KR101624387B1 - Method for software asset management based on software birthmark and apparatus thereof - Google Patents

Abstract

A method and apparatus for managing software assets using software bus marks is disclosed. A software asset management method based on a software bus mark comprises the steps of: collecting an executable file to be executed on a target computer system; generating a software bus mark based on information reflecting the function of the executable file; And identifying an executable file. Thus, all executables running on the computer system are identified based on the software bus marks, so that the software assets can be managed effectively, and the software bus marks can include IAT information related to the function of the executable file and information on the API reference sequence There is a strong advantage in forgery or modulation because it utilizes.

Description

[0001] METHOD FOR SOFTWARE ASSET MANAGEMENT BASED ON SOFTWARE BIRTHMARK AND APPARATUS THEREOF [0002]

The present invention relates to software asset management, and more particularly, to a method and apparatus for managing software assets using software bus marks.

Today, with the development of the Internet and communication network, the distribution and distribution of software has greatly increased. Recently, with the hot air of smartphone, many users have created an environment where they can easily download and use the software through the application market. This change in circumstances has led to a decisive momentum for product selection to move from hardware to software.

However, due to the development of communication such as the Internet, software piracy and plagiarism have soared, which has hampered the development of the software industry.

Piracy of software means copying and distributing certain software as it is, and plagiarism / theft of software means reverse engineering of whole or partial code of software. And the like.

However, one of the conventional software copyright protection technologies is a method of inserting and distributing feature information (watermark, license information, etc.) from a developer, and it is difficult to extract specific information because of different copyright protection applying method for each developer. It can be damaged.

Another copyright protection technique is to compare the size / hash value of an executable file, but it is possible to add arbitrary data or commands to the executable file, so that the method of comparing the size or hash value of the executable file is not accurate, There is a low problem.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a method for managing software assets executed in a computer system using a software bus mark.

Another object of the present invention is to provide an apparatus for managing software assets executed in a computer system using a software bus mark.

According to another aspect of the present invention, there is provided a software asset management method comprising: collecting an executable file to be executed in a target computer system; generating a software bus mark based on information reflecting the function of the executable file; And identifying an executable file using the software bus mark.

Here, the executable file may be any one of an EXE file of Microsoft Windows, a byte file of Java, a.out file of Linux, and a DEX file of Android.

Here, collecting the executable file may collect executable files including open source software and freeware that are executed in the target computer system.

Here, the step of generating the software bus mark may be based on an IAT (Import Address Table) including information on at least one of information on DDL (Dynamic Link Library) and information on API (Application Program Interface) Software bus marks can be created.

Here, generating the software bus mark may produce a hash value for the IAT and a hash value as a software bus mark.

Here, the step of identifying the executable file may identify an executable file by using software bus mark information on an application program interface (API) reference sequence for the executable file.

Here, the step of identifying the executable file may identify the executable file by comparing the software bus mark with the pre-established software asset management DB.

Here, the pre-established software asset management DB includes a software bus mark based on an IAT (Import Address Table), a software bus mark based on information on an API (Application Program Interface) reference sequence, a software name, Or the like.

Here, the software asset management method may further include managing software assets executed in a target computer system through identification of an executable file using a software bus mark.

Herein, the step of managing software assets executed in the target computer system may provide the target computer system with licensing information and version information for the identified executable file.

Wherein managing software assets running on the target computer system may control usage of the identified executable file.

According to another aspect of the present invention, there is provided a software asset management system including a collection unit for collecting execution files to be executed in a target computer system, And an identification unit for identifying an executable file using the software bus mark.

The above and the software asset management method and apparatus according to the embodiment of the present invention identify all the executable files executed in the computer system based on software bus marks, thereby effectively managing software assets.

In particular, since the software bus mark according to the embodiment of the present invention utilizes the IAT information and the API reference sequence information related to the function of the executable file, it is advantageous against forgery or modulation.

In addition, there is an advantage in that the software asset and the version management can be simultaneously performed by effectively identifying the executable file that performs the same function even though the version is different.

1 is a flowchart illustrating a software asset management method according to an embodiment of the present invention.
2 is a conceptual diagram for explaining an IAT according to an embodiment of the present invention.
3 is an exemplary diagram illustrating a method for generating a software bus Merck in accordance with an embodiment of the present invention.
4 is an exemplary diagram illustrating a method for generating an API reference sequence according to an embodiment of the present invention.
5 is a block diagram illustrating a configuration of a software asset management apparatus according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a flowchart illustrating a software asset management method according to an embodiment of the present invention. FIG. 2 is a conceptual diagram illustrating an IAT according to an embodiment of the present invention.

Referring to FIG. 1, a software asset management method according to an exemplary embodiment of the present invention includes collecting an execution file (S110), creating a software bus mark (S120), identifying an execution file (S130 And managing software assets (S140).

