks so that the protection code is divided into a plurality of small blocks and each small block is determined by one row block and one column block. Sets the blocks in the row.

Not all small blocks need to be the same size, and therefore, all the row blocks and all row blocks need not be the same size. It is possible to determine the row length or the column length of each of the blocks differently according to the necessity and importance of protection for each area constituting the protection target code. At this time, it suffices to apply the same criterion for distinguishing between the blocks in the row of the execution protection target code and the blocks in the row, and the criteria for distinguishing between the blocks in the row and the blocks in the row of the original protection target code. That is, the execution protection target code and the source protection target code are classified into a plurality of blocks in a row and a plurality of blocks in a row by applying the same rule.

The protection target code may include a program, a file, a process, an application, a document, a multimedia file, and the like.

FIG. 2 is a view briefly showing a principle of detecting a modulated small block by dividing a protection object code according to the present invention into a plurality of blocks in a row and a plurality of blocks in a column.

FIG. 2 shows an example in which the protection target code is divided into N blocks (CMB_1 to CMB_N) and M blocks (RMB_1 to RMB_M). The original protected code and the corresponding executed protection target code are classified into the same structure.

The eigenvalues of blocks of N rows and M columns of blocks constituting the original protection target code are compared with the eigenvalues of blocks of N rows and M columns of blocks constituting the execution protection target code. That is, N + M middle blocks are compared.

If one small block is modulated, modulation is detected in one of the row blocks (CMB_I) and one of the M row blocks (RMB_J) among the N row blocks. A small block (SB_IJ) at the overlapping position can be detected as the modulation position when modulation is detected in one row block and one column block. That is, one of the N x M small blocks can be detected as a modulation position.

Generally, in order to detect a modulation position in N × M small block units, the eigenvalues of N × M small blocks must be calculated and compared. However, according to the present invention, it is possible to detect a modulated small block among N × M small blocks by calculating and comparing eigenvalues in units of N + M middle blocks.

3 is an operational flowchart showing the modulation position detection method according to the present invention.

First, the modulation position detection system divides an original code to be protected into a plurality of blocks in a row and a plurality of blocks in a column, and stores the eigenvalues of the respective blocks in step S31. Here, the criterion for dividing the original protection target code into a plurality of blocks in a row and a plurality of blocks in a column is that the original protection target code is divided into a plurality of small blocks and each small block is divided into one block To be determined by the block.

The modulation position detection system obtains the eigenvalues of each of the plurality of row blocks and the plurality of heat block of the execution protection target code (S32). Here, the execution protection target code corresponds to the original protection target code, and the criterion for dividing the execution protection target code into a plurality of blocks in the row and a plurality of blocks in the column is the block in which the original protection target code is divided into a plurality of blocks, It is preferable that the reference is the same as the reference for dividing by blocks. It is also preferable that the eigenvalue computation method of the block of execution protection target code and the eigenvalue computation method of the block of the original protection target code are the same.

Next, the modulation position detection system compares the eigenvalues of the original protection target code with the eigenvalues of the execution protection target code on a block-by-block basis (S33). If the comparison result is the same, it is determined that the corresponding block is not modulated, and if it is not the same, it is of course determined that the corresponding block is modulated.

After the comparison of all the middle blocks is completed (S34), if there is a modulated block (S35), the modulated row block and the heat block The overlapped small blocks are detected as modulation positions (S36).

In one embodiment, a block setting unit 11, a block-by-block eigenvalue calculation unit 12, a storage unit 13, a matching unit 14, a comparison unit 15, The detection unit 16 may be physically located within the same terminal (e.g., one PC or mobile device).

In another embodiment, the middle block setting unit 11 and the middle block specific eigen value calculating unit 12 are located in the client terminal, and the storing unit 13, the matching unit 14 and the comparing unit 15 are located in the server It is possible. At this time, the modulation position detection unit 16 may be located at the client terminal or at the server. In such a client-server environment, it is desirable to transmit the identifier and the eigenvalue of the corresponding block in order to communicate the eigenvalue of each block.

Follow-up actions can be taken variously according to the policy of the developer, operator, and user of the protected code when the code to be protected is modulated differently from the original code to be protected and the position of the modulation is detected.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiments, it is to be understood that the invention is not limited to the disclosed embodiments. In addition, it is a matter of course that various modifications and variations are possible without departing from the scope of the technical idea of the present invention by anyone having ordinary skill in the art.

11: middle block setting unit 12: middle block eigenvalue calculation unit
13: storage unit 14: matching unit
15: comparison unit 16: modulation position detection unit

Claims (10)

A storage unit for storing eigenvalues of blocks in a plurality of rows of the original code to be protected and eigenvalues of blocks in the plurality of columns;
The method comprising: obtaining an eigenvalue of blocks in a plurality of rows of an execution protection target code corresponding to the original protection target code and an eigenvalue of a plurality of blocks in the column, A matching unit for matching,
Comparing the eigenvalue of the execution protection target code with the eigenvalue of the original protection target code for the middle block matched by the matching unit to detect whether the modulation is performed for each of the blocks, And a comparator for comparing the first and second signals,
Wherein the source protection target code and the execution protection target code are divided into a plurality of small blocks, each small block is determined by one row block and one column block,
Wherein the matching unit assigns an identifier for each block of the execution protection target code and the source protection target code, and the matching unit uses the identifier to match blocks of the mutually corresponding blocks of the execution protection target code and the source protection target code And the modulated position detection system. The apparatus of claim 1, further comprising: a block setting unit for dividing the execution protection target code into a plurality of blocks in a row and a plurality of blocks in a column;
Further comprising a block eigenvalue calculator for calculating an eigenvalue of each block in the row and an eigenvalue of each block in the column and providing the eigenvalue to the matching unit. The modulation position detection system according to claim 1, further comprising a modulation position detection unit that determines a modulated position as a modulated position, when the modulation result of the comparison unit is sensed, the small block determined by the modulated row block and the heat block. delete The system of claim 1, wherein the execution protection target code and the source protection target code are classified into a plurality of blocks of a row and a plurality of blocks of a heat applying the same rule. Comprising: a first step of obtaining eigenvalues of blocks in a plurality of rows of an execution protection target code corresponding to an original protection target code and eigenvalues of blocks in a plurality of rows;
A second step of matching the middle blocks of the execution protection target code with the middle blocks of the source protection target code,
Comparing an eigenvalue of the execution protection target code with an eigenvalue of the original protection target code stored for the middle block matched in the second step to detect whether modulation is performed for each of the blocks, So that the modulation position is determined by the third step,
Wherein the source protection target code and the execution protection target code are divided into a plurality of small blocks, each small block is determined by one row block and one column block,
And a second step of assigning an identifier for each block of the execution protection target code and the source protection target code, Wherein the first and second modulation positions are matched with each other. 7. The method of claim 6, further comprising: a fourth step of dividing the execution protection target code into a plurality of blocks and a plurality of blocks;
Further comprising: a fifth step of calculating an eigenvalue of each of the blocks in the row and an eigenvalue of each of the blocks in the row, and providing the calculated eigenvalues to the second step. The method as claimed in claim 6, further comprising a sixth step of determining a small block determined by a modulatable row block and a row block as a modulation position when the modulation result of the third step is sensed. delete 7. The method of claim 6, wherein the execution protection target code and the source protection target code are classified into a plurality of blocks and a plurality of blocks in which the same rule is applied.

Images