KR102042086B1 - Module for controlling encryption communication protocol - Google Patents

Abstract

The present invention provides an encryption communication protocol control module, comprising: a connection monitoring unit configured to monitor whether a connection of an encryption communication protocol occurs and to change destination information of the encryption communication protocol when the connection of the encryption communication protocol occurs; A client connection unit forming a connection of the encrypted communication protocol according to the changed destination information; A control unit which receives the destination information from the connection monitoring unit, determines whether to connect with a target server corresponding to a destination, and transmits connection information for connection with the target server; And a server connection unit requesting a connection to the target server according to the connection information received from the controller.

Description

Cryptographic Communication Protocol Control Module {MODULE FOR CONTROLLING ENCRYPTION COMMUNICATION PROTOCOL}

The present invention relates to an encryption communication protocol control technology, and more particularly, to an encryption communication protocol control module for controlling an encryption communication protocol based on information performed on a personal computer.

In order to protect user's personal information, major domestic and foreign internet services use TLS / SSL, which is an encryption communication protocol, for web service and mail service. Encrypted traffic transmitted using an encrypted communication protocol can be secured against external sniffing attacks and can be expected to enhance confidentiality in terms of security. However, most security devices cannot analyze the encrypted traffic and cannot control malicious behavior using encrypted communication in Internet services.

As a method of controlling an encryption communication protocol for reducing security threats on an Internet service using encryption communication, there is a method using a proxy or a method using a network security device. In the control method using a proxy, a proxy server is placed between a client and a destination to decrypt and control encrypted traffic passing through the location. This method is low in availability because it requires a separate setting on the PC and is only applicable to Internet browsers and some programs that can set up a proxy server. The control method using the network security equipment decrypts and controls the encrypted traffic communication when the internet gateway is detected.

In other words, these two methods are controlled based on internet communication information such as IP address, MAC address, PORT number, traffic contents, etc.But only this information can be used to identify the PC that generated the encrypted traffic. There is a problem that cannot be correctly identified, and information such as the process name used for communication on the PC and the actual path of the file transmitted as an attachment is unknown.

Korean Patent Publication No. 10-201-0106912

An object of the present invention is to provide an encryption communication protocol control module for controlling an encryption communication protocol based on information performed in a personal computer.

A first aspect of the present invention for achieving the above object is an encryption communication protocol control module, which monitors whether a connection of an encryption communication protocol occurs, and if the connection of the encryption communication protocol occurs, destination information of the encryption communication protocol. Connection monitoring unit to change; A client connection unit forming a connection of the encrypted communication protocol according to the changed destination information; A control unit which receives the destination information from the connection monitoring unit, determines whether to connect with a target server corresponding to a destination, and transmits connection information for connection with the target server; And a server connection unit requesting a connection to the target server according to the connection information received from the controller.

Preferably, the connection monitoring unit monitors whether a program that performs the connection of the encryption communication protocol is executed on a personal computer, and when the program is executed, injects a DLL into the program and APIs for the connection function of the program. Hooking to change the destination information, or to execute the driver of the program to register the TDI filter driver and obtain the destination information through monitoring through a TDI filter to change the destination information, the changed destination information is It may correspond to a client connection.

Preferably, the connection monitoring unit may transmit the destination information to the control unit and allow a connection request to the client connection unit through the program according to the changed destination.

Preferably, the control unit may transmit connection information including the destination information to the server connection unit, generate a first private key and a first certificate corresponding to signature information, and register the same with the personal computer.

Preferably, when the connection with the target server is completed according to the connection information, the server connection unit may extract the subject name and the subject alternative name from the public information of the encryption communication protocol and transfer it to the controller.

Preferably, the controller generates a second private key corresponding to the second certificate and secret information corresponding to the public information based on the subject name and the subject alternative name, and uses the first private key to generate the second private key. The electronic signature may be performed on the certificate, and the second private key and the second certificate on which the electronic signature is performed may be transferred to the client connection unit.

Preferably, the client connection unit may register a second certificate on which the digital signature is performed, accept a connection request requested from the program, and transfer the second certificate on which the digital signature is performed to the program.

Preferably, based on the first certificate and the second certificate registered in the personal computer by the program, if the issuer, name, and validity period of the second certificate for which the electronic signature was performed are checked, the client connection unit The connection with can be completed.