First, an executable file to be executed in the target computer system may be collected (S110). Here, the computer system may be a concept including all systems, devices, and terminals capable of reading and executing a program.

The executable file may also refer to software, programs, and the like that are executed in a computer system. For example, the executable file may be an executable file of Microsoft Windows (MS Windows), an executable file of java, an executable file of Linux, and the like. That is, the executable file can be any one of MS Windows EXE file, Java byte file, Linux a.out file, and Android DEX file.

The computer system can execute various executable files. An executable file to be executed in the computer system can be executed while installed in the computer system or can be executed without being installed.

All executable files executed in the computer system according to the embodiment of the present invention can be collected. That is, it can collect executable files including open source software and freeware that run on a computer system.

For example, in Windows OS (Operating System), executable files installed in the "Program Files" folder are executed. However, according to the embodiment of the present invention, not only an executable file installed in another folder but also an executable file which is executed without being installed can be collected.

A software bus mark may be generated based on information reflecting the function of the executable file (S120).

The software birthmark includes unique feature information of the executable file and can be used as information for identifying the executable file. The software bus mark can be created by using various feature information, but there is an advantage that it is difficult for forgery and falsification to be generated by utilizing the information reflecting the function of the executable file.

Accordingly, the software bus mark according to the embodiment of the present invention is generated based on an IAT (Import Address Table) including at least one of information about DDL (Dynamic Link Library) and information about API (Application Program Interface) . That is, the information reflecting the function of the executable file may be IAT.

Referring to FIG. 2, the Microsoft Windows operating system uses a PE (Portable Executable) file format as a file format for an executable file, an object code, and a dynamic linking library (DLL).

The PE file format includes dynamic library references for links, tables for exporting and importing APIs, resource management data and thread local storage (TLS) Data and so on. The PE file contains a large number of headers and sections to enable the dynamic linker to map the file into memory.

When the executable file is loaded, the Windows loader loads all the DLLs used by the application and maps them onto the process address space. This behavior occurs in the IAT of the executable file referenced by the Windows loader . That is, the IAT can be used as a lookup table used when an application calls functions.

The executable file according to the PE file format has an IAT. The import table of the IAT includes the addresses of the DLLs used by the executable file, the names of the DLLs, the addresses of the APIs used by the executable file, the names of the APIs, Information, and such information can be used as feature information of the executable file.

However, the present invention is not limited to utilizing an executable file (PE file format) of MS Windows. That is, the information (characteristic information) reflecting the function of the executable file can be extracted from the Linux ELF format, Java, Windows PE format, and Android DEX format.

The executable file can be identified using the software bus mark (S130).

First, according to an embodiment of the present invention, an executable file is identified through a software bus mark (IAT-based software bus mark) generated based on an IAT including information on at least one of information on a DDL and information on an API can do.

In addition, it may happen that the executable file can not be identified using the software bus mark generated based on the IAT. That is, if the function of the executable file is the same but the version is different, it can be recognized as the same executable file.

Therefore, if the executable file can not be correctly identified using the software bus mark generated based on the IAT, information on an API (Application Program Interface) reference sequence for the executable file is referred to as a software bus mark Sequence-based software bus marks) to identify the executable file. That is, the API reference sequence may include information about the version of the executable file. The information on the API reference sequence may be information that can be extracted from the executable file, and may refer to sequence information on the API to be referred to when the executable file is executed.

Specifically, the software bus mark can be compared with the pre-built software asset management DB 200 to identify the executable file.

Here, the software asset management DB 200 can be constructed in advance using information on executable files that can be executed in the computer system.

The software asset management DB 200 may also include software bus marks based on IAT, software bus marks based on information on API reference sequences, software names, licensing information, and version information.

Therefore, it is possible to identify an executable file to be executed in the computer system using the information stored in the pre-built software asset management DB 200, and to store information (for example, licensing information, version Information) can be used to manage the executable file.

And managing the software asset executed in the target computer system through identification of the executable file using the software bus mark (S140).

That is, licensing information and version information for the identified executable file can be provided to the target computer system. You can also control usage for the identified executable file.

For example, an executable file of the target computer system can be identified, and licensing information and version information for the executable file can be provided to the user of the target computer system. Here, the licensing information may include information on the right holder of the executable file, information on usage rights, information on the expiration date of use, and the version information may include information on the final version of the executable file.

In addition, if the executable file is a file that does not have usage rights, or the file has an expiration date, the use of the executable file can be restricted.

Thus, according to an embodiment of the present invention, an executable file running on a computer system may be identified using an IAT-based software bus mark or API reference sequence-based software bus mark. Through this, it is possible to effectively manage the software asset by accurately identifying the executable file.

3 is an exemplary diagram illustrating a method for generating a software bus Merck in accordance with an embodiment of the present invention.