Preferably, when the connection of the encrypted communication protocol is formed, the client connection unit may decrypt the encrypted traffic received from a program that performs the connection of the encrypted communication protocol and transmit the decrypted traffic to the controller.

Preferably, the control unit stores the contents of the decoded traffic as a log, inspects the contents of the traffic, and then delivers the traffic to the server connection unit, wherein the contents of the traffic are inappropriate according to the contents inspection of the traffic. If it is determined that the contents of the traffic is changed, it may be delivered to the server connection unit.

Preferably, the server connection unit, after encrypting the traffic based on the public information of the encryption communication protocol of the target server, may transmit the encrypted traffic to the target server.

Preferably, the method may further include a file monitoring unit for monitoring a file accessed by a program that performs the connection of the encrypted communication protocol and contents of a file read by the program.

Preferably, the file monitoring unit monitors whether a file read occurs in the program when the client connection unit and the encryption communication protocol are connected, and contents of a file read by the program when a file read occurs in the program. Store the contents of the file read by the program may be transmitted to the client connection as encrypted traffic through the program.

Preferably, the client connection unit may decrypt the encrypted traffic and transmit the decrypted traffic to the control unit, and the control unit may transmit the decrypted traffic to the file monitoring unit.

Preferably, the file monitoring unit may check whether the content of the traffic received from the controller is included in the content of the stored read file, and may transmit the test result to the controller.

Preferably, the control unit, when indicating that the check result corresponds to a file leaking behavior, requests the client connection unit to terminate the connection of the encryption communication protocol, and the client connection unit terminates the connection of the encryption communication protocol according to the request for termination of the connection. You can exit.

As described above, according to the present invention, the end-to-end confidentiality which is a characteristic of the encrypted communication is maintained, but there is an effect of preventing the leakage of confidential information.

In addition, the accuracy of identifying the user who generated the encryption traffic by fusion with the authentication system is improved, and the personal information leakage detection system has the effect of detecting the leakage of the personal information file using the encryption communication protocol.

In addition, only a process that a user wants to monitor on the personal computer can change and control the destination information.

In addition, compared to the conventional proxy method, it is possible to control the personal computer without proxy setting, and to control other programs besides the Internet browser, and compared with the conventional network security equipment method, without changing the network configuration. It is possible to control and control based on Internet communication information based control such as IP address, MAC address, PORT number, traffic content, etc., and actions occurring on user's personal computer such as communication process name and file information. have.

1 is a block diagram of a cryptographic communication protocol control module according to a preferred embodiment of the present invention.
2 is a flowchart illustrating a process of forming an encrypted communication protocol connection in a method of controlling an encrypted communication protocol according to an exemplary embodiment.
3 and 4 are diagrams for explaining change of destination information performed in a TDI filter.
5 is a flowchart illustrating a process of controlling traffic transmission in an encryption communication protocol control method according to an embodiment.
6 is a flowchart illustrating a process in which response traffic transmission is controlled in an encryption communication protocol control method according to an embodiment.
7 is a flowchart illustrating a process of controlling file transfer in an encryption communication protocol control method according to an embodiment.
8 and 9 are diagrams for explaining data monitoring performed in the minifilter.

Advantages and features of the present invention, and a method of achieving them will be apparent from the following detailed description with reference to the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various forms, and only the present embodiments are intended to complete the disclosure of the present invention, and the general knowledge in the art to which the present invention pertains. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. Like reference numerals refer to like elements throughout. “And / or” includes each and all combinations of one or more of the items mentioned.

Although the first, second, etc. are used to describe various elements, components and / or sections, these elements, components and / or sections are of course not limited by these terms. These terms are only used to distinguish one element, component or section from another element, component or section. Therefore, the first device, the first component, or the first section mentioned below may be a second device, a second component, or a second section within the technical spirit of the present invention.

In addition, in each step, an identification code (eg, a, b, c, etc.) is used for convenience of description, and the identification code does not describe the order of the steps, and each step is clearly specified in context. Unless stated in order, it may occur differently from the stated order. That is, each step may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and / or “comprising” refers to the presence of one or more other components, steps, operations and / or elements. Or does not exclude additions.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used in a sense that can be commonly understood by those skilled in the art. In addition, the terms defined in the commonly used dictionaries are not ideally or excessively interpreted unless they are specifically defined clearly.