Referring to FIG. 3, a method of generating a software bus mark using the IAT will be described.

As described above, the executable file according to the PE file format includes the IAT, and the IAT includes information such as the addresses of the DLLs and the names of the DLLs, the addresses of the APIs used by the executable file, the names of the APIs, can do.

First, the address information of the APIs may be removed from the IAT extracted from the PE file format (S310). That is, since the API address can be changed, it is not used as the feature information of the executable file.

Next, a hash value for the IAT from which the API address has been removed may be calculated, and the calculated hash value may be utilized as a software bus mark (IAT-based software bus mark) (S320).

In detail, the information included in the IAT is input as a byte string, and a hash value is generated by inputting it into a predetermined hash function based on the byte string. The generated hash value is converted into a software bus mark (IAT-based software Bus mark). For example, a hash value can be generated by combining at least one of the number of DLLs, the names of DLLs, the number of APIs, and the names of APIs, and the generated hash value can be utilized as an IAT-based software bus mark.

That is, the IAT-based software bus mark can effectively identify the executable file as feature information reflecting the function of the executable file. Falsifying or modulating IAT-based software bus marks requires forging or tampering with IATs, making it difficult to forge or tamper with IAT-based software bus marks without affecting executable functionality. Thus, an IAT-based software bus mark can be effectively utilized to identify an executable file.

Therefore, IAT-based software bus marks can be used to identify unauthorized executable files.

4 is an exemplary diagram illustrating a method for generating an API reference sequence according to an embodiment of the present invention.

Referring to FIG. 4, an API reference sequence based software bus mark is described.

Using an IAT-based software bus mark may not effectively identify executable versions that have different versions. That is, if the same executable file or version is different, IAT-based software bus marks may not be used to distinguish between them.

In this case, the executable file can be identified using the information on the API reference sequence. The API reference sequence-based software bus mark may be information about the API reference sequence.

The API reference sequence can be obtained through additional analysis on the executable file, thereby causing additional overhead to the computer system. Thus, an API reference sequence based software bus mark may not be utilized if an executable file is identified using an IAT-based software bus mark.

The API reference sequence may be extracted from disassembled executable code or instructions.

In detail, the address of the API to be called from the disassembled executable code or command may be extracted (S410). In addition, an API reference sequence can be generated by a sequence indicating the order of the extracted API addresses.

Therefore, according to the embodiment of the present invention, the executable file can be identified by software bus mark information on the API reference sequence for the executable file (S420).

5 is a block diagram illustrating a configuration of a software asset management apparatus according to an embodiment of the present invention.

5, the software asset management apparatus 100 according to the embodiment of the present invention may include a collection unit 110, a bus mark generation unit 120, an identification unit 130, and a management unit 140 have.

The collecting unit 110 may collect an executable file to be executed in the target computer system. Here, the software asset management apparatus 100 may be included in the target computer system or may be an external device capable of interworking with the target computer system.

You can collect all executable files that run on a computer system. That is, it can collect executable files including open source software and freeware that run on a computer system.

The bus mark generating unit 120 may generate a software bus mark based on information reflecting the function of the executable file.

The software bus mark includes unique feature information of the executable file and can be utilized as information for identifying the executable file. The software bus mark can be created by using various feature information, but there is an advantage that it is difficult for forgery and falsification to be generated by utilizing the information reflecting the function of the executable file.

The bus mark generating unit 120 generates a bus mark (IAT) based on an IAT (Import Address Table) including information on at least one of information on DDL (Dynamic Link Library) and information on API (application program interface) Based software bus mark).

The identification unit 130 can identify the executable file using the software bus mark. That is, the identification unit 130 can identify the executable file using the IAT-based software bus mark.

In addition, when the executable file can not be correctly identified using the software bus mark generated based on the IAT, the identification unit 130 stores information about the API reference sequence for the executable file in a software bus mark (API reference sequence-based software Bus mark) to identify an executable file.

More specifically, the identification unit 130 can identify the executable file by comparing the software bus mark with the pre-built software asset management DB 200. [

Here, the software asset management DB 200 can be constructed in advance using information on executable files that can be executed in the computer system, and can be included in the software asset management apparatus 100 or operated separately.

The software asset management DB 200 may also include software bus marks based on IAT, software bus marks based on information on API reference sequences, software names, licensing information, and version information.

The management unit 140 can manage the software assets executed in the target computer system through identification of the executable file using the software bus mark. That is, the management unit 140 can manage the executable file using the information stored in the software asset management DB 200 (for example, licensing information and version information).

In particular, the management unit 140 may provide the target computer system with the licensing information and version information for the identified executable file. In addition, the management unit 140 can control the use of the identified executable file.

For example, the management unit 140 may identify the executable file of the target computer system and provide licensing information and version information for the executable file to the user of the target computer system. Here, the licensing information may include information on the right holder of the executable file, information on usage rights, information on the expiration date of use, and the version information may include information on the final version of the executable file.