In describing the embodiments of the present invention, when it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the embodiments of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the contents throughout the specification.

1 is a block diagram of a cryptographic communication protocol control module according to a preferred embodiment of the present invention.

Referring to FIG. 1, the encryption communication protocol control module 100 includes a connection monitoring unit 110, a client connection unit 120, a control unit 130, a server connection unit 140, and a file monitoring unit 150.

The connection monitoring unit 110 monitors whether the connection of the encryption communication protocol occurs, and changes the destination information of the encryption communication protocol when the connection of the encryption communication protocol occurs. Preferably, the connection monitoring unit 110 may change the destination of the encryption communication protocol to the client connection unit 120, and the original destination information may be transmitted to the controller 130. Through this, when a program that executes an encryption communication protocol performed on a personal computer transmits traffic to a target server or reads a file, the information is not transferred directly to the target server corresponding to the original destination of the encryption communication protocol. It is delivered through the client connection unit 120.

The client connection unit 120 forms a connection of the encryption communication protocol according to the changed destination information. Preferably, the client connection unit 120 may form a connection between the program of the personal computer and the encryption communication protocol. After the connection of the encryption communication protocol is formed, the client connection unit 120 receives the encrypted traffic from the program, decrypts it, and delivers it to the control unit 130. In addition, the traffic transmitted from the target server may be received, encrypted, and transmitted as response traffic to a client, that is, a program of a personal computer.

The controller 130 receives the destination information from the connection monitoring unit 110 and determines whether to connect to the target server corresponding to the destination, and transmits the connection information for the connection with the target server. Preferably, after the connection between the program of the personal computer and the client connection unit 120 is completed, examine the contents of the traffic received from the client connection unit 120 to determine whether to block, or the content of the traffic file monitoring unit 150 It can be delivered to the test result, and according to the test result, the traffic received from the client connection unit 120 can be delivered to the server connection unit 140 as it is, or can be delivered by changing the received traffic. In addition, the controller 130 may transfer the traffic received from the server connector 140 to the client connector 120 as it is or change it.

The server connection unit 140 requests a connection to the target server according to the connection information received from the controller 130. Preferably, when the connection with the target server is completed, and the connection between the program and the client connection unit 120 is completed, the server connection unit 140 receives the destination information and the traffic content from the control unit 130, encrypts the traffic, and the target server. It can be delivered to, and after receiving and decrypting the encrypted traffic for the response from the target server, the decrypted traffic can be delivered to the controller.

The file monitoring unit 150 monitors the file accessed by the program that performs the connection of the encryption communication protocol and the contents of the file read by the program. Preferably, the file monitoring unit 150 stores the contents of the file read by the program, and when the traffic content check is requested for the contents of the file read from the controller 130, whether the traffic contents exist in the contents of the stored read file. The test result may be transmitted to the control unit 130.

Hereinafter, an encryption communication protocol control method performed by the encryption communication protocol control module 100 will be described. The encryption communication protocol control method includes a process of forming a connection of the encryption communication protocol and a traffic after the connection of the encryption communication protocol is formed. Or a process of controlling file transfer. First, a process of forming a connection of an encryption communication protocol will be described with reference to FIGS. 2 to 4, and control of traffic and file transfer will be described with reference to FIGS. 5 to 8. Describe the process to be performed.

2 is a flowchart illustrating a process of forming an encrypted communication protocol connection in a method of controlling an encrypted communication protocol according to an exemplary embodiment.

Referring to FIG. 2, the connection monitoring unit 110 monitors whether a program for forming an encrypted communication protocol connection is executed in a personal computer, and when the program is executed (step S201), the connection monitoring unit 110 executes a program. Is detected (step S202).

The connection monitoring unit 110 transmits the information about the destination to which the executed program forms a connection of the encryption communication protocol to the control unit 130 (step S203), and changes the destination information (step S204). Here, the information on the destination may correspond to IP and port information, and the changed destination information corresponds to the client connection unit 120.

In one embodiment, the connection monitoring unit 110 may inject a DLL into the program and change the destination information by API hooking to the connection function of the program. This DLL injection and API hooking method is to force the DLL into a specific process and execute the specified code when a specific API is called, allowing the user to change to a destination other than the original destination. More specifically, the connection monitoring unit 110 performs a DLL injection to the program and monitors the call of the connection function by API hooking the connection function of the program, and when it is detected that the connection function is called. The connection monitoring unit 110 executes the designated code for changing the destination information to the client connection unit 120. That is, the destination information is changed to the client connection unit 120 due to the execution of the designated code.

In another embodiment, the connection monitoring unit 110 may execute a driver of a program to register a TDI filter driver, obtain destination information through monitoring through the TDI filter, and change the destination information. In this method, the driver is registered in the TDI Filter layer and monitored in the network layer of Windows, as shown in FIG. 3. When the TCP connection request signal is received, the destination information is not the original destination. To make the change to something else. More specifically, the connection monitoring unit 110 executes a driver in a program, and registers the TDI filter driver and monitors the TDI filter according to the execution of the driver. Here, the TDI filter is added to the TCP, IP, UDP, RawIP device to monitor the outgoing packet to the network to monitor the network connection of the device. Referring to FIG. 4, as a kernel structure for monitoring a connection, when a network connection is detected by the TDI filter, the TDI_CONNECT function communicates using a TDI_CONNECT function, where the TDI_CONNECT function is connected to a destination to be connected (communicated). This is a function for requesting a connection, and IP and port information connected through the TDI_CONNECT function correspond to information on a destination. Then, the process that wants to communicate over the network is added to the monitored item. For example, iexplore.exe can be added as the monitored item because the process tries to communicate when iexplore.exe is executed. Then, it is checked whether the monitored item is a process registered in advance to change the destination information, and if the process is registered in advance to change the destination information, the connection monitoring unit 110 changes the IP and the port. To change the destination to the client connection unit 120 and then proceed with communication.

After changing the destination information, the connection monitoring unit 110 calls the program to connect the encrypted communication protocol (step S205), and the program requests the client connection unit 120 to connect the encrypted communication protocol (step S206). That is, the destination information is changed to the client connection unit 120 in the connection function of the program through step S204. When the connection monitoring unit 110 calls the connection function of the program, the program requests the connection to the client connection unit 120. It is done.

The client connection unit 120 immediately receives the requested connection request from the program and waits until steps S207 to S215 described below are performed, or waits until steps S207 to S216 are performed, and then waits for a connection request. Can be received. Hereinafter, the latter case will be described as a reference.

When the destination information is transmitted to the controller 130 through step S203, the controller 130 checks the destination information (step S207), and transmits the connection information including the information on the destination to the server connection unit 140 (step S208). Here, the connection information includes the destination information (IP, Port) and the test result value of the destination information. More specifically, the controller 130 checks whether the IP included in the destination information is the control target of the encryption communication protocol, and if it is determined that the IP is not the control target of the encryption communication protocol, the controller 130 performs the connection after the completion of the connection of the encryption communication protocol. Log storage and traffic changes are not performed during the control of traffic and file transfers. In addition, the controller 130 checks whether the IP included in the destination information is a connection to an authorized destination, and if it is determined that the IP is a connection to an unauthorized destination, after the connection of the encryption communication protocol is completed, the connection is performed. Can be terminated.

The server connection unit 140 receives the connection information and requests a connection of the encryption communication protocol to the target server corresponding to the destination (step S209), and when the connection is completed (step S210), the subject name and the public name of the encryption communication protocol are disclosed. The subject alternative name is extracted (step S211). Herein, the public information means a public key, and the public information is in the form of an SSL certificate, and the server connection unit 140 extracts a subject name and a subject substitute name included in the attribute of the certificate. For example, the subject name may include a representative domain name value such as google.com, and the subject alternative name may include a multi-domain name value other than the representative domain when multiple domains are used. Preferably, the subject name and the subject alternative name may be used to check whether the encryption communication protocol is regular by comparing whether the URL connected to the encryption communication protocol and the subject name of the certificate used as the public key are the same. Next, the server connection unit 140 transmits the subject name and the subject alternative name to the controller 130 (S212).

The controller 130 may generate and register signature information before receiving the subject name and the subject substitute name from the server connection unit 140 (step S213). Preferably, the controller 130 may generate a first private key and a first certificate corresponding to signature information issued by a certification authority and register the same with a personal computer.