In addition, the management unit 140 can restrict the use of the executable file when the executable file is a file having no use right or a file whose expiration date has passed.

The software asset management method described above can be implemented by the software asset management apparatus 100. [ Accordingly, the software asset management apparatus can be more clearly understood with reference to the description of the software asset management method described above.

Although each component of the above-described software asset management apparatus 100 has been described as being arranged in each component section for convenience of explanation, at least two of the components may be combined to form one component, or one component may be divided into a plurality of components, And the case of the integrated and separate embodiments of each of these components is also included in the scope of the present invention unless departing from the essence of the present invention.

Also, the software asset management apparatus 100 according to the embodiment of the present invention can be implemented as a computer-readable program or code on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. The computer-readable recording medium may also be distributed and distributed in a networked computer system so that a computer-readable program or code can be stored and executed in a distributed manner.

The software asset management method and apparatus according to the embodiment of the present invention can effectively manage software assets by identifying all executable files executed in the computer system based on software bus marks.

In particular, since the software bus mark according to the embodiment of the present invention utilizes the IAT information and the API reference sequence information related to the function of the executable file, it is advantageous against forgery or modulation.

In addition, there is an advantage in that the software asset and the version management can be simultaneously performed by effectively identifying the executable file that performs the same function even though the version is different.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims It can be understood that

100: software asset management device
110: collecting unit 120: bus mark generating unit
130: Identification unit 140:
200: Software Asset Management DB

Claims (21)

A software asset management method based on software bus marks performed by a target computer system,
Collecting executable files to be executed on the target computer system;
Generating an IAT-based software bus mark based on an IAT (Import Address Table) including information on at least one of information on DDL (Dynamic Link Library) and information on API (Application Program Interface) from the executable file ;
Comparing the IAT-based software bus mark with an established software asset management DB to identify the executable file; And
Managing software assets executed in accordance with the identified executable file in the target computer system through identification of the executable file using the software bus mark,
Wherein identifying the executable file comprises identifying the executable file using an API reference sequence based software bus mark for the executable file if the executable file is not identified using the IAT based software bus mark,
Wherein the API reference sequence based software bus mark is based on a sequence of disassembled executable code or an address of an API that is called from the instruction. The method according to claim 1,
The executable file includes:
Wherein the software asset is one of a Microsoft Windows EXE file, a Java byte file, a Linux a.out file, and an Android DEX file. The method according to claim 1,
The collecting of the executable file comprises:
And collecting the executable file including open source software and freeware running in the target computer system. delete The method according to claim 1,
Wherein generating the IAT-based software bus mark comprises:
Calculating a hash value for the IAT and generating the hash value as the IAT-based software bus mark. delete delete The method according to claim 1,
The pre-built software asset management DB includes:
A software bus mark based on an IAT (Import Address Table), a software bus mark based on information on an API (Application Program Interface) reference sequence, software name, licensing information and version information. Based software asset management method. delete The method of claim 8,
Wherein managing software assets running on the target computer system comprises:
And providing licensing information and version information for the identified executable file to the target computer system. The method of claim 10,
Wherein managing software assets running on the target computer system comprises:
And controlling usage of the identified executable file. ≪ RTI ID = 0.0 > 11. < / RTI > A software asset management device based on software bus marks operating on a target computer system,
A collection unit for collecting executable files executed in the target computer system;
A bus for generating an IAT-based software bus mark based on an IAT (Import Address Table) including at least one of information about DDL (Dynamic Link Library) and information about an API (Application Program Interface) A mark generating unit;
An identification unit for comparing the IAT-based software bus mark with an established software asset management DB to identify the executable file; And
And a management unit for managing software assets to be executed corresponding to the identified executable file in the target computer system through identification of the executable file using the software bus mark,
Wherein the identification unit identifies the executable file using an API reference sequence based software bus mark for the executable file if the executable file can not be identified using the IAT based software bus mark,
Wherein the API reference sequence based software bus mark is based on a sequence of disassembled executable code or an address of an API that is called from the instruction. The method of claim 12,
Wherein,
And collecting the executable file including open source software and freeware executed in the target computer system. delete The method of claim 12,
Wherein the bus mark generating unit comprises:
Calculating a hash value for the IAT and generating the hash value as the IAT-based software bus mark. delete delete The method of claim 12,
The previously constructed software asset management DB
A software bus mark based on an IAT (Import Address Table), a software bus mark based on information on an API (Application Program Interface) reference sequence, software name, licensing information and version information. Based software asset management device. delete The method of claim 12,
Wherein,
And providing licensing information and version information for the identified executable file to the target computer system. The method of claim 12,
Wherein,
And controls usage of the identified executable file. ≪ Desc / Clms Page number 21 >

Images