The controller 130 generates public information and secret information based on the subject name and subject substitution name received in step S212, and digitally signs the public information using the signature information generated in step S213 (step S214). Preferably, the controller 130 generates a second certificate corresponding to the public information and a second private key corresponding to the secret information based on the subject name and the subject substitution name, and uses the first private key to generate the second certificate. Digital signatures can be performed at. Here, the method of generating the second private key and the second certificate may use a conventional opensslAPI, but the method is not limited thereto.

The controller 130 transmits the second certificate with the electronic signature corresponding to the public information and the second private key corresponding to the secret information to the client connection unit 120 (step S215).

The client connection unit 120 registers public information corresponding to the second certificate on which the digital signature was performed (step S216), and receives a connection request requested from the program in step S206 (step S217). The client connection unit 120 transmits the public information including the second certificate on which the digital signature was performed (step S218).

The program checks the public information including the second certificate on which the digital signature was performed (step S219), and completes the connection (step S220). Preferably, the program checks the issuing authority of the second authenticity in which the digital signature was performed based on the first certificate registered in the personal computer through step S213, and determines the name of the second certificate in which the digital signature was performed and the encryption communication protocol. The name of the object to be accessed, that is, the subject name and the subject alternative name may be compared and checked, and the validity period of the second certificate on which the digital signature is performed may be checked. If such checks pass, the connection of the encryption communication protocol of the program and the client connection unit 120 is completed.

5 is a flowchart illustrating a process of controlling traffic transmission in an encryption communication protocol control method according to an embodiment.

The process shown in FIG. 5 is performed after the connection between the program and the encrypted communication protocol of the client connection unit 120 is completed through step S220 in FIG. 2. Referring to FIG. 5, the encrypted traffic from the program to the client connection unit 120 is described. (Step S501).

The client connection unit 120 decrypts the encrypted traffic (step S502), and transmits the decrypted traffic to the controller 130 (step S503). Preferably, decryption of the encrypted traffic may be performed by a conventional encrypted packet reception function, and a symmetric key corresponding to information for decryption may be generated when step S218 described with reference to FIG. 2 is performed. .

The controller 130 stores the traffic content as a log (step S504), examines the traffic content (step S505), and then passes the traffic to the server connection unit 140 (step S506). Here, storing as a log leaves an audit record, and the controller 130 may store traffic contents in a file form.

In an embodiment, if it is determined that the contents of the traffic are inappropriate as a result of performing step S505, the controller 130 may transfer the changed traffic to the server connection unit 140 after changing the contents of the traffic. More specifically, the controller 130 may predefine and register the pattern for the inappropriate traffic type, and in step S505, the controller 130 determines whether there is a pattern for the inappropriate traffic type previously registered in the content of the traffic. Can be determined to determine whether the contents of the traffic are inappropriate. If it is determined that the contents of the traffic are inappropriate, the controller 130 may change all or part of the contents of the traffic received from the client connection unit 120 and store them in the memory, and transmit the changed contents to the server connection unit 140. That is, the controller 130 changes the whole or part of the traffic content so that the original destination traffic cannot be delivered to the target server.

The server connection unit 140 encrypts the traffic (step S507), and transmits the encrypted traffic to the target server (step S508). Preferably, the server connection unit 140 may encrypt the traffic based on the public information of the encryption communication protocol of the target server, wherein the public information used to encrypt the traffic is a certificate of the target server, and the server connection unit 140 ) Can generate a symmetric key using a certificate and then encrypt or decrypt the traffic using the symmetric key.

The target server receives the encrypted traffic from the server connection unit 140 (step S509). That is, according to the present invention, the target server does not directly receive the encrypted traffic from the program, but receives the traffic determined to be secure through the client connection unit 120, the control unit 130, and the server connection unit 140. .

6 is a flowchart illustrating a process in which response traffic transmission is controlled in an encryption communication protocol control method according to an embodiment.

After the target server receives the encrypted traffic through steps S501 to S509 of FIG. 5, the target server transmits the encrypted traffic to the server connection unit 140 as a response to the received encrypted traffic (step S601). Here, the encryption traffic transmitted by the target server to the server connection unit 140 corresponds to different traffic as response traffic to the encryption traffic received by the target server.

The server connection unit 140 decrypts the encrypted traffic (step S602), and transmits the decrypted traffic to the controller 130 (step S603). Preferably, the server connection unit may decrypt the encrypted traffic using the symmetric key used to encrypt the traffic in step S507 described with reference to FIG.

The control unit 130 receives the decrypted traffic and changes the traffic according to the inspection result of the traffic content performed in step S505 described with reference to FIG. 5 (step S604). Preferably, when the content of the traffic is checked as inappropriate in step S505 and the traffic is changed, the control unit 130 changes the whole or part of the traffic content to perform an operation performed when the program receives the response traffic transmitted from the target server. If the content of the traffic is checked to be appropriate in step S505, the controller 130 may not change the content of the traffic.

The controller 130 transmits the traffic changed or unchanged according to the performance of step S604 to the client connection unit 120 (step S605).

The client connection unit 120 encrypts the traffic (step S606), delivers it to the program (step S607), and the program receives the encrypted traffic (step S608).

For example, assuming that the program transmits traffic A and the target server receives the traffic A, and then sends traffic B as a response thereto, encryption C and decryption D are performed at the server connection unit 140, and the client connection unit is performed. Assuming encryption C 'and decryption D' are performed in FIG. 5, the transmission control process of the traffic and response traffic performed through FIGS. 5 and 6 is as follows.

The encrypted traffic C '(A) from the program is transmitted to the client connection unit 120, and the client connection unit 120 decrypts the encrypted traffic and transmits D' (C '(A)) (= A) to the control unit 130. The controller 130 stores the contents of the traffic A as a log and inspects the contents, and then passes the traffic A to the server connection unit 140. The server connection unit encrypts the traffic and delivers the C (A) to the target server. The target server then decodes the encrypted traffic to obtain D (C (A)) (= A). Then, the target server encrypts traffic B as a response to traffic A, and transmits C (B) to the server connection unit 140, and the server connection unit 140 decrypts the encrypted traffic to D (C (B)) ( = B) is transmitted to the controller 130, and the controller 130 changes the traffic B according to the inspection result and then transfers the traffic B to the client connection unit 120, and the client connection unit 120 encrypts the traffic B to C '( B) is passed to the program, which decrypts the encrypted traffic to obtain D '(C' (B)) (= B).

In another example, if the program is a web browser, the target server corresponds to a portal site (eg daum.net), and there is a "subject" in the traffic that can be determined to send mail, Assuming that this is the case, the transmission control process of traffic and response traffic performed through FIGS. 5 and 6 is as follows.

When the mail transmission is selected (clicked) by the user in the web browser, the web browser encrypts the contents of the request headers and the contents of the request payload and transmits the contents to the client connection unit 120. The client connection unit 120 decrypts the encrypted traffic and transmits the encrypted traffic to the controller 130, and the decrypted traffic is as shown in FIG. The controller 130 stores the contents of the traffic as a log and inspects the contents of the traffic. As a result of the inspection, the content of the “subject” is detected, and the controller 130 determines that the traffic is inappropriate and changes the traffic. For example, as shown in FIG. 10B, the controller 130 may change all of the contents of 752 bytes of the request payload to Null. The controller 130 transfers the changed traffic to the server connection unit 140, and the server connection unit 140 encrypts the traffic and transmits the traffic to the portal site.

The portal site encrypts the response traffic as shown in (c) of FIG. 10 in response to the traffic received from the server connection unit 140 and transmits it to the server connection unit 140. The server connection unit 140 decrypts the encrypted traffic and transmits the encrypted traffic to the controller 130. Here, the decrypted traffic is as shown in FIG. When the traffic is transmitted from the web browser, the controller 130 determines that the traffic is inappropriate, and thus the controller 130 changes the response traffic transmitted from the portal site so that the web browser terminates the encrypted communication connection. For example, the controller 130 may change the traffic indicating the success of the HTTP protocol request as shown in (c) of FIG. 10 into traffic as shown in (d) of FIG. 1.1 400 ”means failure of an HTTP protocol request. The controller 130 transmits the changed traffic to the client connection unit 120, and the client connection unit 120 encrypts the traffic and transmits the traffic to the web browser. As a result, the web browser receives the traffic shown in Fig. 10D, and outputs a mail transmission failure page as shown in Fig. 10E.

7 is a flowchart illustrating a process of controlling file transfer in an encryption communication protocol control method according to an embodiment.

The process shown in FIG. 7 is performed after the connection between the program and the encryption communication protocol of the client connection unit 120 is completed through step S220 in FIG. 2. Referring to FIG. 6, the file monitoring unit 150 stores a file in a program. It is monitored whether or not reading is performed (step S701), and if file reading occurs in the program (step S702), the file monitoring unit 150 stores the content read by the program (step S703). In order to transfer a file, the program reads the file, writes it to another location, or reads the file and transmits the packet over the network. Therefore, it is possible to monitor which file is being read and compare it when the file is leaked to the outside. Try to save what you read in the program.

Preferably, monitoring whether file reading is performed may be performed through a minifilter. Referring to FIG. 8, which shows the hierarchical structure of the file system filter driver, the minifilter is connected with a Filter Manager Frame to intercept a request for a file system and perform an operation of blocking or changing before reaching the intended destination. Can be. More specifically, referring to FIG. 9, it illustrates a kernel structure for a part for detecting the occurrence of file reading and storing the read content, for explaining an operation performed through the minifilter. Since the program reads the file using the ReadFile and createFilemapping functions, the minifilter registers the IRP_MJ_READ and IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION functions in the minifilter to monitor reading the file from the filter driver. You can monitor whether or not you read. Here, each of the IRP_MJ_READ and IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION functions includes a PreOperation layer that acquires and monitors data before it reaches the file system driver, and a PostOperation layer that acquires and monitors the data after it reaches the target driver. do.

Preferably, when monitoring whether file reading occurs in IRP_MJ_READ function, it can be monitored by PostOperation. When a file read occurs and the read comes in, the part of the read and the path of the file, drive information, process ID, etc. Information can be stored.

Since general files use Create, Open, Read, and Write functions, the data of the file can be checked in the driver stage, but since IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION function does not read data directly, that is, Create, Open, Read, Write Since functions such as are not called, IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION will randomly call functions such as OpenFile and ReadFile to open the file and read the data directly. The operation is monitored in PreOperation before the file handle is opened. Here, the file handle corresponds to a unique ID assigned to identify each file used for the program. Get the file handle using ZwOpenFile and get the data portion of the file using ZwReadfile. The read data stores information such as file path, drive information, and process ID. In addition, whenever the stored data information occurs, it communicates with the application of the user end to store the list of files read in the application memory, and the stored data is maintained until the file handle is terminated in the IRP_MJ_CLEANUP function.

The program transmits the read content to the client connection unit 120 as encrypted traffic (step S704).

The client connection unit 120 decrypts the encrypted traffic (step S705), and transfers the decrypted traffic to the controller 130 (step S706).

The control unit 130 requests the file monitoring unit 150 to inspect the decrypted traffic content (step S707).

The file monitoring unit 150 compares the contents of the traffic requested for inspection with the contents of the reading stored in step S603 (step S708) and detects whether the file is leaked (step S709). Preferably, the file monitoring unit 150 may check whether the traffic content is included in the read content, and if the read content includes the traffic content, may determine that the file is leaked.

In one embodiment, if the file monitoring unit 150 is determined to be a file leakage activity, the file monitoring unit 150 transmits a test result corresponding to the file leakage activity to the control unit 140 (step S710), the control unit 140 is a client connection unit 130 Request to terminate the connection of the encrypted communication protocol with the program (step S711), and the client connection unit 130 may terminate the connection of the encrypted communication protocol with the program accordingly (step S712).

In another embodiment, when the file monitoring unit 150 is determined to not correspond to the file leakage activity and the file monitoring unit 150 transmits the inspection result to the control unit 130, the control unit 130 transmits the traffic to the server connection unit 140, The server connection unit 140 may encrypt the received traffic and transfer the encrypted traffic to the target server so that the target server receives the encrypted traffic.

That is, according to the present invention, the file is not directly transmitted from the program to the target server, but the file leaking activity is performed through the client connection unit 120, the control unit 130, the server connection unit 140, and the file monitoring unit 150. Only files scanned as not applicable are transmitted to the target server, and if the file is leaked, the connection of the encryption communication protocol is terminated, thereby maintaining security.

While a preferred embodiment of the cryptographic communication protocol control module according to the present invention has been described above, the present invention is not limited thereto, and the present invention is not limited thereto, and various modifications can be made within the scope of the claims and the detailed description of the invention and the accompanying drawings. It is possible and this also belongs to the present invention.

100: encrypted communication protocol control module
110: connection monitoring unit
120: client connection
130: control unit
140: server connection
150: file monitor

Claims (16)

A connection monitoring unit that monitors whether a connection of the encryption communication protocol occurs in a program of the personal computer, and changes destination information of the encryption communication protocol when the connection of the encryption communication protocol occurs;
A client connection unit forming a connection of the encrypted communication protocol according to the changed destination information;
Upon receiving the destination information from the connection monitoring unit, it is checked whether the IP included in the destination information is the control target of the encryption communication protocol, and if it is determined that the IP is not the control target of the encryption communication protocol, the connection of the encryption communication protocol is completed. Control unit that transmits connection information for connection with the target server corresponding to the destination when the IP is checked to be the control target of the encryption communication protocol without performing log storage and traffic change in the control process of the traffic and file transfer performed afterwards. ; And
An encryption communication protocol control module including a server connection unit for requesting connection to the target server according to the connection information received from the control unit.
The connection monitoring unit,
Monitoring whether a program that performs the connection of the encrypted communication protocol is executed on the personal computer,
When the program is executed, DLL injection is made to the program and API hooking is performed on the link function of the program to change the destination information, or the driver of the program is registered to register the TDI filter driver and monitor through the TDI filter. Acquire the destination information through to change the destination information to the client connection,
Deliver the changed destination information to the controller, and request a connection to the client connection unit through the program according to the changed destination;
The control unit,
Transfer the connection information including the changed destination information to the server connection unit, generate a first private key and a first certificate corresponding to signature information, and register the same with the personal computer;
The server connection unit,
When the connection with the target server is completed according to the changed connection information, the subject name and the subject substitute name are extracted from the public information of the encryption communication protocol and transferred to the controller.
The control unit,
Generate a second certificate corresponding to the public information and a second private key corresponding to the secret information based on the subject name and the subject alternative name, and perform an electronic signature on the second certificate using the first private key; And transmitting the second private key and the second certificate on which the digital signature is performed, to the client connection unit.
The client connection unit,
And registering the second certificate on which the digital signature was performed, accepting the connection request requested from the program, and transferring the second certificate on which the digital signature was performed to the program.
delete delete delete delete delete delete The method of claim 1,
If the issuer, name, and expiration date of the second certificate on which the electronic signature is performed are checked based on the first certificate and the second certificate registered in the personal computer by the program, connection with the client connection unit The encryption communication protocol control module, characterized in that is completed.
The method of claim 1, wherein the client connection unit,
Once the connection of the cryptographic communication protocol is established,
Cryptographic communication protocol control module, characterized in that for decrypting the encrypted traffic received from the program that performs the connection of the encrypted communication protocol and forwarded to the controller.
The method of claim 9, wherein the control unit,
After storing the contents of the decrypted traffic as a log, inspecting the contents of the traffic, and forwards the traffic to the server connection,
And if it is determined that the contents of the traffic are inappropriate according to the inspection of the contents of the traffic, the contents of the traffic are changed and then transmitted to the server connection unit.
The method of claim 10, wherein the server connection unit,
Encrypting the traffic based on the public information of the encryption communication protocol of the target server, and then transmitting the encrypted traffic to the target server.
The method of claim 1,
And a file monitoring unit configured to monitor a file accessed by a program executing the connection of the encrypted communication protocol and contents of a file read by the program.
The method of claim 12, wherein the file monitoring unit,
When the connection between the client connection unit and the encrypted communication protocol is formed,
Monitor whether or not a file read occurs in the program, and if a file read occurs in the program, store the contents of the file read by the program,
The contents of the file read by the program are transmitted to the client connection unit in encrypted traffic through the program.
The method of claim 13,
And the client connection unit decrypts the encrypted traffic and transmits the encrypted traffic to a control unit, and the control unit transmits the decrypted traffic to the file monitoring unit.
The method of claim 14, wherein the file monitoring unit,
And checking whether the contents of the traffic received from the controller are included in the contents of the stored read file, and transmitting the test result to the controller.
The method of claim 15,
If the control unit indicates that the check result corresponds to a file leakage activity, the controller requests the client connection unit to terminate the connection of the encryption communication protocol.
And the client connection unit terminates the connection of the encryption communication protocol according to the request for terminating the connection.

Images